Towards Statistically Strong Source Anonymity for Sensor Networks

Abstract

Abstract-For sensor networks deployed to monitor and report real events, event source anonymity is an attractive and critical security property, which unfortunately is also very difficult and expensive to achieve. This is not only because adversaries may attack against sensor source privacy through traffic analysis, but also because sensor networks are very limited in resources. As such, a practical tradeoff between security and performance is desirable. In this paper, for the first time we propose the notion of statistically strong source anonymity, under a challenging attack model where a global attacker is able to monitor the traffic in the entire network. We propose a scheme called FitProbRate, which realizes statistically strong source anonymity for sensor networks. We also demonstrate the robustness of our scheme under various statistical tests that might be employed by the attacker to detect real events. Our analysis and simulation results show that our scheme, besides providing source anonymity, can significantly reduce real event reporting latency compared to two baseline schemes.

Efficient Privacy-Preserving Stream Aggregation in Mobile Sensing with Low Aggregation Error

“…Source anonymity [24] is not necessary since data content is protected. Peer-to-peer communication among the nodes is not required, because nodes may not know each other for privacy reasons and such communication is nontrivial due to the mobility of nodes in mobile sensing.…”

Algorithmic Aspects of Sensor Localization

“…Although some researches on security of localization schemes are presented [70,71], the types of attacks and the related countermeasures are restricted to a few typi- [42] 2.48m for RSS; 1.12 for TOA O(nL) 4 anchors at corners Ecolocation (outdoor) [66] 20%D N/A 11 nodes with full connectivity Ecolocation (indoor) [66] 35%D N/A 12 anchors, 5 non-anchors Robust Quad [34] 5.18cm for ultrasound ranging N/A dg=12, total 40 nodes Multilateration [21,45] 10.67m N/A range data from 1 mobile beacon Mobile Beacon [45] 1.4m N/A 12 non-anchors, 1 mobile beacon RADAR [48] 3m N/A dg=3, 3 anchors Kernel-based Learning [49] 3.5m N/A grid deployment of 25 anchors and 81 nodes LaSLAT [51] 1.9cm for ultrasound ranging N/A dg=10, total 27 nodes cal cases. Similarly, researches on privacy of nodes' locations mostly focus on preventing the locations of data sources or base stations from being exposed to adversaries [72,73]. The existing sensor localization schemes have not been fully examined from the perspective of privacy protection.…”

An Active Global Attack Model for Sensor Source Location Privacy: Analysis and Countermeasures

“…Recently, a passive global attack model has been studied [4], [5], [6], [7], where the attacker is assumed to be capable of monitoring all the network traffic by either deploying simple sensors covering the network or employing powerful site surveillance devices with hearing range no less than the network radius. With the collected network-wide traffic, the attacker can conduct traffic analysis to identify the potentially real sources.…”

“…With the collected network-wide traffic, the attacker can conduct traffic analysis to identify the potentially real sources. Under such a strong attack model, the corresponding countermeasures focus on making all sensors [4], [5], [6], [7] or k sensors [4] transmit (dummy) messages at the same or similar pattern to disguise the real source location. In general, such approaches are more robust to traffic analysis, at the cost of higher message overhead.…”

“…To demonstrate both the procedure and the effectiveness of this attack model, we apply it to two existing schemes: a statistically strong source anonymity scheme [5] (referred to as SSSA scheme hereinafter) and a k-anonymity scheme [4]. We show that although the SSSA scheme provides strong source location privacy with statistical testing, under our attack model an attacker can gain some information about the locations of real sources when the message rate of a real event becomes high.…”