近年來，無線感測網路的應用日益廣泛，舉凡生活防災到安全議題上都可以看見其蹤跡。但也由於無線感測網路通常都建置在開放式或無人監控的環境之下，使得攻擊者可以很容易取得其中的感測器並將惡意程式碼植入其中，藉此傳遞不正確的資料讓使用者做出錯誤的決策或分析。

有學者提出使用遠端認證 (Remote Attestation) 的方式讓基地台驗證感測器的完整性，以確認其是否遭受破壞。許多相關論文在分析無線感測網路安全性時只著重分析基地台與單個感測器間的情況，但是無線感測網路通常都是一個基地台管理大量的感測器。根據我們的分析發現，使用一對一的完整性驗證協定並無法保證一對多的應用情況下仍然安全。

在本論文中，我們首先提出一種名為『節點恢復』(Node Recovery) 之新型式攻擊，並以這個新攻擊為觀點去分析一些現存一對多感測器完整性驗證對策的缺陷。最後，我們提出一項機率式的一對多型式之感測器完整性驗證協定，其不僅可以抵禦前述節點恢復攻擊，並能有效率的進行整體無線感測網路完整性驗證。

Wireless Sensor Networks (WSNs) have been increasingly developed in many mission-critical applications, such as military and healthcare monitoring systems. Sensor nodes are usually equipped with limited computational resources and become attractive target for various security risks, one of which is malicious code injection attack. An attacker can alter the internal memory state of a sensor node; the compromised nodes can violate the safety and privacy of the users and send foraged data to a base station. Therefore, a mechanism for verifying the trustworthiness of the sensor nodes is highly desirable.

Many researchers have proposed several methods to check the integrity of the sensor nodes in WSNs. Remote attestation is a common promising protection mechanism used for verifying the integrity of a sensor node's memory state. The remote attestation is based on challenge-response technique. A verifier can attest the sensor node's integrity by verifying a cryptographic checksum of the node's memory state. However, most remote attestation schemes are suitable only for the one-hop communication between the verifier and the prover.

This research first identifies a new attack model, namely node recovery attack, which enables an attacker to recover a compromised sensor node; consequently, the verifier is convinced that the recovered node is not compromised. We analyze various countermeasures applied in two WSN architectures and show that these countermeasures are subject to the node recovery attack. A probabilistic remote attestation scheme is proposed to resist the node recovery attack.

[1] J. N. Al-Karaki and A.E.Kamal, “Routing Techniques in Wireless Sensor Networks: A Survey, ”In Proceedings of the Wireless communications, IEEE vol.11, issue6, pp.6-28,2004

[2] S. Bratus, N. D'Cunha, E. Sparks, and S.W.Smith, “TOCTOU,Traps,and TrustedComputing, ”In Proceedings of the Trusted Computing - Challenges and Applications, vol.4968, pp.14-32, 2008.

[3] C. Castelluccia, A. Francillon, D. Perito, and C. Soriente, “On the Difficulty of Software-based Attestation of Embedded Devices, ”In Proceedings of the 16th ACM conference on Computer and communications security, pp. 400-409, 2009.

[4] K. E. Defrawy, A. Francillon, D. Perito, and G. Tsudik, “SMART: Secure and Minimal Architecture for (Establishing a Dynamic) Root of Trust,” In Proceedings of the Network and Distributed System Security Symposium, vol.12, pp. 1-15, 2012.

[5] A. Francillon and C. Castelluccia, “Code in jection attacks on Harvard-architecture devices, ”In Proceedings of the ACM Conference on Computer and Communications Security, pp. 15-26, ACM, 2008.

[6] C. Hartung, J. Balasalle, and R. Han, “Node Compromise in Sensor Networks: The Need for Secure Systems, ”Technical Report CU-CS-990-05, Department of Computer Science University of Colorado at Boulder, 2005.

[7] Institute of Electrical and Electronics Engineers, “IEEE Draft Standard for Local and Metropolitan Area Networks - Part15. 4: Wireless Medium Access Control (MAC) and Physical Layer (PHY) Specifications for Low Rate Wireless Personal Area Networks (WPANs) Amendment - Physical Layer (PHY) Specifications for Low Energy, Critical Infrastructure Monitoring Networks (LECIM), ”2013.

[8] B. Mamalis, D. Gavalas, C. Konstantopoulos, and G. Pantziou, “Clustering in Wireless Sensor Network, ”Chapter 12, pp.324-354, 2009.

[9] J. M. McCune, B. J. Parno, A. Perrig, M. K. Reiter, and H. Isozaki, “Flicker: an execution infrastructure for tcb minimization, ”In Proceedings of ACM SIGOPS Operating Systems Review, vol.42, issue4, pp.315-328, ACM, 2008.

[10] A. A. Rbaugh, J. Fuber, and M. Smith, “A Secure and Reliable Bootstrap Architecture, ”In Proceedings of the IEEE Symposium on Security and Privacy, pp.65-71, 1997.

[11] A. Seshadri, A. Perrig, L. vanDoorn, and P. Khosla, “SWATT: Software-based Attestation for Embedded Devices, ”In Proceedings of the 2004 IEEE Symposium on Security and Privacy, pp.272-282,2004.

[12] A. Seshadri, M. Luk, A. Perrig, L. vanDoorn, and P. Khosla, “Using FIRE and ICE for detecting and recovering compromised nodes in sensor networks, ”In Proceedings of the Technical Report CMU-CS-04-187, School of Computer
Science, Carnegie Mellon University, December2004, 2004.

[13] A. Seshadri, M. Luk, A. Perrig, L. vanDoorn, and P. Khosla, “SCUBA: Secure Code Update by Attestation in Sensor Network, ”In Proceedings of the 5th ACM workshop on Wireless security, pp.85-94, ACM, 2006.

[14] R. Strackx, F. piessens, and B. Preneel, “Efficient Isolation of Trusted Subsystems in Embedded Systems, ”In Proceedings of Security and Privacy in Communication Networks, vol.10, pp.344-361, 2010.
[15] W. Stallings, Cryptography and Network Security, Principles and Practice 5th ed, pp.16-19, 2010.

[16] Trusted Computing Group, “TCG Specification Architecture Overview, ”TCG Specification Revision 1.4, 2007.

[17] Q. Wang, Y. Zhu, and L. Cheng, “Reprogramming Wireless Sensor Networks: Challenges and Approaches, ”In Proceedings of Network, IEEE, vol.20, issue 3, IEEE, pp.48-55, 2006.

[18] ZigBee Alliance,“ZigBee Specification, ” ZigBee Alliance, 2008.