Patent ID: 8571223

Claim:
A method for combining mechanisms of authentication and key management in a sensor network, comprising: 1) Pre-distributing keys, comprising: 1.1) pre-distributing communication keys, which comprises: prior to network deployment, pre-distributing the communication keys to nodes for establishing secure connection between the nodes; and 1.2) pre-distributing an initial broadcast message authentication key, which comprises: prior to network deployment, pre-distributing the initial key for authenticating a broadcast message to receiving nodes of the broadcast message; 2) performing authentication, comprising: 2.1) authenticating a node identity, which comprises: after network deployment, authenticating, by a communication node, legitimacy of a counterpart identity prior to communication, comprising after network deployment and prior to a node communication, performing pre-shared-key based authentication between the nodes based on a shared key, after establishment of the shared key between the nodes, wherein performing pre-shared-key based authentication comprises: a) generating a random number N A and sending the random number N A to a node B, by a node A; b) generating a random number N B , calculating a session key with the node A SK=F(PSK, N B ∥N A ), generating a message authentication code MAC 1 =H(SK, N B ∥N A ) by using the session key SK, constructing a message N B ∥N A ∥MAC 1 and sending the massage N B ∥N A ∥MAC 1 to the node A, by the node B; and c) checking, by the node A whether the random number N B in the message matches up with the random number sent to the node B; if the random number N B in the message does not match up with the random number sent to the node B, ending the authentication; and if the random number N B in the message matches up with the random number sent to the node B, calculating a session key with the node B SK=F(PSK, N B ∥N A ) and generating an authentication code MAC 2 =H(SK, N B ∥N A ) by using the session key SK=F(PSK, N B ∥N A ), by the node A, and when MAC 2 =MAC 1 , calculating MAC 3 =H(SK, N B ) and constructing a message N B ∥MAC 3 and sending the massage N B ∥MAC 3 to the node B, by the node A; wherein PSK represents the pre-shared key, F represents a key generating algorithm, and H represents a one-way Hash function; and 2.2) authenticating the broadcast message, which comprises: after network deployment, if there is broadcast in the network, authenticating, by the receiving nodes of the broadcast message, legitimacy of the broadcast message; and 3) negotiating a session key between the nodes, comprising: after successfully authenticating the node identity, negotiating the session key between the nodes based on a result of the step of authenticating the node identity.