# An Untraceable Data Sharing Scheme in Wireless Sensor Networks
## 3 Network Model  
As shown in Figure 1, the considered network is composed of a sink node and a set of homogenous sensor nodes, which are randomly scattered in the interested area. In this paper, we assume that all the sensor nodes in the network are static and strictly resource-limited in terms of power, communication, storage, and computation. However, they are capable of sensing, processing data, receiving and sending data, and hence they can fulfill sophisticated tasks in a collaborative manner which is discussed in Section 4. After deployment of the network, these sensor nodes intelligently form a connected network based on hello mechanism, and each pair of nodes can bi-directionally communicate with each other if their distance is not larger than \(R_{c}\). If a pair of nodes can directly communicate with each other, they are defined as two neighboring nodes. To keep the transmitted data confidential from the adversary, we further assume that each node negotiates secret keys with all the neighbor nodes and the sink node. Then, all the delivered packages in the network are encrypted based on the keys before being transmitted.  
As the transmission radius of the sensor nodes is very small, the sensor nodes cannot directly send data to the network operator. Fortunately, they can communicate with the network user through the sink node that is much powerful. We also assume that the sink node is stationary and, however, it has sufficient storage and computation capabilities to store and process the collected data of the network. In addition, the sink node has enough power to communicate with the network user through the Internet, 3G/4G or satellite communication techniques. Note that the sink node is the sole destination of all the data generated by the sensor nodes and the data packages are delivered to the sink node in one hop or multi-hops. To protect the monitored data, they are encrypted before being packed into data packages.  
In this paper, we employ the deployed network to monitor wild animals such as pandas. Specifically, the network needs to accurately record basic vital signs of the pandas, such as location, body temperature, heart rate, sleep quality, and even blood pressure in the near future. The basic descriptions of the pandas can be properly fused further to estimate the physical status of the pandas and hence we can take good care of them. To collect these data flexibly, each panda needs to wear a smart tiny wearable device that can communicate with the neighboring sensor nodes. This is reasonable considering that the size of the wearable device is constrained and hence sending the data directly to the sink node is impractical. For the sake of convenience, we assume that the communication range of the wearable device is also \(R_{c}\).  
Though the wearable device may be able to communicate with a set of sensor nodes in a specific location, it sends the data only to the nearest sensor node in order to save energy and prolong the lifetime of the network. Meanwhile, the nearest sensor node becomes the source node. The source node is responsible for delivering the data to the sink node in a relay manner. The nodes keep salient if they are not the source node or locate on the routing paths of the packages. Apparently, the source node is naturally near to the pandas and once the adversary finds the source node, he can locate the pandas easily. This is a great threat to the safety of the pandas and we need to protect the location privacy of the source node.