# An Access Control Protocol for Wireless Sensor Network Using Double Trapdoor Chameleon Hash Function

Authors: Tejeshwari Thakur
Journal: Journal of Sensors
 (2016)

---

## Abstract

Wireless sensor network (WSN), a type of communication system, is normally deployed into the unattended environment where the intended user can get access to the network. The sensor nodes collect data from this environment. If the data are valuable and confidential, then security measures are needed to protect them from the unauthorized access. This situation requires an access control protocol (ACP) in the design of sensor network because of sensor nodes which are vulnerable to various malicious attacks during the authentication and key establishment and the new node addition phase. In this paper, we propose a secured ACP for such WSN. This protocol is based on Elliptic Curve Discrete Log Problem (ECDLP) and double trapdoor chameleon hash function which secures the WSN from malicious attacks such as node masquerading attack, replay attack, man-in-the-middle attack, and forgery attacks. Proposed ACP has a special feature known as session key security. Also, the proposed ACP is more efficient as it requires only one modular multiplication during the initialization phase.


---

## Body

## 1. Introduction

A wireless sensor network (WSN) is a system of a network consisting of spatially distributed autonomous devices which uses sensors to cooperatively monitor physical or environmental conditions such as temperature, sound, vibration, pressure, motion, or pollutants at different locations. The purpose of a WSN is to collect and process data from a target domain and transmit the information back to specific sites. WSN technology is an emerging technology that can be utilized in a wide range of potential applications in the real world. Such a network usually consists of a number of wireless sensor nodes that arrange themselves into a multihop network. Each node consists of one or more sensors. In many WSN, it is sufficient to secure the data transfer between the sensor nodes and the base station, especially, when the base station is needed to ensure that the received message sent by the specific sensor node is unaltered during transfer. However, in any WSN, providing security during authentication, key establishment and new node deployment is important and for that purpose, an ACP is needed. In the health-care monitoring systems, military domains, and in many other applications, WSN requires a hard and fast authentication scheme to secure the data from the attackers because the authenticity and integrity of such data received at the base station highly influence the final results in many WSN applications, as shown by Abduvaliev et al. [1], Akyildiz et al. [2], and Akyildiz and Kasimoglu [3]. In a paper, Zhou et al. [4] developed an ACP based on the elliptic curve cryptosystem (ECC) for securing the new node deployment process. For details on the elliptic curve (EC) one can refer to Miller and Koblitz [5, 6] and so forth. Next, Huang [7] proposed an efficient ACP based on the EC and hash chains. In this scheme, new nodes can be easily added. The authors claimed that it is resistant to various attacks. Later, Kim and Lee [8] pointed out that the ACP given by Huang [7] is insecure and it lacks hash chain renewability which is an important aspect needed in any resource constrained sensor network. Consequently, Kim and Lee [8] further proposed an enhanced ACP by adding a hash chain renewal phase supporting the mutual authentication. Also, they claimed that their enhanced access control protocol is resistant to various known attacks.Further, Shen et al. [9] and Zeng et al. [10] demonstrated that the scheme given by Kim and Lee was still vulnerable to masquerade attack executed by new as well as legal nodes because it lacks hash chain renewability soon after the authentication and key established phase. Finally, Lee et al. [11] proposed a practical ACP based on EC and the hash chain. However, it was later observed that a large number of key distributions in Lee et al. [11] and Zhou [4] are also vulnerable to various adversary attacks and had hung storage overhead at the sensor node.The concept of chameleon hash function was first given by Krawczyk and Rabin [12]. Chameleon hash function is used to calculate the message digest. A chameleon hash function is a basically trapdoor collision-resistant hash function. It is found to be a very useful tool in cryptography. In order to take such advantage of this function, Chen et al. [13] involved it in the access control protocol. However, the Chen et al. [13] protocol required the precomputed secret value of x-1 during the transection even without verifying the authentic value and thus invites attacks.Motivated by the use of the double trapdoor chameleon hash function by Chen et al. [14], in this paper, we propose a secure and efficient ACP based on ECDLP. In our opinion, the proposed protocol which does not require the precomputed value of x-1 dynamically provides the security against different attacks, even when new nodes are added to the WSN. Looking to the other advantages, our proposed scheme is better as compared to the scheme given by Chen et al. [13].The rest of the paper is organized as follows. In Section2, we give preliminaries required for the proposed access control protocol. In Section 3, the proposed scheme is explained. The security and efficiency analysis of our proposed scheme is given in Section 4. Finally, the conclusion is made in Section 5.


## 2. Preliminaries

As we have said earlier, in this section, we first explain the requirements for the ACP of a wireless sensor network using the ECDLP and trapdoor chameleon hash function. Before doing so, we need to explain the notion of a trapdoor chameleon hash function as given by Chen et al. [15] scheme. Let us first recall the EC as given below.


### 2.1. Elliptic Curve

We consider the parameters of any EC such that the EC domain parameters can be verified to meet the requirements as given by Law et al. [16]. In order to avoid the Pollard-rho [17] and Pohlig-Hellman algorithms for the discrete logarithm problem defined on EC, it is necessary that the number of Fp-rational points on E, denoted by #E(Fp), be divisible by a sufficiently large prime n. Also, in order to avoid the reduction algorithms of Menezes et al. [18] and Frey and Rück [19], our EC should be nonsuper singular (i.e., p should not divide (p+1-#E(Fp))). Further, in order to avoid the attack of Semaev [20] on Fp-anomalous curves, our EC should not be Fp-inconsistent (i.e., #E(Fp)≠p).


### 2.2. Elliptic Curve Discrete Logarithm Problem

LetE be an elliptic curve defined over a finite field Fp and let P∈E(Fp) be a point of order n. Given Q, where Q∈E(Fq), the ECDLP is used to find the integer l,0≤l≤n-1, such that Q=l·P.


### 2.3. Trapdoor Chameleon Hash Function

Following the ACP of Chen et al. [15], we define double trapdoor chameleon hash function as below.LetG be a subgroup generated by P and define a cryptographic secure keyed-hash function f:Zq×G→Zq. Choose random elements (two trapdoor keys) k,x∈RZq and compute K=kP,Y=xP. The public hash key is HK=(K,Y), and the private trapdoor key is TK=(k,x). For the given hash family, we define the hash key HK and the proposed chameleon hash function HHK:Zq×Zq→G as follows: (1)HHKm,r=fm,K·K+Y+rP.A double trapdoor chameleon hash function carries the following properties. (1)
Efficiency. Given a hash key pair HK and a pair (m,r)∈Zq×Zq, HHK(m,r)=f(m,K)·(K+Y)+rP is computable in the polynomial time.(2)
Collision Resistance. Without the trapdoor key TK, it is computationally infeasible to find two pairs (m1,r1),(m2,r2)∈Zq×Zq which satisfy m1≠m2 and HHK(m1,r1)=HHK(m2,r2).(3)
Trapdoor Collision. Assume that we have given the hash and the trapdoor key pair (HK,TK), a pair (m1,r1)∈Zq×Zq, and an additional message m2∈Zq, and we want to find r2∈Zq such that (2)fm1,K·K+Y+r2Y=fm2,K·K+Y+r2Y.The value ofr2 can be computed in polynomial time as follows: r2=r1+(k+x)(f(m1,K)-f(m2,K))modq.Also, asr1 is uniformly distributed in R then the distribution of r2 is computationally indistinguishable from the uniformly distributed r1 in R.


### 2.4. Notations Used in the Proposed Scheme

The notations involved are listed as follows:Ni: ith node.Nj: jth node.BS: base station.l: integer number.E: elliptic curve.P: generator of subgroup G.f: cryptography secure hash function.r: random number.HHK: chameleon hash function.Au: authentication value.


## 2.1. Elliptic Curve

We consider the parameters of any EC such that the EC domain parameters can be verified to meet the requirements as given by Law et al. [16]. In order to avoid the Pollard-rho [17] and Pohlig-Hellman algorithms for the discrete logarithm problem defined on EC, it is necessary that the number of Fp-rational points on E, denoted by #E(Fp), be divisible by a sufficiently large prime n. Also, in order to avoid the reduction algorithms of Menezes et al. [18] and Frey and Rück [19], our EC should be nonsuper singular (i.e., p should not divide (p+1-#E(Fp))). Further, in order to avoid the attack of Semaev [20] on Fp-anomalous curves, our EC should not be Fp-inconsistent (i.e., #E(Fp)≠p).


## 2.2. Elliptic Curve Discrete Logarithm Problem

LetE be an elliptic curve defined over a finite field Fp and let P∈E(Fp) be a point of order n. Given Q, where Q∈E(Fq), the ECDLP is used to find the integer l,0≤l≤n-1, such that Q=l·P.


## 2.3. Trapdoor Chameleon Hash Function

Following the ACP of Chen et al. [15], we define double trapdoor chameleon hash function as below.LetG be a subgroup generated by P and define a cryptographic secure keyed-hash function f:Zq×G→Zq. Choose random elements (two trapdoor keys) k,x∈RZq and compute K=kP,Y=xP. The public hash key is HK=(K,Y), and the private trapdoor key is TK=(k,x). For the given hash family, we define the hash key HK and the proposed chameleon hash function HHK:Zq×Zq→G as follows: (1)HHKm,r=fm,K·K+Y+rP.A double trapdoor chameleon hash function carries the following properties. (1)
Efficiency. Given a hash key pair HK and a pair (m,r)∈Zq×Zq, HHK(m,r)=f(m,K)·(K+Y)+rP is computable in the polynomial time.(2)
Collision Resistance. Without the trapdoor key TK, it is computationally infeasible to find two pairs (m1,r1),(m2,r2)∈Zq×Zq which satisfy m1≠m2 and HHK(m1,r1)=HHK(m2,r2).(3)
Trapdoor Collision. Assume that we have given the hash and the trapdoor key pair (HK,TK), a pair (m1,r1)∈Zq×Zq, and an additional message m2∈Zq, and we want to find r2∈Zq such that (2)fm1,K·K+Y+r2Y=fm2,K·K+Y+r2Y.The value ofr2 can be computed in polynomial time as follows: r2=r1+(k+x)(f(m1,K)-f(m2,K))modq.Also, asr1 is uniformly distributed in R then the distribution of r2 is computationally indistinguishable from the uniformly distributed r1 in R.


## 2.4. Notations Used in the Proposed Scheme

The notations involved are listed as follows:Ni: ith node.Nj: jth node.BS: base station.l: integer number.E: elliptic curve.P: generator of subgroup G.f: cryptography secure hash function.r: random number.HHK: chameleon hash function.Au: authentication value.


## 3. Proposed Access Control Protocol Based on ECDLP

Now we propose our ACP based on ECDLP and double trapdoor chameleon hash function. This method consists of two phases: initialization phase and the node authentication with key establishment phase. The implementation of the proposed ACP is as follows.


### 3.1. Initialization Phase of the Proposed ACP

The initialization phase is described in the following steps.Step 1.
The base station (BS) chooses a random elementx∈RZq and computes Y=xP. The public hash key is HK=Y=xP and the private trapdoor key is TK=x.Step 2.
Choose a random numberk∗∈RZq, and compute the chameleon hash value HHKBS=k∗P.Step 3.
Given messagem from pair (ki,kiP), where ki∈Zq as the secrete key and i=1,2,3,…,n1, then compute a security key ri=k∗-f(m,kiP)(ki+x)modq, uploaded (Ni,kiP,ri,HHK) to node Ni.Note. r i = k ∗ - f ( m , k i P ) ( k i + x )   m o d  q . It requires only 1 modular multiplication of Zq in this phase.


### 3.2. Authentication with Key Establishment Phase of ACP

In this section, we give different steps of authentication of the proposed ACP.In all the sensor nodes when deployed, if nodeNi wants to communicate with another node Nj, they must implement the following steps to authenticate each other. Subsequently, they must establish a shared session key for securing their communication.Step 1.
Two nodes areNi and Nj, where i=1,2,3,…,n1 and j=1,2,3,…,n2, for n1,n2∈n, and node Ni chooses random number c1∈Zq to compute the public key c1P and (K+Y)ri and then sends (Ni,c1P,(K+Y)ri,kiP) to node Nj.Step 2.
NodeNj computes the chameleon hash value HHK of node Ni based on the received message (Ni,c1P,(K+Y)ri,kiP). If HHKBS and HHKBS′ are equal, then node Nj chooses random number c2∈Zq to compute c2P and session key (c1c2)xP=(c2c1)xP between nodes Ni and Nj. Then node Nj uses different security key rj to compute authentication value Auj=HHK((c1c2)xP∥rj(K+Y)). It then delivers the message (Nj,c2P,rj(K+Y),kjP,Auj) to node Ni.Step 3.
NodeNi receives the message from Nj and computes chameleon hash value of node Nj and according to the message (Nj,c2P,rj(K+Y),kjP,Auj) from Nj, it then computes HHKBS′=f(m,K)(K+Y)+riP with the chameleon hash of base station HHKBS. If HHKBS=HHKBS′, node Ni then computes the share session key and (c1c2)xP=(c2c1)xP the authentication value Auj′, where Auj′=HHK((c1c2)xP∥rj(K+Y)).
Again, nodeNi checks the authentication value Auj; if Auj=Auj′ then node Nj is valid and goes back to a authentication value for given ri and (c1c2)xP, where Aui=HHK((c1c2)xP∥ri(K+Y)).Step 4.
NodeNj receives Aui; it also computes the value Aui′=HHK((c1c2)xP∥ri(K+Y)). If Aui=Aui′ then node Ni is authenticated; otherwise, the value Aui is discarded. Same method applies for node Nj, if Auj=Auj′ is authenticated; otherwise value Auj is discarded.New Node Addition Phase. During the network communication phase, if some sensor nodes are lost, new sensor nodes are needed to deploy. When a new node with Ni+1 is added, the base station also generates a secret key ki+1 and then the base station computes the chameleon hash value HHKBS=f(m,ki+1P)(ki+1P+Y)+ri+1P at node Ni+1 and update as broadcasting chameleon hash value HHKBS in the base station. The authentication and key establishment for any old node with the new node Ni+1 is the same as authentication steps.


### 3.3. Correctness of the Proposed ACP

In order to show the correctness of our proposed ACP, we assert that, during the authentication with key establishment phase, nodeNj authenticates node Ni based on the chameleon hash value of node Ni; that is, it computes the value of HHKBS=f(m,K)(K+Y)+riP based on the received message (Ni,c1P,ri(K+Y),kiP) from node Ni and publishes the message of the base station which is written as HHKBS=f(m,kiP)(kiP+Y)+k∗P-f(m,kiP)(kiP+xP)=k∗P the chameleon hash value (see Box 1).Box 1
NodeNi                 Node Nj Generatec1∈Zn∗ Computec1P,(K+Y)ri →Ni,c1P,(K+Y)ri,kiP Choosec2 ComputeHHK,c1P,(K+Y)ri,kiP, and Auj=HHK((c1c2)xP∥rj(K+Y)) CheckHHKBS?=HHKBS′ ←Nj,c1P,(K+Y)rj,kjP,Auj CheckHHKBS?=HHKBS′ Compute(c1c2)xP, A u j ′ ? = H H K ( ( c 1 c 2 ) x P ∥ r j ( K + Y ) ) A u i = H H K ( ( c 1 c 2 ) x P ∥ r i ( K + Y ) ) →Aui CheckAui′?=HHK((c1c2)xP∥ri(K+Y))


## 3.1. Initialization Phase of the Proposed ACP

The initialization phase is described in the following steps.Step 1.
The base station (BS) chooses a random elementx∈RZq and computes Y=xP. The public hash key is HK=Y=xP and the private trapdoor key is TK=x.Step 2.
Choose a random numberk∗∈RZq, and compute the chameleon hash value HHKBS=k∗P.Step 3.
Given messagem from pair (ki,kiP), where ki∈Zq as the secrete key and i=1,2,3,…,n1, then compute a security key ri=k∗-f(m,kiP)(ki+x)modq, uploaded (Ni,kiP,ri,HHK) to node Ni.Note. r i = k ∗ - f ( m , k i P ) ( k i + x )   m o d  q . It requires only 1 modular multiplication of Zq in this phase.


## 3.2. Authentication with Key Establishment Phase of ACP

In this section, we give different steps of authentication of the proposed ACP.In all the sensor nodes when deployed, if nodeNi wants to communicate with another node Nj, they must implement the following steps to authenticate each other. Subsequently, they must establish a shared session key for securing their communication.Step 1.
Two nodes areNi and Nj, where i=1,2,3,…,n1 and j=1,2,3,…,n2, for n1,n2∈n, and node Ni chooses random number c1∈Zq to compute the public key c1P and (K+Y)ri and then sends (Ni,c1P,(K+Y)ri,kiP) to node Nj.Step 2.
NodeNj computes the chameleon hash value HHK of node Ni based on the received message (Ni,c1P,(K+Y)ri,kiP). If HHKBS and HHKBS′ are equal, then node Nj chooses random number c2∈Zq to compute c2P and session key (c1c2)xP=(c2c1)xP between nodes Ni and Nj. Then node Nj uses different security key rj to compute authentication value Auj=HHK((c1c2)xP∥rj(K+Y)). It then delivers the message (Nj,c2P,rj(K+Y),kjP,Auj) to node Ni.Step 3.
NodeNi receives the message from Nj and computes chameleon hash value of node Nj and according to the message (Nj,c2P,rj(K+Y),kjP,Auj) from Nj, it then computes HHKBS′=f(m,K)(K+Y)+riP with the chameleon hash of base station HHKBS. If HHKBS=HHKBS′, node Ni then computes the share session key and (c1c2)xP=(c2c1)xP the authentication value Auj′, where Auj′=HHK((c1c2)xP∥rj(K+Y)).
Again, nodeNi checks the authentication value Auj; if Auj=Auj′ then node Nj is valid and goes back to a authentication value for given ri and (c1c2)xP, where Aui=HHK((c1c2)xP∥ri(K+Y)).Step 4.
NodeNj receives Aui; it also computes the value Aui′=HHK((c1c2)xP∥ri(K+Y)). If Aui=Aui′ then node Ni is authenticated; otherwise, the value Aui is discarded. Same method applies for node Nj, if Auj=Auj′ is authenticated; otherwise value Auj is discarded.New Node Addition Phase. During the network communication phase, if some sensor nodes are lost, new sensor nodes are needed to deploy. When a new node with Ni+1 is added, the base station also generates a secret key ki+1 and then the base station computes the chameleon hash value HHKBS=f(m,ki+1P)(ki+1P+Y)+ri+1P at node Ni+1 and update as broadcasting chameleon hash value HHKBS in the base station. The authentication and key establishment for any old node with the new node Ni+1 is the same as authentication steps.


## 3.3. Correctness of the Proposed ACP

In order to show the correctness of our proposed ACP, we assert that, during the authentication with key establishment phase, nodeNj authenticates node Ni based on the chameleon hash value of node Ni; that is, it computes the value of HHKBS=f(m,K)(K+Y)+riP based on the received message (Ni,c1P,ri(K+Y),kiP) from node Ni and publishes the message of the base station which is written as HHKBS=f(m,kiP)(kiP+Y)+k∗P-f(m,kiP)(kiP+xP)=k∗P the chameleon hash value (see Box 1).Box 1
NodeNi                 Node Nj Generatec1∈Zn∗ Computec1P,(K+Y)ri →Ni,c1P,(K+Y)ri,kiP Choosec2 ComputeHHK,c1P,(K+Y)ri,kiP, and Auj=HHK((c1c2)xP∥rj(K+Y)) CheckHHKBS?=HHKBS′ ←Nj,c1P,(K+Y)rj,kjP,Auj CheckHHKBS?=HHKBS′ Compute(c1c2)xP, A u j ′ ? = H H K ( ( c 1 c 2 ) x P ∥ r j ( K + Y ) ) A u i = H H K ( ( c 1 c 2 ) x P ∥ r i ( K + Y ) ) →Aui CheckAui′?=HHK((c1c2)xP∥ri(K+Y))


## 4. Security Analysis

For the purpose of analyzing the security aspect of our proposed ACP, we claim that attacker can not find the authentication value for communication node betweenNi and Nj. These nodes require authentic value of the message to be communicated from Ni to Nj. First we ascertain that node Ni has been authenticated by node Nj using the chameleon hash value (3)HHKBS=fm,ki+1Pki+1P+Y+ri+1P and then computes the authentication value Auj corresponding to Aui. The authentication value Aui is obtained by the shared session key and the security key ri. However, only the communication nodes accept the session key c1c2P, and the only node Ni and the base station can have the security key ri.Second, nodeNj is preloaded with the chameleon hash value by the base station HHKBS along with node Ni and obtained HHKBS′. However, the computed value of HHKBS′ needs some value of identity ID, secure hash key kiP, and security key ri of node Ni. This way, the process can authenticate ID and the hash key because computing HHKBS′ is an elliptic curve discrete logarithm problem and attacker can not find any information about ID and hash key. On the other hand, even if attacker successfully finds out the security key ri then also he can not know the secret values x and k∗ because of its trapdoor chameleon hash value. Only the authorized user can find out the secret key.In addition, we claim that the proposed ACP is able to resist the attacks such as forgery attacks, legal node masquerading attacks, new node attack, replay attacks, man-in-the-middle attacks, and session key security attack as given below.(1)
Forgery Attack. Say, an attacker tries to obtain the commutation values by eavesdropping on the communication channel as (4)ri′=ri-ki+xfm′,kiP-fm,kiPmodqri′=k∗-fm,kiPki+x-fm′,kiPki+x+fm,kiPki+xmodqri′=k∗-fm′,kiPki+xmodq.But it is not possible for him because the value ofri′ cannot be computed without secret key (ki+x).(2)
Legal Node Masquerading Attacks. Under this attack, the attacker has to deploy a pseudonode by removing the legal one. For this purpose, attacker has to obtain the commutation values by eavesdropping on the communication between nodes Ni and Nj. However, even if the attacker obtains the values of c1P and c2P from the authentication and key establishment phase, then also, deriving the legalized session key c1c2P is extremely difficult to obtain because of the security tool employed as ECDLP. In other words, the legal node Nj is well equipped with the security key rj(K+Y) provided by the base station HHKBS which attacker can not retrieve.(3)
New Node Masquerading Attacks. Under this attack, when some sensor node is lost, it needs to be replaced by new sensor node Ni+1. To take advantage of this situation, the attacker may try to know the secrete keys x and k∗ from the new node. But, this is not possible because the secret keys are provided by the base station to the new node with chameleon hash values HHKBS and ri+1 which attacker can not compute.(4)
Replay Attack. In this attack, the adversary first eavesdrops on the communication between two communicating entities and then tries to impersonate the legal authentic message by simply replacing the other messages to the dedicated entity. For example, when an attacker transfers the message (Ni,c1P,ri(K+Y),kiP) to another node Nj, the attacker provides ri for establishing authentication value Aui. Aui is required for shared session key with the node to be connected. It is not possible for the attacker to obtain ri without x and k∗ which is the trapdoor secret value and available at the base station only. On the other hand, if the attacker sends the authenticated value Au to node Nj, he can use the shared session key to authenticate, whether the connecting node is legitimate or not; if the node is legitimate then process is to proceed for the next step, otherwise discard, because the authenticated node uses up-to-date session keys c1 and c2 in order to apply the different strategies. Hence our proposed ACP successfully resists the replay attack.(5)
The Man-in-the-Middle Attack. This is one of the classical attacks that can be executed in any WSN environment. However, in any WSN equipped with our proposed ACP, the communication nodes can authenticate and establish the session keys between the users and the server. If attacker wants to mount the man-in-the-middle attack, he only knows the public keys c1P and c2P and wants to solve the ECDLP. Even if the attacker obtains the user’s information (Ni,kiP,(K+Y)ri), then also the attacker cannot pass the authentication and key establishment phase, because he cannot compute the session key Au. Hence, our ACP can resist man-in-middle attack.(6)
Session Key Security. Our proposed ACP is well equipped with the session key security feature. Since only the communicating parties know the session key c1c2P and hence are aware of the security of the session key, consequently, they can only verify the user of the message. The session key c1c2P is not known to anyone because random values c1P and c2P are protected by the ECDLP. Therefore, the proposed ACP provides session key security as an additional feature.


### 4.1. Efficiency

The computational cost of proposed ACP is calculated in Table1 at different phases and these are compared with other such schemes in Table 2. For this purpose, in Table 1, we have first given the computational cost of our ACP for three phases at base station and at node Ni considering the elliptic curve and hash chain components as below.Table 1
Computational cost of the proposed protocol.
Phases Base station NodeNi Initialization 3 T e m + 1 T h + 1 T m u l Not applicable Authentication and key establishment Not applicable 4 T e m + 1 T h New node adding 2 T e m + 1 T m u l Not applicableTable 2
Comparison of computation cost with other protocols.
Protocol Authentication and establishment phase Zhou et al. [4] 3 T e m + T m u l + T h Kim and Lee [8] 4 T e m + 8 T h Huang [7] 2 T e m + 5 T h Lee et al. [11] 2 T e m + 5 T h Our scheme 4 T e m + 1 T hThe notations we use in Tables1 and 2 for the purpose of comparison are as follows:Tem: one multiplication computation over an elliptic curve.Th: cryptographic secure hash function.Tmul: modulus multiplication operation.The total computational cost of proposed ACP is4Tem+1Th during the authentication and key establishment phase at node Ni and its computational cost is 3Tem+1Th+1Tmul during the base station and 2Tem+1Tmul is the computational cost at the new node addition phase in Table 1.Next, in Table2, we have shown the comparison of the computational cost of our proposed ACP with Zhou et al. [4], Kim and Lee [8], Huang [7], and Lee et al. [11] scheme during authentication and key establishment phase.From Table2, it is evident that the proposed ACP has the lowest computational cost 4Tem+1Th as compared to other schemes.Finally, we compare the time consumed at authentication phase during data transmission in CPU device with other schemes using Mathematica 7.0, shown in Table3.Table 3
Comparison of time consumed with other protocols.
Protocol Time consumed during authentication phase Zhou et al. [4] 2.56 CPU time Kim and Lee [8] 1.57 CPU time Huang [7] 0.895 CPU time Our scheme 0.256 CPU timeFrom Table3, it is evident that the proposed ACP takes 0.256 seconds in CPU time which is less as compared to other protocols.


## 4.1. Efficiency

The computational cost of proposed ACP is calculated in Table1 at different phases and these are compared with other such schemes in Table 2. For this purpose, in Table 1, we have first given the computational cost of our ACP for three phases at base station and at node Ni considering the elliptic curve and hash chain components as below.Table 1
Computational cost of the proposed protocol.
Phases Base station NodeNi Initialization 3 T e m + 1 T h + 1 T m u l Not applicable Authentication and key establishment Not applicable 4 T e m + 1 T h New node adding 2 T e m + 1 T m u l Not applicableTable 2
Comparison of computation cost with other protocols.
Protocol Authentication and establishment phase Zhou et al. [4] 3 T e m + T m u l + T h Kim and Lee [8] 4 T e m + 8 T h Huang [7] 2 T e m + 5 T h Lee et al. [11] 2 T e m + 5 T h Our scheme 4 T e m + 1 T hThe notations we use in Tables1 and 2 for the purpose of comparison are as follows:Tem: one multiplication computation over an elliptic curve.Th: cryptographic secure hash function.Tmul: modulus multiplication operation.The total computational cost of proposed ACP is4Tem+1Th during the authentication and key establishment phase at node Ni and its computational cost is 3Tem+1Th+1Tmul during the base station and 2Tem+1Tmul is the computational cost at the new node addition phase in Table 1.Next, in Table2, we have shown the comparison of the computational cost of our proposed ACP with Zhou et al. [4], Kim and Lee [8], Huang [7], and Lee et al. [11] scheme during authentication and key establishment phase.From Table2, it is evident that the proposed ACP has the lowest computational cost 4Tem+1Th as compared to other schemes.Finally, we compare the time consumed at authentication phase during data transmission in CPU device with other schemes using Mathematica 7.0, shown in Table3.Table 3
Comparison of time consumed with other protocols.
Protocol Time consumed during authentication phase Zhou et al. [4] 2.56 CPU time Kim and Lee [8] 1.57 CPU time Huang [7] 0.895 CPU time Our scheme 0.256 CPU timeFrom Table3, it is evident that the proposed ACP takes 0.256 seconds in CPU time which is less as compared to other protocols.


## 5. Conclusion

From the aforesaid sections, we conclude to say that our proposed ACP using the double trapdoor function and whose security is based on ECDLP is best suited to anyWSN environment. The reason for being more secured is that it can resist many known attacks such as masquerading, replay, man-in-the-middle, and forgery attacks and has a special feature known as session key security and as shown in Tables 1, 2, and 3 it is more efficient as compared to many other existing protocols.



---

*Source: 1210938-2016-10-25.xml*