# Secure Access Control Method for Wireless Sensor Networks

Authors: Cheng-Yeh Chen; Alan Dahgwo Yein; Te-Cheng Hsu; John Y. Chiang; Wen-Shyong Hsieh
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

Wireless sensor networks (WSNs) contain a large number of resource-constrained and energy-limited sensor nodes that are generally deployed in an open environment. Those sensor nodes communicate with each other or with a base station via wireless channels. Therefore, secure access control is an important issue in WSNs because sensor nodes are susceptible to various malicious attacks during the authentication and key establishment phase and the new node addition phase. In this study, we propose a new access control method based on elliptic curve cryptography and the chameleon hash function. This method addresses the security problems in the existing research. It also has additional advantages since it does not require time synchronization between communication nodes, nor does it require node verification tables. In addition to our proposal, the correctness, security, resistance to possible attacks, and the performance of the proposed method are analyzed and evaluated. The results of our study demonstrate that the proposed method has an outstanding performance and fulfills all the requirements for secure communication in WSNs.


---

## Body

## 1. Introduction

Wireless sensor networks (WSNs) consist of base stations and a large number of resource-constrained and energy-limited sensor nodes that are typically deployed in various environments. Since the base stations and sensor nodes communicate with each other via wireless channels [1], the WSN system is threatened by malicious security attacks.In WSNs, after a prolonged period of operation, the power of some of the sensor nodes gets exhausted. This occurs due to uneven distribution of radio transmission load or damage caused by unpredictable events. The base station must dynamically add new nodes to the WSN to ensure the coverage and connectivity of sensor nodes. Following the addition of a node, the new node is authenticated by the neighboring nodes, and it establishes shared session keys with them for secure communication.In order to attack or access communication information, malicious nodes may modify received messages, eavesdrop on transmission messages, insert false messages, or provide misleading information to legitimate sensor nodes. Therefore, access control security is a major concern in WSNs.Zhou et al. [2] proposed an access control protocol to improve the performance of traditional public-key-based encryption protocols. This protocol was based on the elliptic curve. Each sensor node could sustain for a tolerable time interval before it was compromised, rendering the scheme unsuitable for certain practical applications. Huang [3] proposed an efficient access control protocol based on the elliptic curve and hash chains. This scheme could easily add new nodes and resist various attacks. Kim and Lee [4] proposed an enhanced access control protocol based on the scheme proposed by Huang. Their research indicated that the method proposed by Huang could not resist replay as well as active attacks. Further, it lacked hash chain renewability after the authentication and key establishment phase. In 2010, Shen et al. [5] and Zeng et al. [6] demonstrated that the scheme presented by Kim and Lee was vulnerable to masquerade attacks executed by new as well as legal nodes because it lacked hash chain renewability. In 2012, Lee et al. [7] proposed a practical access control scheme, still based on elliptic curve and hash chain. However, such a large number of key distribution schemes [2–7] are vulnerable to various adversary attacks and had huge storage overhead at the sensors node.In 2013, Molavi et al. [8] use ECDLP method to solve security problem but still need time synchronization and had more compute time.Our goal is to solve the problems mentioned above, and we propose a secure and flexible access control protocol. The idea of proposed scheme based on the chameleon hash function [9–12] and Diffie-Hellman key agreement. This proposed method can dynamically and securely add new nodes to the existing networks. Moreover, it overcomes the existing security problems and had a fewer number of transmissions and does not require time synchronization or the verification table.The remainder of this paper is organized as follows. Section2 describes the preliminary information relevant to our scheme, that is, the chameleon hash function based on the elliptic curve. In Section 3, the proposed scheme is introduced, followed by the correctness and performance analysis in Section 4. Finally, we draw our conclusions in Section 5.


## 2. Preliminaries

This section introduces the properties of chameleon hash functions based on elliptic curves [7, 8]. The base station initially chooses a large prime number q, an elliptic curve Eq, a point P of order n over Eq, a subgroup G with order P, and a cryptographically secure hash function f: Zq×G→Zq. Here, M is a message space, and R is a finite space. Two random elements are chosen k,x∈RZq∗, and then K=kP and Y=xP are computed. The public hash key is HK=(K,Y), and the private trapdoor key is TK=(k,x).The proposed chameleon hash function is as follows.Given the hash keyHK, CH(m,r): Zq×Zq→G is defind as (1)CHm,r=fm,kPkP+rY.According to [10], the chameleon hash function has the following properties.(1)
Anyone that knows the public keyHK=(K,Y) can compute the associated hash function CH(m,r) in polynomial time.(2)
If the private trapdoor key is not known, it is not possible to find two inputs (m1,m2) that are mapped to the same output, such that CHm1,r1=CHm2,r2.(3)
The holder of the secret key information can easily find collisions for a given input, that is, two messagesm1 and m2, where CHm1,r1=CHm2,r2.Note that in signature schemes that use the chameleon hash function, there is a signer and a recipient, and two phases of execution. In the off-line phase, the signer precomputes the chameleon hash values CH and the corresponding signatures σ on the hash values. In the online phase, the signer computes a random number r of the chameleon hash function for the given message m such that CHm,r=CH. The signature for the message m is r, σ. When the recipient receives m, r, σ, it decrypts σ and verifies CHm,r=CH.


## 3. The Proposed Scheme

This section presents the proposed access control method based on the chameleon hash function [9–12] and used twice Diffie-Hellman key exchange. This study used signature parameter to archive robust authentication and key exchange. This method consists of two phases: the initialization phase and the node authentication and key establishment phase. The basic concepts and operations are as follows:(1)
initialization phase: the base station sets the necessary values of the sensor nodes before they are deployed;(2)
node authentication and key establishment phase: a deployed node engages in mutual authentication with one of its neighboring nodes and then establishes a common session key with the neighboring node for secure communication.In order to depict the proposed method more clearly, the notations used in this paper are listed in Notations Section.


### 3.1. Initialization Phase

To set up the network system parameters, the base station initially chooses a large prime numberq, an elliptic curve Eq, a point P of order n over Eq, a subgroup G with order P, and a cryptographically secure hash function f: Zq×G→Zq. It then completes the initialization phase by carrying out the following steps.Step 1.
Choose random elementsx,α∈RZq∗ as the secret key and then compute the public key Y=xP as well as the chameleon hash value of the base station CHBS=αY.Step 2.
Select random numberski∈RZq∗ as the secret key, where i=1,2,3,…,n, compute the trapdoor/hash key pair (kix-1,kiP), and load kiP to node Ni.Step 3.
Compute a security keyri of CHBS for the given m, where m=Ni∥kiPX of node Ni, such that CHBS=f(m,kiP)·kiP+riY. Here, ri=α-f(m,kiP)kix-1modq. Load (Ni,kiP,ri,CHBS) to node Ni and publish Eq,q,n,P,Y to all the sensor nodes.These three steps of the initialization phase are shown in Algorithm1.Algorithm 1:Steps of the initialization phase.
The nodeNi      The base station
Preloads Choose secret key   x,α∈RZq∗
Ni,kiP,ri,CHBS     Computes public key   Y=xP
and chameleon hash value
CHBS=αP
Generateski∈RZq∗
Computeskix-1,kiP
andri=α-fm,kiPkix-1mod⁡q
m=Ni∥kiPX


### 3.2. Authentication and Key Establishment Phase

After all the sensor nodes have been deployed, if nodeNi wants to communicate with another node Nj, they must implement the following steps to authenticate each other. Subsequently, they must establish a shared session key for securing their communication.Step 1.
NodeNi chooses a random integer a∈RZq∗ to compute the public key aP and riY and then sends (Ni,aP,riY,kiP) to the node Nj.Step 2.
NodeNj computes the chameleon hash value CHBS′ of node Ni based on the received message (Ni,aP,riiY,kiP). m=Ni∥kiPX, according to (1), where (2)CHBS′=fm,kiPkiP+riY.
Then,Nj compares CHBS′ with the chameleon hash value of the base station CHBS.
IfCHBS′=CHBS, then node Nj chooses a random number b∈RZq∗ to compute the public key bP and the shared session key baP(abP) between Ni and Nj.
Then,Nj uses rj to compute the mutual authentication value MavNj for the given values of rj and abPX, where MavNj=f((abPX∥rjriYX),kjP). It subsequently delivers the message (Nj,bP,rjY,kjP,MavNj) to node Ni.Step 3.
When nodeNi receives the message from Nj, it also computes the chameleon hash value m=Nj∥kjPX and CHBS′=f(m,kjP)kjP+rjY of node Nj, according to the received message (Nj,bP,rjY,kjP,MavNj) from Nj. It then compares CHBS′ with the chameleon hash value of the base station CHBS. If CHBS′=CHBS, then node Ni computes the shared session key abP, the mutual authentication value MavNj′ for the given ri, and abPX, where(3)MavNj′=fabPX∥rirjYX,kjP.
IfMavNj′=MavNj, then the node Nj is legitimized, and node Ni sends back a mutual authentication value MavNi for the given ri and abPX, where(4)MavNi=fabPX∥rirjYX,kiP.Step 4.
WhenNj receives MavNi, it also computes the value for MavNi′=f((abPX∥rjriYX),kiP). If MavNi′=MavNi, then node Ni is authenticated. Otherwise, the value MavNi is discarded.
The steps of the authentication and the key establishment phase are shown in Algorithm2.Algorithm 2:Authentication and key establishment phase.
The NodeNi          The Node   Nj
Generatesa→Ni,aP,riY,kiP    Check CHBS ?= CHBS′
ComputeaP,riY             Generates   b
ComputebP,baP,rjY
CheckMavNj=f((abPX∥rjriYX),kjP)
CHBS ?= CHBS′  ←Nj,bP,rjY,kjP,MavNj
ComputeabP
Ma
v
′
N
j
?
=
f
(
(
a
b
P
X
∥
r
i
r
j
Y
X
)
,
k
j
P
)
Mav
N
i
=
f
(
(
a
b
P
X
∥
r
i
r
j
Y
X
)
,
k
i
P
)
→MavNi  Check
Mav′Ni?=f((abPX∥rjriYX),kiP)Note that after the sensor network has operated for a certain period of time, new nodes must be deployed in the network to extend its life. For example, for the deployment of a new nodeNi+1, the base station adds the new node by following Steps 2 and 3 of the initialization phase outlined in Section 3.1.


## 3.1. Initialization Phase

To set up the network system parameters, the base station initially chooses a large prime numberq, an elliptic curve Eq, a point P of order n over Eq, a subgroup G with order P, and a cryptographically secure hash function f: Zq×G→Zq. It then completes the initialization phase by carrying out the following steps.Step 1.
Choose random elementsx,α∈RZq∗ as the secret key and then compute the public key Y=xP as well as the chameleon hash value of the base station CHBS=αY.Step 2.
Select random numberski∈RZq∗ as the secret key, where i=1,2,3,…,n, compute the trapdoor/hash key pair (kix-1,kiP), and load kiP to node Ni.Step 3.
Compute a security keyri of CHBS for the given m, where m=Ni∥kiPX of node Ni, such that CHBS=f(m,kiP)·kiP+riY. Here, ri=α-f(m,kiP)kix-1modq. Load (Ni,kiP,ri,CHBS) to node Ni and publish Eq,q,n,P,Y to all the sensor nodes.These three steps of the initialization phase are shown in Algorithm1.Algorithm 1:Steps of the initialization phase.
The nodeNi      The base station
Preloads Choose secret key   x,α∈RZq∗
Ni,kiP,ri,CHBS     Computes public key   Y=xP
and chameleon hash value
CHBS=αP
Generateski∈RZq∗
Computeskix-1,kiP
andri=α-fm,kiPkix-1mod⁡q
m=Ni∥kiPX


## 3.2. Authentication and Key Establishment Phase

After all the sensor nodes have been deployed, if nodeNi wants to communicate with another node Nj, they must implement the following steps to authenticate each other. Subsequently, they must establish a shared session key for securing their communication.Step 1.
NodeNi chooses a random integer a∈RZq∗ to compute the public key aP and riY and then sends (Ni,aP,riY,kiP) to the node Nj.Step 2.
NodeNj computes the chameleon hash value CHBS′ of node Ni based on the received message (Ni,aP,riiY,kiP). m=Ni∥kiPX, according to (1), where (2)CHBS′=fm,kiPkiP+riY.
Then,Nj compares CHBS′ with the chameleon hash value of the base station CHBS.
IfCHBS′=CHBS, then node Nj chooses a random number b∈RZq∗ to compute the public key bP and the shared session key baP(abP) between Ni and Nj.
Then,Nj uses rj to compute the mutual authentication value MavNj for the given values of rj and abPX, where MavNj=f((abPX∥rjriYX),kjP). It subsequently delivers the message (Nj,bP,rjY,kjP,MavNj) to node Ni.Step 3.
When nodeNi receives the message from Nj, it also computes the chameleon hash value m=Nj∥kjPX and CHBS′=f(m,kjP)kjP+rjY of node Nj, according to the received message (Nj,bP,rjY,kjP,MavNj) from Nj. It then compares CHBS′ with the chameleon hash value of the base station CHBS. If CHBS′=CHBS, then node Ni computes the shared session key abP, the mutual authentication value MavNj′ for the given ri, and abPX, where(3)MavNj′=fabPX∥rirjYX,kjP.
IfMavNj′=MavNj, then the node Nj is legitimized, and node Ni sends back a mutual authentication value MavNi for the given ri and abPX, where(4)MavNi=fabPX∥rirjYX,kiP.Step 4.
WhenNj receives MavNi, it also computes the value for MavNi′=f((abPX∥rjriYX),kiP). If MavNi′=MavNi, then node Ni is authenticated. Otherwise, the value MavNi is discarded.
The steps of the authentication and the key establishment phase are shown in Algorithm2.Algorithm 2:Authentication and key establishment phase.
The NodeNi          The Node   Nj
Generatesa→Ni,aP,riY,kiP    Check CHBS ?= CHBS′
ComputeaP,riY             Generates   b
ComputebP,baP,rjY
CheckMavNj=f((abPX∥rjriYX),kjP)
CHBS ?= CHBS′  ←Nj,bP,rjY,kjP,MavNj
ComputeabP
Ma
v
′
N
j
?
=
f
(
(
a
b
P
X
∥
r
i
r
j
Y
X
)
,
k
j
P
)
Mav
N
i
=
f
(
(
a
b
P
X
∥
r
i
r
j
Y
X
)
,
k
i
P
)
→MavNi  Check
Mav′Ni?=f((abPX∥rjriYX),kiP)Note that after the sensor network has operated for a certain period of time, new nodes must be deployed in the network to extend its life. For example, for the deployment of a new nodeNi+1, the base station adds the new node by following Steps 2 and 3 of the initialization phase outlined in Section 3.1.


## 4. Analysis of the Proposed Scheme

In this section, we analyze the correctness, the security, and the performance of the proposed access control protocol. The security analysis also shows how the proposed method can resist known security attacks.


### 4.1. Correctness

In the authentication and key establishment phase, nodeNj authenticates node Ni based on the chameleon hash value of the node Ni; that is, the computed result of CHBS′=f(m,kiP)·kiP+riY.Based on the received message (Ni,aP,riY,kiP) from node Ni and the published message of the base station P,Y, (2) can be rewritten as(5)CHBS′=f((Ni∥kiPX),kiP)·kiP+(α-f((Ni∥kiPX),kiP)kix-1)·xP=f((Ni∥kiPX),kiP)·kiP-f((Ni∥kiPX),kiP)kiP+αxP=αY.All nodes of the WSN have the same chameleon hash value as the base station; that is, CHBS=αY. This is preloaded by the base station. Therefore, node Nj can verify the received identification and the hash key kiP of node Ni based on the result of comparison of CHBS′ with CHBS. Moreover, node Ni also can ensure whether node Nj is valid by applying the same method that is used by node Nj. In this case, the received message is from node Nj.If nodeNi confirms that node Nj is valid, a shared session key abP can be established by using the mutual authentication value (MavNj) of the received message from node Nj. Subsequently, MavNj′ can be computed, where (6)MavNj′=f((abPX∥rirjYX),kjP).Equation (3) can be rewritten as(7)MavNj′=f((abPX∥rirjYX),kjP)=f((baPX∥rjriYX),kjP)=MavNj.On the other hand, the random values a and b are chosen by nodes Ni and Nj, respectively. The point P of the Elliptic curve and the public key Y are initially published by the base station. Therefore, node Ni can obtain the value of abPX using the aforementioned parameters. ri is Ni’s security key. Node Ni then compares MavNj′ with MavNj, which are obtained by Diffie-Hellman key exchange. If they are equal, the shared session key has been established. In a similar manner, node Nj can apply the method used by node Ni to confirm the mutual authentication value.


### 4.2. Security Analysis

The proposed scheme utilizes the chameleon hash function and twice Diffie-Hellman key exchange produces the mutual authentication value to establish mutual authentication between communication nodes. This study is constructed of security chameleon hash function, and further proof is in [10, 11]. For example, if nodes Ni and Nj require mutual authentication, Nj will first compare the preloaded chameleon hash value of the base station, CHBS, with the chameleon hash value of node Ni,CHBS′, obtained by using (1). However, the calculation of CHBS′ requires the ID, the hash key kiP, and the value riY of node Ni. Thus, the process can authenticate the ID and hash key because computing CHBS′ is an elliptic curve discrete logarithm problem (ECDLP) if the attacker does not have any information about the ID and hash key. Furthermore, ri is protected by the secret keys α and kix-1.After nodeNi has been authenticated, node Nj applies (1) and (2) to compute the MavNj. Then, MavNj is compared with MavNi. MavNi is obtained by using the shared session key abP and security key ri. However, only the communication nodes recognize the session key abP, and only node Ni and the base station can have the secret key ri.In addition to security analysis, the following paragraphs explain how the proposed method can resist attacks such as legal node masquerading attacks,forgery attacks, new node masquerading attacks, replay attacks, and man-in-the-middle attacks.(A) Legal Node Masquerading Attack. In this study, the authentication of node Nj depends on the comparison of chameleon hash values in the authentication and key establishment phase.First, the node to be authentication nodeNj checks CHBS. Nj can provide a legitimate value of rjY only if it is legitimate, and only the base station knows the secret keys α and kjx-1 can provide corresponding rj for given message.Secondly, only a legitimate nodeNj can use rj to compute the mutual authentication value and get authenticated successfully.An attacker may obtain the commutation values by eavesdropping on the communication between nodesNi and Nj. However, even if the attacker obtains the values of aP and bP from the authentication and key establishment phase, deriving the legalized session key abP is extremely difficult because of the ECDLP. Therefore, the proposed scheme can prevent a legal node masquerading attack.(B) Forgery Attack. Consider the case where an adversary has obtained the commutation values by eavesdropping on the communication channel.The adversary may attempt to create a legitimate authentication message using the following equation:(8)ri′=ri+kix-1fm′,kiP-fm,kiPmodq.However, it is not possible for the adversary to create a forged message because the value ofri′ cannot be computed without secret key kix-1.(C) New Node Masquerading Attack. When some of the sensor nodes in the wireless sensor network are damaged or have exhausted their power, new sensor nodes must be added to the network to extend its life. In the new node addition phase, the base station preloads the ki+1P, CHBS, Ni+1, and ri+1 values to a new node. Owing to the nonavailability of the secret keys x and α, the attacker cannot compute the value of ri+1; hence, it cannot use ri+1 to verify the ID and the hash key of the new node. Therefore, the proposed scheme can prevent new node masquerading attacks.(D) Replay Attack. A replay attack is the one in which an attacker captures the transmitted messages of a legitimate node and later replays them on the network in an attempt to imitate legitimate authentication messages. For example, if an attacker transmits the captured message (Ni,aP,riY,kiP) to another node Nj, the attacker must then provide ri for establishing a mutual authentication value Mav. The Mav is required for a shared session key with the node to be connected. However, it is not possible for the attacker to obtain ri without the secret key kix-1.In addition, if the attacker sends the valueMav to connect node Nj, node Nj can use the shared session key to authenticate whether the connecting node is legitimate or not. Another point that must be noted is that every connection between the two nodes uses the up-to-date session key values a and b. By means of these different strategies, the proposed method can resist replay attacks.(E) The Man-in-the-Middle Attack. In the proposed scheme, the communication nodes can mutually authenticate and establish session keys between users and servers. Although an attacker may launch a man-in-the-middle attack, the attacker can only know the values of aP and bP. It still has to resolve the ECDLP. Moreover, even if the attacker obtains user information (such as Ni,kiP,riY), the attacker still cannot pass the authentication and key establishment phase because it cannot compute the mutual authentication value Mav of the session key. Therefore, the proposed scheme can resist man-in-middle attacks.


#### 4.2.1. Session Key Security

The proposed scheme uses a session key. Only the communicating parties know the session keyabP when the user verifies the message from receiving party. The session key SK=abP is not known by anyone other than the communicating parties because the random values aP and bP are protected by the ECDLP. Therefore, the proposed scheme provides session key security.


### 4.3. Performance Analysis

Table1 shows the proposed scheme compared with related works Huang [3], Kim and Lee [4], Zeng et al. [6], and Molavi et al. [8] in terms of the function of access control method. The computation cost and the transmission cost are two popular benchmarks for evaluation of the efficiency of the WSNs. Table 2 shows the computation costs of the proposed method during different phases. When compared to the computation cost of the hash chain and the elliptic curve-based schemes, the computation cost of the proposed method is slightly higher. However, our proposed method does not require time synchronization or the verification table for authentication. Hence, it is more efficient than the hash chain and elliptic curve-based methods.Table 1
Compared function of access control method.
Function
Method
[3]
[4]
[7]
[8]
Proposed method
Resist various attacks
No
No
Yes
Yes
Yes
Easily add new node
Yes
Yes
Yes
Yes
Yes
Do not need time synchronization
No
No
No
No
Yes
After authentication, no need for broadcast
No
No
No
Yes
Yes
Do not have to verify table
No
No
No
Yes
Yes
After adding new node, no need for broadcast
No
No
No
Yes
YesTable 2
The computation costs of the proposed method during different phases.
Phase
Computation cost
Base station
NodeNi
Initialization
2
T
e
m
+
n
(
2
T
e
m
+
1
T
mul
)
N/A
Authentication and key establishment
N/A
5
T
e
m
+
1
T
h
New node adding
2
T
e
m
+
1
T
mul
N/A
T
e
m: time cost for one multiplication computation over an elliptic curve.
T
h: time for cryptographic secure hash function.
T
mul: time cost of performing the modulus multiplication operation.The energy cost of communication and cryptography in wireless sensor networks is an important consideration. In [13] indicated, the energy cost of cryptographic protocols, both from a communication energy cost and computation energy cost. According to [13] measure practical costs of computation and communication in WSN, it used TelosB sensors run Elliptic Curve Diffie-Hellman key exchange with authentication energy costs total is 130 (mJ), communication costs is 58.3 (mJ), and computation cost is 77 (mJ). As a result, we can realize that communication cost is an important consideration same as the computation cost. Table 3 presents the computation and the transmission costs incurred by using the methods put forward by Zhou et al. [2], Huang [3], Kim and Lee [4], and Lee et al. [7]. It also displays the costs incurred by using our proposed method. The protocol proposed by Huang requires seven transmissions and updates the broadcast hash chain after each authentication, key establishment, and new node addition phase. Our method requires only five transmissions. Consequently, it needs less bandwidth than the schemes proposed by Zhou et al. and Huang.Table 3
The comparison of computation costs and number of transmissions.
Scheme
Each node achieves authentication and establishes shared session key
Total number of transmissions to establish shared session key
Zhou et al. [2]
3
T
e
m
+
T
mul
+
T
h
21
Kim and Lee [4]
2
T
e
m
+
8
T
h
14
Huang [3]
2
T
e
m
+
5
T
h
10
Lee et al. [7]
2
T
e
m
+
5
T
h
8
Our proposed scheme
5
T
e
m
+
1
T
h
5
T
e
m: point multiplication computation over an elliptic curve.
T
h: time for cryptographic secure hash function.
T
mul: time cost of performing the modulus multiplication operation.Therefore, the proposed scheme can be applied to applications from the WSNs criteria that had less number of transmissions and had lower data rate of communication. However, every broadcast has resulted in poor throughput of WSNs. Our proposed method does not need broadcast to update node list and verify table. Furthermore, it can be implemented by using any elliptic curve and cryptographic secure hash function.


## 4.1. Correctness

In the authentication and key establishment phase, nodeNj authenticates node Ni based on the chameleon hash value of the node Ni; that is, the computed result of CHBS′=f(m,kiP)·kiP+riY.Based on the received message (Ni,aP,riY,kiP) from node Ni and the published message of the base station P,Y, (2) can be rewritten as(5)CHBS′=f((Ni∥kiPX),kiP)·kiP+(α-f((Ni∥kiPX),kiP)kix-1)·xP=f((Ni∥kiPX),kiP)·kiP-f((Ni∥kiPX),kiP)kiP+αxP=αY.All nodes of the WSN have the same chameleon hash value as the base station; that is, CHBS=αY. This is preloaded by the base station. Therefore, node Nj can verify the received identification and the hash key kiP of node Ni based on the result of comparison of CHBS′ with CHBS. Moreover, node Ni also can ensure whether node Nj is valid by applying the same method that is used by node Nj. In this case, the received message is from node Nj.If nodeNi confirms that node Nj is valid, a shared session key abP can be established by using the mutual authentication value (MavNj) of the received message from node Nj. Subsequently, MavNj′ can be computed, where (6)MavNj′=f((abPX∥rirjYX),kjP).Equation (3) can be rewritten as(7)MavNj′=f((abPX∥rirjYX),kjP)=f((baPX∥rjriYX),kjP)=MavNj.On the other hand, the random values a and b are chosen by nodes Ni and Nj, respectively. The point P of the Elliptic curve and the public key Y are initially published by the base station. Therefore, node Ni can obtain the value of abPX using the aforementioned parameters. ri is Ni’s security key. Node Ni then compares MavNj′ with MavNj, which are obtained by Diffie-Hellman key exchange. If they are equal, the shared session key has been established. In a similar manner, node Nj can apply the method used by node Ni to confirm the mutual authentication value.


## 4.2. Security Analysis

The proposed scheme utilizes the chameleon hash function and twice Diffie-Hellman key exchange produces the mutual authentication value to establish mutual authentication between communication nodes. This study is constructed of security chameleon hash function, and further proof is in [10, 11]. For example, if nodes Ni and Nj require mutual authentication, Nj will first compare the preloaded chameleon hash value of the base station, CHBS, with the chameleon hash value of node Ni,CHBS′, obtained by using (1). However, the calculation of CHBS′ requires the ID, the hash key kiP, and the value riY of node Ni. Thus, the process can authenticate the ID and hash key because computing CHBS′ is an elliptic curve discrete logarithm problem (ECDLP) if the attacker does not have any information about the ID and hash key. Furthermore, ri is protected by the secret keys α and kix-1.After nodeNi has been authenticated, node Nj applies (1) and (2) to compute the MavNj. Then, MavNj is compared with MavNi. MavNi is obtained by using the shared session key abP and security key ri. However, only the communication nodes recognize the session key abP, and only node Ni and the base station can have the secret key ri.In addition to security analysis, the following paragraphs explain how the proposed method can resist attacks such as legal node masquerading attacks,forgery attacks, new node masquerading attacks, replay attacks, and man-in-the-middle attacks.(A) Legal Node Masquerading Attack. In this study, the authentication of node Nj depends on the comparison of chameleon hash values in the authentication and key establishment phase.First, the node to be authentication nodeNj checks CHBS. Nj can provide a legitimate value of rjY only if it is legitimate, and only the base station knows the secret keys α and kjx-1 can provide corresponding rj for given message.Secondly, only a legitimate nodeNj can use rj to compute the mutual authentication value and get authenticated successfully.An attacker may obtain the commutation values by eavesdropping on the communication between nodesNi and Nj. However, even if the attacker obtains the values of aP and bP from the authentication and key establishment phase, deriving the legalized session key abP is extremely difficult because of the ECDLP. Therefore, the proposed scheme can prevent a legal node masquerading attack.(B) Forgery Attack. Consider the case where an adversary has obtained the commutation values by eavesdropping on the communication channel.The adversary may attempt to create a legitimate authentication message using the following equation:(8)ri′=ri+kix-1fm′,kiP-fm,kiPmodq.However, it is not possible for the adversary to create a forged message because the value ofri′ cannot be computed without secret key kix-1.(C) New Node Masquerading Attack. When some of the sensor nodes in the wireless sensor network are damaged or have exhausted their power, new sensor nodes must be added to the network to extend its life. In the new node addition phase, the base station preloads the ki+1P, CHBS, Ni+1, and ri+1 values to a new node. Owing to the nonavailability of the secret keys x and α, the attacker cannot compute the value of ri+1; hence, it cannot use ri+1 to verify the ID and the hash key of the new node. Therefore, the proposed scheme can prevent new node masquerading attacks.(D) Replay Attack. A replay attack is the one in which an attacker captures the transmitted messages of a legitimate node and later replays them on the network in an attempt to imitate legitimate authentication messages. For example, if an attacker transmits the captured message (Ni,aP,riY,kiP) to another node Nj, the attacker must then provide ri for establishing a mutual authentication value Mav. The Mav is required for a shared session key with the node to be connected. However, it is not possible for the attacker to obtain ri without the secret key kix-1.In addition, if the attacker sends the valueMav to connect node Nj, node Nj can use the shared session key to authenticate whether the connecting node is legitimate or not. Another point that must be noted is that every connection between the two nodes uses the up-to-date session key values a and b. By means of these different strategies, the proposed method can resist replay attacks.(E) The Man-in-the-Middle Attack. In the proposed scheme, the communication nodes can mutually authenticate and establish session keys between users and servers. Although an attacker may launch a man-in-the-middle attack, the attacker can only know the values of aP and bP. It still has to resolve the ECDLP. Moreover, even if the attacker obtains user information (such as Ni,kiP,riY), the attacker still cannot pass the authentication and key establishment phase because it cannot compute the mutual authentication value Mav of the session key. Therefore, the proposed scheme can resist man-in-middle attacks.


### 4.2.1. Session Key Security

The proposed scheme uses a session key. Only the communicating parties know the session keyabP when the user verifies the message from receiving party. The session key SK=abP is not known by anyone other than the communicating parties because the random values aP and bP are protected by the ECDLP. Therefore, the proposed scheme provides session key security.


## 4.2.1. Session Key Security

The proposed scheme uses a session key. Only the communicating parties know the session keyabP when the user verifies the message from receiving party. The session key SK=abP is not known by anyone other than the communicating parties because the random values aP and bP are protected by the ECDLP. Therefore, the proposed scheme provides session key security.


## 4.3. Performance Analysis

Table1 shows the proposed scheme compared with related works Huang [3], Kim and Lee [4], Zeng et al. [6], and Molavi et al. [8] in terms of the function of access control method. The computation cost and the transmission cost are two popular benchmarks for evaluation of the efficiency of the WSNs. Table 2 shows the computation costs of the proposed method during different phases. When compared to the computation cost of the hash chain and the elliptic curve-based schemes, the computation cost of the proposed method is slightly higher. However, our proposed method does not require time synchronization or the verification table for authentication. Hence, it is more efficient than the hash chain and elliptic curve-based methods.Table 1
Compared function of access control method.
Function
Method
[3]
[4]
[7]
[8]
Proposed method
Resist various attacks
No
No
Yes
Yes
Yes
Easily add new node
Yes
Yes
Yes
Yes
Yes
Do not need time synchronization
No
No
No
No
Yes
After authentication, no need for broadcast
No
No
No
Yes
Yes
Do not have to verify table
No
No
No
Yes
Yes
After adding new node, no need for broadcast
No
No
No
Yes
YesTable 2
The computation costs of the proposed method during different phases.
Phase
Computation cost
Base station
NodeNi
Initialization
2
T
e
m
+
n
(
2
T
e
m
+
1
T
mul
)
N/A
Authentication and key establishment
N/A
5
T
e
m
+
1
T
h
New node adding
2
T
e
m
+
1
T
mul
N/A
T
e
m: time cost for one multiplication computation over an elliptic curve.
T
h: time for cryptographic secure hash function.
T
mul: time cost of performing the modulus multiplication operation.The energy cost of communication and cryptography in wireless sensor networks is an important consideration. In [13] indicated, the energy cost of cryptographic protocols, both from a communication energy cost and computation energy cost. According to [13] measure practical costs of computation and communication in WSN, it used TelosB sensors run Elliptic Curve Diffie-Hellman key exchange with authentication energy costs total is 130 (mJ), communication costs is 58.3 (mJ), and computation cost is 77 (mJ). As a result, we can realize that communication cost is an important consideration same as the computation cost. Table 3 presents the computation and the transmission costs incurred by using the methods put forward by Zhou et al. [2], Huang [3], Kim and Lee [4], and Lee et al. [7]. It also displays the costs incurred by using our proposed method. The protocol proposed by Huang requires seven transmissions and updates the broadcast hash chain after each authentication, key establishment, and new node addition phase. Our method requires only five transmissions. Consequently, it needs less bandwidth than the schemes proposed by Zhou et al. and Huang.Table 3
The comparison of computation costs and number of transmissions.
Scheme
Each node achieves authentication and establishes shared session key
Total number of transmissions to establish shared session key
Zhou et al. [2]
3
T
e
m
+
T
mul
+
T
h
21
Kim and Lee [4]
2
T
e
m
+
8
T
h
14
Huang [3]
2
T
e
m
+
5
T
h
10
Lee et al. [7]
2
T
e
m
+
5
T
h
8
Our proposed scheme
5
T
e
m
+
1
T
h
5
T
e
m: point multiplication computation over an elliptic curve.
T
h: time for cryptographic secure hash function.
T
mul: time cost of performing the modulus multiplication operation.Therefore, the proposed scheme can be applied to applications from the WSNs criteria that had less number of transmissions and had lower data rate of communication. However, every broadcast has resulted in poor throughput of WSNs. Our proposed method does not need broadcast to update node list and verify table. Furthermore, it can be implemented by using any elliptic curve and cryptographic secure hash function.


## 5. Conclusion

This study demonstrated a new access control scheme for WSNs that has three characteristics. First, the proposed scheme can establish mutual authentication between two communication nodes and resist possible attacks when the base station adds a new node to the WSN. Second, the proposed scheme can establish a common session key between two nodes in an efficient manner. Moreover, it does not require time synchronization or the verification table. Third, the proposed scheme requires fewer transmissions and less bandwidth than existing schemes.



---

*Source: 261906-2015-07-01.xml*