A Survey of Security Challenges in Cognitive Radio ... - IEEE Xplore

0 downloads 0 Views 80KB Size Report
BY JIM ESCH. In the past decade, the field of cognitive radio (CR) has grown and matured to the point where it can be considered a feasible, demonstrable ...
PROLOG

An introduction to the paper by Attar, Tang, Vasilakos, Yu, and Leung

A Survey of Security Challenges in Cognitive Radio Networks: Solutions and Future Research Directions BY J IM E SCH

In the past decade, the field of cognitive radio (CR) has grown infrastructure-less, each architecture has its concordant set and matured to the point where it can be considered a feasible, of pertinent attacks, which are classified in this paper. A CRN’s secondary spectrum access depends on accdemonstrable technology. As such, issues of robustness and security have become more prominent. At this juncture, it is urate sensing, and it is this core feature that poses a large important to assess the challenges faced by cognitive radio security threat. Several spectrum sensing approaches are used, but energy detection remains the most networks (CRN) and the current status popular approach. Energy detection is of solutions to general and CRNsimple to implement and flexible to specific security threats. (Note that deploy. By analyzing energy detection this paper concentrates primarily on This paper surveys the strategies, we can better understand CRN-specific issues.) main security threats how CRNs operate and where the What distinguishes a CRN from a within cognitive radio security threats are most prominent. more conventional wireless system? networks. Attack This paper describes single-node (local) Essentially, the kind of spectrum techniques are classified sensing and cooperative spectrum sensaccess right paradigm that is used. by type of attacker, ing, as well as techniques such as Legacy wireless networks adopt a feature detection, change detection, ‘‘horizontal’’ method wherein all intrusive nodes, and and consensus schemes. participating nodes are deemed greedy cognitive radios. Exogenous attackers can affect equal with respect to access rights the successful operation of an ad to the radio spectrum. On unlicensed bands, there are no intersystem interference mitigation hoc CRN through jamming. When energy detection is used techniques to ensure successful transmission of data. CR, to sense spectrums in the ad hoc CRN, a jammer can on the other hand, uses a ‘‘vertical’’ spectrum paradigm. CR transmit white/colored noise over the sensed channel, nodes are secondary spectrum users with authorized access significantly increasing the local false alarm probability to frequency channels only on a no- or limited-interference and hampering the overall performance of the ad hoc CRN. manner with respect to licensed users of the band. It is this It could reach the point where the sensed channel is secondary status that opens up vulnerabilities, particularly abandoned due to the mistaken notion that the signal is to denial-of-service attacks. In fact, there are three main not available in that channel. The cognitive aspect of CR is also susceptible to exploicategories of attack strategies to be concerned about: exogenous attackers, intruding malicious nodes, and greedy tation. Machine learning techniques such as reinforcement CRs. As CRN architectures can be infrastructure-based or learning and Q-learning negotiate a tradeoff between exploration of new channels and exploitation of proven channels. If a channel suffers from inaccurate sensing due to a sensor-jamming attack, the local sensing node will Digital Object Identifier: 10.1109/JPROC.2012.2219194 3170

Proceedings of the IEEE | Vol. 100, No. 12, December 2012

0018-9219/$31.00 Ó 2012 IEEE

Prolog to the paper by Attar, Tang, Vasillakos, Yu, and Leung

return to that channel in future interactions with a much lower probability. In effect, the CRN learns to ignore an otherwise idle band. Exogenous attacks can also interfere with a CRN by jamming common control channels. In situations where feature detection delivers more reliable primary detection, an adversary node could transmit an emulated signal that closely matches the primary channel’s waveform. This is known as incumbent emulation, and they are likely to be most common in centralized (infrastructure-based) environments. Intruding attacker nodes can penetrate the network by posing as legitimate nodes. After infiltration, it can influence the overall spectrum sensing decision by reporting misleading local sensing data. This security threat is known as spectrum sensing data falsification. At its simplest, this type of attack always reports a channel as busy or idle. A greedy CR exploits the competitive nature of ad hoc CRNs, wherein nodes vie for available spectrum resources. A greedy CR is actually an authenticated and authorized node that behaves badly [acting falsely within the adopted medium-access protocol (MAC) framework] in order to game the system, which tends to reduce total network capacity compared to cooperative networking strategies. Like infrastructure-less CRNs, infrastructure-based CRN specific networks are most vulnerable to spectrum sensing attacks. The three classes mentioned heretoforeV exogenous attackers, intruding attackers, and greedy CRsVare active threats in this space as well. What are the long-term effects of such attacks? An exogenous attack can skew the overall CRN sensing decision on an attacked channel to ‘‘busy’’ and thus unlawfully deprive the network of that channel. The denial-of-service attack takes a short-term exploitation and leverages the cognitive capability of the CRN to ingrain a belief in that channel’s unreliability. A compromised channel will have a much lower probability of being selected. There are other attacks worthy of mention that are not exclusive to CRNs. These include receiver jamming, which reduces the received signal-to-noise ratio (SNR) below the required threshold; eavesdropping; MAC-layer attacks that exploit the ability of a CNR to flexibly alter their transmission specification by forging control channel messages; authorization and authentication attacks; as well as malicious code that infects application-layer security. Solutions to the security threats mentioned here are proposed in this paper. For exogenous attacks, possible protections include cooperative spectrum sensing policies, shadow-fading correlation-based filters, and noncommon control channel strategies that work alongside multihop routing strategies. In infrastructure-based CRNs, threats can be countered via common control channels, interference-resistant waveforms, and error-detection and correction coding. Receiver jamming can be resisted through consistency checking parameters, spreadspectrum communication techniques, direct sequence SS, and frequency hopping SS. Other possible solutions in-

clude rateless coding and piecewise coding techniques. Game theory concepts can be applied to this problem. Incumbent emulation can be resisted through the verification of a priori known information regarding the primary transmitter such as the location of transmitters. Intruding node attacks can be defended against by identifying outliers through crosschecking (via shadow-fading correlation-based filters), as well as trustworthiness and reputation weighting. MAC-layer attacks can be resisted by identifying intruding and misbehaving nodes, monitoring CR node behavior, and blocking offending nodes. In distributed settings, a clustering strategy can crosscheck the behavior of other nodes. Authentication and authorization attacks can be protected against by means of distributed authentication techniques. Eavesdropping can be addressed by utilizing information theory to determine the secrecy capacity of a wireless channel. Fading in the communication channel can help legitimate nodes to achieve a secure communication due to outage probability at the eavesdropper receiver. Greedy CRs can be combated by means of centralized or peer-based monitoring of CR node behavior and penalizing the greedy behavior, or by providing incentives to not misbehave by minimizing the difference in the utility of truthful and falsifying nodes in a distributed spectrum sensing (DSS) setting, thus reducing the motivation toward greedily consuming resources. Mechanism design can also play a role by devising a framework to ensure the outcome of a given game, based on concepts applied to auction design. With respect to the robustness of CRNs, studies are considering the effects that errors have on the performance of primary and secondary users. Like traditional wireless systems, CRNs face challenges with respect to synchronization, precoding, beam forming, and transmit power control, to name a few. This paper covers recent proposals for maintaining robust power control, precoding, stochastic transmit power control, clustering mechanisms, defense mechanisms to incumbent emulation attacks, improvements on Bayesian schemes of detecting falsifying CR nodes in a cooperative spectrum sensing setting, and more robust transmission schemes. Security considerations in CRNs are at an immature level to date. More rigorous analysis is needed. A number of research directions are pointed out: a cross-layer approach to CRN security; distributed CRN monitoring; joint link and system level learning; incentive-based security mechanisms; reliable spectrum sensing schemes; anti-jamming CR techniques; and robust cognitive communications. While many solutions have been proposed to address the threat of exogenous and insider malicious nodes, in particular securing the spectrum sensing process based on trust ranking, we need more attention paid to other attacks such as incumbent emulation and sensor jamming. Finally, we need to understand the effect of attacks on CR learning-based interaction with more clarity. h

Vol. 100, No. 12, December 2012 | Proceedings of the IEEE

3171