Abstract:
A method for implement an energy-efficient user access control to wireless sensor networks is disclosed. A user creates a secret key and sending it to a sensor. The sensor builds a first MAC value by the secret key and sends it to the Key Distribution Center which builds a second MAC value and sending it to the sensor. The sensor decrypts the second MAC value to get a random number, and builds a third MAC value by the random number. The third MAC value is used by the user to authenticate the sensor.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    This invention relates generally to security, and more specifically, relates to controlling user access in sensor networks. 
         [0003]    2. Description of the Related Art 
         [0004]    Due to privacy reason or data clearance, access restriction to sensor networks may be enforced for users with different access rights. For example, in a sensor network spread over a large geographic area, the maintainer of the network offers services to a large number of mobile users. In the network used for precision agriculture, farmers subscribe to services and remotely query sensors on their fields using a mobile device like PDA. In this case, only authorized users should be answered by the network. 
         [0005]    The symmetric key based scheme suffers a number of problems including low scalability, large memory requirement, difficulty in new sensor deployment, and complicated key pre-distribution. The recent progress in public key cryptography using 160-bit Elliptic Curve Cryptography (ECC) shows that an ECC point multiplication takes less than one second on 8-bit CPU Atmel ATmega128 8 MHz (N. Gura, et al. Comparing Elliptic Curve Cryptography and RSA on 8-bit CPUs. In CHES2004, volume 3156 of LNCS, 2004). This proves that public-key cryptography is feasible for sensor security related applications. 
       SUMMARY OF THE INVENTION 
       [0006]    Thus, the present invention is based on ECC to design and further develop a method of above-mentioned kind in such a way that it is scalable, requires less memory, easy to deploy new nodes, and requires no complicated key pre-distribution. 
         [0007]    According to the invention, the proposed method for access control is characterized in that the user authenticates to the sensor and vice versa via the KDC (Key Distribution Center) using ECC, whereby the sensor only computes symmetric cryptography which is quite feasible for sensor devices. 
         [0008]    The user starts an access request by sending his certificate signed by an ECC private key to the sensor. Upon receiving the message, the sensor builds a first MAC (Message Authentication code) value by its ECC private key and sends it to the KDC. At KDC, it verifies if the user&#39;s certificate is legible or not. If yes, the user is authentic. The KDC then builds a second MAC value and sends it to the sensor. The sensor verifies it. If it is correct, then the user is authentic to the sensor. Otherwise, the sensor rejects the user. After that, the sensor decrypts the message from KDC to get the random number. It builds a third MAC value of this random number and sends it to the user. The user verifies it. If it is correct, then the sensor is authentic. 
         [0009]    According to the invention, the mutual authentication is established based on the trust relationship between the user, the sensor and the KDC. The sensor trusts the KDC, so if the user is authentic to the KDC, it is authentic to the sensor as well. Likewise, the user trusts the KDC, so if the sensor is authentic to the KDC, it is authentic to the user. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0010]    The above and other objects, features and other advantages of the present invention will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings, in which: 
           [0011]      FIG. 1  is a diagram illustrating communication between the user, the authentication sensor node and the KDC via intermediate nodes of a sensor network according to an embodiment of the present invention. 
           [0012]      FIG. 2  is a flowchart illustrating the method for controlling user access in sensor networks according to an embodiment of the present invention. 
           [0013]      FIG. 3  illustrates a detailed scheme of the method for controlling user access in sensor networks according to an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
       [0014]      FIG. 1  illustrates communication between a user  101 , an authentication sensor node  103  and a key distribution center (KDC)  105  via intermediate nodes  102 ,  104  of a sensor network according to an embodiment of the present invention. 
         [0015]    Here, the term ‘user’ refers to either human or a device that he is using for access control. The KDC is responsible for generating all security primitives, issuing and revoking user&#39;s access privileges and the KDC is fully trusted. The intermediate nodes store a pair of ECC private and public key. The sending node and the receiving node know the ECC public key of each other. 
         [0016]    Initially, the Key Distribution Center (KDC)  105  selects a particular elliptic curve over a finite field GF(p) (where p is a prime), and publishes a base point P with a large order q (q is also a prime). KDC  105  picks a random number k KDC εGF(p) as the system private key, and publishes its corresponding public key Q KDC =k KDC ×P. KDC  105  also generates private—public keys for each sensor node  102 ,  103 ,  104 . To issue a private—public key pair for a sensor S with identifier ID S , KDC  105  picks up a random number k s εGF(p) and computes Q s =k S ×P. k S  is the private key assigned to sensor S while Q S  is the public key. Each sensor also has a public key Q KDC  of KDC  105  preloaded. 
         [0017]    Notations are explained as follows: ID A  is identifier of entity A; k A  and Q A  is a pair of ECC private and public keys of entity A, respectively; sign A  (m) is message m is signed by entity A; (m)K is symmetric encryption of message m with key K; h(m) is hashing value of message m; ∥ is concatenation; x is ECC point multiplication. 
         [0018]    After deployment, each sensor node computes a shared secret key with KDC  105  for later authentication and access control process. The present invention is based on Elliptic Curve Diffie-Hellman (ECDH) to establish a key agreement between each sensor node  102 ,  103 ,  104  and KDC  105 . ECDH is a key agreement protocol allowing two parties to establish a shared secret key that can be used for private key algorithms. It has been shown that ECDH with 160-bit key size can achieve the same security level with 1024-bits RSA Diffie-Hellman secret sharing protocol. 
         [0019]    To establish a shared secret key with KDC, a sensor node, say S, computes R S =(x S , y S )=k S ×Q KDC . KDC also computes R KDC =(x KDC , y KDC )=k KDC ×Q S . Since k S ×Q KDC =k S ×k KDC ×P=k KDC ×Q S , therefore R S =R KDC  and hence x S =x KDC . As a result, x s  is used as a shared secret key between node S and KDC. This key agreement is done only once for the whole network lifetime. As a consequence, it does not consume much energy overall. It can be performed before or right after network deployment. 
         [0020]    As shown by  FIG. 2 , in the first step S 201 / 301 , a user  101  sends an access control message to a sensor  103  which stores data that the user accesses. 
         [0021]    The user  101  selects a random number rεGF(p) which will be used as a session key with the sensor  103 , as shown by  FIG. 3 , creates a secret key L=h(x U ⊕T U ) (where T U  is the current timestamp generated by the user), and encrypts r with key L. The user  101  then signs this encrypted value along with its certificate. The user  101  sends (r)L, T U , S 1  to the sensor  103  (step  303 ). 
         [0022]    Next, in step S 202 , upon receiving the message from the user  101 , the sensor  103  first checks if the time T U  is valid. 
         [0023]    If it is not valid, control jumps to step S 203  where the sensor  103  rejects the user  101 . 
         [0024]    If yes, then control jumps to step S 204 / 305  where the sensor  103  builds a MAC 1  by the shared secret key x S  (MAC 1 =MAC(x S , (r)L∥T U ∥S 1 )) and then forwards the message along with MAC 1  value to KDC  105  (step  307 ), where MAC is a Message Authentication Code, preferably Cipher Block Chaining Message Authentication Code (CBC-MAC) is used. 
         [0025]    Next, in step S 205 , upon receiving the message from the sensor  103 , KDC  105  verifies MAC 1  value. 
         [0026]    If it is not valid, control jumps to step S 203  where KDC  105  rejects the user  101 . 
         [0027]    If the verification is successful, the sensor  103  is authentic to KDC  105  and control jumps to step S 206 / 309 . KDC  105  verifies S 1  which was signed by the user  101 . If the signature is valid, then the user  101  is also authentic. The cert U  is also verified to check the validity of the access list ac U . KDC  105  now constructs a secret key L=h(x U ⊕T U ), and decrypts (r)L to get r. It then generates a secret key M=h(x S ⊕T KDC ) (where T KDC  is the timestamp created by KDC  105 ), encrypts r, and builds a MAC 2  (MAC 2 =MAC(x S , (r)M∥ID U )). Afterward, KDC  105  sends them  311  to the sensor  103 . 
         [0028]    Next, in step S 207 , upon receiving the message from KDC  105 , the sensor  103  verifies MAC 2  value. 
         [0029]    If it is not valid, control jumps to step S 203  where the sensor  103  rejects the user  101 . 
         [0030]    If the verification is successful, the user  101  is authentic to the sensor  103  and control jumps to step S 208 / 313 . The sensor  103  constructs the secret key M=h(x S ⊕T KDC ) and decrypts (r)M to get r. Using said secret key M, the sensor  103  builds a MAC 3  (MAC 3 =MAC(r, ID S )) value and sends it to the user  101  (step  315 ). 
         [0031]    Next, in step S 209 / 317 , upon receiving the MAC 3  value from the sensor  103 , the user  101  verifies it by the same key r. 
         [0032]    If it is not valid, control jumps to step S 203  where the user  101  rejects the sensor  103 . 
         [0033]    If the verification is successful, then the sensor  103  is authentic to the user  101 .