## 6 Module II: Data Authentication and Integrity  
The data is encrypted before transmission to protect against passive attacks such as eavesdropping. For active attacks, such as data and transaction falsification, message authentication is required. The two important security aspects to achieve: (i) Verify that the content of the message is not altered and; (ii) the source is authentic. We could achieve authentication by either using a message authentication code (_MAC_), or one-way hash function (_OWH_). MAC would require the sender (SNi) and receiver (BS) to share a secret key. The authentication code is calculated as _MAC = F (k, D). DES_ or other algorithms can be used to generate the code. The OWH also accepts a variable size message (_D_) as input and produces a fixed sized digest _MD = H (D)_ as output. Examples for OWH are _SHA_, _MD5_, _Whirlpool and_ HMAC. The advantage of OWH over MAC is the fact that it does not use encryption, which is quite slow. Comes in the middle, HMAC which is a MAC derived from OWH such as _SHA-1_. It could be expressed as: MD = HMAC (K, D). If we opt to use HMAC as an example, the (Mi\(\rightarrow\)j) will be rewritten as in Equation (26):  
\[\mathrm{M_{i\rightarrow j}}=\mathrm{APID_{i}}\parallel\mathrm{OHPID_{i \leftrightarrow j}}\parallel\mathrm{E_{ki\rightarrow j}}\left(\mathrm{APID_{i}} \parallel\mathrm{PID_{i}}\parallel\mathrm{E_{ki\rightarrow bs}}\left( \mathrm{D_{i}}\right)\right)\parallel\mathrm{\textbf{HMAC}_{ki\rightarrow bs} \left(\mathrm{PID_{i}}\parallel\mathrm{\textbf{D_{i}}}\right)} \tag{26}\]  
The key (ki\(\rightarrow\)bs) is shared between SN and the BS. The message could be authenticated with MD using OWH as in Equation (27):  
\[\mathrm{M_{i\rightarrow j}}=\mathrm{APID_{i}}\parallel\mathrm{OHPID_{i \leftrightarrow j}}\parallel\mathrm{E_{ki\rightarrow j}}\left(\mathrm{APID_{i}} \parallel\mathrm{PID_{i}}\parallel\mathrm{E_{ki\rightarrow bs}}\left( \mathrm{D_{i}}\right)\parallel\mathrm{\textbf{H(PID_{i}}\parallel\mathrm{ \textbf{E_{ki\rightarrow bs}}\left(\mathrm{\textbf{D_{i}}}\right))}}\right) \tag{27}\]  
As it is transparent from expression Equation (27), we need more processing time and therefore more power consumption because we have encrypted a sizable packet. There is a tradeoff between higher security and energy conservation. The first approach is more appropriate. Authentication for the broadcast messages is done as in Equation (28):  
\[\mathrm{M_{b}}=\mathrm{Padding}\parallel\mathrm{BPID_{i}}\parallel\mathrm{E_{ kbi}(D_{b})}\parallel\mathrm{HMAC_{kbi}(D_{b})} \tag{28}\]  
Alternatively, it can be achieved using Equation (29):  
\[\mathrm{M_{b}}=\mathrm{Padding}\parallel\mathrm{BPID_{i}}\parallel\mathrm{E_{ kbi}(D_{b}\parallel\mathrm{H(kb_{i}}\parallel D_{b}))} \tag{29}\]  
The message could contain other important information such as _sequence number_ (similar to the well-known _HDLC_ and _TCP_ protocols) and _time stamp_. The receiver uses the sequence number to verify the order of messages. Time stamp is used to check the delay threshold. Both checks will enhance protection against various active attacks. The message core data (Di) could have the following format:  
\[\mathrm{D_{i}}=\mathrm{SEQ\_NO}\parallel\mathrm{TIME\_STAMP}\parallel \mathrm{MSG\_LGTH}\parallel\mathrm{SENSED\_DATA} \tag{30}\]  
Providing authentication to protect against active attacks is crucial in any communication. The innovation of our authentication module is by providing message authentication for every transmission in the network without limiting it to real messages unlike many other works proposed. The adversary can utilize any captured transmission to launch attacks against the network, which could include real, fake and acknowledgement messages. Our module can use MAC, OWHF and HMAC according to the security needs of the WSN. The network can adjust the parameters according to the security situation using adaptive framework.