## 4 Network Access Control Security Framework
### Node Identification, Compliance and Data Security  
As sensor networks are mostly deployed in human-unattended environments, usually for critical sensing measurements tasks, the authentication of the data source as well as the data itself is of critical concern. In fact, authentication guarantee can provide both sensor and router identification ability, in order to protect the integrity and freshness of critical data, and forbid and/or identify several security attacks. Traditionally, there are two schemes to provide authentication: digital signatures based on public-keys and message authentication code based on symmetric-keys. In the current proposal, the same public and private key pairwise, generated by the LSEND protocol to build the cryptographically generated addresses (CGA) addresses, is used to authenticate the network nodes. As aforementioned, the CGA are IPv6 addresses where the least 64 address bits are generated by computing a cryptographic one-way hash function from a public key and other auxiliary parameters. The address owner uses the corresponding private key to declare the address ownership and to sign the messages sent without a certification authority or other security infrastructure. The binding between the address and the public key can be confirmed by re-computing the hash value and by comparing the hash with the interface identifier. As a consequence, messages sent from a CGA IPv6 address can be protected by attaching the public key and auxiliary parameters and by signing the message with the corresponding private key. Every node can generate valid private and public key pairwise and the correspondent CGA address and, once registered in the border router, no other node can use the same address. In our proposal, after the LSEND registration procedure, the administrator approves manually each new node based on its CGA address. Once authenticated, each node is able to verify if the sender node is the right owner of the CGA generated source address. One of the key advantages of this approach is that, in addition to ensuring the identity of the sender, the same public and private pairwise can be also used to guarantee the authenticity, confidentiality and data freshness to all protocols or mechanisms in use.  
Traditionally, two different approaches are used to perform node security compliance. In the first approach, a piece of software named agent is used to perform the nodes assessment. The agent returns to the security enforcement point (in our case, the border router) the result of the assessment. In the second approach, the assessment is performed based on the traffic generated by the node under assessment. The security enforcement point sends requests to the node under assessment and the evaluation is made based on the responses. Usually, the first approach returns more accurate resultsthan the second approach. Moreover, the second approach is more verbose than the first one, because multiple messages are exchanged. The current proposal adopts the agent based assessment approach. The agent can be previously installed on the nodes and the assessment is based on cryptographic hash of the installed software. If the agent is not installed, we assume that the node is not compliant and a new image, which includes the assessment agent, will be uploaded by the reprogramming mechanism on the fly. The hardware configuration can also be evaluated during the assessment, although this feature is not considered in our solution. Note that any solution to perform nodes security assessment is very dependent on the operating system and the hardware used in the network devices. So, different agent versions might be required if different operating systems or hardware platforms are to be used. The border router can use operating system fingerprinting in order to determine which agent version has to be used.