## 6 Design of Seltape++  
**Integrity:** The integrity check mechanism using hash values with the help of signature verification can guarantee that all the data are coming from a trusted source and that no modification is made on \begin{table}
\begin{tabular}{l l} \hline
**Security Principle** & **Requirement** \\ \hline Confidentiality & An encryption algorithm; symmetric is preferred. \\ Authentication & Asymmetric Cryptography (Signature Verification). \\ Integrity & Hash dependency of data combined with PKC signature verification; and/or message authentication code \\ Availability (DoS Attack Resilience) & Immediate verification at the packet-level. \\ Replay Attack Resilience (freshness must be preserved) & Inserting a constant and unique number for each version to be comparable for each node to detect repeated data. \\ Worm-Hole Attack Resilience & Avoid using the same symmetric cryptography keys in the whole network. \\ Battery-Drain Attack Resilience & Using weak authentication on packets that have expensive computations on the time of reception; and, an auto-halting system that will partially protect the system from resource exhaustion. \\ \hline \end{tabular}
\end{table} 
Table 2: Security Model Requirements (SMR). \begin{table}
\begin{tabular}{l c c} \hline
**Algorithm** & \multicolumn{2}{c}{**Signature**} \\ \cline{2-3}  & **Sign** & **Verify** \\ \hline RSA-1024 & 304 & 11.9 \\ \hline ECDSA-160 & 22.82 & 45.09 \\ \hline RSA-2048 & 2302.7 & 53.7 \\ \hline ECDSA-244 & 61.54 & 121.98 \\ \hline \end{tabular}
\end{table} 
Table 3: The energy cost of cryptographic primitives (millijoules). them by a malicious node. WSNs are limited in the number of public cryptography operations that they can perform in their lifetime; hence, we cannot sign every packet for the sake of integrity verification. Therefore, algorithms, like Hash-Chain, Hybrid and Sluice, have been proposed that use single public key signature verification with the use of a hash dependency list or tree. The general idea of using hash dependency and signature verification for integrity verification is shown in Figure 3. If symmetric cryptography is used, message authentication code is also another approach, which is applicable in WSNs for integrity purposes. However, studies performed by the authors of [12, 16, 22, 23] show that a successful way for authenticating image code has to be at the packet level. This requires assigning hash value for each packet in previous packets using a pre-defined pattern, so that each packet being received in the nodes can be immediately verified by its previously received hash value. The most efficient pattern to the best  
Figure 4: The hash dependency structure in Seluge (adapted from [12]). Figure 3: Integrity verification using hash dependency. of our knowledge is employed in Seluge (Figure 4). Therefore, SMR suggests using this pattern for the hash dependency algorithm. **Mitigating DoS Attack:** DoS attack resiliency is an important factor, which has either been neglected or partially preserved in the design of all the security models of WSN reprogramming protocols. Although hash dependency is provides a good and efficient way of authenticating data and preserving integrity, it is susceptible to DoS attacks. Moreover, out of order packet delivery is a regular occurrence, because of the collision in typical wireless networks, and it can cause data in page P to arrive before page P-1, therefore causing the receiving node to buffer these packets, as it cannot verify it unless all the packets in page P-1 are received. This problem is also known as _authentication delay_. If an attacker sends a lot of bogus data or packets indicating that they are from higher numbered pages, then the node will need to either buffer them all or simply drop them.