## 4 The System Model
### Security and Performance Model  
In the presence of inside and outside attacks, our secure scheme for a WSN is concerned primarily with the evaluation of the three attributes: confidentiality (sensitive information is not disclosed to unauthorized member), integrity (data and programs are modified only in a authorized manner) and availability (readiness for usage). The upper part of Figure 2 shows a CTMC model representing the states of the system. After initialization, the system starts to operate properly in the good state \(G\). The system is under the specific threat of timing attacks conducted by random attackers. We describe the events that trigger transitions among states in terms of transition rates. It is assumed that there is only one attacker in the system at a time. If an attack happens, the system is brought to the timing attack state \(T\) at rate \(\lambda_{2}\). In this state, the attacker tries to break the cluster key by taking time observations. Therefore, while the system is in state \(T\), the attacker is not yet able to access confidential information. It takes a certain time to perform the timing attack after which the attacker may know the cluster key, and the system moves to the compromised state \(C\) at rate \(\lambda_{3}\). Consequently, \(\lambda_{3}^{-1}\) is the mean time a timing attack takes. There is a possibility indicated by the arc \(\lambda_{6}\) that the attacker successfully breaks the key, while he or she fails at accessing the data or just fails to conduct a successful timing attack. If the attacker succeeds in determining the cluster key through time measurements, confidential data will be disclosed, which is assumed to incur a high cost. This can only happen if the system is in the compromised state \(C\), and we call the incident of entering the compromised state a security failure. In this state, all of the data transited between sensors and gateway nodes are not secure any more; therefore, they must be repeated and do not contribute to the throughput. The lost jobs are represented by the red arc in Figure 2.  
Renewing the cluster encryption key can prevent or interrupt a timing attack. The arcs from other states to state \(R\) represent these operations. The rekeying rate is the parameter one can tune at the command node. It indicates how often the system launches the rekeying process. The rate \(\lambda_{1}\) is the rekeying rate when the system is in the good state \(G\) or in the timing attack state \(T\). The considered WSN has intrusion detection mechanisms running that can find indicators of compromised behavior, in which case the system will trigger the rekeying process more frequently. The intrusion detection mechanism does not trigger the rekeying immediately because of the rekeying cost to the system. Therefore, in the compromised state \(C\), we assume that the rekeying process is triggered at a different rate, \(\lambda_{5}=n\lambda_{1}\). The parameter \(n\) is called the coefficient of rekeying in the compromised state because it represent the relationship between the rekeying rate in the good state and the rekeying rate in the compromised state. All of these three paths transfer the WSN cluster to the rekeying state \(R\) from which it will finally return to the initial state \(G\). The challenge is to find an optimal value for the rekeying interval. The rekeying should in the optimal case happen before or soon after the system enters the compromised state. In the rekeying state, the sensors do not transit any data to the gateway, and some jobs will be lost in this state. As a result, the system throughput is degraded. The rekeying process will bring the system back to the initial state \(G\) at rate \(\lambda_{4}\). The mean time to perform the rekeying process is \(\lambda_{4}^{-1}\). The lower part of Figure 2 shows the queueing model proposed to exhibit the performance attribute of the WSN. The data collected and preprocessed by sensors are transmitted to the gateway node before forwarded to a command node, which is represented by a queue.