Attack-Resilient

Hierarchical

Data

Aggregation

in

Sensor

Networks

In

a

large

sensor

network

in-network

data

aggregation

i.e.

combining

partial

results

at

intermediate

nodes

during

message

routing

significantly

reduces

the

amount

of

communication

and

hence

the

energy

consumed

Recently

several

researchers

have

proposed

robust

aggregation

frameworks

which

combine

multi-path

routing

schemes

with

duplicate-insensitive

algorithms

to

accurately

compute

aggregates

-LRB-

e.g.

Sum

Count

Average

-RRB-

in

spite

of

message

losses

resulting

from

node

and

transmission

failures

However

these

aggregation

frameworks

have

been

designed

without

security

in

mind

Given

the

lack

of

hardware

support

for

tamper-resistance

and

the

unattended

nature

of

sensor

nodes

sensor

networks

are

highly

vulnerable

to

node

compromises

We

show

that

even

if

a

few

compromised

nodes

contribute

false

sub-aggregate

values

this

results

in

large

errors

in

the

aggregate

computed

at

the

root

of

the

hierarchy

We

present

modifications

to

the

aggregation

algorithms

that

guard

against

such

attacks

i.e.

we

present

algorithms

for

resilient

hierarchical

data

aggregation

despite

the

presence

of

compromised

nodes

in

the

aggregation

hierarchy

We

evaluate

the

performance

and

costs

of

our

approach

via

both

analysis

and

simulation

Our

results

show

that

our

approach

is

scalable

and

efficient

C.

-LSB-

Computer-Communication

Networks

-RSB-

General

Security

and

protection

C.

-LSB-

Computer-Communication

Networks

-RSB-

Network

Architecture

and

Design

Wireless

communication

D.

-LSB-

Operating

Systems

-RSB-

Security

and

Protection

Cryptographic

controls

K.

-LSB-

Management

of

Computing

and

Information

Systems

-RSB-

Security

and

Protection

Algorithms

Design

Security

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page

To

copy

otherwise

to

republish

to

post

on

servers

or

to

redistribute

to

lists

requires

prior

specific

permission

and/or

a

fee

SASN

October

Alexandria

Virginia

USA

Copyright

ACM

In

large

sensor

networks

computing

aggregates

in-network

i.e.

combining

partial

results

at

intermediate

nodes

during

message

routing

significantly

reduces

the

amount

of

communication

and

hence

the

energy

consumed

-LSB-

-RSB-

An

approach

used

by

several

data

acquisition

systems

for

sensor

networks

is

to

construct

a

spanning

tree

rooted

at

the

querying

node

and

then

perform

in-network

aggregation

along

the

tree

Partial

results

propagate

level-by-level

up

the

tree

with

each

node

awaiting

messages

from

all

its

children

before

sending

a

new

partial

result

to

its

parent

Tree-based

aggregation

approaches

however

are

not

resilient

to

communication

losses

resulting

from

node

and

transmission

failures

which

are

relatively

common

in

sensor

networks

-LSB-

-RSB-

Because

each

communication

failure

loses

an

entire

subtree

of

readings

a

large

fraction

of

sensor

readings

are

potentially

un-accounted

for

at

the

querying

node

leading

to

a

significant

error

in

the

query

answer

To

address

this

problem

researchers

have

proposed

the

use

of

multi-path

routing

techniques

for

forwarding

sub-aggregates

-LSB-

-RSB-

For

aggregates

such

as

Min

and

Max

which

are

duplicate-insensitive

this

approach

provides

a

fault-tolerant

solution

For

duplicate-sensitive

aggregates

such

as

Count

and

Sum

however

multi-path

routing

leads

to

double-counting

of

sensor

readings

resulting

in

an

incorrect

aggregate

being

computed

Recently

researchers

-LSB-

-RSB-

have

presented

clever

algorithms

to

solve

the

double-counting

problem

associated

with

multi-path

approaches

A

robust

and

scalable

aggregation

framework

called

Synopsis

Diffusion

has

been

proposed

for

computing

duplicate

sensitive

aggregates

such

as

Count

and

Sum

There

are

two

primary

elements

of

this

approach

the

use

of

a

ring-based

topology

instead

of

a

tree-based

topology

for

organizing

the

nodes

in

the

aggregation

hierarchy

and

the

use

of

duplicate-insensitive

algorithms

for

computing

aggregates

based

on

Flajolet

and

Martin

's

algorithm

for

counting

distinct

elements

in

a

multi-set

-LSB-

-RSB-

As

presented

the

Synopsis

Diffusion

aggregation

framework

does

not

include

any

provisions

for

security

Although

we

can

easily

prevent

unauthorized

nodes

from

launching

attacks

by

augmenting

the

aggregation

framework

with

authentication

and

encryption

protocols

-LSB-

-RSB-

compromised

nodes

present

an

entirely

new

set

of

security

challenges

The

lack

of

tamper-resistance

and

the

unattended

nature

of

many

networks

renders

sensor

nodes

highly

vulnerable

to

compromise

Standard

authentication

mechanisms

can

not

prevent

a

compromised

node

from

launching

attacks

since

all

its

keys

are

also

compromised

In

this

paper

we

present

novel

mechanisms

for

making

the

synopsis

diffusion

aggregation

framework

resilient

to

attacks

launched

by

compromised

nodes

We

present

counter-measures

against

attacks

in

which

a

compromised

node

attempts

to

change

the

aggregate

value

computed

at

the

root

of

the

hierarchy

In

particular

we

focus

on

an

attack

in

which

a

sensor

node

that

is

not

a

leaf

node

in

the

aggregation

hierarchy

relays

a

false

sub-aggregate

value

to

its

parents

We

refer

to

this

attack

as

the

falsified

sub-aggregate

attack

We

show

that

if

the

synopsis

diffusion

approach

is

used

to

compute

aggregates

such

as

Count

and

Sum

an

adversary

can

use

the

falsified

sub-aggregate

attack

to

cause

the

answer

computed

at

the

base

station

in

response

to

a

query

to

differ

from

the

true

value

by

an

arbitrary

amount

Moreover

we

show

that

this

attack

can

be

launched

with

a

high

rate

of

success

even

if

only

one

or

a

small

number

of

nodes

are

compromised

We

present

an

approach

in

which

the

synopsis

diffusion

aggregation

frameork

is

augmented

with

a

set

of

countermeasures

that

mitigate

the

effect

of

the

falsified

sub-aggregate

attack

In

our

approach

a

subset

of

the

total

number

of

nodes

in

the

network

include

an

authentication

code

-LRB-

MAC

-RRB-

along

with

their

response

to

a

query

These

MACs

are

propagated

to

the

base

station

along

with

the

partial

results

that

are

computed

at

each

level

in

the

hierarchy

By

verifying

these

MACs

the

base

station

can

estimate

the

accuracy

of

the

final

aggregate

value

it

computes

and

can

filter

out

the

effect

of

any

false

sub-aggregates

contributed

by

compromised

nodes

Thus

our

approach

can

be

used

in

conjunction

with

synopsis

diffusion

to

compute

basic

aggregates

such

as

Count

and

Sum

despite

the

presence

of

compromised

nodes

in

the

aggregation

hierarchy

The

communication

overhead

of

our

approach

depends

upon

the

number

of

contributing

nodes

which

send

a

MAC

to

the

base

station

We

evaluate

the

performance

and

costs

of

our

approach

via

both

analysis

and

simulation

We

show

that

our

approach

is

scalable

since

the

number

of

contributing

nodes

-LRB-

and

hence

the

average

communication

overhead

-RRB-

do

not

increase

with

network

size

To

further

reduce

the

communication

overhead

we

describe

a

variation

of

our

basic

approach

that

trades

communication

costs

for

latency

In

this

section

we

provide

a

brief

overview

of

the

synopsis

diffusion

approach

for

robust

aggregation

-LSB-

-RSB-

Figure

illustrates

how

the

synopsis

diffusion

approach

uses

a

rings

topology

for

aggregation

q

C

B

A

D

Figure

Synopsis

Diffusion

over

a

rings

topology

In

the

query

distribution

phase

nodes

form

a

set

of

rings

around

the

querying

node

q

based

on

their

distance

in

hops

from

q

During

the

subsequent

query

aggregation

period

starting

in

the

outermost

ring

each

node

generates

a

local

synopsis

s

SG

-LRB-

v

-RRB-

where

v

is

the

sensor

reading

relevant

to

the

query

and

broadcasts

it

-LRB-

SG

-LRB-

-RRB-

is

the

synopsis

generation

function

-RRB-

A

node

in

ring

R

i

will

receive

broadcasts

from

all

the

nodes

in

its

range

in

ring

R

i

It

will

then

combine

its

own

local

synopsis

with

the

synopses

received

from

its

children

using

a

synopsis

fusion

function

SF

-LRB-

-RRB-

and

then

broadcast

the

updated

synopsis

Thus

the

fused

synopses

propagate

level-by

level

until

they

reach

the

querying

node

who

first

combines

the

received

synopses

with

its

local

synopsis

using

SF

-LRB-

-RRB-

and

then

uses

the

synopsis

evaluation

function

SE

-LRB-

-RRB-

to

translate

the

final

synopsis

to

the

answer

to

the

query

The

functions

SG

-LRB-

-RRB-

SF

-LRB-

-RRB-

and

SE

-LRB-

-RRB-

depend

upon

the

target

aggregation

function

e.g.

Count

Sum

etc.

We

now

describe

the

duplicate-insensitive

synopsis

diffusion

algorithms

for

the

Count

aggregate

i.e.

the

total

number

of

nodes

in

the

sensor

network

and

the

Sum

aggregate

i.e.

the

sum

of

the

sensor

readings

of

the

nodes

in

the

network

These

algorithms

are

based

on

Flajolet

and

Martin

's

well-known

probablistic

algorithm

for

counting

the

number

of

distinct

elements

in

a

multi-set

-LSB-

-RSB-

COUNT

In

this

algorithm

each

node

generates

a

local

synopsis

which

is

a

bit

vector

ls

of

length

k

log

n

where

n

is

an

upper

bound

on

the

nodes

in

the

network

To

generate

its

local

synopsis

each

node

executes

the

function

CT

-LRB-

X

k

-RRB-

given

below

where

X

is

the

node

's

identifier

and

k

is

the

length

of

ls

in

bits

CT

-LRB-

-RRB-

can

be

interpreted

as

a

coin-tossing

experiment

-LRB-

with

a

cryptographic

hash

function

h

-LRB-

-RRB-

modeled

as

a

random

oracle

whose

output

is

or

simulating

a

fair

coin-toss

-RRB-

which

returns

the

number

of

coin

tosses

until

the

first

heads

occurs

or

k

if

k

tosses

have

occurred

with

no

heads

occurring

In

the

local

synopsis

ls

of

node

X

a

single

bit

i

is

set

to

where

i

is

the

output

of

CT

-LRB-

X

k

-RRB-

Thus

ls

is

a

bitmap

of

the

form

i

with

probability

i

Algorithm

CT

-LRB-

X

k

-RRB-

i

while

i

k

AND

h

-LRB-

X

i

-RRB-

do

i

i

end

while

return

i

The

synopsis

fusion

function

SF

-LRB-

-RRB-

is

simply

the

bitwise

Boolean

OR

of

the

synopses

being

combined

Each

node

fuses

its

local

synopsis

ls

with

the

synopses

it

receives

from

its

children

by

computing

the

bit-wise

OR

of

all

the

synopses

Let

S

denote

the

final

synopsis

computed

by

the

querying

node

by

combining

all

the

synopses

received

from

its

children

and

its

local

synopsis

We

observe

that

S

will

be

a

bitmap

of

length

k

of

the

form

r

The

querying

node

can

estimate

Count

from

S

via

the

synopsis

evaluation

function

SE

-LRB-

-RRB-

if

r

is

the

lowest-order

bit

in

S

that

is

the

count

of

nodes

in

the

network

is

r

The

synopsis

evaluation

function

SE

-LRB-

-RRB-

is

based

on

Property

below

Intuitively

the

number

of

sensor

nodes

is

proportional

to

r

since

no

node

has

set

the

rth

bit

while

computing

CT

-LRB-

X

k

-RRB-

We

now

present

a

few

important

properties

of

the

final

synopsis

S

computed

at

the

querying

node

that

have

been

derived

in

-LSB-

-RSB-

and

that

we

will

find

useful

in

the

rest

of

this

paper

Let

S

-LSB-

i

-RSB-

i

k

denote

the

ith

bit

of

S

where

bits

are

numbered

starting

at

the

left

Property

For

i

log

n

log

log

n

S

-LSB-

i

-RSB-

with

probability

For

i

log

n

S

-LSB-

i

-RSB-

with

probability

This

result

implies

that

for

a

network

of

n

nodes

we

expect

that

S

has

an

initial

prefix

of

all

ones

and

a

suffix

of

all

zeros

while

only

the

bits

around

S

-LSB-

log

n

-RSB-

exhibit

much

variation

This

provides

an

estimate

of

the

number

of

bits

k

required

for

a

node

's

local

synopsis

In

practice

k

log

n

bits

are

sufficient

to

represent

S

with

high

probability

-LSB-

-RSB-

This

result

also

indicates

that

the

length

of

the

prefix

of

all

ones

in

S

can

be

used

to

estimate

n.

Let

r

min

-LCB-

i

S

-LSB-

i

-RSB-

-RCB-

i.e.

r

is

the

location

of

the

leftmost

zero

in

S

Then

R

r

is

a

random

variable

representing

the

length

of

the

prefix

of

all

ones

in

the

sketch

The

following

results

hold

for

R.

Property

The

expected

value

of

R

E

-LRB-

R

-RRB-

log

-LRB-

n

-RRB-

where

the

constant

is

approximately

This

result

implies

that

R

can

be

used

for

an

unbiased

estimator

of

log

-LRB-

n

-RRB-

and

it

is

the

basis

for

the

synopsis

evaluation

function

SE

-LRB-

-RRB-

which

estimates

n

as

R

Property

The

variance

of

R

denoted

as

R

n

satisfies

R

n

R

Q

-LRB-

log

n

-RRB-

o

-LRB-

-RRB-

where

constant

R

is

approximately

and

Q

-LRB-

x

-RRB-

is

a

periodic

function

with

mean

value

and

period

This

property

implies

that

the

standard

deviation

of

R

is

approximately

i.e.

the

estimates

of

n

derived

from

R

will

often

be

off

by

a

factor

of

two

or

more

in

either

direction

To

reduce

the

standard

deviation

of

R

Flajolet

et

al

-LSB-

-RSB-

proposed

an

algorithm

named

PCSA

where

m

synopses

are

computed

in

parallel

and

the

new

estimator

-LRB-

R

-RRB-

is

the

average

of

all

individual

R

's

of

these

synopses

For

PCSA

the

standard

error

in

the

estimate

of

n

i.e.

n

n

is

equal

to

m

-LSB-

-RSB-

Property

In

a

network

of

n

nodes

the

expected

number

of

nodes

that

will

have

the

ith

bit

of

their

local

synopsis

ls

-LSB-

i

-RSB-

is

i

This

result

implies

that

the

expected

number

of

nodes

that

contribute

a

to

the

ith

bit

of

S

and

the

bits

to

the

right

of

the

ith

bit

in

S

-LRB-

i.e.

bits

j

where

i

j

k

-RRB-

is

i

SUM

Considine

et

al.

-LSB-

-RSB-

extended

the

Count

algorithm

described

above

for

computing

the

Sum

aggregate

The

synopsis

generation

function

SG

-LRB-

-RRB-

for

Sum

is

a

modification

of

that

for

Count

while

the

fusion

function

SF

-LRB-

-RRB-

and

the

evaluation

function

SE

-LRB-

-RRB-

for

Sum

are

identical

to

those

for

Count

To

generate

its

local

synopsis

for

a

sensor

reading

v

a

node

X

invokes

the

function

CT

-LRB-

-RRB-

v

times

and

ORs

the

results

As

a

result

the

local

synopsis

of

a

node

is

a

bitmap

of

length

k

log

u

s

where

u

s

is

an

upper

bound

on

the

value

of

Sum

aggregate

Unlike

the

local

synopsis

of

a

node

for

Count

more

than

one

bit

in

the

local

synopsis

of

a

node

for

Sum

will

be

equal

to

Count

can

be

considered

as

a

special

case

of

Sum

where

each

node

's

sensor

reading

is

equal

to

one

unit

Considine

et

al.

-LSB-

-RSB-

proposed

an

optimized

version

of

SG

-LRB-

-RRB-

for

Sum

to

make

it

suitable

for

a

low-end

sensor

node

even

if

the

sensed

value

v

is

high

Moreover

they

showed

that

Properties

described

above

for

Count

also

hold

for

Sum

-LRB-

with

appropriate

modifications

-RRB-

Similarly

as

in

the

case

of

Count

the

PCSA

algorithm

can

be

used

to

reduce

the

standard

deviation

of

the

estimate

for

Sum

The

Synopsis

Diffusion

aggregation

framework

does

not

include

any

provisions

for

security

as

a

result

it

is

vulnerable

to

many

attacks

that

can

be

launched

by

unauthorized

or

compromised

nodes

To

prevent

unauthorized

nodes

from

eavesdropping

on

or

participating

in

communications

between

legitimate

nodes

we

can

augment

the

aggregation

framework

with

any

one

of

several

recently

proposed

authentication

and

encryption

protocols

-LSB-

-RSB-

However

compromised

nodes

pose

an

entirely

new

set

of

security

challenges

Sensor

nodes

are

often

deployed

in

unattended

environments

so

they

are

vulnerable

to

physical

tampering

Current

sensor

nodes

Each

sensor

reading

is

assumed

to

be

an

integer

lack

hardware

support

for

tamper-resistance

Consequently

it

is

relatively

easy

for

an

adversary

to

compromise

a

node

without

being

detected

The

adversary

can

obtain

confidential

information

-LRB-

e.g.

cryptographic

keys

-RRB-

from

the

compromised

sensor

and

repro-gram

it

with

malicious

code

A

compromised

node

can

be

used

to

launch

multiple

attacks

against

the

sensor

application

These

attacks

include

jamming

at

physical

or

link

layer

other

denial

of

service

attacks

like

flooding

route

disruption

message

dropping

message

modification

false

data

injection

and

many

others

Standard

authentication

mechanisms

can

not

prevent

these

insider

attacks

since

the

adversary

knows

all

the

keying

material

possessed

by

the

compromised

nodes

In

this

paper

we

focus

on

defending

against

an

important

subclass

of

these

insider

attacks

which

can

potentially

corrupt

the

final

result

of

the

aggregation

query

Below

we

describe

these

attacks

in

the

context

of

the

Count

and

Sum

aggregates

A

compromised

node

M

can

corrupt

the

aggregate

value

computed

at

the

root

-LRB-

i.e.

the

sink

-RRB-

of

the

hierarchical

aggregation

framework

in

three

ways

First

M

can

simply

drop

aggregation

messages

that

it

is

supposed

to

relay

towards

the

sink

If

M

is

located

at

a

relatively

high

position

in

the

aggregation

hierarchy

this

has

the

effect

of

omitting

a

large

fraction

of

the

set

of

sensor

readings

being

aggregated

Second

M

can

falsify

its

own

sensor

reading

with

the

goal

of

influencing

the

aggregate

value

Third

M

can

falsify

the

sub-aggregate

which

M

is

supposed

to

compute

based

on

the

messages

received

from

M

's

child

nodes

The

effect

of

the

first

attack

in

which

a

node

intentionally

drops

aggregation

messages

is

no

different

from

the

effect

of

transmission

and

node

failures

which

are

common

in

sensor

networks

-LSB-

-RSB-

The

synopsis

diffusion

approach

employs

multi-path

routing

for

addressing

these

failures

and

thus

it

also

addresses

message

losses

due

to

compromised

nodes

-LSB-

-RSB-

We

refer

to

the

second

attack

in

which

a

sensor

intentionally

falsifies

its

own

reading

as

the

falsified

local

value

attack

This

attack

is

similar

to

the

behavior

of

nodes

with

faulty

sensors

and

can

be

addressed

by

well-studied

approaches

for

fault

tolerance

such

as

majority

voting

and

reputation-based

frameworks

-LSB-

-RSB-

The

third

attack

however

in

which

a

node

falsifies

the

aggregate

value

it

is

relaying

to

its

parents

in

the

hierarchy

is

much

more

difficult

to

address

and

is

the

main

focus

of

this

paper

We

refer

to

this

attack

as

the

falsified

sub-aggregate

attack

The

Falsified

Sub-Aggregate

Attack

Since

the

sink

estimates

the

aggregate

based

on

the

lowest-order

bit

r

that

is

in

the

final

fused

synopsis

a

compromised

node

would

need

to

falsify

its

own

fused

synopsis

such

that

it

would

affect

the

value

of

r

It

can

accomplish

this

quite

easily

by

simply

inserting

ones

in

one

or

more

bits

in

positions

j

where

r

j

k

in

its

own

fused

synopsis

which

it

broadcasts

to

its

parents

Note

that

the

compromised

node

does

not

need

to

know

the

true

value

of

r

it

can

simply

set

some

higher-order

bits

to

in

the

hope

that

this

will

affect

the

value

of

r

computed

by

the

sink

Since

the

synopsis

fusion

function

is

a

bitwise

Boolean

OR

the

resulting

synopsis

computed

at

the

sink

will

reflect

the

contributions

of

the

compromised

node

Let

r

be

the

lowest-order

bit

that

is

in

the

corrupted

synopsis

whereas

r

is

the

lowest-order

bit

that

is

in

the

correct

synopsis

Then

the

sink

's

estimate

of

the

aggregate

will

be

larger

than

the

correct

estimate

by

a

factor

of

r

r

It

is

easy

to

see

that

with

the

above

technique

the

compromised

node

can

inject

a

large

amount

of

error

in

the

final

estimate

of

the

sink

We

also

observe

that

even

a

single

node

can

launch

this

attack

with

a

high

rate

of

success

because

the

use

of

multi-path

routing

in

the

synopsis

diffusion

approach

makes

it

highly

likely

that

the

falsified

synopsis

will

be

propagated

to

the

base

station

If

p

is

the

packet

loss

rate

and

if

each

node

has

parents

in

the

aggregation

hierarchy

then

the

probability

of

success

for

this

attack

is

-LRB-

p

-RRB-

h

where

the

compromised

node

is

h

hops

away

from

the

sink

As

an

example

if

p

and

h

then

the

probability

that

the

attack

will

succeed

is

On

the

other

hand

it

is

very

hard

to

launch

an

attack

which

results

in

the

aggregate

estimated

at

the

sink

being

lower

than

the

true

estimate

This

is

because

setting

a

bit

in

the

falsified

synopsis

to

has

no

effect

if

there

is

another

node

X

that

contributes

a

to

the

same

position

in

the

fused

synopsis

To

make

this

attack

a

success

the

attacker

has

to

compromise

all

the

possible

paths

from

node

X

to

the

sink

so

that

X

's

can

not

reach

the

sink

which

is

hard

to

achieve

If

there

is

more

than

one

node

which

contributes

to

the

same

bit

then

it

is

even

harder

As

an

example

in

Count

algorithm

half

of

the

nodes

are

likely

to

contribute

to

the

leftmost

bit

of

the

synopsis

one-fourth

nodes

of

contribute

to

the

second

bit

and

so

on

There

are

bits

in

the

synopsis

to

which

only

one

or

two

nodes

contribute

but

it

is

very

hard

to

predict

in

advance

which

nodes

will

be

contributing

to

these

particular

bits

if

the

sink

broadcasts

along

the

query

request

a

random

seed

to

be

used

with

the

hash

function

in

the

synopsis

generation

phase

Hence

we

can

safely

assume

that

this

attack

is

extremely

difficult

to

launch

In

the

rest

of

this

paper

we

restrict

our

discussion

to

the

previous

attack

where

the

goal

of

the

attacker

is

only

to

increase

the

estimate

In

a

sensor

network

where

some

fraction

of

the

nodes

are

potentially

compromised

there

are

three

sources

that

contribute

to

the

error

in

the

sink

's

estimate

of

the

aggregate

being

computed

-LRB-

i

-RRB-

error

due

to

packet

losses

-LRB-

ii

-RRB-

error

due

to

the

approximation

algorithm

used

e.g.

Flajolet

and

Martin

's

probabilistic

algorithm

-LSB-

-RSB-

and

-LRB-

iii

-RRB-

error

injected

by

compromised

nodes

The

first

two

types

of

error

are

already

addressed

by

the

synposis

diffusion

aggregation

framework

Our

paper

is

complementary

to

this

previous

work

our

objective

is

to

filter

out

the

third

type

of

error

In

particular

we

aim

to

make

the

synopsis

diffusion

approach

resilient

to

the

falsified

local

value

attack

and

the

falsified

sub-aggregate

attack

i.e.

to

enable

the

sink

to

get

the

true

estimate

of

the

aggregate

being

computed

despite

the

presence

of

compromised

nodes

in

the

aggregation

hierarchy

By

true

estimate

we

mean

the

estimate

of

the

aggregate

which

the

sink

would

compute

if

there

were

no

compromised

nodes

Assumptions

We

now

discuss

our

assumptions

with

respect

to

the

sensor

network

and

the

adversary

System

Assumptions

We

assume

that

the

base

station

is

located

at

the

center

of

the

sensor

network

and

nodes

are

deployed

around

the

base

station

However

our

approach

for

attack-resilient

aggregation

does

not

depend

upon

this

assumption

We

assume

that

sensor

nodes

are

similar

to

the

current

generation

of

sensor

nodes

e.g.

motes

-LSB-

-RSB-

in

their

computational

and

communication

capabilities

and

power

resources

while

the

sink

is

a

laptop

class

device

supplied

with

long-lasting

power

We

assume

that

the

sink

has

an

estimate

of

the

upper

bound

on

the

value

of

the

Count

aggregate

If

the

sink

does

not

have

any

further

knowledge

the

upper

bound

of

Count

can

be

set

to

the

total

number

of

nodes

deployed

We

also

assume

that

there

exists

an

upper

bound

on

the

value

of

a

sensor

reading

The

upper

bound

of

Sum

can

be

conservatively

set

to

be

equal

to

product

of

the

upper

bound

of

Count

and

the

upper

bound

of

a

sensor

reading

Previous

works

on

the

synopsis

diffusion

approach

-LSB-

-RSB-

have

made

the

same

assumptions

regarding

the

upper

bounds

for

Count

and

Sum

these

bounds

provide

an

estimate

of

the

length

of

the

synopsis

Security

Assumptions

We

assume

that

the

sink

can

not

be

compromised

and

it

uses

a

protocol

such

as

Tesla

-LSB-

-RSB-

-RRB-

to

authenticate

its

broadcast

messages

We

also

assume

that

each

node

shares

a

pairwise

key

with

the

sink

which

is

used

to

authenticate

the

messages

it

sends

to

the

sink

We

assume

that

the

adversary

can

compromise

sensor

nodes

without

being

detected

If

a

node

is

compromised

all

the

information

it

holds

will

also

be

compromised

We

use

a

Byzantine

fault

model

where

the

adversary

can

inject

malicious

messages

into

the

network

through

the

compromised

nodes

We

conservatively

assume

that

all

compromised

nodes

can

collude

or

are

under

the

control

of

a

single

attacker

Notations

The

following

notations

are

used

in

the

description

of

our

attack-resilient

aggregation

algorithms

BS

refers

to

the

base

station

i.e.

the

sink

X

is

the

identifier

of

a

the

sensor

node

whereas

M

represents

a

compromised

node

K

X

is

the

pair-wise

key

X

shares

with

the

sink

denotes

the

concatenation

of

two

message

fields

and

MAC

-LRB-

K

m

-RRB-

is

the

message

authentication

code

-LRB-

MAC

-RRB-

of

the

message

m

generated

using

the

key

K.

X

Y

m

denotes

a

one-hop

delivery

of

message

m

from

X

to

Y

while

X

m

denotes

that

X

broadcasts

message

m

to

all

of

its

one-hop

neighbors

and

X

m

denotes

that

X

broadcasts

message

m

to

all

nodes

in

the

network

In

this

section

we

present

an

attack-resilient

approach

for

computing

the

Count

and

Sum

aggregates

In

this

approach

we

assume

that

the

BS

has

an

estimate

of

the

lower

bound

and

the

upper

bound

of

the

aggregates

We

will

see

that

this

approach

is

scalable

only

if

the

ratio

of

the

upper

bound

to

the

lower

bound

is

small

Despite

this

limitation

we

discuss

this

approach

in

detail

because

it

provides

the

background

and

motivation

for

our

extended

approach

which

is

discussed

in

Section

We

first

present

the

main

idea

underlying

the

basic

approach

and

then

present

the

detailed

protocol

for

securing

Count

and

Sum

The

Main

Idea

In

our

approach

nodes

execute

the

synopsis

diffusion

aggregation

algorithm

as

specified

in

-LSB-

-RSB-

However

a

subset

of

the

nodes

include

along

with

their

synopses

a

message

authentication

code

-LRB-

MAC

-RRB-

that

can

be

used

by

the

sink

to

verify

the

validity

of

their

contribution

to

the

aggregate

function

The

key

observations

behind

the

design

of

our

approach

are

that

In

order

to

derive

the

correct

estimate

from

the

final

synopsis

-LRB-

say

S

-RRB-

computed

at

the

sink

we

need

only

to

figure

out

the

correct

lowest

order

bit

-LRB-

say

r

-RRB-

in

S

that

is

The

number

of

nodes

contributing

a

to

bit

j

decreases

exponentially

as

we

move

from

the

lowest

order

bit

-LRB-

j

-RRB-

to

higher

order

bits

of

the

synopsis

For

example

in

the

case

of

Count

on

average

half

the

nodes

in

the

network

will

contribute

to

the

leftmost

bit

of

the

synopsis

one-fourth

of

the

nodes

contribute

to

the

second

bit

of

the

synposis

and

so

on

Thus

we

expect

that

only

a

small

number

of

nodes

will

contribute

to

the

bits

around

the

expected

value

of

r.

Each

such

node

includes

along

with

its

response

to

an

aggregation

query

a

MAC

computed

using

a

pairwise

key

shared

exclusively

with

sink

We

demonstrate

that

these

MACs

enable

the

sink

to

filter

out

the

contributions

of

the

falsified

sub-aggregates

injected

by

the

compromised

nodes

to

the

final

aggregate

For

our

scheme

to

work

two

issues

need

to

be

addressed

First

since

the

the

value

of

r

is

not

known

before

the

execution

of

the

query

we

need

to

specify

a

criterion

whereby

a

node

can

determine

if

it

needs

to

include

a

MAC

along

with

its

synopsis

Second

this

criterion

should

be

designed

so

that

the

number

of

such

nodes

who

include

a

MAC

is

minimized

In

our

basic

approach

we

assume

that

the

BS

has

an

estimate

of

the

lower

bound

and

the

upper

bound

of

Count

which

are

denoted

by

l

c

and

u

c

respectively

Based

upon

these

bounds

the

BS

knows

that

bit

r

will

lie

between

a

and

b

which

are

the

bit

positions

in

the

synopsis

S

corresponding

to

l

c

and

u

c

respectively

i.e.

a

log

-LRB-

l

c

-RRB-

and

b

log

-LRB-

u

c

-RRB-

-LRB-

by

Property

in

Section

-RRB-

Thus

there

is

no

need

for

the

BS

to

verify

the

bits

to

the

left

of

a

only

nodes

contributing

to

bits

in

the

range

a

to

b

need

to

prove

to

the

BS

that

their

contribution

to

the

synopsis

S

is

valid

We

refer

to

the

collection

of

bits

in

the

range

a

to

b

in

synopsis

S

as

the

synopsis-edge

as

shown

in

Figure

It

is

easy

to

see

that

the

length

of

the

synopsis-edge

is

-LRB-

log

-LRB-

u

c

l

c

-RRB-

-RRB-

bits

If

we

denote

the

number

of

nodes

contributing

to

the

synopsis-edge

by

then

by

Property

in

Section

-LRB-

u

c

a

u

c

b

-RRB-

-LRB-

c

l

c

-RRB-

The

upper

bound

for

Count

-LRB-

u

c

-RRB-

can

be

set

to

the

total

number

of

nodes

deployed

The

lower

bound

for

Count

-LRB-

l

c

-RRB-

can

be

guessed

depending

on

the

the

energy

reserve

of

the

sensor

nodes

and

rate

of

energy

expenditure

As

an

example

if

nodes

are

deployed

then

u

c

and

l

c

may

be

a

safe

estimate

at

the

time

of

the

Count

query

's

execution

For

this

example

the

length

of

the

synopsis-edge

is

u

c

l

c

and

the

expected

number

of

nodes

contributing

to

synopsis-edge

is

less

than

synopsis-edge

corresponds

to

Lower

Bound

corresponds

to

Upper

Bound

Figure

Securing

Count

synopsis

To

securely

compute

Count

synopsis

the

base

station

needs

to

verify

only

bits

in

the

synopsis-edge

For

the

ease

of

presentation

we

present

the

basic

approach

assuming

that

only

one

synopsis

is

computed

We

can

easily

extend

this

approach

to

compute

m

synopses

in

parallel

as

in

algorithm

PCSA

Securing

Count

To

compute

the

Count

aggregate

securely

we

extend

the

original

Count

algorithm

discussed

in

Section

as

follows

For

the

sake

For

convenience

henceforth

we

say

that

a

node

contributes

to

a

position

j

in

the

synopsis

S

if

bit

j

in

its

local

synopsis

is

of

completeness

we

first

briefly

describe

the

query

dissemination

phase

and

then

we

present

the

aggregation

procedure

in

detail

In

the

query

dissemination

phase

the

BS

broadcasts

the

name

of

the

aggregation

function

a

random

number

-LRB-

Seed

-RRB-

and

the

bit

positions

of

the

start

and

the

end

of

the

synopsis-edge

which

are

specified

by

a

and

b

respectively

Each

node

will

use

the

random

number

Seed

as

an

input

to

the

hash

function

in

the

synopsis

generation

procedure

In

more

concrete

terms

a

query

packet

that

the

BS

broadcasts

is

as

follows

BS

F

agg

Seed

a

b

s

t

h

where

F

agg

is

the

name

of

the

aggregation

function

-LRB-

i.e.

Count

-RRB-

s

denotes

the

time

when

the

aggregation

phase

will

start

t

represents

the

duration

of

one

round

i.e.

t

T

h

where

h

is

the

total

number

of

hops

and

T

is

the

duration

of

the

aggregation

phase

-LRB-

also

called

epoch

-RRB-

Note

that

as

in

the

original

Count

algorithm

discussed

in

Section

the

epoch

is

sub-divided

into

a

series

of

rounds

one

for

each

hop

starting

from

the

farthest

hop

Tesla

-LSB-

-RSB-

can

be

used

for

authenticating

the

broadcast

packet

In

the

aggregation

phase

each

node

executes

the

synopsis

generation

function

SG

-LRB-

-RRB-

and

the

synopsis

fusion

function

SF

-LRB-

-RRB-

for

Count

as

discussed

in

Section

In

addition

each

node

checks

whether

it

contributes

to

the

synopsis-edge

and

if

so

it

generates

a

MAC

and

forwards

the

MAC

along

with

its

fused

synopsis

Specifically

if

node

X

contributes

to

bit

i

in

the

synopsis-edge

it

generates

a

MAC

M

MAC

-LRB-

K

X

m

-RRB-

over

the

message

m

whose

format

is

-LSB-

X

i

Seed

-RSB-

where

Seed

is

the

random

number

which

was

dissem-inated

in

the

query

distribution

phase

Each

node

X

forwards

to

its

parents

its

fused

synopsis

along

with

the

set

of

MACs

-LRB-

M

-RRB-

it

received

from

its

child

nodes

and

its

own

MAC

if

it

generated

one

The

format

of

the

message

a

node

X

forwards

to

its

parents

is

as

follows

X

S

l

M

where

S

l

is

the

fused

synopsis

computed

by

X

If

the

message

does

not

fit

into

one

packet

node

X

breaks

it

into

several

packets

and

forwards

them

In

Appendix

A

we

formally

describe

the

algorithm

-LRB-

SecureCount

-RRB-

executed

by

each

node

in

response

to

an

aggregation

query

After

the

BS

receives

the

MACs

it

checks

their

validity

In

particular

for

each

message

and

MAC

pair

-LSB-

m

MAC

-LRB-

K

X

m

-RRB-

-RSB-

where

m

is

-LSB-

X

i

Seed

-RSB-

the

BS

executes

the

synopsis

generation

function

SG

-LRB-

-RRB-

of

X

and

verifies

whether

node

X

really

contributes

to

bit

i

in

the

synopsis-edge

and

then

checks

whether

the

attached

MAC

is

valid

If

any

of

these

tests

fail

the

corresponding

MAC

is

discarded

After

this

verification

step

the

BS

checks

whether

it

has

received

at

least

one

valid

MAC

for

each

bit

in

the

synopsis-edge

The

bits

in

the

synopsis-edge

for

which

the

BS

has

not

received

a

valid

MAC

are

reset

to

The

bits

at

positions

to

the

left

of

the

synopsis-edge

are

set

to

Finally

the

BS

computes

the

Count

using

the

synopsis

evaluation

function

SE

-LRB-

-RRB-

Security

Analysis

The

security

of

our

approach

follows

from

two

facts

The

sink

can

independently

verify

the

output

of

SG

-LRB-

-RRB-

for

a

particular

node

X

This

is

because

the

output

of

SG

-LRB-

-RRB-

depends

only

upon

the

node

id

X

and

the

random

seed

included

in

the

query

message

Each

bit

that

is

set

to

in

the

synopsis

edge

has

an

associated

MAC

that

can

be

verified

by

the

sink

This

MAC

is

computed

using

a

pairwise

key

that

is

known

only

to

the

contributing

node

and

the

sink

thus

the

MAC

can

not

be

fabricated

by

an

attacker

-LRB-

as

long

as

it

is

reasonably

long

-RRB-

Although

a

compromised

node

can

falsely

set

some

bits

in

its

fused

synopsis

and

forward

false

MACs

corresponding

to

those

bits

the

sink

will

be

able

to

discard

any

false

MACs

This

implies

that

the

attacker

can

not

falsely

increase

the

Count

On

the

other

hand

the

attacker

may

attempt

to

decrease

the

Count

by

dropping

a

genuine

MAC

-LRB-

or

by

corrupting

a

genuine

MAC

-RRB-

sent

by

a

contributing

node

but

the

genuine

MAC

is

likely

to

reach

BS

via

an

alternate

path

If

BS

receives

at

least

one

valid

MAC

for

each

bit

in

the

synopsis-edge

then

BS

obtains

the

true

estimate

of

Count

as

discussed

below

As

discussed

in

Section

the

synopsis

diffusion

approach

uses

a

multi-path

routing

scheme

to

reduce

the

aggregation

error

due

to

packet

losses

resulting

from

node

and

link

failures

The

effect

of

packets

being

dropped

by

compromised

nodes

is

simply

to

increase

the

overall

packet

loss

rate

and

this

can

be

countered

by

an

appropriate

choice

of

the

number

of

parents

of

a

node

in

the

synopsis

diffusion

ring-based

aggregation

hierarchy

Specifically

if

each

node

has

more

than

parents

the

total

number

of

rings

in

the

rings

topology

is

h

and

if

the

probability

of

a

node

being

compromised

is

p

then

on

average

a

contributing

node

's

MAC

will

reach

the

BS

with

probability

q

where

q

h

j

-LRB-

p

-RRB-

j

Here

we

have

assumed

that

the

contributing

nodes

are

uniformly

distributed

over

the

rings

in

the

hierarchy

As

an

example

if

p

and

h

then

q

is

greater

than

i.e.

the

impact

of

the

compromised

nodes

on

the

communication

error

is

negligible

We

also

note

that

while

deriving

q

we

assumed

that

there

is

only

one

node

which

contributes

to

a

particular

bit

in

the

synopsis

In

reality

the

expected

number

of

nodes

contributing

to

a

bit

increases

exponentially

as

we

move

from

the

Rth

bit

where

R

is

the

the

length

of

the

prefix

of

all

ones

in

the

synopsis

S

to

the

lower-order

bits

thereby

increasing

the

probability

that

at

least

one

MAC

corresponding

to

a

bit

position

reaches

the

sink

Computation

and

Communication

Overhead

Each

contributing

node

computes

one

MAC

The

expected

number

of

contributing

nodes

is

-LRB-

c

l

c

-RRB-

which

is

independent

of

network

size

Thus

only

a

subset

of

nodes

will

incur

any

computational

overhead

With

respect

to

communication

overhead

the

maximum

number

of

MACs

that

any

node

will

need

to

forward

is

Thus

this

approach

is

scalable

and

can

be

used

in

large-scale

sensor

networks

as

long

as

the

ratio

u

c

l

c

is

reasonably

small

Securing

SUM

We

can

extend

the

approach

used

for

making

the

Count

aggregate

resilient

to

compromised

nodes

to

the

Sum

aggregate

To

derive

the

synopsis-edge

for

Sum

we

need

to

assume

upper

and

lower

bounds

for

the

value

of

a

sensor

reading

in

addition

to

the

upper

and

lower

bounds

for

the

number

of

sensor

nodes

A

node

X

sends

to

the

BS

a

MAC

M

MAC

-LRB-

K

X

m

-RRB-

only

if

it

contributes

to

the

synopsis-edge

as

in

SecureCount

The

format

of

the

message

m

sent

by

a

node

is

-LSB-

X

A

Seed

v

-RSB-

where

X

is

the

node

id

Seed

is

the

random

seed

included

in

the

broadcast

query

A

represents

the

collection

of

bits

in

the

synopsis

to

which

X

contributes

and

v

is

X

's

sensed

value

Security

Analysis

In

the

case

of

the

Sum

aggregate

the

attacker

could

falsely

set

some

bits

in

its

synopsis

not

only

by

using

a

false

node

id

but

also

using

a

false

sensor

reading

Although

MACs

from

the

contributing

nodes

enable

the

BS

to

verify

the

node

Ids

the

BS

can

not

verify

the

sensed

value

of

a

node

A

compromised

node

can

claim

to

have

a

large

sensed

value

close

to

the

upper

bound

u

v

to

increase

its

chance

of

being

able

to

contribute

to

the

synopsis-edge

The

following

theorem

-LRB-

whose

proof

can

be

found

in

Appendix

B

-RRB-

shows

that

this

attack

's

impact

is

limited

Theorem

Let

be

the

number

of

compromised

nodes

in

a

network

of

n

nodes

Let

u

v

and

a

v

denote

the

upper

bound

and

the

average

value

of

the

sensor

reading

respectively

Let

S

be

the

final

synopsis

computed

at

the

sink

and

let

R

be

the

length

of

the

prefix

of

all

ones

in

S.

Let

s

denote

the

value

of

the

Sum

aggregate

If

each

compromised

node

claims

that

its

sensed

value

is

equal

to

the

upper

bound

u

v

and

if

-LRB-

u

v

-RRB-

s

then

the

probability

Pr

-LSB-

S

-LSB-

R

-RSB-

-RSB-

is

proportional

to

the

product

of

the

fraction

of

compromised

nodes

in

the

network

n.

Note

that

if

the

compromised

node

contributes

to

the

-LRB-

R

-RRB-

th

bit

BS

's

estimate

of

Sum

doubles

Thus

the

theorem

shows

that

for

a

large

network

as

long

the

fraction

of

compromised

nodes

grows

sub-linearly

the

probability

of

this

attack

succeeding

is

small

For

smaller

networks

the

probability

of

this

attack

succeeding

depends

upon

the

ratio

n

and

on

the

ratio

u

v

a

v

As

an

example

if

n

and

u

v

a

v

then

Pr

-LSB-

S

-LSB-

R

-RSB-

-RSB-

The

impact

of

the

attack

is

further

reduced

if

we

employ

the

PCSA

algorithm

in

which

m

independent

synopses

are

computed

and

the

final

estimator

R

is

calculated

by

averaging

these

m

esti-mators

As

an

example

to

add

an

error

of

to

the

final

Sum

the

attacker

needs

to

set

the

R

bit

in

at

least

m

synopses

In

the

example

above

where

Pr

-LSB-

S

-LSB-

R

-RSB-

-RSB-

is

this

probability

is

close

to

zero

when

m

is

This

example

illustrates

that

this

attack

's

impact

is

limited

when

-LRB-

u

v

n

a

v

-RRB-

is

small

On

the

other

hand

when

-LRB-

u

v

n

a

v

-RRB-

is

large

we

can

not

neglect

the

possibility

that

the

attacker

will

succeed

in

injecting

a

significant

error

to

the

Sum

computed

at

the

sink

To

address

this

scenario

we

can

use

a

scheme

in

which

a

node

that

contributes

to

the

synopsis-edge

needs

an

endorsement

from

at

least

neighbors

attesting

to

the

validity

of

its

sensed

value

We

assume

that

the

sensed

values

of

one-hop

neighbors

are

correlated

so

that

one

node

can

verify

the

reading

of

its

neighbors

We

assume

that

there

are

fewer

than

compromised

nodes

among

the

one

hop

neighbors

of

any

node

Each

contributing

node

X

collects

at

least

endorsements

from

its

one-hop

neighbors

in

the

form

of

a

MAC

computed

over

the

sensor

reading

using

the

pairwise

key

that

the

neighbor

shares

with

the

sink

Then

X

computes

an

XMAC

-LSB-

-RSB-

by

XORing

the

collected

MACs

and

X

's

own

MAC

and

sends

the

XMAC

to

the

BS

-LRB-

Zhu

et

al.

-LSB-

-RSB-

use

an

identical

scheme

to

reduce

the

total

size

of

the

MACs

-RRB-

We

also

assume

that

BS

has

the

knowledge

to

verify

if

a

set

of

nodes

are

one-hop

neighbors

which

prevents

the

collusion

attack

-LRB-

We

refer

to

this

scheme

as

the

XMAC-based

scheme

-RRB-

Computation

and

Communication

Overhead

The

number

of

contributing

nodes

is

less

than

-LRB-

s

l

s

-RRB-

where

u

s

and

l

s

are

the

upper

bound

and

lower

bound

of

Sum

As

in

the

case

of

Count

is

independent

of

the

network

size

and

thus

this

approach

is

scalable

With

respect

to

worst

case

communication

overhead

a

node

will

need

to

forward

at

most

MACs

When

the

ratio

-LRB-

-RRB-

of

the

upper

bound

of

the

aggregate

to

the

lower

bound

is

high

the

basic

approach

described

in

the

previous

section

is

not

scalable

because

the

worst

case

communication

cost

incurred

by

a

node

is

proportional

to

In

this

section

we

describe

an

approach

which

has

lower

communication

costs

in

comparison

to

the

basic

approach

at

the

expense

of

greater

latency

Protocol

Overview

Our

extended

approach

is

based

on

the

observation

that

the

expected

number

of

nodes

that

contribute

to

bits

i

where

R

i

k

in

the

synopsis

-LRB-

k

is

the

length

of

the

synopsis

-RRB-

is

very

small

In

fact

using

Property

and

Property

from

Section

we

can

show

that

expected

number

of

nodes

contributing

to

the

Rth

and

higher-order

bits

of

S

is

less

than

We

use

a

sliding-window

based

approach

in

which

the

aggregation

phase

is

divided

into

multiple

epochs

Starting

at

the

right-most

bit

k

we

proceed

from

right

to

left

within

the

synopsis

S

using

a

bit

window

of

w

bits

In

each

epoch

only

the

nodes

that

contribute

a

to

the

bits

in

S

corresponding

to

the

current

position

of

the

window

send

MACs

to

the

sink

that

can

be

used

to

verify

their

contribution

to

S

In

other

words

in

the

first

epoch

only

nodes

that

contribute

a

to

bits

k

to

k

w

respond

to

the

query

In

epoch

two

nodes

that

contribute

to

bits

between

k

w

and

k

respond

and

so

on

The

algorithm

terminates

when

the

querying

node

has

determined

that

the

remaining

bits

of

S

to

the

left

of

the

current

window

are

likely

to

be

with

high

probability

The

design

of

this

termination

criterion

is

the

main

challenge

in

using

this

approach

we

discuss

the

termination

criterion

and

its

analytical

underpinnings

in

detail

Once

the

querying

node

determines

that

the

algorithm

can

terminate

it

broadcasts

a

STOP

message

to

the

network

to

announce

the

end

of

the

iterative

aggregation

procedure

Protocol

Operation

The

operation

of

the

protocol

is

similar

to

that

of

the

protocol

used

in

the

basic

approach

with

some

minor

differences

as

follows

The

query

message

broadcast

to

the

network

includes

the

window

size

w

in

addition

to

the

other

parameters

As

in

the

original

synopsis

diffusion

algorithm

-LSB-

-RSB-

we

assume

that

the

time

is

syn-chronized

among

BS

and

the

sensor

nodes

Each

node

computes

the

start

and

end

time

of

the

current

epoch

based

on

the

window

w.

Further

although

the

MACs

generated

by

nodes

are

sent

to

the

BS

over

the

course

of

multiple

epochs

the

fused

synopsis

computed

by

each

node

is

forwarded

to

its

parent

in

the

first

epoch

Thus

the

BS

can

compute

the

aggregate

at

the

end

of

the

first

epoch

itself

although

this

aggregate

may

be

erroneous

in

the

presence

of

compromised

nodes

Termination

Criterion

The

goal

of

our

algorithm

is

to

find

r

the

lowest-order

bit

in

S

that

is

Further

recall

that

S

is

of

the

form

r

where

the

bits

at

positions

i

r

are

highly

likely

to

be

Thus

the

intuition

behind

our

termination

criterion

is

simple

as

we

examine

the

bits

of

S

moving

from

right

to

left

if

we

observe

two

consecutive

's

i.e.

if

we

observe

the

string

it

is

highly

likely

that

the

is

at

the

rth

position

In

fact

we

can

show

analytically

that

the

probability

of

this

event

is

greater

than

which

follows

from

the

following

theorem

Theorem

Let

F

denote

the

event

that

the

string

l

where

s

l

represents

any

string

of

length

l

l

appears

in

a

synopsis

S

The

probability

of

the

event

F

is

less

than

-LRB-

The

proof

is

given

in

the

appendix

-RRB-

Further

we

can

take

advantage

of

the

fact

that

most

applications

will

use

the

PCSA

algorithm

to

reduce

the

approximation

error

in

estimating

R

r

Recall

that

in

the

PCSA

algorithm

m

synopses

are

computed

in

parallel

Let

R

i

denote

the

value

of

R

estimated

from

the

ith

synopsis

Then

according

to

the

PCSA

algorithm

The

original

synopsis

diffusion

algorithm

-LSB-

-RSB-

takes

one

epoch

to

complete

the

the

expected

value

of

the

random

variable

R

is

estimated

by

averaging

the

individual

values

of

R

for

each

synopsis

i.e.

E

-LSB-

R

-RSB-

R

i

m

i

R

i

Although

there

is

likely

to

be

some

variation

among

the

R

i

we

know

from

Property

in

Section

that

the

variation

is

expected

to

correspond

to

two

bit

position

both

to

the

left

and

the

right

of

the

true

value

of

R

This

suggests

that

there

is

a

high

degree

of

correlation

between

the

R

i

for

different

synopses

Thus

in

our

window-based

approach

we

can

increase

our

confidence

that

we

have

found

the

correct

position

of

R

if

we

observe

the

bit

pattern

in

multiple

synopses

among

the

m

that

are

being

computed

in

parallel

Based

on

this

intuition

our

termination

criterion

consists

of

checking

whether

we

have

observed

the

string

in

at

least

m

out

of

the

m

synopses

Synopsis

Synopsis

m-th

Synopsis

Synopsis

position

of

the

window

the

aggregation

after

this

window

process

stops

the

termination-test

passes

in

this

window

Figure

Each

synopsis

is

divided

into

several

windows

of

width

w

bits

After

the

termination

criterion

is

satisfied

the

base

station

broadcasts

a

STOP

message

and

the

aggregation

phase

stops

after

the

next

epoch

In

each

epoch

nodes

which

contribute

to

the

corresponding

window

send

a

MAC

to

the

base

station

The

MACs

which

correspond

to

the

crossed

bits

are

never

sent

Our

goal

in

selecting

the

threshold

m

is

to

reduce

the

likelihood

of

both

a

false

positive

which

means

that

the

algorithm

was

terminated

too

early

and

a

false

negative

which

means

that

the

algorithm

terminated

too

late

i.e.

after

the

sliding

window

had

already

crossed

the

true

position

of

R

A

false

positive

results

in

an

over-estimate

of

R

whereas

a

false

negative

results

in

additional

communication

overhead

We

now

show

that

it

is

possible

to

find

a

suitable

value

for

m

such

that

the

probability

of

false

positive

and

the

probability

of

false

negative

are

both

low

Theorem

Let

G

i

denote

the

event

that

both

bit

i

and

-LRB-

i

-RRB-

in

a

synopsis

S

are

Let

denote

the

expected

value

of

the

estimator

R

Then

Pr

-LSB-

G

-RSB-

Pr

-LSB-

G

-RSB-

and

Pr

-LSB-

G

-RSB-

Because

of

space

limitations

the

proof

of

this

theorem

can

be

found

in

the

appendix

If

the

sliding

window

in

our

algorithm

is

two

bits

wide

i.e

w

from

the

definition

of

the

false

positive

-LRB-

FP

-RRB-

we

get

that

the

probability

Pr

-LSB-

FP

-RSB-

is

the

probability

that

the

event

G

occurs

in

m

or

more

synopses

Similarly

the

probability

of

a

false

negative

Pr

-LSB-

FN

-RSB-

is

the

probability

that

the

event

G

occurs

in

fewer

than

m

synopses

For

m

-LRB-

which

is

the

typical

value

used

in

previous

work

-LSB-

-RSB-

we

find

that

the

best

value

of

m

is

in

which

case

Pr

-LSB-

FP

-RSB-

and

Pr

-LSB-

FN

-RSB-

The

same

approach

illus-trated

here

can

be

used

to

derive

the

appropriate

threshold

m

for

other

window

sizes

Figure

illustrates

the

operation

of

our

algorithm

for

w

Assume

that

the

termination

criterion

is

satisfied

in

epoch

e

The

BS

broadcasts

a

STOP

message

which

directs

all

nodes

to

terminate

the

aggregation

phase

Note

that

by

the

time

each

node

in

the

network

receives

the

broadcast

STOP

message

many

of

the

nodes

will

have

already

sent

MACs

corresponding

to

their

contributions

to

the

next

epoch

e

of

the

algorithm

Thus

the

effect

of

the

termination

criterion

being

satisfied

in

epoch

e

message

is

to

terminate

the

aggregation

after

epoch

e

We

can

take

advantage

of

this

extra

epoch

to

further

increase

our

level

of

confidence

in

the

estimated

value

of

R.

Let

the

bit

position

of

the

sliding

window

in

epoch

e

correspond

to

bits

and

Instead

of

estimating

R

because

m

out

of

m

synopses

had

both

bits

and

equal

to

we

can

now

estimate

R

based

on

the

observed

value

of

R

i

for

all

m

synopses

Our

simulations

show

that

estimate

of

the

aggregate

computed

using

our

extended

approach

is

close

to

the

estimate

computed

using

the

original

synopsis

diffusion

-LSB-

-RSB-

algorithm

Latency

The

number

of

epochs

taken

by

our

sliding

window

approach

depends

on

the

ratio

-LRB-

-RRB-

of

the

upper

bound

of

the

aggregate

to

the

actual

value

If

the

upper

bound

is

u

and

the

actual

value

is

for

a

window

of

width

w

the

number

of

epochs

is

equal

to

-LRB-

log

u

m

log

m

w

-RRB-

-LRB-

log

w

-RRB-

Communication

Overhead

Theorem

implies

that

it

is

highly

likely

that

the

sliding

window

contains

the

position

R

when

the

termination

criterion

is

satisfied

As

discussed

above

if

the

termination

criterion

is

satisfied

in

epoch

e

the

aggregation

completes

after

epoch

e

Thus

by

property

and

property

in

Section

if

m

synopses

are

computed

in

parallel

the

expected

number

of

nodes

which

send

a

MAC

varies

in

the

range

of

-LRB-

m

-RRB-

to

-LRB-

m

-RRB-

Even

if

a

sensor

node

contributes

to

more

than

one

bits

it

sends

just

one

MAC

validating

all

the

bits

Note

that

the

number

of

contributing

nodes

does

not

exceed

this

range

even

if

the

network

size

is

increased

Our

simulation

results

show

that

MACs

are

sent

on

average

when

m

We

observe

that

the

width

of

the

window

w

determines

a

tradeoff

between

the

communication

overhead

and

the

latency

If

we

divide

the

synopses

into

wider

windows

the

number

of

MACs

sent

and

hence

the

communication

overhead

will

increase

while

the

latency

of

the

aggregation

process

will

decrease

and

vice

versa

Discussion

An

alternative

approach

to

the

sliding

window-based

approach

described

above

is

one

in

which

the

base

station

computes

the

aggregate

of

interest

in

the

first

epoch

using

the

original

Synopsis

Diffusion

algorithm

It

then

broadcasts

a

message

requesting

only

the

nodes

that

contribute

to

the

bit

window

that

contains

R

to

send

the

MACs

authenticating

their

local

synopses

If

the

BS

success-fully

verifies

all

the

MACs

it

receives

then

the

protocol

terminates

at

the

end

of

the

second

epoch

However

if

it

does

not

receive

the

requested

MACs

or

if

one

or

more

MACs

are

invalid

the

BS

executes

the

sliding-window

protocol

described

above

to

compute

the

correct

value

of

R

If

the

probability

of

compromised

nodes

being

present

in

the

network

is

low

then

this

alternative

approach

is

preferable

to

the

extended

approach

since

it

will

have

much

lower

latency

on

average

In

this

section

we

report

on

a

detailed

simulation

study

that

examined

the

performance

of

our

attack-resilient

aggregation

algorithms

discussed

in

Sections

and

Our

simulations

were

written

using

the

TAG

simulator

developed

by

Madden

et

al.

-LSB-

-RSB-

We

added

the

attack-resilient

functionality

to

the

source

code

provided

by

Considine

et

al.

-LSB-

-RSB-

which

simulates

their

multipath

aggregation

algorithms

in

the

TAG

simulator

environment

Simulation

Environment

For

our

basic

experimental

network

topology

we

used

a

regular

grid

with

sensor

nodes

where

one

sensor

is

placed

at

each

grid

point

and

the

base

station

is

at

the

center

of

the

grid

as

in

-LSB-

-RSB-

The

communication

radius

of

each

node

is

unit

allowing

the

nearest

eight

grid

neighbors

to

be

reached

The

goal

of

our

simulation

experiments

is

to

examine

the

communication

overhead

and

accuracy

of

our

scheme

in

the

presence

of

packet

losses

which

are

relatively

frequent

in

sensor

networks

We

use

a

simple

packet

loss

model

in

which

packets

are

dropped

with

a

fixed

probability

this

packet

loss

rate

is

assumed

to

include

packets

that

are

lost

due

to

being

dropped

by

compromised

nodes

We

do

not

model

any

additional

attacks

by

compromised

nodes

specifically

the

falsified

subaggregate

and

the

falsified

local

value

attacks

in

our

simulation

This

is

because

we

have

already

shown

that

these

attacks

can

not

affect

the

estimate

of

the

aggregate

computed

at

the

sink

Consequently

these

attacks

simply

have

the

effect

of

increasing

the

communication

and

computation

overhead

in

effect

they

become

a

form

of

DOS

or

resource

consumption

attacks

We

assign

a

unique

id

to

each

sensor

and

we

assume

that

the

sensor

reading

is

a

random

integer

uniformly

distributed

in

the

range

of

to

units

We

compute

synopses

in

parallel

using

the

PCSA

algorithm

as

in

the

experiments

reported

in

-LSB-

-RSB-

We

use

the

method

of

independent

replications

as

our

simulation

methodology

Each

simulation

experiment

was

repeated

times

with

a

different

seed

The

plots

below

show

the

confidence

intervals

of

the

reported

metric

Results

and

Discussion

Due

to

space

constraints

we

will

only

present

the

results

of

our

extended

approach

for

computing

the

Sum

aggregate

Accuracy

of

our

estimate

In

the

first

set

of

experiments

we

validate

our

claim

that

our

attack-resilient

approach

has

the

same

accuracy

in

computing

the

true

value

of

the

aggregate

as

the

original

synopsis

diffusion

approach

Figure

plots

the

estimates

of

our

approach

and

the

synopsis

diffusion

approach

as

a

function

of

the

packet

loss

rate

We

observe

that

the

two

estimates

are

indeed

very

close

in

all

loss

rate

conditions

We

observe

that

the

average

value

of

the

sensor

reading

is

approximately

i.e.

the

accurate

Sum

is

Communication

overhead

We

now

compare

the

communication

overhead

of

our

approach

to

that

of

the

original

synopsis

diffusion

approach

Figure

-LRB-

b

-RRB-

plots

the

total

number

of

bytes

transmitted

for

computing

the

Sum

aggregate

As

discussed

in

Section

for

preventing

a

node

from

using

a

false

reading

to

generate

its

own

local

synopsis

we

can

adopt

two

approaches

In

the

first

approach

we

ignore

the

impact

of

the

falsified

local

value

attack

in

the

figure

this

approach

is

labeled

as

ARSD

-LRB-

attack-resilient

synopsis

diffusion

-RRB-

The

second

approach

requires

the

contributing

node

to

include

a

XMAC

which

corresponds

to

an

endorsement

from

its

neighbors

in

the

message

in

the

figure

this

approach

is

labeled

ARSD+XMAC

For

ARSD+XMAC

each

contributing

node

sends

an

authentication

message

which

has

two

parts

the

first

part

contains

the

ID

-LRB-

x

Link

Loss

Rate

Estimated

Sum

ARSD

SD

Actual

Sum

x

Link

Loss

Rate

Total

Byte

Transmitted

ARSD

ARSD+XMAC

SD

a.

Accuracy

of

Sum

b.

Byte

overhead

Log

-LRB-

upper

bound

actual

Sum

-RRB-

Number

of

epochs

ARSD

-LRB-

window

width

-RRB-

Number

of

sensor

nodes

Number

of

Contributing

nodes

ARSD

c.

Latency

d.

Varying

the

network

size

Figure

Experimental

Results

bytes

-RRB-

of

the

contributing

node

and

its

sensed

value

-LRB-

bytes

-RRB-

and

the

second

part

includes

the

IDs

of

the

k

neighbors

and

a

XMAC

-LRB-

bytes

-RRB-

If

the

value

of

k

is

not

more

than

then

a

node

needs

bytes

to

specify

the

identity

of

the

neighbors

whose

MACs

are

used

to

generate

the

XMAC

Thus

the

size

of

one

authentication

message

is

bytes

For

ARSD

the

contributing

node

just

needs

to

send

its

own

MAC

no

neighbor

endorsement

is

needed

which

reduces

the

authentication

message

size

to

bytes

Figure

-LRB-

b

-RRB-

shows

that

the

byte

overhead

of

the

ARSD+XMAC

scheme

is

roughly

times

larger

than

the

original

approach

whereas

ARSD

is

times

larger

than

the

original

approach

One

might

expect

that

if

loss

rate

is

high

our

extended

approach

may

take

more

time

to

stop

because

some

MACs

could

be

lost

en-route

and

as

a

result

the

communication

overhead

could

increase

But

Figure

-LRB-

b

-RRB-

demonstrates

that

the

overhead

of

the

extended

approach

does

not

increase

with

the

loss

rate

Latency

As

discussed

in

Section

the

latency

of

the

extended

approach

depends

on

the

looseness

of

the

base

station

's

estimate

of

the

upper

bound

of

Sum

Figure

-LRB-

c

-RRB-

plots

the

number

of

epochs

taken

by

our

extended

approach

as

a

function

of

the

ratio

of

the

upper

bound

to

the

actual

value

of

the

aggregate

The

figure

shows

that

the

number

of

epochs

increases

at

logarithmic

scale

with

the

ratio

of

the

upper

bound

to

the

actual

Sum

We

note

however

that

the

byte

overhead

of

our

scheme

is

independent

of

this

ratio

Effect

of

network

size

In

this

experiment

we

study

the

impact

of

the

network

size

on

the

communication

overhead

of

the

extended

approach

The

communication

overhead

depends

upon

the

number

of

contributing

nodes

that

send

a

MAC

to

the

base

station

authenticating

their

synopsis

Recall

from

Section

that

the

expected

number

of

contributing

nodes

is

independent

of

the

network

size

Figure

-LRB-

d

-RRB-

confirms

our

analysis

we

observe

that

the

number

of

contributing

nodes

is

more

or

less

constant

as

the

network

size

increases

This

figure

thus

illustrates

the

scalability

of

our

approach

for

attack-resilient

aggregation

Several

data

aggregation

protocols

-LSB-

-RSB-

have

been

proposed

in

the

literature

which

efficiently

fuse

the

sensed

information

en-route

to

the

base

station

to

reduce

the

communication

overhead

Since

packet

losses

and

node

failures

are

relatively

common

in

sensor

networks

several

studies

have

investigated

the

design

of

robust

aggregation

algorithms

Considine

et

al.

-LSB-

-RSB-

and

Nath

et

al.

-LSB-

-RSB-

have

presented

robust

aggregation

approaches

that

combine

the

use

of

multi-path

routing

with

clever

algorithms

that

avoid

double-counting

of

sensor

readings

Jelasity

et

al.

-LSB-

-RSB-

proposed

a

robust

gossip-based

protocol

for

computing

aggregates

over

network

components

in

a

fully

decentralized

fashion

They

assume

that

nodes

form

an

overlay

network

where

any

pair

of

nodes

are

considered

to

be

neighbors

which

makes

this

protocol

impractical

for

sensor

networks

We

note

that

of

the

above

algorithms

were

designed

with

security

in

mind

Recently

several

researchers

have

examined

security

issues

in

aggregation

Wagner

-LSB-

-RSB-

examined

the

problem

of

resilient

data

aggregation

in

presence

of

malicious

nodes

and

provided

guidelines

for

selecting

aggregation

functions

in

a

sensor

network

Buttyan

et

al.

-LSB-

-RSB-

proposed

a

model

of

resilient

aggregation

and

analyzed

the

maximum

deviation

from

the

true

value

of

the

aggregate

that

an

adversary

could

introduce

while

remaining

undetected

The

models

used

by

by

both

Buttyan

et

al

and

Wagner

assume

that

there

is

no

in-network

aggregation

that

is

the

aggregation

is

performed

at

the

sink

Przydatek

et

al

-LSB-

-RSB-

present

protocols

that

can

be

used

by

a

trusted

remote

user

to

query

a

sensor

network

in

which

the

base

The

link

loss

rate

is

held

at

in

this

set

of

experiments

station

may

be

compromised

and

the

base

station

is

the

only

aggregator

One

of

the

protocols

described

by

Przydatek

et

al

is

a

robust

approach

for

counting

distinct

elements

in

a

data

stream

that

can

be

used

for

estimating

the

size

of

the

network

i.e.

the

Count

aggregate

Their

approach

for

counting

distinct

elements

is

similar

to

our

scheme

for

Count

in

the

sense

that

in

both

cases

only

a

subset

of

elements

need

to

be

verified

The

first

secure

in-network

data

aggregation

protocol

was

designed

by

Hu

and

Evans

-LSB-

-RSB-

Their

protocol

is

effective

only

if

no

more

than

one

node

is

compromised

Recently

Yang

et

al.

-LSB-

-RSB-

proposed

SDAP

a

secure

hop-by-hop

data

aggregation

protocol

which

can

tolerate

more

than

one

compromised

node

SDAP

is

a

tree-based

aggregation

protocol

with

communication

cost

comparable

with

that

of

the

ordinary

aggregation

protocols

while

it

provides

certain

level

of

assurance

on

the

trustworthiness

of

the

aggregation

result

As

SDAP

is

a

tree-based

protocol

it

is

vulnerable

to

link

loss

and

node

failures

which

are

relatively

common

in

sensor

networks

whereas

our

protocol

is

robust

to

this

communication

loss

and

at

the

same

time

secure

against

compromised

nodes

We

note

that

our

work

is

related

to

the

general

problem

of

preventing

false

data

injection

Du

et

al.

-LSB-

-RSB-

proposed

a

mechanism

that

allows

the

base

station

to

check

the

aggregated

values

submit-ted

by

several

designated

aggregators

based

on

the

endorsements

provided

by

a

certain

number

of

witness

nodes

around

the

aggregators

Their

scheme

does

not

provide

per-hop

aggregation

Several

other

works

-LSB-

-RSB-

have

also

proposed

solutions

to

prevent

false

data

injection

attacks

in

sensor

networks

but

they

do

not

involve

data

aggregation

In

this

paper

we

investigated

the

security

issues

of

synopsis

diffusion

framework

in

presence

of

compromised

nodes

We

showed

that

a

compromised

node

can

launch

several

simple

attacks

on

the

existing

aggregation

algorithms

which

could

significantly

deviate

the

estimate

of

the

aggregate

We

also

proposed

modifications

to

the

aggregation

algorithms

that

guard

against

these

attacks

Our

analytical

results

and

simulation

results

show

that

our

approach

is

effective

and

it

incurs

minimal

computation

and

communication

overhead

In

this

paper

we

assume

that

a

sensor

node

has

a

security

association

only

with

the

base

station

and

as

a

result

the

authentication

messages

can

not

be

processed

in-network

in

our

approach

To

further

reduce

the

communication

overhead

we

plan

to

exploit

other

security

settings

e.g.

local

pairwise

keys

among

nodes

as

a

part

of

our

future

work

-LSB-

-RSB-

M.

Bellare

R.

Guerin

and

P.

Rogaway

XOR

MACs

New

methods

for

message

authentication

using

finite

pseudorandom

functions

In

Proc

of

the

Annual

International

Cryptology

Conference

on

Advances

in

Cryptology

CRYPTO

pages

-LSB-

-RSB-

L.

Buttyan

P.

Schaffer

and

I.

Vajda

Resilient

aggregation

with

attack

detection

in

sensor

networks

In

Proc

of

IEEE

Workshop

on

Sensor

Networks

and

Systems

for

Pervasive

Computing

-LSB-

-RSB-

J.

Considine

F.

Li

G.

Kollios

and

J.

Byers

Approximate

aggregation

techniques

for

sensor

databases

In

Proc

of

IEEE

Int

l

Conf

on

Data

Engineering

-LRB-

ICDE

-RRB-

-LSB-

-RSB-

W.

Du

J.

Deng

Y.

S.

Han

and

P.

Varshney

A

pairwise

key

pre-distribution

scheme

for

wireless

sensor

networks

In

Proc

of

the

ACM

Conference

on

Computer

and

Communications

Security

-LRB-

CCS

-RRB-

-LSB-

-RSB-

P.

Flajolet

and

G.

N.

Martin

Probabilistic

counting

algorithms

for

data

base

applications

Journal

of

Computer

and

System

Sciences

-LRB-

-RRB-

-LSB-

-RSB-

S.

Ganeriwal

and

M.

B.

Sribastava

Reputation-based

framework

for

highly

integrity

sensor

networks

In

Proc

of

ACM

Workshop

on

Security

of

Sensor

and

Adhoc

Networks

-LRB-

SASN

-RRB-

Washington

DC

-LSB-

-RSB-

D.

Ganesan

R.

Govindan

S.

Shenker

and

D.

Estrin

Highly-resilient

energy-efficient

multipath

routing

in

wireless

sensor

networks

Mobile

Comuting

and

Communication

Review

-LRB-

-RRB-

-LSB-

-RSB-

L.

Hu

and

D.

Evans

Secure

aggregation

for

wireless

networks

In

Proc

of

Workshop

on

Security

and

Assurance

in

Ad

hoc

Networks

-LSB-

-RSB-

M.

Jelasity

A.

Montresor

and

O.

Babaoglu

Gossip-based

aggregation

in

large

dynamic

networks

ACM

Transactions

on

Computer

Systems

-LRB-

-RRB-

-LSB-

-RSB-

F.

Koushanfar

M.

Potkonjak

and

A.

Sangiovanni-Vincentelli

Fault

tolerance

techniques

in

wireless

ad-hoc

sensor

networks

In

Sensors

Proceedings

of

IEEE

pages

-LSB-

-RSB-

S.

Madden

M.

J.

Franklin

J.M.

Hellerstein

and

W.

Hong

TAG

A

tiny

aggregation

service

for

ad

hoc

sensor

networks

In

Proc

of

USENIX

Symposium

on

Operating

Systems

Design

and

Implementation

-LSB-

-RSB-

A.

Manjhi

S.

Nath

and

P.

Gibbons

Tributeries

and

deltas

Efficient

and

robust

aggregation

in

sensor

network

streams

In

Proc

of

ACM

International

Conference

on

Management

of

Data

-LRB-

SIGMOD

-RRB-

-LSB-

-RSB-

Mica

Motes

-LSB-

-RSB-

S.

Nath

P.

B.

Gibbons

S.

Seshan

and

Z.

Anderson

Synopsis

diffusion

for

robust

aggregation

in

sensor

networks

In

Proc

of

the

international

conference

on

Embedded

networked

sensor

systems

-LRB-

SenSys

-RRB-

-LSB-

-RSB-

A.

Perrig

R.

Szewczyk

V.

Wen

D.

Culler

and

J.

D.

Tygar

SPINS

Security

protocols

for

sensor

networks

In

Seventh

Annual

International

Conference

on

Mobile

Computing

and

Networks

-LRB-

MobiCOM

-RRB-

-LSB-

-RSB-

B.

Przydatek

D.

Song

and

A.

Perrig

SIA

Secure

information

aggregation

in

sensor

networks

In

Proc

of

the

international

conference

on

Embedded

networked

sensor

systems

-LRB-

SenSys

-RRB-

-LSB-

-RSB-

D.

Wagner

Resilient

aggregation

in

sensor

networks

In

Proc

of

ACM

Workshop

on

Security

of

Sensor

and

Adhoc

Networks

-LRB-

SASN

-RRB-

-LSB-

-RSB-

Y.

Yang

X.

Wang

S.

Zhu

and

G.

Cao

SDAP

A

secure

hop-by-hop

data

aggregation

protocol

for

sensor

networks

In

Proc

of

ACM

MOBIHOC

-LSB-

-RSB-

Y.

Yao

and

J.

E.

Gehrke

The

cougar

approach

to

in-network

query

processing

in

sensor

networks

ACM

SIGMOD

Record

-LRB-

-RRB-

September

-LSB-

-RSB-

Fan

Ye

Haiyun

Luo

Songwu

Lu

and

Lixia

Zhang

Statistical

en-route

filtering

of

injected

false

data

in

sensor

networks

In

Proc

of

IEEE

Infocom

-LSB-

-RSB-

W.

Zhang

and

G.

Cao

Group

rekeying

for

filtering

false

data

in

sensor

networks

A

predistribution

and

local

collaboration-based

approach

Proc

of

IEEE

Infocom

-LSB-

-RSB-

J.

Zhao

and

R.

Govindan

Understanding

packet

delivery

performance

in

dense

wireless

sensor

networks

In

Proc

of

the

international

conference

on

Embedded

networked

sensor

systems

-LRB-

SenSys

-RRB-

-LSB-

-RSB-

J.

Zhao

R.

Govindan

and

D.

Estrin

Computing

aggregates

for

monitoring

sensor

networks

In

Proc

of

the

IEEE

International

Workshop

on

Sensor

Network

Protocols

and

Applications

-LSB-

-RSB-

S.

Zhu

S.

Setia

and

S.

Jajodia

LEAP

Efficient

security

mechanisms

for

large-scale

distributed

sensor

networks

In

Proc

of

the

ACM

Conference

on

Computer

and

Communications

Security

-LRB-

CCS

-RRB-

-LSB-

-RSB-

S.

Zhu

S.

Setia

S.

Jajodia

and

P.

Ning

An

interleaved

hop-by-hop

authentication

scheme

for

filtering

injected

false

data

in

sensor

networks

In

Proc

of

IEEE

Symposium

on

Security

and

Privacy

Appendix

A.

Below

we

describe

the

algorithm

-LRB-

SecureCount

-RRB-

executed

by

each

node

in

response

to

a

Count

query

X

represents

the

node

Id

Algorithm

SecureCount

-LRB-

X

Seed

a

b

-RRB-

M

-LCB-

-RCB-

M

is

initialized

as

an

empty

set

i

SG

-LRB-

X

Seed

-RRB-

X

contributes

to

bit

i

if

-LRB-

a

i

b

-RRB-

then

m

-LSB-

X

i

Seed

-RSB-

M

MAC

-LRB-

K

X

m

-RRB-

M

M

M

end

if

S

l

SF

-LRB-

-RRB-

S

l

is

the

fused

synopsis

at

X

M

M

C

C

represents

the

set

of

MACs

X

received

from

its

child

nodes

X

S

l

M

B.

Proofs

of

Theorems

We

provide

the

proofs

for

the

theorems

present

in

the

paper

Theorem

Let

there

be

n

nodes

in

the

sensor

network

among

which

nodes

are

compromised

Let

u

v

and

a

v

denote

the

upper

bound

and

the

average

value

of

the

sensor

reading

respectively

Let

S

be

the

final

synposis

computed

at

the

sink

and

let

R

be

the

length

of

the

prefix

of

all

ones

in

S.

Let

s

denote

the

value

of

the

Sum

aggregate

If

each

compromised

node

claims

that

its

sensed

value

is

equal

to

the

upper

bound

u

v

and

if

-LRB-

u

v

-RRB-

s

then

the

probability

Pr

-LSB-

S

-LSB-

R

-RSB-

-RSB-

is

proportional

to

the

product

of

the

fraction

of

compromised

nodes

in

the

network

n

and

the

ratio

u

v

a

v

P

ROOF

By

property

in

Section

the

expected

value

of

the

estimator

R

for

the

Sum

synopsis

S

is

log

-LRB-

s

-RRB-

where

s

denotes

the

Sum

As

a

node

X

with

sensed

value

v

invokes

the

function

CT

-LRB-

-RRB-

v

times

-LRB-

in

the

synopsis

generation

phase

-RRB-

the

probability

that

X

does

not

contribute

to

bit

i

in

S

is

-LRB-

i

-RRB-

u

v

So

the

probability

-LRB-

p

-RRB-

that

a

node

with

sensed

value

u

v

will

contribute

to

the

-LRB-

R

-RRB-

th

bit

is

-LRB-

-LRB-

R

-RRB-

u

v

-RRB-

After

simplifying

we

get

p

-LRB-

s

-RRB-

u

v

-LRB-

u

v

s

-RRB-

u

v

s

The

above

approximation

is

valid

as

u

v

is

smaller

than

s

If

there

are

compromised

nodes

then

Pr

-LRB-

S

-LSB-

R

-RSB-

-RRB-

is

q

-LRB-

p

-RRB-

p

u

v

s

-LRB-

-RRB-

-LRB-

n

-RRB-

-LRB-

u

v

a

v

-RRB-

To

prove

Theorem

we

first

prove

the

following

results

Lemma

Let

E

i

i

k

denote

the

event

that

the

string

appears

in

a

synopsis

S

from

bit

i

to

bit

-LRB-

i

-RRB-

-LRB-

i.e.

S

-LSB-

i

-RSB-

S

-LSB-

i

-RSB-

and

S

-LSB-

i

-RSB-

-RRB-

where

k

is

the

length

of

S

The

maximum

value

of

the

probability

-LRB-

p

i

-RRB-

of

the

event

E

i

is

for

any

value

of

i

and

for

any

value

of

Count

-LRB-

or

Sum

-RRB-

shared

by

S.

P

ROOF

If

function

CT

-LRB-

-RRB-

is

invoked

once

-LRB-

ref

Section

-RRB-

then

Pr

-LSB-

S

-LSB-

j

-RSB-

-RSB-

q

j

j

j

k

This

probability

increases

if

it

is

given

that

bit

j

j

k

will

remain

Specifically

Pr

-LSB-

S

-LSB-

j

-RSB-

S

-LSB-

j

-RSB-

-RSB-

q

j

q

j

-LRB-

j

-RRB-

-LRB-

j

-RRB-

If

is

the

total

Count

-LRB-

or

Sum

-RRB-

shared

by

synopsis

S

then

Pr

-LSB-

S

-LSB-

i

-RSB-

-RSB-

-LRB-

q

i

-RRB-

and

Pr

-LSB-

S

-LSB-

i

-RSB-

S

-LSB-

i

-RSB-

-RSB-

Pr

-LSB-

S

-LSB-

i

-RSB-

-RSB-

Pr

-LSB-

S

-LSB-

i

-RSB-

-RSB-

Pr

-LSB-

S

-LSB-

i

-RSB-

S

-LSB-

i

-RSB-

-RSB-

-LRB-

-RRB-

-LRB-

i

-RRB-

-LRB-

i

-RRB-

-LRB-

q

i

q

i

-RRB-

-LRB-

i

-RRB-

-LRB-

i

-RRB-

-LRB-

i

i

-RRB-

So

the

probability

of

the

event

E

i

is

p

i

Pr

-LSB-

S

-LSB-

i

-RSB-

-RSB-

Pr

-LSB-

S

-LSB-

i

-RSB-

S

-LSB-

i

-RSB-

S

-LSB-

i

-RSB-

-RSB-

-LRB-

i

-RRB-

-LSB-

-LRB-

-LRB-

i

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

i

-RRB-

-LRB-

-RRB-

-RRB-

-LRB-

-LRB-

i

-RRB-

-LRB-

-RRB-

-LRB-

i

-RRB-

-LRB-

-RRB-

-RRB-

-RSB-

-LRB-

-RRB-

Note

that

if

i

log

-LRB-

-RRB-

the

factor

is

close

to

and

second

factor

is

close

to

making

p

i

close

to

On

the

other

hand

if

i

log

-LRB-

-RRB-

the

factor

is

close

to

but

the

factor

are

close

to

again

making

p

i

close

to

p

i

attains

the

highest

value

when

i

is

close

to

log

-LRB-

-RRB-

We

have

numerically

found

that

the

maximum

value

of

p

i

is

for

any

value

of

i

or

Lemma

Let

E

denote

the

event

that

the

string

appears

in

a

synopsis

S

at

any

position

The

probability

of

the

event

E

is

less

than

P

ROOF

E

i

denotes

the

event

that

appears

in

a

synopsis

S

where

is

at

the

ith

bit

We

observe

that

the

events

E

i

E

i

E

i

are

mutually

exclusive

for

any

value

of

i.

Following

the

same

direction

of

Lemma

we

can

show

that

the

probability

that

l

appears

in

synopsis

S

is

close

to

zero

where

s

l

represents

any

string

of

length

l

l

So

the

probability

that

two

events

E

i

and

E

j

where

j

-LRB-

i

-RRB-

can

occur

together

is

negligible

for

any

value

of

i

As

a

result

we

can

approximate

that

events

E

i

s

are

mutually

exclusive

and

hence

the

probability

of

event

E

is

p

k

i

p

i

where

p

i

is

given

by

expression

-LRB-

-RRB-

and

k

is

the

length

of

S

We

have

numerically

found

that

maximum

value

of

p

is

Lemma

Let

F

i

denote

the

event

that

a

string

i

appears

in

a

synopsis

S

and

let

F

denote

the

general

event

that

a

string

l

l

appears

in

S

where

s

l

represents

any

string

of

length

l

Pr

-LSB-

F

-RSB-

Pr

-LSB-

F

-RSB-

P

ROOF

As

the

string

is

a

special

case

of

string

l

where

l

Pr

-LSB-

F

-RSB-

Pr

-LSB-

F

-RSB-

On

the

other

hand

if

string

s

l

l

appears

in

S

string

must

also

appear

as

a

substring

of

s

As

an

example

if

s

where

s

l

we

can

see

as

a

substring

of

s

Hence

Pr

-LSB-

F

-RSB-

Pr

-LSB-

F

-RSB-

So

we

get

that

Pr

-LSB-

F

-RSB-

Pr

-LSB-

F

-RSB-

Theorem

Let

F

denote

the

event

that

the

string

l

where

s

l

represents

any

string

of

length

l

l

appears

in

a

synopsis

S

The

probability

of

the

event

F

is

less

than

P

ROOF

As

the

event

F

in

Lemma

is

same

as

the

event

E

in

Lemma

we

get

that

the

probability

of

event

F

is

less

than

Theorem

Let

G

i

denote

the

event

that

both

bit

i

and

-LRB-

i

-RRB-

in

a

synopsis

S

are

Let

denote

the

expected

value

of

the

estimator

R

Then

Pr

-LSB-

G

-RSB-

Pr

-LSB-

G

-RSB-

and

Pr

-LSB-

G

-RSB-

P

ROOF

The

expected

value

of

R

is

log

-LRB-

m

-RRB-

which

we

denote

by

where

is

the

total

Count

-LRB-

or

Sum

-RRB-

shared

by

m

synopses

following

the

algorithm

PCSA

If

function

CT

-LRB-

-RRB-

is

invoked

once

-LRB-

ref

Section

-RRB-

Pr

-LSB-

S

-LSB-

i

-RSB-

-RSB-

q

i

m

i

i

k

because

synopsis

S

is

selected

with

probability

m

among

m

synopses

As

is

the

total

Count

-LRB-

or

Sum

-RRB-

shared

by

all

synopses

we

get

by

using

similar

expression

as

-LRB-

-RRB-

in

Lemma

that

Pr

-LSB-

G

i

-RSB-

-LRB-

m

i

-RRB-

-LRB-

m

i

-RRB-

-LRB-

m

i

m

i

-RRB-

So

Pr

-LSB-

G

-RSB-

-LRB-

m

m

-RRB-

-LRB-

m

m

-RRB-

-LRB-

m

m

m

m

-RRB-

e

e

Similarly

we

find

Pr

-LSB-

G

-RSB-

and

Pr

-LSB-

G

-RSB-

synopsis diffusion aggregation framework

attack resilient heirarchical data aggregation