# A PUF- and Biometric-Based Lightweight Hardware Solution to Increase Security at Sensor Nodes
## 5 Lightweight Protocol to Authenticate Sensor Nodes by Dual-Factor  
Let us consider a sensor network with sensors that are able to exchange information and transmit their readings to a base station. Taking into account that sensor nodes are resource-constrained in terms of processing, memory and power consumption, the communication protocol should be lightweight. The base station has more capabilities to process the sensed data and to communicate them to other networks such as Internet. Our focus is on security at sensor nodes. Base station security is outside the scope of this paper. The proposed protocol is able to exploit the dual-factor authentication of the sensors presented in Sections 3 and 4. It contemplates a registration phase in a secure environment. As described in Section 4.4, each sensor node, D, stores Salted Data, \(\left\{SD_{X}^{D}\right\}=\left\{ID_{x}^{D}\oplus\text{QFM}_{x}^{X}\right\}\), and Helper Data, \(\left\{HD_{K}^{D}\right\}=\left\{ID_{x}^{D}\oplus\text{K\_coded}_{x}\right\}\), in its non-volatile memory, for the legitimate user X who can authorize the node to transmit information. One of the x secrets, \(\left\{K_{x}\right\}\), encoded with the Error Correcting Code, is used as the global master secret of the network, \(K_{0}\). If the \(\left\{ID_{x}^{D}\right\}\) are fully random, Helper Data do not reveal nothing about the master secret and the legitimate user. Figure 6 illustrates the proposed protocol between a sensor node D and the base station. The notation used to describe the operations is the following:  
* \([a\parallel b]\) represents the plaintext data \"\(a\)\" concatenated with the plaintext data \"\(b\)\". * \([c]_{K}\) represents the plaintext data \"\(c\)\" encrypted by the key \"\(K\)\" using, for example, the block cipher AES (Advanced Encryption Standard). AES was approved in 2001 as a US federal standard (FIPS PUB 197) and then, it was included in the ISO/IEC 18033-3 standard. Hence, AES is the dominant symmetric-key algorithm in many commercial applications and it is included as hardware module in many sensor node microcontrollers. The messages are authenticated by a Message Authentication Code, MAC. The most popular approach in practice is to use a block cipher such as AES in Cipher Block Chaining (CBC) mode according to NIST 800-38A. This is not illustrated in Figure 6 to simplify the scheme. The notation used to describe the message exchanges is as follows:  
* \"\(n\)\" represents a randomly initialized index which increases by 1 both in the sensor and the base station simultaneously after each message exchange is successfully completed. * nonce\({}_{B}\) and \(nonce_{D}\) represents, respectively, the random seed generated by the base station and the sensor, which are used to derive the new key \(K_{new}\) from the old key \(K_{old}\). * \(h\) (\(x\),\(E\)) refers to a cryptographic hash function approved by NIST and \"\(E\)\" is the identifier of the network. A message time-out, \(T_{out}\), is established for each message pair exchanged. That is, each message sent needs a response in a specific time. If the response is not received before the time-out, the message is retransmitted again. When the base station requires sensor node D to communicate sensed data, a mutual authentication is performed previously. In order to ensure that symmetric keys are used only once to increase security, a session key, \(K_{new}^{D}\), is derived from the previous session key, \(K_{old}^{D}\). The first time a communication is initiated with a node, the shared secret key is used, \(K_{old}^{D}=K_{0}\). Following NIST  
Figure 6: Proposed lightweight protocol. recommendations [32], a Key Derivation Function, KDF, is applied to \(K_{old}^{D}\) and the random seeds (nonces) interchanged at steps 1 and 2, to obtain \(K_{new}^{D}=KDF\big{(}\text{nonce}_{B},\text{ nonce}_{D},K_{old}^{D}\big{)}\). At step 2, sensor node D reads the start-up values of its SRAM cells and obtains the responses \(\left\{\overline{ID}_{x}^{D}\right\}\).