# Public Key-Based Authentication and En-Route Filtering Scheme in Wireless Sensor Networks
## 2 Related Works  
To filter out false reports as early as possible, many en-route filtering schemes have been proposed, which can be classified into two major categories: symmetric-key cryptography based schemes and public-key cryptography (PKC) based schemes. Due to the limited space, we only discuss the existing PKC-based schemes more related to this study. To mitigate the impact of compromised nodes, [PERSON] et al. [7] proposed a suite of location-based compromise-tolerant security mechanisms. A notion of location-based keys (LBKs) was proposed based on a new cryptography concept called pairing, in which the private key of an individual node was bound to both its ID and geographic location. Then, an LBK-based neighborhood authentication protocol was proposed to constrain the impact of compromised nodes to their vicinity. Moreover, a location-based threshold-endorsement scheme, called LTE, was proposed to filter out bogus reports during their early transmission stages. The proposed approaches can reduce the impact of compromised nodes in the network and provide high resiliency. However, the bi-linear pairing is too expensive for low-energy sensor nodes, and localization will incur additional communication overhead. Furthermore, [PERSON] et al. [14] pointed out that LTE cannot resist key compromise impersonation (KCI) attacks and cannot provide forward secrecy. [PERSON] et al. [19] proposed a public key-based (PDF) false data filtering technique based on elliptic curve cryptography [22] and [PERSON]'s threshold cryptography [23]. In PDF, each sensor holds a unique share of the system secret key, and any \(t\) sensors can collaborate to construct the system secret key. Thus, the adversary needs to compromise at least \(t\) sensors to infer the system secret key. Every report is attached with a digital signature cosigned by the \(t\) detecting nodes using the ECPVS signature scheme [22], and any forwarding node with the system public key can verify the report. PDF can effectively reject the false data reports, but it is vulnerable to both report disruption attacks and selective forwarding attacks. [PERSON] et al. [20] proposed a hybrid approach for filtering false reports in WSNs using a hash-based short signature. In the proposed scheme, a forwarding node will detect the false report by verifying the signature of the report. Moreover, the adversary cannot forge a signature by compromising a CH node. The proposed scheme provides high security resilience, and requires slight more cost than symmetric key approaches but substantially less cost compared to public key-based approaches. [PERSON] et al. [6] proposed an authentication and en-route data filtering scheme for WSNs in the IoT scenario, which used the efficient ID-based signature algorithm to generate signature share and used the verifiable secret sharing technique to distribute the shares to multiple cooperative sensor nodes. When an event occurs, multiple neighboring nodes in the event area collectively generate the event report and sign the report. Finally, the signed report is forwarded to the sink through multi-path routing. The forwarding nodes verify the signature of a report with the predefined probability. The proposed scheme can defend against node compromise attacks as well as denial of service (DoS) attacks. However, multi-path routing will incur high communication overhead for forwarding a report and high computation overhead for verifying a report. The location-aware end-to-end data security scheme (LEDS) [11] saves communication overhead for forwarding a report by allowing only one node in the receiving cell to forward the report, however, each node in the receiving cell has to verify the report, which results in high computation overhead. [PERSON] et al. [17] proposed an en-route data filtering scheme based on the elliptical curve digital signature algorithm (ECDSA) and the NFFS scheme, which can filter out false reports and can mitigate the impact of compromised nodes.