Abstract: With the rapid development of wireless communication and electronic device technologies, the development and widespread application of low-cost, low-power, and multifunctional wireless sensor networks have become possible. In most application environments, users have high requirements for the security of wireless sensor networks. However, the inherent characteristics of wireless sensor networks make it difficult to directly apply traditional security mechanisms and protocols, thus posing greater security challenges than traditional networks. This paper discusses the security issues faced by each layer of the wireless sensor network protocol stack and explores key technologies for solving these security problems. Keywords: Wireless sensor network; Protocol; Attack; Security Abstract: Recent advancements in wireless communications and electronics have enabled the development and application of low-cost, energy-efficient, and multi-function wireless sensor networks (WSNs). Since most sensor network applications have strict security requirements, security is a critical issue in wireless sensor networks. Most traditional security standards and protocols are unavailable for wireless sensor networks due to their characteristics, thus wireless sensor networks face more security challenges than traditional networks. This paper analyzes the security problems faced by each layer of the WSN protocol stack and discusses the key techniques to solve these problems. Key words: wireless sensor networks; Protocol; Attack; Security 0 Introduction Wireless Sensor Networks (WSNs) are self-organizing networks composed of a large number of nodes with functions such as wireless communication, data acquisition and processing, and collaborative cooperation. WSNs have broad application prospects in military, environmental, industrial control, and transportation fields. Since most users have high requirements for the security of WSN, and WSN has different characteristics from traditional Ad hoc networks, most traditional security mechanisms and security protocols are difficult to apply directly to WSN. Therefore, it is necessary to design a security scheme suitable for WSN. Wireless sensor networks have the following unique characteristics compared with traditional Ad hoc networks [1]: (1) The number of sensor nodes is huge and the network scale is large; (2) Nodes are densely distributed in the target area; (3) The energy, storage space and computing power of nodes are limited and they are prone to failure; (4) Dynamic network topology; (5) Nodes usually do not have a unified identity (ID). 1 Security issues of WSN In WSN, the contradiction between the minimum resource consumption and the maximum security performance is the primary issue of sensor network security. Usually, the balance between the two needs to take into account five aspects: limited energy, limited storage space, limited computing power, limited communication bandwidth and communication distance. The openness of WSN in space makes it easy for attackers to eavesdrop, intercept, tamper with and replay data packets. The limited energy of nodes in the network makes WSN vulnerable to resource consumption attacks. Furthermore, due to the special nature of the node deployment area, attackers may capture nodes and damage or crack them. Additionally, WSNs are data communication-centric; data fusion is required before sending similar or identical data collected by adjacent nodes to the base station, and intermediate nodes need to access the content of data packets. Therefore, traditional end-to-end security mechanisms are unsuitable. Link-layer security mechanisms are typically used to meet the requirements of WSNs. 2. Common Attacks and Solutions Different layers of the WSN protocol stack are susceptible to different attacks, requiring different defenses and security mechanisms. 2.1 Physical Layer The physical layer performs functions such as frequency selection, carrier generation, signal detection, and data encryption. Common attacks include: 1) Congestion Attacks: Attacking nodes continuously send useless signals on the WSN's operating frequency band, causing nodes within the attacking node's communication radius to malfunction. If such attacking nodes reach a certain density, the entire network will face paralysis. Congestion attacks have a significant impact on single-frequency wireless communication networks; spreading and frequency hopping methods can effectively address this. 2) Physical Damage: WSN nodes are distributed over a large area, making it difficult to guarantee the physical security of each node. Attackers may capture some nodes, perform physical analysis and modification on them, and use them to interfere with the normal function of the network. They may even destroy the security of the network by analyzing its internal sensitive information and upper-layer protocol mechanism. To combat physical damage, anti-tampering hardware can be adopted in the node design, and physical damage perception mechanism can be added. In addition, sensitive information can be encrypted and stored using a lightweight symmetric encryption algorithm. 2.2 MAC layer The MAC layer provides a reliable communication channel for adjacent nodes. MAC protocols are divided into three categories: deterministic allocation, contention and random access. Among them, the random access mode is more suitable for the energy-saving requirements of wireless sensor networks. In the random access mode, the node determines whether it can access the channel by carrier sensing, so it is vulnerable to denial-of-service (DOS) attacks [2]. Once a channel collision occurs, the node uses the binary exponential backoff algorithm to determine the timing of retransmission. An attacker only needs to generate a collision of one byte to destroy the transmission of the entire data packet. At this time, the receiver sends back the data collision ACK, and the sending node backoffs and reselects the transmission timing. Repeated conflicts cause nodes to back up, leading to channel congestion and quickly depleting the nodes' limited energy. Currently, there is no good solution to combat this type of DoS attack; however, channel monitoring mechanisms can be used to reduce the collision rate. If the attacker's attack is only momentary, affecting only a few data bits, error correction codes can be used to counteract this attack. For example, if the MAC layer protocol uses a time-division multiplexing algorithm to allocate transmission time slices to each node, it does not require negotiation before data transmission, thus avoiding collisions, but it is still vulnerable to DoS attacks. Malicious nodes can exploit the interactive characteristics of the MAC protocol to launch attacks. For instance, the IEEE 802.11-based MAC protocol uses RTS, CTS, and DATA ACK messages to reserve channels and transmit data. If a malicious node continuously requests a channel from a node using RTS messages, the destination node will continuously respond with CTS messages. This continuous requesting eventually depletes the destination node's energy. Access control can counteract this attack. Nodes can automatically ignore excessive requests and not have to respond to each one. Simultaneously, policies can be added to the protocol to ignore excessively frequent requests or limit the number of retransmissions of the same data packet. 2.3 Network Layer Routing Protocols are implemented at the network layer. There are many types of routing protocols in WSN, which can be mainly divided into three categories: data-centric routing protocols, hierarchical routing protocols, and location-based routing protocols [3]. Most routing protocols do not consider security requirements, making them vulnerable to attacks, which can cause the entire WSN to collapse. The main attacks on WSN at the network layer are: 1. False routing information After receiving a data packet, a malicious node may not only discard the data packet, but also modify the source and destination addresses and choose an incorrect path to send it out, thus causing network routing chaos. If a malicious node forwards all the received data packets to a fixed node in the network, that node may become blocked and run out of energy and fail. This attack method is related to the network layer protocol. For hierarchical routing protocols, output filtering can be used, that is, to authenticate the source route and confirm whether a data packet is sent from its legitimate child node, and directly discard data packets that cannot be authenticated. 2. Selective forwarding/non-forwarding Malicious nodes discard some or all data packets during the forwarding process, so that the data packets cannot reach the destination node. In addition, malicious nodes may also send their own data packets with a high priority, disrupting the network communication order. Multipath routing is usually used to solve this problem. Even if a malicious node drops a data packet, the data packet can still reach the destination node through other paths. Although multipath routing increases the reliability of data transmission, it also introduces new security problems. 3. Greedy forwarding, i.e., sinkhole attack. Attackers use the characteristics of strong sending and receiving capabilities to attract almost all traffic in a specific area and create a sinkhole centered on the attacker. The distance vector-based routing mechanism selects routes by calculating the path length. Thus, a malicious node with strong sending and receiving capabilities attracts all data packets from surrounding nodes by sending a 0 distance (indicating that the distance to the target node is 0) announcement, forming a routing black hole in the network, preventing data packets from reaching the correct target node. Black hole attacks are highly destructive but relatively easy to detect. Black hole attacks can be resisted through authentication, multipath routing, and other methods. 4. Sybil attack [4] In a Sybil attack, a node appears in front of other nodes in the network with multiple identities, making it easier for it to become a node in the routing path, and then combining with other attack methods to achieve the attack objective. Sybil attacks can significantly reduce the fault tolerance of routing schemes for distributed storage, decentralized and multipath routing, and topology maintenance. It poses a great threat to location-based routing protocols. In order to efficiently route packets identified by geographic addresses, such location-sensitive routes usually require nodes to exchange coordinate information with their neighbors. A node should have only one set of reasonable coordinates for its neighbors, but an attacker can be at different coordinates at the same time. To combat Sybil attacks, methods such as key distribution, encryption and authentication are usually used. 5. Wormholes attack Wormholes attacks usually require two malicious nodes to collude and attack together. One malicious node is near the base station, and the other is far away from the base station. The far-away node claims that it and the nodes near the base station can establish a low-latency, high-bandwidth link to attract packets from surrounding nodes. Wormholes attacks are likely to be combined with selective forwarding or Sybil attacks. When it is combined with Sybil attacks, it is usually difficult to detect. Adding a security level strategy to the routing design can combat wormholes attacks. Reference [5] gives a method for adding a security level to the routing design of Ad hoc networks, which can be slightly improved by using the base station to complete the task of listening to and detecting the channel of the next node. Improved routing protocols can combat sinkhole and wormhole attacks. Geographically based routing protocols, such as Greedy Perimeter Stateless Routing[6], can effectively detect and defend against sinkhole and wormhole attacks by periodically broadcasting probe frames to detect black hole regions. 6. HELLO flood Many routing protocols require nodes to periodically send HELLO packets to declare themselves as neighbor nodes of other nodes. Attackers broadcast HELLO packets with sufficiently high transmission power, making all nodes in the network think that it is a neighbor node, even though they are actually far apart. If other nodes send data packets to it with normal transmission power, they will not be able to reach the destination, thus causing network chaos. Adding a broadcast radius limit to the routing design can combat HELLO flood. Limiting the data transmission radius of a node so that it can only send data to nodes within this radius area, instead of broadcasting to the entire network, avoids high-energy attackers continuously sending data packets throughout the network area, causing network nodes to continuously process this data, resulting in DOS and energy exhaustion attacks. 2.4 Transport layer The transport layer is used to establish end-to-end connections between WSN and the Internet or other external networks. Currently, in most WSN applications, there is no need for the transport layer, and the transport layer protocol generally adopts the traditional network protocol. 2.5 Application Layer The application layer provides various practical applications of WSN, and therefore also faces various security issues. Key management and secure multicast provide security support for the entire WSN security mechanism. WSN uses symmetric encryption algorithm, low-energy authentication mechanism and hash function. Currently, the generally accepted feasible key distribution scheme is pre-distribution, that is, the key is pre-configured in the node before the node is deployed. There are several implementation methods: l Pre-configuration scheme based on key pool. Before deployment, each node randomly selects a certain number of key subsets from the pre-generated key pool. After the node is deployed to the designated area, it only communicates with nodes with the same key. l Pre-configuration scheme based on polynomial. Proposed by C Blundo et al. [7], it can effectively resist node capture, has strong scalability, but has large computational overhead and does not support the identity authentication of neighboring nodes. l Pre-configuration scheme using node deployment information. References [8,9] group nodes according to their geographical location and assign shared keys to nodes in the same or adjacent groups. This makes the node grouping pattern and query more consistent with the node broadcasting characteristics, improves key utilization, and reduces the cost of key distribution and maintenance. 4. Conclusion As a new information acquisition and processing technology, WSN has advantages that traditional technologies cannot match in certain fields. However, due to some limitations of sensor networks and nodes themselves, it brings new challenges to its security design. Efficient encryption algorithms, secure MAC protocols and routing protocols, as well as key management and secure multicast are all areas worthy of in-depth research. The innovation of this paper lies in exploring security issues from different layers of the WSN protocol stack, proposing a spread spectrum method for congestion attacks at the physical layer, and improving sensor nodes to resist physical damage. For DoS attacks at the link layer, error correction codes, access control, and retransmission restriction methods can be used to defend against them. Adding security mechanisms to the routing protocol at the network layer can be achieved through hierarchical routing, multipath transmission, security levels, and broadcast radius restrictions. Key management and secure multicast provide security support for the entire WSN. References: [1] LAN F, AKYILDIZ, SU WEILIAN, YOGESH SANKARASUBRAMANIAM, ERDAL CAYIRCI. A Survey on Sensor Networks [J]. IEEE Communications Magazine, 2002, 8. [2] WOOD D, STANKOVIC J A. Denial of Service in Sensor Networks [J]. Computer, 2002, 35 (10): 54-62. [3] LIU Changxin, XIA Chunhe. Comparative Study on Routing Protocols for Wireless Sensor Networks [J], Microcomputer Information, 2006, 9-1: 205-207. [4] JIN Qun, ZHANG Jianming. Sybil Attack Detection in Wireless Sensor Networks [J], Computer Applications, 2006, vol (26) 12: 2899-2902. [5] HU YC, PERRIG A, JOHNSON D B. Packet Leashes: A Defense Against Wormhole Attacks in Wireless Ad hoc Networks[C]. IEEE Infocom, 2003:1976-1986. [6] KARP B, KUNG H T. GPSR: Greedy Perimeter Stateless Routing for Wireless Networks [C]. The 6th Ann. Int. Conf. Mobile Computing and Networking (MobiCom 2000), ACM Press, New York, 2000:243-254. [7] BLUNDO C, SANTIS A D. Perfectly Secure Key Distribution for Dynamic Conferences [J]. Information and Computation, 1995,146(1):1-23. [8] LIU D, NING P. Location Based Pairwise Key Establishments for Static Sensor Networks [A]. In 2003 ACM Workshop on Security in Ad Hoc and Sensor Networks(SASN'03)[C].2003.72-82. [9] Liu He, Wan Runze. Cellular model for key pre-allocation in wireless sensor networks [J], Microelectronics & Computer, 2006, vol(23): 215-217.