# A Framework for Constructing a Secure Domain of Sensor Nodes
## 3 The Concept of a Security Domain of Sensor Nodes
### The Concept of Protection for Sensor Nodes  
The creation of a secure domain of sensor nodes results from the fact that such a domain will perform its tasks in an unfriendly environment exposed to unauthorized impact on individual domain nodes. This means that every element of the domain should be pre-prepared before starting normal operations in this hostile environment. It is assumed that the preparation procedures of each sensor node should be performed in a safe and controlled environment outside the area of regular sensor node operation. This approach allows the secure preparation of further sensor nodes for work in the domain, regardless of the regular domain operation.  
The task of pre-preparing the sensor nodes of the domain is carried out by the base node (B node). This node is also responsible for generating the Domain Key (DK) for the domain, defining the domain description parameters, generating identifiers for the future sensor nodes of the domain, and defining the transmission parameters for the wireless link used by the domain nodes. From the point of view of security procedures, the B node is not a member of the secure domain of sensor nodes. It works only in a safe area.  
Figure 2: The logical topology of the network in the security domain (**A**) and network in the domain of the transmission of data obtained from sensor nodes (**B**).  
It was assumed that each node of the sensor domain would use its local trust structure. This trust structure will be used to secure data stored in the resources of a given node, as well as to build a trust relationship with other nodes belonging to the same security domain. For this purpose, a TPM is used, which is a necessary component of every sensor node.  
The local trust structure is based on the hierarchy of asymmetric keys (e.g., Algorithm Rivest-Shamir-Adleman (RSA) 2048). At the top of the hierarchy is the Endorsement Key (EK), which, for a given module, can be generated only once. It is not possible to modify or reset this key. It is also not possible to read the private content of this key. The next keys in the hierarchy are the Storage Root Key (SRK) and the Domain Key (DK). The SRK key is generated during the take over ownership procedure of the TPM. During this procedure, a secret (a string of characters) is determined, which later will be necessary to perform authorized actions of the sensor node in the security domain. The DK key is common to all nodes of the secure domain and is used for only the first exchange of symmetric keys between domain nodes. The DK is distributed between the domain nodes using a specially prepared secure procedure. The DK distribution procedure between domain nodes is described in detail in [19; 20]. The private part of this key is never available in plain text form outside of the TPM module, and the public part of this key, although available in plain text outside the TPM module, is never transmitted between the nodes in an open form. The DK can be treated as the identifier of the secure domain of the sensor nodes, and the EK can be treated as the identifier of the sensor node in the domain.  
Access to the NVRAM of the TPM module is protected by TPM mechanisms that use the SRK of the module. For this reason, the sensor node identifiers, symmetric keys used by the node, and addresses of nodes acting as the Master and Gateway nodes in the domain, as well as the transmission parameters of the wireless link used by the nodes in the domain are stored in this memory. The other sensitive data that are stored in the EEPROM of the sensor node are cryptographically protected using a symmetric NK. This key is one of the keys stored in the NVRAM of the TPM.