## 7 ECC-based Key Agreement Protocol
### Key Agreement Protocol
Our key agreement protocol differs from the handshakes in SSL/TLS in the following ways: (1) we use only three protocol messages to set up the session keys, as message transmissions consume a significant amount of energy; (2) since motes do not have their own public/private keys, we incorporate the patient biometric signature in _KeyGenStart_ as a means of authenticating the mote to the base station; (3) the nonces are encrypted in our protocol for more protection; and (4) in addition to the patient biometric signature, we have several other built-in measures to limit what an attacker can do with a compromised mote, as discussed below. Key Update Procedure  
The base station and the mote periodically update the session keys \(K_{s}\) and \(K_{mac}\) to limit the amount of private data that can be recovered in case the keys are compromised. To update the session keys, they simply exchange new values of \(n_{1}\) and \(n_{2}\) and rerun the key derivation function using the existing master key \(K_{m}\) and the new nonce values. This allows the session keys to be updated without having to undertake the expensive public-key operations in the full key agreement protocol. We omit the details due to space constraints. Further Considerations for Physical Compromise of Motes  
We enhance the above mechanisms with the following measures to limit what an attacker can do with a compromised mote. Suppose that an attacker has been eavesdropping on the communication between the mote and the base station. We have two measures to bound the amount of private information that the attacker can recover from earlier captured sensor data. First, once the key update procedure produces a new session key, the previous session's keys (\(K_{s}\), \(K_{mac}\)) and nonces (\(n_{1}\), \(n_{2}\)) are erased from memory. Therefore, the attacker can only decrypt the data that has already been sent in the _current_ session. Second, if the base station and the mote have not communicated for a long period of time (e.g., if the patient removes the mote or if the mote is inadvertently lost), the master key \(K_{m}\) and its derived keys expire and are removed from memory. The attacker will not obtain any session keys in this case. Note that when the master key expires, the entire key agreement protocol must be re-run to resume communication between the mote and base station. The idle time before \(K_{m}\) expires can be tuned to fit specific security needs, with a shorter idle time providing added security at the expense of greater patient inconvenience (since the biometric security procedure would have to be reactivated) and greater computational load for key agreement. Suppose that the attacker wants to send forged data using the mote. If the mote has been idle for too long and the master key has expired, the attacker needs to use a valid fingerprint to activate the key agreement protocol. To prevent this from happening, we remove \(FP\) from the mote's memory as soon as the _KeyGenAck_ message is received, so it is difficult for an attacker to obtain a valid patient's biometric information. On the other hand, if the master key is still valid, the attacker can use the current session key and establish new session keys through the key update procedure. However, the attacker will most likely be detected by the base station via the second-tier authentication scheme, as the forged patient data will not match the existing profile.