Abstract-Aggregation of local sensor observations is a widely used and powerful approach to estimating the global state of large networked systems. However, guaranteeing the integrity of the aggregate remains an open problem, in particular for dynamic networked systems. We consider this problem in a single aggregator model -a system of several networked sensors and one inherently trusted collector. We argue that algorithmic approaches are insufficient in the general case and propose a simple, yet effective, solution based on the principles of trusted systems.
I. INTRODUCTIONInformed decision making based on quantifiable information is contingent on accurate, high-quality measurements. We focus on networked measurement systems, in which sensors propagate local observations to a single collector in order to produce an aggregate -an approximate global view of the system [2]. In particular, we consider the integrity of the aggregation process in networked measurement systems in the presence of corrupt sensors, controlled by an insider adversary, whose goal is to stealthily [3] influence the global aggregate computed. We define such systems in a broad sense, encompassing diverse paradigms, such as wireless sensor networks [4], large-scale network monitoring systems [5] and industrial control systems.The integrity of the entire aggregation process must be considered in the context of the consuming application and its operators. Our opinion is that the only applications which can tolerate arbitrary inputs, and hence, arbitrary aggregates, are trivial ones suitable only for the most basic of tasks. Critical aggregation examples include military applications of sensor networks [6], [7], public safety command and control [8] and nuclear plant monitoring [9]. We can also consider applications where money is at stake, such as accurate metering for utilities.We ask the following question: can the aggregation process be secured in the general case of arbitrary data types and aggregation functions and in dynamic networks, while at the same time giving sufficiently strong integrity guarantees? In our view, this is infeasible unless one assumes some means of establishing a basis of trust at the sensor itself: we need some sort of integrity guarantees up front at the time the