End-to-end security solutions for Internet-integrated Wireless Sensor Networks
Authors
Abstract
The area of Wireless Sensor Networks (WSN) has motivated great interest and numerous research efforts in the recent years. The initial purpose of these networks was to provide a technological basis on top of which new distributed sensorial applications can be built. One main distinctive characteristic of WSN is the employment of sensing devices that have the capability of communicating wirelessly, and also of “feeling” and “actuating“ with the physical world. Such capabilities enable the development of truly innovative solutions, based on applications that are designed to benefit from or require interactions with the physical world. Most traditional WSN approaches target particular research goals and applications with very focused purposes, rather than the support of heterogeneous applications and devices as in traditional Internet communication environments.Another important characteristic of WSN is the employment of constrained wireless sensing platforms. The constraints of such platforms are mostly due to cost restrictions, given that such devices are designed to support cost-effective applications that may require the employment of large amounts of devices in potentially large geographical areas. These cost restrictions usually motivate that most sensing platforms are constrained in term of critical resources such as memory, energy and computational capabilities. Sensing devices usually also run on batteries, since WSN applications frequently target remote and unattended deployment environments without continual energy sources. In conclusion, we may observe that the constraints and characteristics of WSN devices and applications determine that communications and security mechanisms be designed to be very optimized and to use the limited available resources very frugally.
As previously observed, the initial applications designed for WSN targeted very particular goals and application areas. Due to the characteristics and constraints of WSN sensing devices, the communication and security technologies designed for such applications were optimized according to the particular requirements of the application at hand, rather than to support heterogeneous applications and devices, as is the traditional Internet communications environment. In the same context, communications with external networks or with the Internet was also not an issue. As research in WSN evolves, we currently observe that this perception is changing, and that the advantages of integrating WSN with the Internet are currently being realized and motivating further research efforts.
The integration of WSN with the Internet can potentially support transparent end-to-end communications involving constrained wireless sensing devices and other external or Internet hosts. The support of such communications may also contribute to materialize current visions of the Internet of the future, as the IoT (Internet of Things) or the WoT (Web of Things), in which communications with sensing devices of various types and possessing diverse capabilities are transparently supported as required for sensing applications.
As discussed in Chapter 2, the integration of WSN with the Internet may in practice be accomplished according to different strategies, some of which are materialized in existing research and commercial proposals. Many of such proposals employ proprietary intermediary systems (gateways) or cloud-based computational services. Despite the pragmatism and practicality of such approaches, we in general realize that they lack the support of pure end-to-end Internet communications enabling the full integration of WSN with the Internet communications infrastructure. This is due to the fact that in such approaches WSN are isolated from the global Internet communications, despite the WSN data and devices being reachable via interconnection gateways. As we will observe later, the full integration of WSN with the Internet at the protocol level provides various benefits and motivates the research solutions discussed throughout the thesis.
As in traditional WSN applications, security will be a fundamental enabling factor of future sensorial applications employing sensing devices integrated with the Internet communications infrastructure. This applies to all the existing integration approaches, and will constitute a particularly relevant and challenging aspect for the integration of WSN employing Internet communication technologies. In such WSN environments, security threats will be present not only because of aspects which are inherent of WSN environments, for example the employment of wireless communications and the constraints and physical exposure of sensing devices, but also because of the threats which may be present from the day we start exposing WSN communications to the Internet. If on the one side security mechanisms, such as traffic filtering or intrusion detection, may help in preventing such threats, on the other applications may require or benefit from the employment of true end-to-end communications involving constrained sensing devices. Security will thus be of paramount importance for the enabling of such applications.
In the present thesis we describe and evaluate research proposals designed to target the problem of security in the context of WSN integrated with the Internet using Internet communication technologies designed and optimized for such environments. These technologies enable end-to-end Internet communications between WSN devices, and also between WSN devices and external or Internet hosts, and provide the context for the research proposals described in the present thesis. We target different approaches in supporting end-to-end security in the context of Internet-integrated WSN, with the goal of investigating the viability of supporting end-to-end security with communication technologies developed for such environments, and providing complementary solutions to support heterogeneous applications and deployment environments. We must also note that, despite our particular focus on end to end communications and security, the full integration of WSN with the Internet will in fact require efforts towards the design of appropriate mechanisms targeting other important security aspects. Such mechanisms may possibly be designed in a cross-layer fashion and support fundamental security-related operations such as key management and intrusion detection, or the enforcement of security requirements such as privacy and trust, among others.
The security mechanisms described throughout the thesis are proposed and evaluated in the context of a reference model supporting the integration of WSN with the Internet at the protocol level, which we discuss in Chapter 3. Rather than providing a definitive conception of how this integration approach may be supported, this model supports a reference framework for the employment of the Internet communication technologies currently being designed with this purpose. These communication technologies provide the ground for the development of the security mechanisms proposed throughout the thesis. We evaluate such proposals experimentally, as we consider this approach to provide various benefits in comparison with its validation in simulation environments, as we discuss later.
The security proposals discussed in the thesis seek to investigate the viability of enabling security for end-to-end communications with sensing devices using Internet WSN communication technologies. For this purpose, we propose solutions to protect communications using technologies currently being designed without proper security mechanisms, and propose alternatives to existing security approaches that we find to be inappropriate or insufficient. The research solutions proposed and evaluated throughout the thesis also aims to support heterogeneous devices and applications, as security is addressed at different protocol layers and by implementing different approaches to the support of security-related procedures. The effectiveness of new security mechanisms may be measured according to their ability to not compromise the lifetime of sensing applications, in the light of the previously discussed characteristics and constraints of WSN applications and devices, which we may measure according to specific metrics and evaluation criteria. On the other hand, applications with different functional and security requirements must also be appropriately supported by the proposed mechanisms, in line with our goal of securing communications supporting heterogeneous applications and deployment environments.
The security solutions proposed and evaluated throughout the thesis are materialized in security mechanisms implementing different approaches to the problem of end-to-end security with Internet-integrated WSN. We evaluate the proposed solutions against its ability to cope with predefined security requirements, while at the same time being able to employ the limited resources available on constrained sensing platforms in an efficient and controlled manner. As with the current Internet architecture, the complementarity of the approaches considered for the design of such mechanisms may promote the support of applications and deployment scenarios with different characteristics and requirements in terms of security. As we discuss next, we target the usage of end-to-end security at the network, transport and application layers.
At the network layer, the proposed solutions in practice inherit some of the characteristics of the current approach of the Internet security architecture to network-layer security. In particular, we consider the employment of security headers employed side-by-side with the headers of the network layer, with the goal of supporting end-to-end security in a transparent fashion to communication protocols and applications at upper layers of the communications stack. The design of the proposed security headers also considers its future adoption in the Internet security architecture, as we discuss later in the thesis.
In what respects the transport layer, we consider the employment of delegation techniques to offload costly security-related computations from constrained sensing platforms to more powerful network entities. In particular, such entities may support public-key cryptography in the context of the authentication and key agreement phase, which is particularly costly for the support of transport-layer security with Internet-integrated WSN as currently proposed. The proposed solutions to address security at the transport-layer are also able to guarantee total transparency from the point of view of the two ends of the transport-layer secure communications, while adapting to sensing applications and devices with different requirements and characteristics. The proposed mechanisms also support further security functionalities such as intrusion detection, and network operations such as mobility of sensing devices between sensing domains.
Regarding security at the application layer, we consider yet a different approach complementing network-layer security and transport-layer security as previously described. We investigate the benefits of the integration of security in the communications protocol itself, rather than being transparently supported by mechanisms designed at lower layers of the communications stack. Such an approach may enable the support of granular security policies or of various authentication methods and multiple security domains, thus complementing other security mechanisms for sensing applications with such requirements.
As we discuss throughout the thesis, the various research proposals offer effective solutions to the problem of securing end-to-end communications in the context of Internet integrated sensing applications. Other that the security of such communications, the proposed solutions also lay the ground for the design of further mechanisms accomplishing important security-related goals for the protection of WSN devices against Internet-originated threats and attacks.
One important requirement of the discussed research solutions is to be able to complementarily adapt to the functional and security requirements of different applications and deployment scenarios. The complementary nature of the various security approaches is an important property of the current Internet security architecture, and one that may also be fundamental in a future Internet security architecture supporting communications with Internet-integrated WSN. As previously discussed, this aspect also differentiates the research proposals discussed in the thesis from traditional approaches to security in WSN environments.