# An Embedded Sensor Node Microcontroller with Crypto-Processors
## 1 Introduction  
For many wireless sensor networks (WSN) in industrial, medical, and military applications, secure operation is mandatory [1]. The security requirements in WSNs are slightly different from the typical requirements of common communication networks. In all these networks, the security is characterized by data confidentiality, authenticity, integrity, and replay prevention [2]. Data confidentiality ensures that the data transmitted by a node do not leak to neighbouring networks. The standard approach to provide confidentiality is data encryption. Authentication is required to prevent malicious data injection by an adversary. It helps the receiver to confirm that the received data are sent from a trusted source. Authentication schemes are based on cryptographic signatures. Data integrity ensures that the data are not altered during their transmission. Integrity can be provided by implementing secure hash functions. Replay prevention must ensure that a transmitted message cannot be reused to bypass security schemes. The particular properties of wireless sensor networks, e.g., network size, harsh environment, dense deployment, changing topology as well as limited resources, make the network security easy to compromise if appropriate countermeasures are not applied. Operating in a hostile environment, sensor nodes are vulnerable to different types of malicious attacks. Eavesdropping, impersonation, injection of faulty information as well as denial of service are only some examples of hostile activities. A wireless sensor network attacker will try to compromise the network security and authentication, availability of data and the network service integrity [3]. Attacks canbe launched on all layers of a sensor network protocol stack [4]. A simplified communication model is illustrated in Figure 1.  
Attacks on the physical layer try to disable network functionality by radio frequency jamming or try to extract sensitive information by node tampering. Jamming attacks launched by a powerful radio source are very hard to defend [5]. Some techniques such as spread spectrum communication using frequency hopping can improve the network resilience [6], but these techniques require substantial computational resources, which are not available in typical wireless sensor nodes. Anti-tampering techniques attempt to prevent the disclosure of confidential data if a node is physically attacked [7; 8]. The intruder may also try to install malicious software on the physically accessed node [9]. An effective anti-tampering can be implemented during chip design stage or by a tamper-proof package. The standard cryptographic algorithms usually persist to exhaustive attacks but their hardware and software implementations have exhibited vulnerabilities to side-channel attacks, e.g., power analysis and fault injection attacks. Countermeasures against fault injection attacks on cryptographic devices have been described by [PERSON] _et al._ in [10]. In [11], [PERSON] _et al._ described the application of the fault-based side-channel cryptanalysis-tolerant Rijndael symmetric block cipher architecture at different levels of granularity, _i.e._, checking against the inverse operation at the operation, round or full cipher level. This approach exploits the inverse relationship that exists between Rijndael encryption and decryption at various levels and develops concurrent error detection architectures that explore the trade-off between area overhead, performance penalty and error detection latency. The first passive and active combined attacks were reported in [12]. [PERSON] _et al._ showed that it is possible to attack an RSA exponentiation that was protected against power analysis attacks using a balanced algorithm with message randomization, by inducing _ad hoc_ faults. A good way to protect against these attacks is to detect the injected fault immediately, rather than wait until the computation of the signature is completed, and upon detection, abort the process and thus avoid generating the power profile that discloses the secret key.