# A Framework for Constructing a Secure Domain of Sensor Nodes
## 3 The Concept of a Security Domain of Sensor Nodes  
### Secure Domain Architecture  
To build a secure network of IoT nodes, one should take into account the security observations described in the previous section and implement the following postulates:  
* Wireless sensor nodes (**Sensor node**: Element of the sensor network, which includes at least the measuring element (sensor), a microcontroller, and a communication module that allows the transfer of measured data through wireless connections. **Sensor**: Measuring component of the sensor node) constitute the cluster of sensors (domain) in which security mechanisms are implemented;
* The resources of each node are protected by cryptography;
* Data transmission between cluster nodes and between clusters is protected by cryptography;
* Each cluster uses the local trust structure and a secure procedure for generating and distributing cryptographic keys;
* Each sensor node must be registered in the domain before it can start working in the domain. Registered nodes in the domain before they begin their activities must be authenticated;
* The necessary hardware component of each sensor node is a TPM.  
From a security perspective, each secure domain of sensor nodes is autonomous, i.e., all procedures related to the creation of trust structures with the generation, distribution, and renewal of keys are performed internally in a secure domain. All necessary data for these procedures are stored in the protected resources of the domain sensor nodes. The cluster structure in which a secure domain of sensor nodes can be created is similar to that shown in Figure 1.  
Cluster objects (sensor nodes) exchange data using wireless links. An example of such an object can be a soldier or an unmanned aerial vehicle (UAV) equipped with measuring sensors. The object's task is to collect data from its measurement sensors, pre-process them, and securely transfer aggregated data to another sensor node.  
Figure 1: Structure of a sensor node network cluster.  
The cluster nodes form two interpenetrating domains [15] (each cluster node belongs to both domains):  
* **Security domain**. The domain of security is created by all sensor nodes registered in the domain. At a given moment, there is exactly one sensor node in the security domain that acts as a Master (M node). Such a node is the authority of security in the domain. Its resources store the description of the domain and the descriptions of all sensor nodes forming the domain and the necessary data to authenticate other nodes in the domain. The other nodes in their resources store a copy of the secure domain description obtained from the M node and act as a Replica (R node). In case of damage to the node acting as a Master, the procedure of selecting a new M node from correctly functioning R nodes is initiated. To secure transmission in the security domain between a given sensor node and the M node, a symmetric key (NSK--Node Secure Key) is used, which is known only for these two nodes. For this reason, the network creates star topologies in the security domain, regardless of the transmission medium used (Figure 2A) In the domain, diagnostic procedures are also performed to detect nodes that are working incorrectly. To secure transmission in these procedures, a symmetric key NDK (Node Diagnostic Key) common to all domain nodes is utilized. Each domain sensor node (both M nodes and R nodes) is equipped with measuring sensors and is a natural source of sensor data.
* **The domain of protected transmission**. In this domain, one of the sensor nodes is the recipient (sink node) of data from the other nodes of the domain and acts as the Gateway (G node) in this domain. Both the M node and R node can perform a Gateway role. The role of the G node is also to securely transfer sensor data coming from the domain to recipients working in other domains. (Figure 2B).