Live forensics framework for wireless sensor nodes using sandboxing

Authors:
Aexandros Zaharis;Adamantini I. Martini;Leonidas Perlepes;Georgios Stamoulis;Panayotis Kikiras
Affiliations:
University of Thessaly, Volos, Greece;University of Thessaly, Volos, Greece;University of Thessaly, Volos, Greece;University of Thessaly, Volos, Greece;University of Thessaly, Volos, Greece
Venue:
Proceedings of the 6th ACM workshop on QoS and security for wireless and mobile networks
Year:
2010

Citing 24
Cited 0

Why cryptosystems fail

Communications of the ACM
Designing programs that check their work

Journal of the ACM (JACM)
Software reliability via run-time result-checking

Journal of the ACM (JACM)
Spot-checkers

STOC '98 Proceedings of the thirtieth annual ACM symposium on Theory of computing
Introducing trusted third parties to the mobile agent paradigm

Secure Internet programming
Watermarking, tamper-proffing, and obfuscation: tools for software protection

IEEE Transactions on Software Engineering
Secure Transactions with Mobile Agents in Hostile Environments

ACISP '00 Proceedings of the 5th Australasian Conference on Information Security and Privacy
On the (Im)possibility of Obfuscating Programs

CRYPTO '01 Proceedings of the 21st Annual International Cryptology Conference on Advances in Cryptology
Tamper Resistant Software: An Implementation

Proceedings of the First International Workshop on Information Hiding
Dynamic Self-Checking Techniques for Improved Tamper Resistance

DRM '01 Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management
Protecting Software Code by Guards

DRM '01 Revised Papers from the ACM CCS-8 Workshop on Security and Privacy in Digital Rights Management
Protection of Software-Based Survivability Mechanisms

DSN '01 Proceedings of the 2001 International Conference on Dependable Systems and Networks (formerly: FTCS)
Cryptographic Traces for Mobile Agents

Mobile Agents and Security
Time Limited Blackbox Security: Protecting Mobile Agents From Malicious Hosts

Mobile Agents and Security
Breaking Abstractions and Unstructuring Data Structures

ICCL '98 Proceedings of the 1998 International Conference on Computer Languages
Software Tamper Resistance: Obstructing Static Analysis of Programs

Software Tamper Resistance: Obstructing Static Analysis of Programs
Soft Tamper-Proofing via Program Integrity Verification in Wireless Sensor Networks

IEEE Transactions on Mobile Computing
BIND: A Fine-Grained Attestation Service for Secure Distributed Systems

SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems

Proceedings of the twentieth ACM symposium on Operating systems principles
Avrora: scalable sensor network simulation with precise timing

IPSN '05 Proceedings of the 4th international symposium on Information processing in sensor networks
Accurate prediction of power consumption in sensor networks

EmNets '05 Proceedings of the 2nd IEEE workshop on Embedded Networked Sensors
Tamper resistance: a cautionary note

WOEC'96 Proceedings of the 2nd conference on Proceedings of the Second USENIX Workshop on Electronic Commerce - Volume 2
Distributed Software-based Attestation for Node Compromise Detection in Sensor Networks

SRDS '07 Proceedings of the 26th IEEE International Symposium on Reliable Distributed Systems
Remote software-based attestation for wireless sensors

ESAS'05 Proceedings of the Second European conference on Security and Privacy in Ad-Hoc and Sensor Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

Typical sensor nodes are resource constrained devices containing user level applications, operating system components, and device drivers in a single address space, with no form of memory protection. A malicious user could easily capture a node and tamper the applications running, in order to perform different types of attacks. In this paper, we propose a remote live forensics protection architecture that prevents the execution of tampered software while alarming the owners of the sensors network. Using sandboxing to restrict application memory accesses within the address space and forensic techniques to validate the authenticity of the running applications we prevent malicious code from being executed while specifying the intrusion.