## 3 Literature Reviews
### ESPDA as a Secure Data Aggregation Protocol  
There are many secure data aggregation protocols proposed so far. The works in [6,7] build many approaches to classify them. For example, the classifications are based on adversary types, single/multiple aggregator model, the existence of verification phase, the types of attacks faced, the security properties provided, the cryptographic primitives used, and the type of sensor data (plain or encrypted sensor data). However, for briefness, we only explain a protocol that is used in our proposed protocol. Figure 4: MS-LEACH protocol. Figure 5: ESPDA protocol. Where the various symbols denote:  
\(i,H,BS\): A sensor node \(i\), a CH and BS, respectively;  
\(\Rightarrow\), \(\rightarrow\): Broadcast and unicast transmissions, respectively;  
\(id_{i}\): The id of node \(i\);  
\(d_{i}\): Sensed data from node \(i\);  
\(pattern\_code_{i}\), \(timestamp_{i}\): The pattern code and timestamp of node \(i\);  
\(k_{i},r_{b},k_{i,b}\): The secret built-in key of node \(i\), the random session number from BS and node specific session key of node \(i\), respectively;  
\(mac_{k}(\,)\): MAC calculated using \(k\) key;  
\(i_{selected}\), \(i_{de-selected}\): The selected set of node that has unique pattern codes and unselected ones, respectively. Energy-efficient and Secure Pattern based Data Aggregation (ESPDA) [19] works on clustered-based WSNs and is suitable for LEACH-based secure routing protocols. Figure 5 shows a summary of ESPDA protocol. The main idea of ESPDA is that instead of directly sending the actual sensed data to the CH, the sensor nodes send their pattern codes first. The pattern code is data representative of the sensed data and is generated based on the secret pattern seed which is periodically distributed by the CH. The CH then compares those pattern codes, selects only the unique ones and requests the actual data from the nodes having the corresponding unique codes. In reply, each selected node then sends the encrypted actual data to the CH while the rest may be instructed to drop the data. The CH does not need to decrypt the received encrypted data because the data aggregation process is done prior to the actual data transmission. This reduces the overhead of the CH and thus contributes to the energy efficiency. Then CH can forward the message to the BS. Each sensor node is assigned a unique id (\(id_{i}\)), a node specific secret key (\(k_{i}\)) and a secret key common to all nodes (\(k\)) prior to the deployment by the BS. In addition, BS periodically broadcasts a random session number (\(r_{b}\)) in encrypted form using key \(k\) which is \(enc_{k}(r_{b})\). Upon receiving \(r_{b}\), any node \(i\) computes the node specific session key (\(k_{i,b}\) ) for data communication by XOR-ing its built-in secret key \(k_{i}\) with \(r_{b}\), \(k_{i,b}=k_{i}\bigotimes r_{b}\). Later on node \(i\) uses \(k_{i,b}\) to encrypt its actual data. Accompanying this encrypted data, node \(i\) also sends its timestamp and id. Those two pieces of data will help the BS to choose the right \(r_{b}\) and compute the right \(k_{i,b}\) to decrypt the message. In order to provide data integrity, the MAC of the message computed with \(k_{i,b}\) is also included in the message. This protocol uses the Non-blocking OVSF Block-Hopping (NOVSF-BH) technique. This technique improves the security and the spectral efficiency of the network. In NOVSF codes, each OVSF code has 64 time slots such that any number of this timeslots can be assigned to a channel. The proposed NOVSF-BH technique assigns data blocks to time slots using different mapping in every session, so besides equipping every sensor node with keys, the BS also periodically sends a different mapping permutation in encrypted format using the key \(k\) (\(enc_{k}(permutation)\)) to CHs. This mapping permutation allows every node to map its data blocks according to the given code before sending it to the CH.