## 4 SCODE - Primarily Proposed Secure Routing Protocol  
### Overview  
Before presenting our enhanced security scheme, we briefly describe the basic scheme _Secure COordination-based Data dissEmination_ protocol (SCODE) [12]. The SCODE is based on the following assumptions. 1. There may be hundreds or thousands of homogeneous nodes uniformly distributed into a field. 2. All sensor nodes are stationary and aware of their locations. Sensors may use GPS or a secure location discovery service, e.g. [13], to estimate their locations. 3. Each node/sink has a unique ID and maintains three key types based on LEAP\({}^{+}\) scheme [14]: a unique individual key \(K_{A}\) that each node A shares with a sink; a cluster key \(K_{CH}\) shared among all nodes in the same cell; and a pair-wise shared key \(K_{AB}\) shared between a node/sink \(A\) and its neighbor \(B\) (Node B is defined as a neighbor of node A if and only if B coexists in the same or adjacent cell of A). 4. Due to resource constraints, sensor nodes are not equipped with tamper-resistant hardware. If an adversary successfully compromises a sensor, then she can obtain all key material, data, and code stored on that node. 5. Sinks are powerful nodes, moving within the sensor network field. Sinks are also aware of its location. Since sinks are mobile, sensors cannot know sink locations. 6. Each sink stores a table containing (node, key) pairs (\(ID_{node}\)\(K_{node}\)) of all the sensor nodes. 7. Sinks are trusted. In SCODE, the network plane is partitioned into a virtual grid as illustrated in Figure 3. Each node can compute its cell ID [X,Y] as \(X=\left\lfloor x/r\right\rfloor\), \(Y=\left\lfloor y/r\right\rfloor\), where \(r\) is the cell size and (x,y) is node coordinate. Nodes in each cell negotiate based on GAF [15] so that there is only one node, called coordinator, stays awake to handle routing while the others fall into sleeping mode for the sake of energy saving. Since each cell has eight neighboring cells, the cell size should be appropriately determined so that any two nodes in adjacent cells could communicate with each other within one-hop transmission. For that reason, it must be \((2r)^{2}+(2r)^{2}\leq R^{2}\) or \(r\leq R/\sqrt{8}\), where \(R\) is radio range of sensor nodes. After an interval, sleeping nodes wake up and elect again. When a stimulus appears, sensors surrounding it collectively process signal and one of them becomes a source to generate data reports. SCODE has three major phases: _data announcement, query transfer_, and _data dissemination_. In the _data announcement_ phase, the source broadcasts data announcement messages encrypted by its individual key to all coordinators. When a sink receives a data announcement message from a coordinator, it builds a query message, encrypted by the source's individual key and sends to the source. The query message is relayed through coordinators towards the source. During the _query transfer_, a routing path is established between the sink and the source. Upon receiving the query, the source starts data dissemination process to the sink. It generates data report and sends to the sink along the routing path. The sink frequently checks its current cell ID. If it moves out of the current cell, it first sends a _cache-removal_ message to remove the old path. Then it sends a new query to the source to update its new location and establishes a new routing path. In order to detect a compromised or malfunctioning node, we introduce an _inspecting system_. In the inspecting system, all eight neighboring coordinators of each coordinator play roles of inspectors. The inspectors observe messages sent out from the inspected node and detect whether it is a compromised or malfunctioning node. For example, if a malicious node \(B\) receives a message from a node \(A\) and  
Figure 3: Routing in SCODE.