Tài liệu hạn chế xem trước, để xem đầy đủ mời bạn chọn Tải xuống
1
/ 30 trang
THÔNG TIN TÀI LIỆU
Nội dung
A Compromise-resilient Pair-wise Rekeying Protocol in Hierarchical WirelessSensorNetworks 319 the key shared by any two non-compromised nodes. However, an attacker who compromises t + 1 nodes can use interpolation to recover the master polynomial f (x, y). By applying the symmetric property, a secure link can be easily built up by just exchanging the IDs of transmission nodes. On the other hand, a t-degree bivariate polynomial key scheme can only keep secure against coalitions of up to t compromised sensors. Although increasing the value of t can improve the security property of bivariate polynomial key scheme, it is not suitable forwirelesssensornetworks due to the limited memory size of sensors. 2.3 Per turbation Polynomial Function Our proposed pair-wise rekeying protocol exploits the characteristic of the perturbation poly- nomial, which was originally introduced in (Zhang et al., 2007). Given a finite field F q , a positive integer r (r < ), and a set of node Ids S (S ⊂ { 0, ··· , q −1 } ), a polynomial set Φ is a set of perturbation polynomials regarding r and S if any polynomial φ (·) ∈ Φ has the following limited infection property: ∀x ∈ S, φ(x) ∈ { 0, ··· , 2 r −1 } . (4) According to the above definition, the value of a perturbation polynomial will not be larger than (2 r − 1), i.e., it has at most r bits. This property is used to design perturbation-based scheme. If let an r-bit number add to a -bit number, only the least significant r-bit of the -bit numer will be directly affected. Wheather the most significant ( −r) bits are changed or not will hinge on if a carry is generated from the least significant r bits in the addition process. For example, we assume = 6 and r = 4. The addition (101001) 2 + (0101) 2 = (101110) 2 changes the least significant 4-bits but not the most −r = 2 significant bits of the first operand, but (101001) 2 + (1100) 2 = (110101) 2 not only changes least significant 4-bits but also the most significant 2 bits, because a carry is generated from the least significant 4-bits. 3. A Pair-wise Rekeying Protocol In general, the design of a light-weight compromise-recilient rekeying scheme in WSNs is difficult because of the vulnerability of sensor nodes and the constrained system resources. Due to these challenges, a practical pair-wise rekeying scheme for WSNs should be resilient to large number of node compromises, be efficient in computation, communication, and storage, and allow both full and direct key establishment. In this section, we present a perturbation- based pair-wise rekeying protocol that can achieve all these goals. In the basic polynomial-based scheme (Blundo et al., 1993), where any two nodes (with IDs u and v) are given shares (f (u, y) and f (v, y)) of a symmetric polynomial f (x, y), they can always find a match f (u, v) to be used as the shared key of size bits. Different from this, our rekeying scheme does not use shares generated from symmetric polynomial but perturbation polynomials such that (1) a match can still be achived and (2) the shared key is difficult to crack by large-scale NCAs. To further explain the above basic idea, we now introduce the three major steps of the rekeying scheme: system initialization, pre-distribution of perturbed polynomials, and key establishment and rekeying. In order to present it in a formal way, we list the notations used in our protocol descriptions in Table 1 for convenience to the readers. 3.1 System Initialization We assume that there are n sensor nodes to be deployed in the network. The node deployment can be done by only once, or several times in order to extend the lifetime of the network with Notation Description CH a The Id of cluster head a CS k The Id of compromised sensor node k E(data, K) An encryption function using K as a key f (x, y) a symmetric polynomial F q a finite field with any element that can be represented by bits g u (y) the univariate polynomial for node u obtained by g u (y) = f (u, y) ¯ g u (y) the perturbed polynomial preloaded to node u H k (x) the hashed value based on the most significant k bits of x K a,b the shared pairwise key between nodes a and b the minimal integer satisfying 2 > q n the total number of sensor nodes to be deployed, n < q n a the number of sensor nodes in a cluster n c the number of compromised sensor nodes in a cluster m the total number of perturbation polynamials, m = |Φ| p u (y) a randomly generated univariate rekeying polynomial at node u q a large prime number r a positive integer such that 2 r < q S a set of legitimate IDs forsensor nodes, S ⊂ { 0, ··· , q −1 } SN i The Id of sensor node i t the degree of both variables x and y in the symmetric polynomial f (x, y) φ u (y) a perturbation polynamial assigned for node u Φ a set of perturbation polynamials satisfying the limited infection property regarding r and S Table 1. Notations the renewed nodes. Based on the number n, a large prime number q is chosen such that n < q and let be the minimal integer satisfying 2 > q. The offline authority arbituary constructs a bivariate symmetric polynomial f (x, y) ∈ F q [x, y], where the degrees of x and y are both t, and for any x, y ∈ F q , f (x, y) = f (y, x). It then applies the method in (Zhang et al., 2007) to construct the legitimate ID set S forsensor nodes and the perturbation polynamial set Φ, which satisfies the limited infection property regarding r and S with m (m ≥ 2) number of bivariate symmetric polynomials. Finally, we note that the desired number of bits for any pairwise key is −r. 3.2 Pre-distribution of Perturbed Polynomials Before sensor devices are deployed into usage, some secret information should be pre- assigned as follows. Each cluster head a needs to be preloaded with a unique Id CH a ∈ S and a perturbed polynomial g CH a (y): g CH a (y) = f (CH a , y) + φ CH a (y) = g CH a (y) + φ CH a (y). (5) Similarly, for each sensor node i, the security server preloads it with a unique Id SN i ∈ S and a perturbed polynomial g SN i (y): g SN i (y) = f (SN i , y) + φ SN i (y) = g SN i (y) + φ SN i (y). (6) Smart WirelessSensor Networks320 Fig. 1. The protocol for pair-wise key establishment and rekeying Note that the security authority only preloads each sensor device u (a CH or SN) the coeffi- cients of g u (y). Hence, each sensor device cannot extract from g u (y) the coefficients of the original polynomial shares of either f (x, y), f u (y), or φ u (y) (φ u (·) ∈ Φ). Furthermore, each sensor device is equipped with the same one-way hash function H k (x), which returns the hashed value based on the most significant k bits of x. 3.3 Pair-wise Key Establishment and Rekeying After the key pre-assignment phase, wireless sensors are randomly distributed in a given area, and later on, some clustering algorithm, e.g., (Heinzelman et al., 2002), shall organize the network into a hierarchical structure. The following intra-cluster protocol, as illustrated in Figure 1, is to establish the new pair-wise key between a cluster head a and one of its member sensor nodes i in a new round of rekeying phase, in which the orignal pair-wise key establishment is treated the same as the subsequent rekeyings. The inter-cluster rekeying protocol for CH-CH links works in a similar manner and thus is omitted here. • Step 1: At the beginning of each rekeying phase, CH a randomly generates a new t- degree univariate rekeying polynomial function p CH a (y). For each of its sensor node SN i , CH a updates the corresponding pair-wise key K CH a ,SN i as K CH a ,SN i = H −r (p CH a (SN i )). (7) • Step 2: CH a uses p CH a (y) and the preloaded polynomial g CH a (y) to construct a master polynomial w CH a (y): w CH a (y) = p CH a (y) + g CH a (y) (8) and broadcasts its ID CH a and this polynomial w CH a (y) to all its sensor nodes by a single transmission. • Step 3: Upon receiving the broadcast message, each SN i evaluates the preloaded poly- nomial g SN i (y) at y = CH a and evaluates the receieved master polynomial w CH a (y) at y = SN i . After that, three candidate keys K ∗ CH a ,SN i , K + CH a ,SN i and K − CH a ,SN i will be calculated as follows, respectively. K ∗ CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) (9) K + CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) + 2 r (10) K − CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) −2 r (11) • Step 4: At a later time, a encoded information E(msg, K CH a ,SN i ) will be piggybacked in a normal unicast message sent from CH a to SN i . The exact new pair-wise key is determined by SN i once such message can be decoded successfully using one of the candidate keys. Note that due to the characteristic of the perturbation polynomial (Zhang et al., 2007), only one of the candidate keys (9) - (11) will be validated as the new pair-wise key between SN i and CH a , i.e., K CH a ,SN i ∈ K ∗ CH a ,SN i , K + CH a ,SN i , K − CH a ,SN i . (12) The unicast message can be also sent from SN i to CH a . Under this circumstance, the new pair-wise key will be calculated at SN i as K CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) , while three candidate keys will be evaluated at CH a as K ∗ CH a ,SN i = H −r ( p CH a (SN i ) ) , K + CH a ,SN i = H −r ( p CH a (SN i ) + 2 r ) , and K − CH a ,SN i = H −r ( p CH a (SN i ) −2 r ) . All remaining rekeying pro- cesses are the same and conclusion in (12) will be also made. 3.4 Examples To help understand the details of our rekeying protocol, we provide the following simplified example with CH a = 3 and SN i = 2. In system initialization, we set q = 127, t = 2, = 7, and r = 3. All arithmetic operations are over finite field F 127 . The bivariate symmetric polynomial is f (x, y) = xy 2 + x 2 y + 2xy + 5 and the corresponding univariate polynomials for CH a and SN i are g 3 (y) = f (3, y) = 3y 2 + 15y + 5 and g 2 (y) = f (2, y) = 2y 2 + 8y + 5, respectively. Now, we consider the following cases in a rekeying phase, in which CH a generates a new univariate polynomial function p 3 (y) = 3y 2 + 15y + 9 under different preloaded perturbed polynomials. Case 1: Suppose the perturbation polynomials for CH a and SN i are φ 3 (y) = y 2 − 3y + 5 and φ 2 (y) = y 2 − 4y + 5, respectively. Note that both polynomials satisfy the limited infection property: φ 3 (2) = 3 ∈ {0, 1, ··· , 7} and φ 2 (3) = 2 ∈ {0, 1, ··· , 7}. Their preloaded polynomials are therefore g 3 (y) = g 3 (y) + φ 3 (y) = 4y 2 + 12y + 10 and g 2 (y) = g 2 (y) + φ 2 (y) = 3y 2 + 4y + 10, respectively, as illustrated in Figure 2. In rekeying, CH a calculates the new pair-wise key as K 3,2 = H 4 (p 3 (2)) = H 4 (51) = H 4 (0110011) and A Compromise-resilient Pair-wise Rekeying Protocol in Hierarchical WirelessSensorNetworks 321 Fig. 1. The protocol for pair-wise key establishment and rekeying Note that the security authority only preloads each sensor device u (a CH or SN) the coeffi- cients of g u (y). Hence, each sensor device cannot extract from g u (y) the coefficients of the original polynomial shares of either f (x, y), f u (y), or φ u (y) (φ u (·) ∈ Φ). Furthermore, each sensor device is equipped with the same one-way hash function H k (x), which returns the hashed value based on the most significant k bits of x. 3.3 Pair-wise Key Establishment and Rekeying After the key pre-assignment phase, wireless sensors are randomly distributed in a given area, and later on, some clustering algorithm, e.g., (Heinzelman et al., 2002), shall organize the network into a hierarchical structure. The following intra-cluster protocol, as illustrated in Figure 1, is to establish the new pair-wise key between a cluster head a and one of its member sensor nodes i in a new round of rekeying phase, in which the orignal pair-wise key establishment is treated the same as the subsequent rekeyings. The inter-cluster rekeying protocol for CH-CH links works in a similar manner and thus is omitted here. • Step 1: At the beginning of each rekeying phase, CH a randomly generates a new t- degree univariate rekeying polynomial function p CH a (y). For each of its sensor node SN i , CH a updates the corresponding pair-wise key K CH a ,SN i as K CH a ,SN i = H −r (p CH a (SN i )). (7) • Step 2: CH a uses p CH a (y) and the preloaded polynomial g CH a (y) to construct a master polynomial w CH a (y): w CH a (y) = p CH a (y) + g CH a (y) (8) and broadcasts its ID CH a and this polynomial w CH a (y) to all its sensor nodes by a single transmission. • Step 3: Upon receiving the broadcast message, each SN i evaluates the preloaded poly- nomial g SN i (y) at y = CH a and evaluates the receieved master polynomial w CH a (y) at y = SN i . After that, three candidate keys K ∗ CH a ,SN i , K + CH a ,SN i and K − CH a ,SN i will be calculated as follows, respectively. K ∗ CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) (9) K + CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) + 2 r (10) K − CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) −2 r (11) • Step 4: At a later time, a encoded information E(msg, K CH a ,SN i ) will be piggybacked in a normal unicast message sent from CH a to SN i . The exact new pair-wise key is determined by SN i once such message can be decoded successfully using one of the candidate keys. Note that due to the characteristic of the perturbation polynomial (Zhang et al., 2007), only one of the candidate keys (9) - (11) will be validated as the new pair-wise key between SN i and CH a , i.e., K CH a ,SN i ∈ K ∗ CH a ,SN i , K + CH a ,SN i , K − CH a ,SN i . (12) The unicast message can be also sent from SN i to CH a . Under this circumstance, the new pair-wise key will be calculated at SN i as K CH a ,SN i = H −r w CH a (SN i ) − g SN i (CH a ) , while three candidate keys will be evaluated at CH a as K ∗ CH a ,SN i = H −r ( p CH a (SN i ) ) , K + CH a ,SN i = H −r ( p CH a (SN i ) + 2 r ) , and K − CH a ,SN i = H −r ( p CH a (SN i ) −2 r ) . All remaining rekeying pro- cesses are the same and conclusion in (12) will be also made. 3.4 Examples To help understand the details of our rekeying protocol, we provide the following simplified example with CH a = 3 and SN i = 2. In system initialization, we set q = 127, t = 2, = 7, and r = 3. All arithmetic operations are over finite field F 127 . The bivariate symmetric polynomial is f (x, y) = xy 2 + x 2 y + 2xy + 5 and the corresponding univariate polynomials for CH a and SN i are g 3 (y) = f (3, y) = 3y 2 + 15y + 5 and g 2 (y) = f (2, y) = 2y 2 + 8y + 5, respectively. Now, we consider the following cases in a rekeying phase, in which CH a generates a new univariate polynomial function p 3 (y) = 3y 2 + 15y + 9 under different preloaded perturbed polynomials. Case 1: Suppose the perturbation polynomials for CH a and SN i are φ 3 (y) = y 2 − 3y + 5 and φ 2 (y) = y 2 − 4y + 5, respectively. Note that both polynomials satisfy the limited infection property: φ 3 (2) = 3 ∈ {0, 1, ··· , 7} and φ 2 (3) = 2 ∈ {0, 1, ··· , 7}. Their preloaded polynomials are therefore g 3 (y) = g 3 (y) + φ 3 (y) = 4y 2 + 12y + 10 and g 2 (y) = g 2 (y) + φ 2 (y) = 3y 2 + 4y + 10, respectively, as illustrated in Figure 2. In rekeying, CH a calculates the new pair-wise key as K 3,2 = H 4 (p 3 (2)) = H 4 (51) = H 4 (0110011) and Smart WirelessSensor Networks322 Fig. 2. Example of K CH a ,SN i = K ∗ CH a ,SN i sends the master polynomials w 3 (y) = p 3 (y) + g 3 (y) = 7y 2 + 27y + 19 to SN i . At SN i side, it then calculates three candidate keys: K ∗ 3,2 = H 4 (w 3 (2) − g 2 (3)) = H 4 (52) = H 4 (0110100), K + 3,2 = H 4 (60) = H 4 (0111100), and K − 3,2 = H 4 (44) = H 4 (0101100). We observe that K CH a ,SN i = K ∗ CH a ,SN i (H 4 (0110011) = H 4 (0110100)) is achieved. Fig. 3. Example of K CH a ,SN i = K + CH a ,SN i Case 2: Under different perturbation polynomials φ 3 (y) = y 2 − 2y + 1 (φ 3 (2) = 1) for CH a and φ 2 (y) = y 2 −y (φ 2 (3) = 6) for SN i , we can obtain g 3 (y) = g 3 (y) + φ 3 (y) = 4y 2 + 13y + 6, g 2 (y) = g 2 (y) + φ 2 (y) = 3y 2 + 7y + 5, and w 3 (y) = p 3 (y) + g 3 (y) = 7y 2 + 28y + 15. Eventually, we observe K CH a ,SN i = K + CH a ,SN i (H 4 (0110011) = H 4 (0110110)) as shown in Figure 3. Case 3: Similarly, the perturbation polynomials φ 3 (y) = y 2 −6y + 14 (φ 3 (2) = 6) and φ 2 (y) = y 2 −7y + 13 (φ 2 (3) = 1) are for CH a and SN i , respectively. We then obtain g 3 (y) = g 3 (y) + φ 3 (y) = 4y 2 + 9y + 19, g 2 (y) = g 2 (y) + φ 2 (y) = 3y 2 + y + 18, and w 3 (y) = p 3 (y) + g 3 (y) = Fig. 4. Example of K CH a ,SN i = K − CH a ,SN i 7y 2 + 24y + 28. The final case K CH a ,SN i = K − CH a ,SN i (H 4 (0110011) = H 4 (0110000)) is shown in Figure 4. 4. Security Analysis In this section, we give a security analysis for our proposed rekeying scheme and compare it to other proposals in terms of robustness to the node capture attack. 4.1 Breaking Rekeying Polynomial p CH a (y) We assume that an adversary has compromised n c sensor nodes in cluster a , denoted as CS k (k = 1, ··· , n c > t), and has obtained all their preloaded information. To derive the polynomial p CH a (y) that is used to generate the new pair-wise key as shown in (7), the adversary needs to break g CH a (y) because p CH a (y) = w CH a (y) − g CH a (y), in which w CH a (y) is the public information broadcasted by CH a . Furthermore, for any sensor node y of CH a , the corresponding pair-wise key K CH a ,y satisfies: K CH a ,y = H −r w CH a (y) − g CH a (y) = H −r ( w CH a (y) − g CH a (y) −φ CH a (y) ) = H −r ( w CH a (y) − g CH a (y) ) , or H −r ( w CH a (y) − g CH a (y) −2 r ) . The above equation shows that to break g CH a (y) is equivalent to break g CH a (y) or f (CH a , y). This can be done by collecting a number of polynomials g CS k (y) stored in the compromised sensor nodes, which satisfy g CS k (y) = f (CS k , y) + φ CS k (y). (13) It can be formulated as a linear equation system as follows. t ∑ i=0 a ij ·(CS k ) i + b kj = d kj , 0 ≤ j ≤ t, 1 ≤ k ≤ n c (14) A Compromise-resilient Pair-wise Rekeying Protocol in Hierarchical WirelessSensorNetworks 323 Fig. 2. Example of K CH a ,SN i = K ∗ CH a ,SN i sends the master polynomials w 3 (y) = p 3 (y) + g 3 (y) = 7y 2 + 27y + 19 to SN i . At SN i side, it then calculates three candidate keys: K ∗ 3,2 = H 4 (w 3 (2) − g 2 (3)) = H 4 (52) = H 4 (0110100), K + 3,2 = H 4 (60) = H 4 (0111100), and K − 3,2 = H 4 (44) = H 4 (0101100). We observe that K CH a ,SN i = K ∗ CH a ,SN i (H 4 (0110011) = H 4 (0110100)) is achieved. Fig. 3. Example of K CH a ,SN i = K + CH a ,SN i Case 2: Under different perturbation polynomials φ 3 (y) = y 2 − 2y + 1 (φ 3 (2) = 1) for CH a and φ 2 (y) = y 2 −y (φ 2 (3) = 6) for SN i , we can obtain g 3 (y) = g 3 (y) + φ 3 (y) = 4y 2 + 13y + 6, g 2 (y) = g 2 (y) + φ 2 (y) = 3y 2 + 7y + 5, and w 3 (y) = p 3 (y) + g 3 (y) = 7y 2 + 28y + 15. Eventually, we observe K CH a ,SN i = K + CH a ,SN i (H 4 (0110011) = H 4 (0110110)) as shown in Figure 3. Case 3: Similarly, the perturbation polynomials φ 3 (y) = y 2 −6y + 14 (φ 3 (2) = 6) and φ 2 (y) = y 2 −7y + 13 (φ 2 (3) = 1) are for CH a and SN i , respectively. We then obtain g 3 (y) = g 3 (y) + φ 3 (y) = 4y 2 + 9y + 19, g 2 (y) = g 2 (y) + φ 2 (y) = 3y 2 + y + 18, and w 3 (y) = p 3 (y) + g 3 (y) = Fig. 4. Example of K CH a ,SN i = K − CH a ,SN i 7y 2 + 24y + 28. The final case K CH a ,SN i = K − CH a ,SN i (H 4 (0110011) = H 4 (0110000)) is shown in Figure 4. 4. Security Analysis In this section, we give a security analysis for our proposed rekeying scheme and compare it to other proposals in terms of robustness to the node capture attack. 4.1 Breaking Rekeying Polynomial p CH a (y) We assume that an adversary has compromised n c sensor nodes in cluster a , denoted as CS k (k = 1, ··· , n c > t), and has obtained all their preloaded information. To derive the polynomial p CH a (y) that is used to generate the new pair-wise key as shown in (7), the adversary needs to break g CH a (y) because p CH a (y) = w CH a (y) − g CH a (y), in which w CH a (y) is the public information broadcasted by CH a . Furthermore, for any sensor node y of CH a , the corresponding pair-wise key K CH a ,y satisfies: K CH a ,y = H −r w CH a (y) − g CH a (y) = H −r ( w CH a (y) − g CH a (y) −φ CH a (y) ) = H −r ( w CH a (y) − g CH a (y) ) , or H −r ( w CH a (y) − g CH a (y) −2 r ) . The above equation shows that to break g CH a (y) is equivalent to break g CH a (y) or f (CH a , y). This can be done by collecting a number of polynomials g CS k (y) stored in the compromised sensor nodes, which satisfy g CS k (y) = f (CS k , y) + φ CS k (y). (13) It can be formulated as a linear equation system as follows. t ∑ i=0 a ij ·(CS k ) i + b kj = d kj , 0 ≤ j ≤ t, 1 ≤ k ≤ n c (14) Smart WirelessSensor Networks324 Note that a ij and b kj are the variables of this linear equation system, which are defined by (1) and the following equation φ CS k (y) = t ∑ j=0 b kj ·y j , 1 ≤ k ≤ n c , (15) respectively. On the other hand, the values of d kj are known to the adversary: g CS k (y) = t ∑ j=0 d kj ·y j , 1 ≤ k ≤ n c . (16) By applying a similar reasoning technique in (Zhang et al., 2007), we can derive that the prob- abilities to find the solution of the linear equation system (14) in one attempt is m −(t+1) , in which m is the total number of perturbation polynamials, i.e., m = | Φ | ≥ 2. In other words, to break f (x, y), or g CH a (y) = f (CH a , y), in one attempt is m −(t+1) . Finally, we can conclude that the computational complexity for breaking p CH a (y) under the condition of t + 1 compromised nodes is Ω m t+1 . 4.2 Node Capture Attack After deployment, each cluster head and each sensor node can be captured and compro- mised by attackers due to the unattended deployment environments and their lack of tamper- resistance. The adversary can read out all information stored in the node to get all secret information. In addition, the attackers may collect the secrets owned by compromised nodes, and attempt to derive the secrets held by innocent nodes (and therefore can cheat these inno- cent nodes or impersonate as them). This is the well-known node capture attack. In the Chadha’s scheme (Chadha et al., 2005), each sensor node SN i is pre-loaded a 2t-degree masking polynomial h (x) in its storage. After 2t sensor nodes are compromised, the whole network will crash. In our proposed pair-wise rekeying protocol, in order to derive the rekey- ing polynomial p CH a (y) of cluster head a, the adversary needs to break the original symmetric polynomial f (x, y) with extremely low probability. Assume that the degree of polynomial function is t = 80, the NCA-robustness comparison of these two protocols are illustrated in Figure 5. As we observe that after a number of sensor nodes are compromised, Chadha’s schemes will disclose the polynomials that can generate any group key in the past or future. On the contrary, our proposed scheme can achieve both forward and backward secrecy because such polynomials are extremely hard to be broken in our approach. 5. Performance Analysis In this section, we evaluate the performance of our proposal by comparing with Chadha’s scheme (Chadha et al., 2005). The performance metrics include the computational complexity, communication overhead, and storage overhead. Table 2 summarizes the performance results. In the Chadha’s scheme, each cluster head first constructs w (x) = g(x) f (x) + h (x) and calculates n a − n c pair-wise keys for all innocent nodes, in which n a and n c are number of all sensor nodes and compromised sensor nodes, respectively, in a cluster. It needs O (n 2 c + n c t + (n a − n c )t) = O(n 2 c + n a t) multiplications. Upon receiving w(x), each sensor node needs to derive its personal key using O (t) multiplications. In our proposed pair-wise Fig. 5. NCA robustness comparison (t = 80) Chadha’s Our Scheme Computation Cluster head O (n 2 c + n a t) mul. O ((n a −n c ) ˙ t ) mul. n a −n c hash fun. Sensor node O (t) mul. O (t) mul. 3 hash fun. Communication Cluster head (2t + n c + 1) · (t + 1) · Sensor node 0 0 Storage Cluster head (2t + 1) · (t + 1) · Sensor node (t + 1) · Table 2. Performance analysis rekeying scheme, each cluster head needs to recalculate n a −n c pair-wise keys using the rekey- ing polynomial with O ((n a −n c )t) multiplications. Each key generation involves a hash func- tion operation as well. For each sensor node, it needs to calculate three candidate keys, which takes O (t) multiplications and 3 hash function operations. In the Chadha’s scheme, each cluster head broadcasts a new 2t-degree polynomial w (x) and n c Ids of detected compromised nodes to all the sensor nodes in the cluster. Such broadcast message has (2t + n c + 1) · bits. No message transmission at sensoe node side. The only communication overhead in our proposed scheme is the broadcast message for sending the t-degree master polynomial with (t + 1) · bits. Note that, the overhead of the piggybacked short message for key agreement are considered as normal traffic and not included in Table 2. In the evaluation of storage overhead, we consider the space requirement of the preloaded information in each sensor node and cluster head for the rekeying schemes. In Chadha’s scheme, each cluster head is pro-loaded a 2t-degree masking polynomial function h (x). All coefficients for the polynomial require (2t + 1) · bits. Each sensor node S i needs to store one secret values h (S i ) with bits. In our scheme, each sensor device (both cluster head and sensor node) is preloaded one t-degree perturbed polynomial taking (t + 1) · bits. A Compromise-resilient Pair-wise Rekeying Protocol in Hierarchical WirelessSensorNetworks 325 Note that a ij and b kj are the variables of this linear equation system, which are defined by (1) and the following equation φ CS k (y) = t ∑ j=0 b kj ·y j , 1 ≤ k ≤ n c , (15) respectively. On the other hand, the values of d kj are known to the adversary: g CS k (y) = t ∑ j=0 d kj ·y j , 1 ≤ k ≤ n c . (16) By applying a similar reasoning technique in (Zhang et al., 2007), we can derive that the prob- abilities to find the solution of the linear equation system (14) in one attempt is m −(t+1) , in which m is the total number of perturbation polynamials, i.e., m = | Φ | ≥ 2. In other words, to break f (x, y), or g CH a (y) = f (CH a , y), in one attempt is m −(t+1) . Finally, we can conclude that the computational complexity for breaking p CH a (y) under the condition of t + 1 compromised nodes is Ω m t+1 . 4.2 Node Capture Attack After deployment, each cluster head and each sensor node can be captured and compro- mised by attackers due to the unattended deployment environments and their lack of tamper- resistance. The adversary can read out all information stored in the node to get all secret information. In addition, the attackers may collect the secrets owned by compromised nodes, and attempt to derive the secrets held by innocent nodes (and therefore can cheat these inno- cent nodes or impersonate as them). This is the well-known node capture attack. In the Chadha’s scheme (Chadha et al., 2005), each sensor node SN i is pre-loaded a 2t-degree masking polynomial h (x) in its storage. After 2t sensor nodes are compromised, the whole network will crash. In our proposed pair-wise rekeying protocol, in order to derive the rekey- ing polynomial p CH a (y) of cluster head a, the adversary needs to break the original symmetric polynomial f (x, y) with extremely low probability. Assume that the degree of polynomial function is t = 80, the NCA-robustness comparison of these two protocols are illustrated in Figure 5. As we observe that after a number of sensor nodes are compromised, Chadha’s schemes will disclose the polynomials that can generate any group key in the past or future. On the contrary, our proposed scheme can achieve both forward and backward secrecy because such polynomials are extremely hard to be broken in our approach. 5. Performance Analysis In this section, we evaluate the performance of our proposal by comparing with Chadha’s scheme (Chadha et al., 2005). The performance metrics include the computational complexity, communication overhead, and storage overhead. Table 2 summarizes the performance results. In the Chadha’s scheme, each cluster head first constructs w (x) = g(x) f (x) + h (x) and calculates n a − n c pair-wise keys for all innocent nodes, in which n a and n c are number of all sensor nodes and compromised sensor nodes, respectively, in a cluster. It needs O (n 2 c + n c t + (n a − n c )t) = O(n 2 c + n a t) multiplications. Upon receiving w(x), each sensor node needs to derive its personal key using O (t) multiplications. In our proposed pair-wise Fig. 5. NCA robustness comparison (t = 80) Chadha’s Our Scheme Computation Cluster head O(n 2 c + n a t) mul. O((n a −n c ) ˙ t ) mul. n a −n c hash fun. Sensor node O(t) mul. O(t) mul. 3 hash fun. Communication Cluster head (2t + n c + 1) · (t + 1) · Sensor node 0 0 Storage Cluster head (2t + 1) · (t + 1) · Sensor node (t + 1) · Table 2. Performance analysis rekeying scheme, each cluster head needs to recalculate n a −n c pair-wise keys using the rekey- ing polynomial with O ((n a −n c )t) multiplications. Each key generation involves a hash func- tion operation as well. For each sensor node, it needs to calculate three candidate keys, which takes O (t) multiplications and 3 hash function operations. In the Chadha’s scheme, each cluster head broadcasts a new 2t-degree polynomial w (x) and n c Ids of detected compromised nodes to all the sensor nodes in the cluster. Such broadcast message has (2t + n c + 1) · bits. No message transmission at sensoe node side. The only communication overhead in our proposed scheme is the broadcast message for sending the t-degree master polynomial with (t + 1) · bits. Note that, the overhead of the piggybacked short message for key agreement are considered as normal traffic and not included in Table 2. In the evaluation of storage overhead, we consider the space requirement of the preloaded information in each sensor node and cluster head for the rekeying schemes. In Chadha’s scheme, each cluster head is pro-loaded a 2t-degree masking polynomial function h (x). All coefficients for the polynomial require (2t + 1) · bits. Each sensor node S i needs to store one secret values h (S i ) with bits. In our scheme, each sensor device (both cluster head and sensor node) is preloaded one t-degree perturbed polynomial taking (t + 1) · bits. Smart WirelessSensor Networks326 6. Conclusion The traditional polynomial based pair-wise rekeying protocol suffers the large-scale node cap- ture attack. Once t + 1 nodes are compromised, all previous and future keys for any pair of nodes will be disclosed. We present a compromise-resilient pair-wise rekeying scheme based on a three-tier WSN. It can significantly improve the security level by reducing this probabil- ity from 1 down to m −(t+1) (m ≥ 2). Our proposed scheme also achieves both forward and backward secrecy. 7. References Akyildiz, I. F.; Su, W.; Sankarasubramaniam, Y. & Cayirci, E. (2002). Wirelesssensor Networks: A Survey, Journal of Computer Networks, Vol. 38, No. 4, 393–422. Blundo, C.; De Santis, A.; Herzberg, A.; Kutten, S.; Vaccaro, U. & Yung, M. (1993). Perfectly- secure key sistribution for dynamic conferences, LNCS, Vol. 740, 471–486. Chadha, A.; Liu, Y. & Das, S. (2005). Group key distribution via local collaboration in wireless sensor, IEEE SECON, pp. 46–54, July 2005. Cheng, Y. & Agrawal, D. P. (2005). Efficient pairwise key establishment and management in static wirelesssensor networks, IEEE MASS, November 2005. Cheng, Y. & Agrawal, D. P. (2007). A improved key distribution mechanism for large-scale hierarchical wirelesssensor networks, Journal of Ad Hoc Networks, Vol. 5, No. 1, 35– 48. Diffie, W. & Hellman, M. E. (1976). New direction in cryptography, IEEE Transactions on Infor- mation Theory, Vol. 22, No. 6, 644–654. Du, W. L.; Deng, J.; Han, Y.& Varshney, P. K. (2003). A pairwise key pre-distribution scheme forwirelesssensor network, ACM Conference on Computer and Communications Security, pp. 42–51, October 2003. Eschenauer, L. & Gligor, V. (2002). A key-management scheme for distributed sensor net- works, ACM CCS, pp. 41–47, November 2002. Heinzelman, W. R.; Chandrakasan, A. P. & Balakrishnan, H. (2002). An application specific protocol architecture forwireless microsensor networks, IEEE Transactions on Wireless Communications, Vol. 1, No. 4, 660–670. Mishra, S. (2002). Key management in large group multicast, Technical Report CU-CS-970-02, University of Colorado. Rivest, R.; Shamir, A. & Adleman, L. (1978). A method for obtaining digital signatures and public key cryptosystems, Communications of ACM, Vol. 21, No. 2, 120–126. Zhang, W.; Song, H.; Zhu, S. & Cao, G. (2005). Least privilege and privilege deprivation: Towards to tolerating mobile sink compromises in wirelesssensor networks, ACM MobiHoc, pp. 378–389, May 2005. Zhang, W.; Tran, M.; Zhu, S. & Cao, G. (2005). A random perturbation-based scheme for pair- wise key establishment in sensor networks, ACM MobiHoc, pp. 90–99, September 2007. Zhang, W.; Subramanian, N.; Zhu, S. & Wang, G. (2005). Lightweight and compromise- resilient message authentication in sensor networks, IEEE INFOCOM, pp. 1418–1426, April 2008. Security architecture, trust management model with risk evaluation and node selection algorithm for WSN 327 Security architecture, trust management model with risk evaluation and node selection algorithm for WSN Bin Ma and Xianzhong Xie X Security architecture, trust management model with risk evaluation and node selection algorithm for WSN Bin Ma 1,2 and Xianzhong Xie 1,2 1 School of computer science and technology, Chongqing University of Posts and Telecommunications 2 Institute of Personal Communications, Chongqing University of Posts and Telecommunications P.R. China 1. Introduction Wirelesssensornetworks are ideal candidates to monitor the environment in a variety of applications such as military surveillance, forest fire monitoring, etc. In such a network, a large number of sensor nodes are deployed over a vast terrain to detect events of interest (e.g., enemy vehicles, forest fires), and deliver data reports over multihop wireless paths to the user. Security is essential for these mission-critical applications to work in an adverse or hostile environment. WirelessSensornetworks are typically characterized by limited power supplies, low bandwidth, small memory sizes and limited energy. This leads to a very demanding environment to provide security. Public-key cryptography is too expensive to be usable, and even fast symmetric-key ciphers must be used sparingly. Communication bandwidth is extremely dear: each bit transmitted consumes about as much power as executing 800–1000 instructions(J. Hill et al 2000), and as a consequence, any message expansion caused by security mechanisms comes at significant cost. Wirelesssensornetworks consist of spatially distributed autonomous devices using sensors to cooperatively monitor physical or environmental conditions, such as temperature, sound, vibration, pressure, motion or pollutants, at different locations. In addition to one or more sensor nodes, each node in wirelesssensornetworks is typically equipped with a radio transceiver or other wireless communication devices, a microcontroller, and an energy source, usually a battery. Wirelesssensornetworks are the connection between physical world and mankind, which cannot be simply regarded as communication networks. It should mainly concentrate on sensory information processing and services. Wirelesssensornetworks should be developed as an integrated information infrastructure, in which information aggregation and collaborative processing are key issues. 19 Smart WirelessSensor Networks328 And so, all nodes share common sensing tasks in wirelesssensor networks. This implies that not all sensors are required to perform the sensing task during the whole system lifetime. Turning off some nodes does not affect the overall system function as long as there are enough working nodes to assure it. Therefore, if we can schedule sensors to work alternatively, the system lifetime can be prolonged by exploiting redundancy. In this chapter,we present a cross-layer trust management model based on cloud model; and using the trust model, we innovate an algorithm of node selection in Wirelesssensor networks. The rest of the chapter is structured as follows. In the beginning we introduce wirelesssensor networks. Furthermore, A discussion of related work for security architecture and trust management model. Thereafter, we provide a unique security requirements of WSNs and present a security architecture forwirelesssensornetworks that addresses most of the problems above, also describe the technical aspects of our security architecture. Subsequently, we utilizes lightweight trust management model that allow for easy access control between the mobile sensor nodes and secure the communication inside the network. Furthermore, it minimizes the effects of compromised sensor nodes. 2. Related Works 2.1 security architecture Security in sensornetworks has been studied by several other researchers. Perrig et al(2001). developed the security architecture SPINS, which is based on the two protocols SNEP, a protocol for data confidentiality, two-party data authentication, and data freshness and μTESLA, a broadcast authentication protocol.Their architecture relies on the concept, that every node shares a secret key with a trusted base station, which is at all times able to communicate with every node in the network. Furthermore, several key management schemes have been put forward forsensor networks: Basagni et al(2001). proposed a solution to periodically update a symmetric key which is shared by all nodes in the network. Their solution is based on the assumption that all nodes are constructed tamper-proof, which is not always the case. Carman et al(2000). studied several key management protocols in sensornetworks with respect to performance on different hardware platforms. Zhu et al(2003). proposed the Localized Encryption and Authentication Protocol(LEAP) which utilizes four types of keys for each node. These are used for different purposes and range from the individual key that is shared with the base station, up to a group key that is shared with all nodes in the network. Eschenauer and Gligor(2002) presented a pool-based random key predistribution system, which Chan et al.(2003) extended by presenting three new mechanisms for key establishment. Wood and Stankovic(2002,2003) identified several DoS attacks in sensornetworks and presented a protocol, which allows to map regions that are subject to DoS by radio jamming. 2.2 trust management model The traditional trust management systems are suitable for wired and wireless ad hoc network, but cannot satisfy the security requirements of wirelesssensor network. Because they need very large resources consumption which is wirelesssensor network lacked. The trust management system may be the centralism or the distribution, but they both do not suit sensor network, the central system needs enough energy to satisfy the extra route need, but in the distributional system, each node needs enough storage space and strong computing power. But in the sensor network, all node joint operation as if is more realistic. Therefore, the mix low consumption trust management system can satisfy the demand of sensor network. Since Marsh(1994) introduced the research of trust to the computer domain, trust mechanism has gradually obtained more and more researcher's(Blaze M 1996, Adrian Perrig 2001, Sasha Slijepcevic 2002, and so on) values for its flexibility and extendibility. The people proposed the numerous trust models in distribution network, pervasive computing, peer-to- peer computing, ad hoc network and so on. In these models, trust is usually quantified as a definite real number. However, because the node trust has much subjectivity, natural insufficiency has existed by using the definite value to describe trust. For example, if node A trusts node B, it is very difficult to determine that the trust value should be 0.9 is 0.8. Therefore, uncertainty is considered to be the important attribute of trust, namely trust among the node is fuzziness and randomness; especially among strange node. Therefore, uncertainty must be considered when trust model build. Based on this, a cross-layer wirelesssensor network trust model based on cloud model is proposed. This model unifies the description of trust degree and uncertainty of trust relationship among the nodes with trust cloud forms, and gives algorithms of trust cloud transmission and merge. The cloud model by Deyi Li et al(2000,2004) has first proposed as the qualitative description and the quota expressed of one kind of terminology. It unifies the fuzziness and randomness, thus describing the uncertainty well. Now, the cloud model has already applied in numerous domains, like data mining, automatic control, quantitative evaluation and so on. 3. Security architecture 3.1 The security requirement of wirelesssensornetworksWirelesssensornetworks are composed of massive sensor nodes. These nodes are small, cheap, battery power supply, and have the ability of wireless communication and monitor. All the nodes are deployed densely in the monitored region to monitor the Physical world. Because the sensor nodes mostly are deployed in the enemy or nobody region, sensor network security problem is prominent especially. Lacking effective safety mechanism already becomes the chief obstacle of the sensor network application. Wirelesssensor network's own characteristic (the limitation of computation, communication and memory, lacks of the apriority to nodes deploying, unreliable Physical security of deployed region as well as dynamic change of network topology and so on) enables the sensor network except to have the traditional network security requirements, but also has some specific security property. Data Confidentiality The sensor network should not reveal the information to the neighbor network. In many applications, the node transmits the highly confidential data. The standard method to protect data confidentiality is enciphered data with the key, the receiver can decipher data, therefore achieves confidentiality, establish the security channel among the nodes according to the communication mode. Data Authentication In the sensor network, message authentication is important to many applications. When the network is constructed, authentication to the management task is necessary. At the same [...]... structural model 332 Smart WirelessSensorNetworks Fig 1 security architecture of wirelesssensornetworks 4 Trust management model with risk evaluation The traditional trust management systems are suitable for wired and wireless ad-hoc network, but cannot satisfy the security requirements of wirelesssensor network Because they need very large resources consumption which is wirelesssensor network lacked... Capture Attacks in WirelessSensorNetworks 345 20 0 Distributed Detection of Node Capture Attacks in WirelessSensorNetworks Jun-Won Ho Department of Computer Science and Engineering University of Texas at Arlington Arlington, TX, USA Abstract Wirelesssensornetworks are vulnerable to node capture attacks because sensor nodes are usually deployed in unattended manner Once attacker captures sensor nodes,... Cloud Trust Model forWirelessSensorNetworks Computer Science, vol 37(3),pp 128 -132 Perrig, A., Szewczyk, R., Wen, V., Culler, D., and Tygar, J.D.(2001) SPINS: Security Protocols forSensorNetworks Proceedings of the 7th International Conference on mobile Computing and Networks. ,pp.189 –199,ACM Press, Washington DC S Marsh.(1994) Formalising Trust as a Computational Concept, Departmet of Computer... node to cooperate from the set End Fig 4 wirelesssensor node selection algorithm 6 Conclusion and Further Research In this chapter, we have proposed a security architecture that provides confidentiality, integrity, and authentication with trust management for a wirelesssensor network For this purpose, we present a security architecture forwirelesssensornetworks that addresses most of the security... of wirelesssensornetworks are information sensing and processing Thus, the security of information cooperative processing scheme in wirelesssensornetworks must be considered in the architecture design 3.2 Security issues of each layers in wirelesssensornetworks The network protocol stack of wirelesssensornetworks is composed of physical layer, data link layer, network layer, transmission layer... security requirement of wirelesssensornetworksWirelesssensornetworks are composed of massive sensor nodes These nodes are small, cheap, battery power supply, and have the ability of wireless communication and monitor All the nodes are deployed densely in the monitored region to monitor the Physical world Because the sensor nodes mostly are deployed in the enemy or nobody region, sensor network security... Scheme for Distributed SensorNetworks Proceedings of the Conference on Computer and Communications Security ’02 pp 41 – 47.Washington DC I.F.Akyildiz, W.Su, Y.Sankarasubramaniam, E.Cayirci.(2002) WirelessSensor Networks: A Survey, Computer Networks, Vol 38, No 8, August 2002, pp 398-422 J Hill, R Szewczyk, A Woo, S Hollar, D Culler and K Pister (2000) System architecture directions for networked sensors... renewal All in all, The security requirement of wirelesssensornetworks is main list: 1) As the key feature of wirelesssensor network applications, the diversity of sensors, data flow and QoS requires the system architecture be of compatibility, universality and scalability to meet the various requirements 2) The prevailing studies on wirelesssensornetworks focus on the solution of low data rate,... and the wirelesssensor network support technology The hierarchical network communication and security protocol structure is similar to the TCP/IP protocol architecture; the wirelesssensor network support technology is mainly to sensor node own management as well as the user to the wirelesssensor' s management; two partial protocols and the technology has overlapping and the union, and have formed... manner 1 Introduction Wirelesssensornetworks have recently gained much attention in the sense that they can be readily deployed for many different types of missions In particular, they are useful for the missions that are difficult for humans to carry out For example, they are suitable for sensing dangerous natural phenomenon such as volcano eruption, biohazard monitoring, and forest fire detection In addition . requirement of wireless sensor networks Wireless sensor networks are composed of massive sensor nodes. These nodes are small, cheap, battery power supply, and have the ability of wireless communication. requirement of wireless sensor networks Wireless sensor networks are composed of massive sensor nodes. These nodes are small, cheap, battery power supply, and have the ability of wireless communication. selection in Wireless sensor networks. The rest of the chapter is structured as follows. In the beginning we introduce wireless sensor networks. Furthermore, A discussion of related work for security