## 3 Our Approach
### Routing Protocol  
In order to improve network scalability and throughput, we use a clustering technique based on Random Competition based Clustering (RCC) [27] to construct a multi-level network structures. Previous approaches [28, 29, 30] group nodes into clusters, and within each cluster a node is elected as a cluster head. Cluster heads together form a higher-level network, upon which clustering can again be applied. This structure simplifies communication and makes it possible to restrict bandwidth-consuming network attacks like flooding to a single cluster.  
For a wireless network with \(n\) nodes capable of transmitting at \(Wbits/s\), according to [31], the throughput, \(T\), for each node under optimal conditions is:  
\[T=\Theta\Big{(}\frac{W}{\sqrt{n}}\Big{)}\]  
Thanks to the clustering approach, in a two-level mobile backbone network where the number of nodes is \(n\) and the number of clusters is \(m\), the throughput in the lower level becomes:  
\[T_{1}=\Theta\Big{(}\frac{W_{1}}{\sqrt{n/m}}\Big{)}\]  
and in the higher level:  
\begin{table}
\begin{tabular}{|c c|} \hline Parameter & Description \\ \hline \hline \multicolumn{2}{|c|}{Redundancy-related} \\ \hline \(N_{p}\) & Number of reputation tables stored in a node. \\ \(N_{d}\) & Number of values stored for each sensor/value pair. \\ \(N_{r}\) & Number of routers per node. \\ \hline \multicolumn{2}{|c|}{Adaptation-related} \\ \hline \(t_{\tau}\) & Time between trust data messages sent to the reputation servers. \\ \(t_{\rho}\) & Time between reputation data messages from the servers to the nodes. \\ \(t_{v}\) & Time between sensor data messages from the sensor nodes to the network. \\ \(t_{r}\) & Minimum time between messages containing route information. \\ \hline \end{tabular}
\end{table}
Table 1: Parameters that can be adjusted dynamically to adapt the environment to possible attacks.  
\[T_{2}=\Theta\Big{(}\frac{W_{2}}{\sqrt{m}}\Big{)}\]  
Node clustering, however, reduces redundancy and introduces single points of failure, as an intruder could control a whole zone by attacking its cluster head. The solution we propose is to introduce redundancy again. Every node in the network will have several cluster heads and will distribute messages randomly between them. This additional redundancy does not reduce the maximum throughput because at any given time the network structure is exactly the same as in the pure RCC scheme.  
Of course, no node will ever select an untrusted cluster head. On the other hand, the s-consistency check required by the mechanism of reputation sharing would not be feasible without the non-determinism in the message paths introduced by the routing protocol. Therefore, the trust framework and the routing protocol cooperate in order to minimize the threats.  
It may be argued that for every node to have two cluster heads, we need to double the backbone nodes so that there are twice as much backbone nodes in the coverage area. While it is true that more nodes have to belong to the backbone, this does not imply any reduction of the attainable throughput, as at any given time half the backbone nodes will not be used as such, and therefore the network structure remains exactly the same as in the pure RCC case. On the contrary, the burden of routing backbone messages is more distributed and therefore the penalty in energy consumption of being a cluster head is significantly reduced.