## 5 SCODE_plus_: Enhanced Secure Routing and Key Management Scheme
### Inspecting System  
One of the most security concerns in sensor networks is node compromise. Due to resource limitation, sensor nodes are not equipped with any tamper-resistant hardware. Once a node is compromised, the adversary can extract all information stored in that node including all key materials. Then the adversary can use this node to perform various types of attacks to the networks. Defending against node compromise in routing is a non-trivial task.  
We propose an _inspecting system_ which utilizes neighboring coordinators to detect if a node performs any wrongdoing. For each coordinator, there are six inspection nodes, called inspectors, which are neighboring coordinator of that node. For example, in Figure 7 there are six inspectors _A, C, D, E, F_, and \(G\) around node \(B\).  
If a compromised node modifies routing information such as \(\mathit{ID}_{\mathit{S}_{\mathit{s}}}\)\(\mathit{CID}_{\mathit{S}_{\mathit{s}}}\)\(\mathit{ID}_{\mathit{Sinb}}\)\(\mathit{CID}_{\mathit{Sinb}}\)\(\mathit{CID}_{\mathit{This}}\) in the message, that can be easily detected by the uplink and downlink nodes because those nodes also maintain the source, sink, and information about its neighbors.  
In case the compromised node \(A\) modifies \(\mathit{CID}_{\mathit{Near}}\) and then relays to a wrong cell, the inspectors can detect this by overhearing the message sent out of \(A\) and computing next cell ID based on the information in the message. If the actual next cell ID is not the same as next cell ID in the message, then the inspectors will report this as a problem.  
If \(A\) drops the packet, then the next cell node (uplink node) (which is also one of the inspectors) will detect by looking at packet sequence number. If \(A\) tries to modify the message content, it can be recognized by six next cell nodes or the source/sink. For example, if packet ID (_PID_) was modified, then the uplink node can detect that by verifying MAC using the pair-wise shared key \(K_{\mathit{S}\mathit{A}}\); if encrypted data \(\{\mathit{DATA}\}K_{\mathit{S}}\) is modified, then the source/sink can detect by verifying the MAC with the source key \(K_{\mathit{S}}\).  
Once the compromised node is detected, the inspectors alert to other coordinators and eliminate that node from participating in the routing process. Coordinators consider that cell a void cell and establish another route by finding a round path. For example in Figure 7, the coordinator \(A\) is legitimate node, and \(B\) is a compromised node. Node \(C\) and \(G\) are common inspectors of \(A\) and \(B\), so they can receive the message sent out from \(A\) and \(B\) and can detect if \(B\) is doing something wrong. When \(C\) and \(G\) detect \(B\) as a compromised node, they send an alert message to the neighboring coordinator of \(B\) including \(A\), \(D\), \(E\), and \(F\). The alert message sent from \(C\) will go through \(C\)\(\rightarrow\)\(D\)\(\rightarrow\)\(E\)\(\rightarrow\)\(F\)\(\rightarrow\)\(G\)\(\rightarrow\)\(A\)\(\rightarrow\)\(C\). The alert message sent out from \(G\) will go through \(G\)\(\rightarrow\)\(F\)\(\rightarrow\)\(E\)\(\rightarrow\)\(D\)\(\rightarrow\)\(C\)\(\rightarrow\)\(A\)\(\rightarrow\)\(G\). This duplicated alert message makes sure that the compromised node is detected by two inspectors. The alert message is encrypted by the pairwise key between the sender and the receiver. For example, \(G\) sends an alert message to \(F\):  
\[G\to F\text{: }ID_{G}\text{, }CID_{G}\text{, }ID_{B}\text{, }CID_{B}\text{, }\text{MAC(}K_{GF}\text{, }ID_{G}\text{, }CID_{G}\text{, }ID_{B}\text{, }CID_{B}\text{)} \tag{3}\]  
where \(ID_{G}\text{, }CID_{G}\text{ is node ID and cell ID of the inspector which detects compromised node, and }ID_{B}\text{, }CID_{B}\text{ is the node ID and cell ID of the compromised node.