# A Mutual Broadcast Authentication Protocol for Wireless Sensor Networks Based on Fourier Series

Authors: Xiaogang Wang; Weiren Shi
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

This thesis presents a mural broadcast authentication protocol (MBAP) for wireless sensor networks based on Fourier series according to the issues of the main broadcast authentication protocolµTESLA being limited in authentication delay, more initial parameters, limited time, large key chain, and network congestion. Firstly, achieving the forward authentication work for common sensor nodes to base station is based on the characteristic of continuous-integrability function f(x) in [-π,π] which could be expanded into Fourier series, including entity authentication and source attestation. Secondly, assume that f(x) is the quadratic form function, and achieve
the reverse authentication work for base station to common sensor nodes by detecting the security of f(x). The analysis results of safety performance in MBAP show that the captured nodes in WSN will not affect the security of broadcast authentication protocol and have low computation and communication cost, the base station can make broadcast randomly, and common sensor nodes can authenticate messages instantly, which solves the problem of network congestion well. The most important thing of MBAP is the mutual broadcast authentication method which ensures the security of the network greatly.


---

## Body

## 1. Introduction

In wireless sensor networks (WSN), in order to save the network bandwidth and the communication time, the base station and the cluster heads generally send messages to the common sensor nodes by broadcasting. And broadcast communication plays a very important role in WSN, and its security has a direct impact on the security of the entire network [1–5]. Therefore, it must be able to authenticate the source, the accuracy, and the integrity of the broadcast packets when the receiving nodes get the broadcast packets; it is also known as broadcast authentication.The broadcast authentication includes two parts: entity authentication and source attestation. Entity authentication is the process for confirming the identity of the sending nodes based on some authentication protocol, which insures the security for network access. And source attestation is mainly to ensure the integrity of the messages and prevent unauthorized nodes sending, forging, and tampering messages. These two parts’ authentication can be achieved by the generation and verification of message authentication code (MAC). If the broadcast authentication takes the symmetric encryption mechanism, each captured node can modify or forge the messages and threaten the whole network security. So, it is necessary to use asymmetric encryption technique for broadcast authentication.There are many efficient broadcast protocols that have been proposed, such as broadcast transmission capacity (BTC) of heterogeneous wireless ad hoc networks with secrecy outage constraints [6], a qos-based broadcast protocol (QBBP) for multihop cognitive radio ad hoc networks under blind information [7], and a reliable and total order tree-based (RTOT) broadcast in wireless sensor network [8]. But it is hard to design broadcast authentication protocols for WSN because of the limitations of WSN. There are two kinds of WSN broadcast authentication protocols: one is the signature authentication [9–11], but it is hard to be applied because of the disadvantage of using public key cryptography and large cost, and the other one is the message authentication code (MAC) [12–15], such as the μTESLA which is proposed as the broadcast authentication protocol by Perrig based on the security protocols for sensor networks in [15], which realizes the asymmetry of broadcast authentication by using the symmetric encryption mechanism, and including three key parts: key establishment, disclosing authentication key, and authenticating broadcast data. In addition, multilevel LTESLA, a broadcast authentication system for distributed sensor networks, is proposed in [16], which divides authentication into multiple levels, where the high level key chain authenticates the low level key chain, and the low layer key chain authenticates the broadcast data packets, but it is suitable for the single base station network.This thesis presents a mutual broadcast authentication protocol (MBAP) for wireless sensor networks based on Fourier series according to the problems of the main broadcast authentication protocolμTESLA being limited in authentication delay, more initial parameters, limited time, large key chain, and network congestion. And the mutual authentication between nodes and base station is achieved according to the characteristic of continuous-integrability function f(x) in [-π,π] which could be expanded into Fourier series. Firstly one has pre-distributing f(x) for each node upon network initializing, calculating the current Fourier series coefficients, establishing authentication key K′, verifying the correctness of the broadcast authentication information, achieving entity authentication and source attestation. Secondly, assuming that f(x) is the quadratic form function and achieving the reverse authentication work for base station to common sensor nodes by detecting the security of f(x), it also means that the MBAP protocol can achieve mutual security authentication. The analysis results of safety performance in MBAP show that the captured nodes in WSN will not affect the security of broadcast authentication protocol and have low computation and communication cost, the base station can make broadcast randomly, and common sensor nodes can authenticate messages instantly, which solves the problem of network congestion well. The most important thing of MBAP is the mutual broadcast authentication method which ensures the security of the network greatly.The paper is organized as follows. In Section2, we analyze the related work, such as μTESLA protocol principle and its issues. In Section 3, we discuss the specific principle of MBAP, including network model assumptions, Fourier series’ characteristics analysis and MBAP authentication principle. Section 4 analyzes the security of MBAP compared with MBAP. And summary is made in Section 5.


## 2. Related Work

### 2.1.μTESLA Protocol

InμTESLA, the asymmetric characteristic of broadcast authentication is realized by using the symmetric encryption mechanism on condition of the loose time synchronization of sending nodes and receiving nodes. The key points of μTESLA protocol are using hash key chain and publishing key delayed, as showed in Figure 1, a one-way function key chain is established by the sending node, where the length of key chain is n+1, and the first key Kn of the key chain is generated randomly by the sending node, but the next keys are all generated by the one-way function hash acting on the last key repeatedly, such as Kj=H(Kj+1). The sending node divides the communication time into equal time slices, where the length of each time slice is D, and each time slice is assigned a key in order, but the order of the assigned keys is the opposite order of the key chain, and each message Pi of time slice j is encrypted by Kj, such as MACKjPi. The sending node determines the key delay time δ based on the time slice length, and the key Kj on time slice j will be published after δ, such as δ=2 in Figure 1.Figure 1
μTESLA protocol.To avoid the additional communication cost, the published key is sent to the receiving nodes by being attached with the data packet. If there is no data packet on some time slice, the key attached with the data packet will not be published, and this key can be calculated by the next keys in one-way functionhash. More importantly, the initial parameters K0, δ, and D and starting time T0 should be sent to receiving nodes before authentication.


### 2.2.μTESLA Protocol Issues

#### 2.2.1. Computation Cost

TheμTESLA protocol has higher authentication efficiency in the case of sending data packets frequently, but it has a very low sending frequency in some applications, such as fire alarm and other event-driven applications, where the transmission interval of the adjacent data packets may be far greater than the time slice D of μTESLA and causes lots of keys not to be used for the data packets authentication, and the distance between adjacent keys on the key chain is also increased and causes a large computation cost and authentication delay.IncreasingD can alleviate this problem, but it also causes a lot of authentication delay, and the receiving nodes also need more memory space for buffering packets.


#### 2.2.2. Delay

InμTESLA, the time interval of sending message MACKiPi∥Ki-2∥Pi∥it will be increased gradually, and the time for buffering data packets is also increased because of the authentication delay, which also makes the protocol more vulnerable to be attacked by DoS. Therefore, the authentication mechanism of μTESLA is not suitable for the situation of large sending time interval.


#### 2.2.3. Problem of Initialization Parameters

The most important problem ofμTESLA is the distribution of initialization parameters. Each sending node has an independent authentication key chain for encrypting its own data packets, and each receiving node makes authentication for MACKiPi∥Ki-2∥Pi∥it after receiving the initialization parameters K0, δ, and D and starting time T0. If the nodes send the initialization parameters K0,δ,D,T0 in unicast way, it will cause much resource consumption, because the sending node needs to encrypt the K0,δ,D,T0 in different keys shared with the receiving node, which will cause the delay for data packet transmission and authentication, and the delay may lead to DoS attacks.


#### 2.2.4. Authentication Aging Problem

There are some applications that require real-time authentication for broadcasting, such as real-time audio frequency, video stream, and alarm information. Obviously,μTESLA is not suitable for high ageing applications because of the authentication delay.


#### 2.2.5. Fixed Key Chain Length

InμTESLA, the authentication key of each time slice is predistributed upon network initialization. On the one hand, if the work time is too long, it means that the length of key chain is too large, which will cause a large computation cost and storage cost. On the other hand, if the work time is too short, it cannot meet the requirement of frequent data exchange and long-term work.Therefore, in order to meet the characteristics of lower delay, better aging, less key storage, computing fast, and better flexibility for the general broadcast authentication in WSN, this paper introduces the mathematical theory of Fourier series, which simplifies the practical issues based on characteristic of Fourier series coefficients and makes a simple and efficient broadcast authentication.


## 2.1.μTESLA Protocol

InμTESLA, the asymmetric characteristic of broadcast authentication is realized by using the symmetric encryption mechanism on condition of the loose time synchronization of sending nodes and receiving nodes. The key points of μTESLA protocol are using hash key chain and publishing key delayed, as showed in Figure 1, a one-way function key chain is established by the sending node, where the length of key chain is n+1, and the first key Kn of the key chain is generated randomly by the sending node, but the next keys are all generated by the one-way function hash acting on the last key repeatedly, such as Kj=H(Kj+1). The sending node divides the communication time into equal time slices, where the length of each time slice is D, and each time slice is assigned a key in order, but the order of the assigned keys is the opposite order of the key chain, and each message Pi of time slice j is encrypted by Kj, such as MACKjPi. The sending node determines the key delay time δ based on the time slice length, and the key Kj on time slice j will be published after δ, such as δ=2 in Figure 1.Figure 1
μTESLA protocol.To avoid the additional communication cost, the published key is sent to the receiving nodes by being attached with the data packet. If there is no data packet on some time slice, the key attached with the data packet will not be published, and this key can be calculated by the next keys in one-way functionhash. More importantly, the initial parameters K0, δ, and D and starting time T0 should be sent to receiving nodes before authentication.


## 2.2.μTESLA Protocol Issues

### 2.2.1. Computation Cost

TheμTESLA protocol has higher authentication efficiency in the case of sending data packets frequently, but it has a very low sending frequency in some applications, such as fire alarm and other event-driven applications, where the transmission interval of the adjacent data packets may be far greater than the time slice D of μTESLA and causes lots of keys not to be used for the data packets authentication, and the distance between adjacent keys on the key chain is also increased and causes a large computation cost and authentication delay.IncreasingD can alleviate this problem, but it also causes a lot of authentication delay, and the receiving nodes also need more memory space for buffering packets.


### 2.2.2. Delay

InμTESLA, the time interval of sending message MACKiPi∥Ki-2∥Pi∥it will be increased gradually, and the time for buffering data packets is also increased because of the authentication delay, which also makes the protocol more vulnerable to be attacked by DoS. Therefore, the authentication mechanism of μTESLA is not suitable for the situation of large sending time interval.


### 2.2.3. Problem of Initialization Parameters

The most important problem ofμTESLA is the distribution of initialization parameters. Each sending node has an independent authentication key chain for encrypting its own data packets, and each receiving node makes authentication for MACKiPi∥Ki-2∥Pi∥it after receiving the initialization parameters K0, δ, and D and starting time T0. If the nodes send the initialization parameters K0,δ,D,T0 in unicast way, it will cause much resource consumption, because the sending node needs to encrypt the K0,δ,D,T0 in different keys shared with the receiving node, which will cause the delay for data packet transmission and authentication, and the delay may lead to DoS attacks.


### 2.2.4. Authentication Aging Problem

There are some applications that require real-time authentication for broadcasting, such as real-time audio frequency, video stream, and alarm information. Obviously,μTESLA is not suitable for high ageing applications because of the authentication delay.


### 2.2.5. Fixed Key Chain Length

InμTESLA, the authentication key of each time slice is predistributed upon network initialization. On the one hand, if the work time is too long, it means that the length of key chain is too large, which will cause a large computation cost and storage cost. On the other hand, if the work time is too short, it cannot meet the requirement of frequent data exchange and long-term work.Therefore, in order to meet the characteristics of lower delay, better aging, less key storage, computing fast, and better flexibility for the general broadcast authentication in WSN, this paper introduces the mathematical theory of Fourier series, which simplifies the practical issues based on characteristic of Fourier series coefficients and makes a simple and efficient broadcast authentication.


## 2.2.1. Computation Cost

TheμTESLA protocol has higher authentication efficiency in the case of sending data packets frequently, but it has a very low sending frequency in some applications, such as fire alarm and other event-driven applications, where the transmission interval of the adjacent data packets may be far greater than the time slice D of μTESLA and causes lots of keys not to be used for the data packets authentication, and the distance between adjacent keys on the key chain is also increased and causes a large computation cost and authentication delay.IncreasingD can alleviate this problem, but it also causes a lot of authentication delay, and the receiving nodes also need more memory space for buffering packets.


## 2.2.2. Delay

InμTESLA, the time interval of sending message MACKiPi∥Ki-2∥Pi∥it will be increased gradually, and the time for buffering data packets is also increased because of the authentication delay, which also makes the protocol more vulnerable to be attacked by DoS. Therefore, the authentication mechanism of μTESLA is not suitable for the situation of large sending time interval.


## 2.2.3. Problem of Initialization Parameters

The most important problem ofμTESLA is the distribution of initialization parameters. Each sending node has an independent authentication key chain for encrypting its own data packets, and each receiving node makes authentication for MACKiPi∥Ki-2∥Pi∥it after receiving the initialization parameters K0, δ, and D and starting time T0. If the nodes send the initialization parameters K0,δ,D,T0 in unicast way, it will cause much resource consumption, because the sending node needs to encrypt the K0,δ,D,T0 in different keys shared with the receiving node, which will cause the delay for data packet transmission and authentication, and the delay may lead to DoS attacks.


## 2.2.4. Authentication Aging Problem

There are some applications that require real-time authentication for broadcasting, such as real-time audio frequency, video stream, and alarm information. Obviously,μTESLA is not suitable for high ageing applications because of the authentication delay.


## 2.2.5. Fixed Key Chain Length

InμTESLA, the authentication key of each time slice is predistributed upon network initialization. On the one hand, if the work time is too long, it means that the length of key chain is too large, which will cause a large computation cost and storage cost. On the other hand, if the work time is too short, it cannot meet the requirement of frequent data exchange and long-term work.Therefore, in order to meet the characteristics of lower delay, better aging, less key storage, computing fast, and better flexibility for the general broadcast authentication in WSN, this paper introduces the mathematical theory of Fourier series, which simplifies the practical issues based on characteristic of Fourier series coefficients and makes a simple and efficient broadcast authentication.


## 3. MBAP

### 3.1. Network Model Assumptions

In WSN, either the base station or the sensor node is the broadcaster (as shown in Figure2).Figure 2
Broadcasting communication in centralized network.According to the topology of the network, it can broadcast directly when the base station is the broadcaster which can send the information to the prerecipient without intermediate nodes or can send the information to the prerecipient layer by layer, such that the base station will send the information to each cluster head first of all, and the cluster head will send the information to each common sensor node after authentication.When the sensor nodes are the broadcasters, they can only send the information to their neighbor nodes directly without intermediate nodes.In order to facilitate the description of MBAP, the network is assumed as follows:(1)
Assume that the network is isomorphic and static and each of the sensor nodes has been uniformly deployed in the target area and has same configuration in software and hardware and will not move any more once they are deployed, where the network size isN, including 2 types of nodes, base station (BS) and sensor node (SN), as shown in Figure 2.(2)
Assume that base station (BS) is equipped with abundant software and hardware resources and can cover the entire network deployment area by means of a high power radio signal, and it is responsible for storing the basic information of all the nodes in network and has the ability to detect compromised or captured nodes.(3)
Common sensor node is responsible for collecting environmental data. The ability to process data of sensor node is limited by storage space, energy reserves, and communication distance. Since the communication radius of the common sensor node is limited, the communication between nodes which are not in the communication radius should be transferred by neighbor node.The main symbols in the text are shown as follows:BS: base station,SN: sensor node,h(x): hash function,K: authentication key,IDi: identity symbol of node i,f(x): continuous-integrability function,D: time slice length,P: plaintext,Li: authentication message of time slice i.


### 3.2. Analyzing Characteristics of Fourier Series

Definition 1.
If the functionf(x) period is T, it is satisfied on the following conditions:(1)fx=A0+∑n=1∞Ansin⁡nωx+φn=A0+∑n=1∞ancos⁡nωx+bnsin⁡nωx.And claim that formula (1) is the Fourier series determined by f(x).


#### 3.2.1. Orthogonal Analysis of Trigonometric Function

Assume thatc is a real number and cos⁡kx and sin⁡kx are the periodic function in c,c+2π, where the period is 2π, and then(2)∫cc+2πcos⁡kxdx=∫02πcos⁡kxdx=0,∫cc+2πsin⁡kxdx=∫02πsin⁡kxdx=0,k=1,2,….And it is easy to prove with product and difference(3)∫cc+2πsin⁡kxcos⁡lxdx=0,∫cc+2πsin⁡kxsin⁡lxdx=0,∫cc+2πcos⁡kxcos⁡lxdx=0k≠l;k,l=1,2,…(4)∫cc+2πcos2⁡kxdx=∫02πcos2⁡kxdx=∫02π1+cos⁡2kx2dx=π,∫cc+2πsin2⁡kxdx=π,k=1,2,…∫cc+2π12dx=2π.


#### 3.2.2. Fourier Series Coefficient Analysis

Deduction 1.
Assume that functionf(x) has been expanded to a uniformly convergent trigonometric series:(5)fx=a02+∑k=1∞akcos⁡kx+bksin⁡kx.
Then(6)a0=1π∫-ππfxdx,ak=1π∫-ππfxcos⁡kxdx,k=0,1,2,…,bk=1π∫-ππfxsin⁡kxdx,k=0,1,2,….Proof.
Assume thatf(x) is an integrable function in [-π,π], where the right side of (5) can be integrable term by term. So we can get (7) by (2). Consider(7)∫-ππfxdx=a02·2π=a0π,a0=1π∫-ππfxdx.
Set thatn is a positive integer and multiplying by both sides with cos⁡nx for f(x) and integration in [-π,π] then we can get (8) by (2), (3), and (4):(8)∫-ππfxcos⁡nxdx=a02∫-ππcos⁡nxdx+∑k=1∞ak∫-ππcos⁡kxcos⁡nxdx+bk∫-ππsin⁡kxcos⁡nxdx=∫-ππancos2⁡nxdx=anπ.
Therefore(9)an=1π∫-ππfxcos⁡nxdx.
Similarly(10)bn=1π∫-ππfxsin⁡nxdx.
Thus Deduction1 is proved.


### 3.3. MBAP Authentication Principle

We assume thatf(x) is a continuous-integrability function in [-π,π] which is predistributed for each node upon initializing. So, the MBAP authentication principle is as follows.Step  1 (establishing authentication key). The base station divides the communication time into equal time slices, where the length of each time slice is D, and each time slice is assigned a key in order. Set Ki to be the authentication key distributed for the time slice i, and set (11)Ki=a02+∑k=1iakcos⁡kx+bksin⁡kx.It is obvious that the keys for each time slice are different based on Deduction1, and(12)Ki+1=a02+∑k=1i+1akcos⁡kx+bksin⁡kx=Ki+ai+1cos⁡i+1x+bi+1sin⁡i+1x.It is showed in (12) that the authentication key Ki+1 on time slice i+1 can be calculated by Ki and Fourier series coefficients ai+1 and bi+1.Step  2 (building broadcast authentication information). We assume that Li is the broadcast authentication information of the time it on time slice i, where t is a certain time on time slice i, and set(13)Li=Pit∥hai∥hbi∥MAC=hKi,Pit,it∥it,where ai=1/π∫-ππfxcos⁡ixdx and bi=(1/π)∫-ππfxsin⁡ixdx are last two Fourier series coefficients of Ki, Pit is the plaintext message of time it, and MAC=h(K(i),Pit,it) makes sure that K(i) is undisclosed which ensures the security of the key in the process of message communication.Then there are base station broadcastsLi.Step  3 (application verification). The common sensor node gets the authentication information Li and time it.If the common sensor node has received the authentication informationLi on time it+1, it is showed that the authentication information Li is outdated, and it is likely to be caused by network congestion or may be an enemy in disguise after being captured. For this unusual situation, the first step is to abandon Li on time it, and the second step is to verify the legitimacy of Li on time it by BS.Conversely, ifit is the latest time, it is showed that Li is the authentication information which needs to be authenticated currently, and go to Step4.Step  4 (entity authentication). Because f(x) is predistributed for each sensor node, according to the Definition 1 and Deduction 1, set(14)ai′=1π∫-ππfxcos⁡ixdxbi′=1π∫-ππfxsin⁡ixdx.Ifhai′=hai and hbi′=hbi, it is showed that Li is the authentication information sent by BS on the time slice i, and entity authentication is completed by now.Conversely, ifhai′≠hai or hbi′≠hbi, abandon Li and check the legitimacy of Li by BS.Step  5 (source attestation). After the completion of entity authentication, it is necessary to determine whether the plaintext message Pit has been tampered by enemy, and set(15)K′i=a0′2+∑k=1iak′cos⁡kx+bk′sin⁡kx(16)OrK′i=Ki-1+ai′cos⁡ix+bi′sin⁡ix,where K(i-1) is the authentication key on time slice i-1 which has been authenticated on last time slice and hai′=hai and hbi′=hbi have been authenticated in Step4, so K′i=K(i) based on (12), where K(i) encrypted by hash function cannot be got by enemy.It is showed in (16) that the calculation of K′i avoids amounts of the calculation of Fourier series coefficients each time and reduces the computation cost greatly.And if(17)hK′i,Pit,it=hKi,Pit,it=MAC,it is showed that the plaintext message Pit is integrity and not tampered by enemy, and source attestation is completed by now.Conversely, ifh(K′(i),Pit,it)≠h(K(i),Pit,it), it is showed that the plaintext message Pit is captured by enemy and checking the legitimacy of Li by BS.The forward authentication work for common sensor nodes to base station is completed from now on, and the forward flow chart of MBAP protocol is showed in Figure3.Figure 3
Forward flow chart of MBAP protocol.Step  6 (reverse authentication)Deduction 2.
In order to detect the security off(x), assume that f(x) is a quadratic polynomial and a continuous-integrability function for some variable in [-π,π]. And the reverse authentication work for the base station to the common sensor nodes can be completed by detecting the security of f(x), and it also means that the MBAP protocol can achieve mutual security authentication.Proof.
Assume thatf(x1,x2,…,xn) is a multiple asymmetric quadratic form polynomial in field P:(18)fx1,x2,…,xn=a11x12+a12x1x2+⋯+a1nx1xn+a21x2x1+a22x22+⋯+a2nx2xn+⋯+an1xnx1+an2xnx2+⋯+annxn2=x1,x2,…,xna11a12⋯a1na21a22⋯a2n⋮⋮⋮⋮an1an2⋯annx1x2⋮xn=XTAX,where A is the quadratic matrix of f(x1,x2,…,xn),aij=aji, i,j=1,…,n,A=AT.
A key management scheme based on quadratic for WSN is proposed in [17] by the author Xiaogang Wang, where, assuming fwi(x1,x2,…,xn) is the quadratic polynomial of node i, λi1,λi2,…,λin are the eigenvalues of fwi(x1,x2,…,xn), ξi1,ξi2,…,ξin are the eigenvectors of fwi(x1,x2,…,xn), and assume that (19)Ci=λi10⋯00λi2⋯0⋮⋮⋮⋮00⋯λin,Di=ξi1,ξi2,…,ξin.
We can assume that nodeni has achieved forward authentication work for base station and responded to the base station with a message M=f(x)∥h(Ci)∥h(Di)∥IDi and the base station will make reverse authentication upon receiving the message M=f(x)∥h(Ci)∥h(Di)∥IDi.
Based on [17], we can get that the eigenvalues λi1,λi2,…,λin of quadratic polynomial fwi(x1,x2,…,xn) in different sequence or incorrectness will affect the accuracy of eigenvectors ξi1,ξi2,…,ξin or Di, and the eigenvectors in different sequence that belonged to the same eigenvalue also can affect the accuracy of Di. For this reason, we can assume that the sequence of eigenvalues and eigenvectors of each sensor node are predistributed by base station, which can avoid the same response information by different nodes and ensure the independence of the reverse authentication work. For example, M=f(x)∥h(Ci)∥h(Di)∥IDi is the response information of node ni, and the base station can get Ci′ and Di′ based on the sequence of eigenvalues and eigenvectors of node ni. If h(Ci)≠h(Ci′) or h(Di)≠h(Di′), it is showed that node ni is captured by enemy and removed by base station. If h(Ci)=h(Ci′) and h(Di)=h(Di′), it is showed that identity of node ni is authenticated base station.
Therefore, a mutual broadcasting authentication work is achieved by now and Deduction2 is proved.Step  7 (update
f
(
x
)
). For the network security, f(x) should be updated periodically, so we modify the broadcast authentication information Li by the base station and set (20)Li′=Pit∥hai∥hbi∥MAC=hKi,Pit,it∥Kifxnew∥hfxnew∥it,where the first part Pit∥hai∥hbi∥MAC=h(K(i),Pit,it) of L(i)′ is still the broadcast authentication information Li, so the common sensor nodes can still make forward authentication work. After forward authentication, each sensor node can get fxnew by Ki and verify fxnew by hfxnew, removing the old f(x) at last.And the updating forf(x) is completed by now.


## 3.1. Network Model Assumptions

In WSN, either the base station or the sensor node is the broadcaster (as shown in Figure2).Figure 2
Broadcasting communication in centralized network.According to the topology of the network, it can broadcast directly when the base station is the broadcaster which can send the information to the prerecipient without intermediate nodes or can send the information to the prerecipient layer by layer, such that the base station will send the information to each cluster head first of all, and the cluster head will send the information to each common sensor node after authentication.When the sensor nodes are the broadcasters, they can only send the information to their neighbor nodes directly without intermediate nodes.In order to facilitate the description of MBAP, the network is assumed as follows:(1)
Assume that the network is isomorphic and static and each of the sensor nodes has been uniformly deployed in the target area and has same configuration in software and hardware and will not move any more once they are deployed, where the network size isN, including 2 types of nodes, base station (BS) and sensor node (SN), as shown in Figure 2.(2)
Assume that base station (BS) is equipped with abundant software and hardware resources and can cover the entire network deployment area by means of a high power radio signal, and it is responsible for storing the basic information of all the nodes in network and has the ability to detect compromised or captured nodes.(3)
Common sensor node is responsible for collecting environmental data. The ability to process data of sensor node is limited by storage space, energy reserves, and communication distance. Since the communication radius of the common sensor node is limited, the communication between nodes which are not in the communication radius should be transferred by neighbor node.The main symbols in the text are shown as follows:BS: base station,SN: sensor node,h(x): hash function,K: authentication key,IDi: identity symbol of node i,f(x): continuous-integrability function,D: time slice length,P: plaintext,Li: authentication message of time slice i.


## 3.2. Analyzing Characteristics of Fourier Series

Definition 1.
If the functionf(x) period is T, it is satisfied on the following conditions:(1)fx=A0+∑n=1∞Ansin⁡nωx+φn=A0+∑n=1∞ancos⁡nωx+bnsin⁡nωx.And claim that formula (1) is the Fourier series determined by f(x).


### 3.2.1. Orthogonal Analysis of Trigonometric Function

Assume thatc is a real number and cos⁡kx and sin⁡kx are the periodic function in c,c+2π, where the period is 2π, and then(2)∫cc+2πcos⁡kxdx=∫02πcos⁡kxdx=0,∫cc+2πsin⁡kxdx=∫02πsin⁡kxdx=0,k=1,2,….And it is easy to prove with product and difference(3)∫cc+2πsin⁡kxcos⁡lxdx=0,∫cc+2πsin⁡kxsin⁡lxdx=0,∫cc+2πcos⁡kxcos⁡lxdx=0k≠l;k,l=1,2,…(4)∫cc+2πcos2⁡kxdx=∫02πcos2⁡kxdx=∫02π1+cos⁡2kx2dx=π,∫cc+2πsin2⁡kxdx=π,k=1,2,…∫cc+2π12dx=2π.


### 3.2.2. Fourier Series Coefficient Analysis

Deduction 1.
Assume that functionf(x) has been expanded to a uniformly convergent trigonometric series:(5)fx=a02+∑k=1∞akcos⁡kx+bksin⁡kx.
Then(6)a0=1π∫-ππfxdx,ak=1π∫-ππfxcos⁡kxdx,k=0,1,2,…,bk=1π∫-ππfxsin⁡kxdx,k=0,1,2,….Proof.
Assume thatf(x) is an integrable function in [-π,π], where the right side of (5) can be integrable term by term. So we can get (7) by (2). Consider(7)∫-ππfxdx=a02·2π=a0π,a0=1π∫-ππfxdx.
Set thatn is a positive integer and multiplying by both sides with cos⁡nx for f(x) and integration in [-π,π] then we can get (8) by (2), (3), and (4):(8)∫-ππfxcos⁡nxdx=a02∫-ππcos⁡nxdx+∑k=1∞ak∫-ππcos⁡kxcos⁡nxdx+bk∫-ππsin⁡kxcos⁡nxdx=∫-ππancos2⁡nxdx=anπ.
Therefore(9)an=1π∫-ππfxcos⁡nxdx.
Similarly(10)bn=1π∫-ππfxsin⁡nxdx.
Thus Deduction1 is proved.


## 3.2.1. Orthogonal Analysis of Trigonometric Function

Assume thatc is a real number and cos⁡kx and sin⁡kx are the periodic function in c,c+2π, where the period is 2π, and then(2)∫cc+2πcos⁡kxdx=∫02πcos⁡kxdx=0,∫cc+2πsin⁡kxdx=∫02πsin⁡kxdx=0,k=1,2,….And it is easy to prove with product and difference(3)∫cc+2πsin⁡kxcos⁡lxdx=0,∫cc+2πsin⁡kxsin⁡lxdx=0,∫cc+2πcos⁡kxcos⁡lxdx=0k≠l;k,l=1,2,…(4)∫cc+2πcos2⁡kxdx=∫02πcos2⁡kxdx=∫02π1+cos⁡2kx2dx=π,∫cc+2πsin2⁡kxdx=π,k=1,2,…∫cc+2π12dx=2π.


## 3.2.2. Fourier Series Coefficient Analysis

Deduction 1.
Assume that functionf(x) has been expanded to a uniformly convergent trigonometric series:(5)fx=a02+∑k=1∞akcos⁡kx+bksin⁡kx.
Then(6)a0=1π∫-ππfxdx,ak=1π∫-ππfxcos⁡kxdx,k=0,1,2,…,bk=1π∫-ππfxsin⁡kxdx,k=0,1,2,….Proof.
Assume thatf(x) is an integrable function in [-π,π], where the right side of (5) can be integrable term by term. So we can get (7) by (2). Consider(7)∫-ππfxdx=a02·2π=a0π,a0=1π∫-ππfxdx.
Set thatn is a positive integer and multiplying by both sides with cos⁡nx for f(x) and integration in [-π,π] then we can get (8) by (2), (3), and (4):(8)∫-ππfxcos⁡nxdx=a02∫-ππcos⁡nxdx+∑k=1∞ak∫-ππcos⁡kxcos⁡nxdx+bk∫-ππsin⁡kxcos⁡nxdx=∫-ππancos2⁡nxdx=anπ.
Therefore(9)an=1π∫-ππfxcos⁡nxdx.
Similarly(10)bn=1π∫-ππfxsin⁡nxdx.
Thus Deduction1 is proved.


## 3.3. MBAP Authentication Principle

We assume thatf(x) is a continuous-integrability function in [-π,π] which is predistributed for each node upon initializing. So, the MBAP authentication principle is as follows.Step  1 (establishing authentication key). The base station divides the communication time into equal time slices, where the length of each time slice is D, and each time slice is assigned a key in order. Set Ki to be the authentication key distributed for the time slice i, and set (11)Ki=a02+∑k=1iakcos⁡kx+bksin⁡kx.It is obvious that the keys for each time slice are different based on Deduction1, and(12)Ki+1=a02+∑k=1i+1akcos⁡kx+bksin⁡kx=Ki+ai+1cos⁡i+1x+bi+1sin⁡i+1x.It is showed in (12) that the authentication key Ki+1 on time slice i+1 can be calculated by Ki and Fourier series coefficients ai+1 and bi+1.Step  2 (building broadcast authentication information). We assume that Li is the broadcast authentication information of the time it on time slice i, where t is a certain time on time slice i, and set(13)Li=Pit∥hai∥hbi∥MAC=hKi,Pit,it∥it,where ai=1/π∫-ππfxcos⁡ixdx and bi=(1/π)∫-ππfxsin⁡ixdx are last two Fourier series coefficients of Ki, Pit is the plaintext message of time it, and MAC=h(K(i),Pit,it) makes sure that K(i) is undisclosed which ensures the security of the key in the process of message communication.Then there are base station broadcastsLi.Step  3 (application verification). The common sensor node gets the authentication information Li and time it.If the common sensor node has received the authentication informationLi on time it+1, it is showed that the authentication information Li is outdated, and it is likely to be caused by network congestion or may be an enemy in disguise after being captured. For this unusual situation, the first step is to abandon Li on time it, and the second step is to verify the legitimacy of Li on time it by BS.Conversely, ifit is the latest time, it is showed that Li is the authentication information which needs to be authenticated currently, and go to Step4.Step  4 (entity authentication). Because f(x) is predistributed for each sensor node, according to the Definition 1 and Deduction 1, set(14)ai′=1π∫-ππfxcos⁡ixdxbi′=1π∫-ππfxsin⁡ixdx.Ifhai′=hai and hbi′=hbi, it is showed that Li is the authentication information sent by BS on the time slice i, and entity authentication is completed by now.Conversely, ifhai′≠hai or hbi′≠hbi, abandon Li and check the legitimacy of Li by BS.Step  5 (source attestation). After the completion of entity authentication, it is necessary to determine whether the plaintext message Pit has been tampered by enemy, and set(15)K′i=a0′2+∑k=1iak′cos⁡kx+bk′sin⁡kx(16)OrK′i=Ki-1+ai′cos⁡ix+bi′sin⁡ix,where K(i-1) is the authentication key on time slice i-1 which has been authenticated on last time slice and hai′=hai and hbi′=hbi have been authenticated in Step4, so K′i=K(i) based on (12), where K(i) encrypted by hash function cannot be got by enemy.It is showed in (16) that the calculation of K′i avoids amounts of the calculation of Fourier series coefficients each time and reduces the computation cost greatly.And if(17)hK′i,Pit,it=hKi,Pit,it=MAC,it is showed that the plaintext message Pit is integrity and not tampered by enemy, and source attestation is completed by now.Conversely, ifh(K′(i),Pit,it)≠h(K(i),Pit,it), it is showed that the plaintext message Pit is captured by enemy and checking the legitimacy of Li by BS.The forward authentication work for common sensor nodes to base station is completed from now on, and the forward flow chart of MBAP protocol is showed in Figure3.Figure 3
Forward flow chart of MBAP protocol.Step  6 (reverse authentication)Deduction 2.
In order to detect the security off(x), assume that f(x) is a quadratic polynomial and a continuous-integrability function for some variable in [-π,π]. And the reverse authentication work for the base station to the common sensor nodes can be completed by detecting the security of f(x), and it also means that the MBAP protocol can achieve mutual security authentication.Proof.
Assume thatf(x1,x2,…,xn) is a multiple asymmetric quadratic form polynomial in field P:(18)fx1,x2,…,xn=a11x12+a12x1x2+⋯+a1nx1xn+a21x2x1+a22x22+⋯+a2nx2xn+⋯+an1xnx1+an2xnx2+⋯+annxn2=x1,x2,…,xna11a12⋯a1na21a22⋯a2n⋮⋮⋮⋮an1an2⋯annx1x2⋮xn=XTAX,where A is the quadratic matrix of f(x1,x2,…,xn),aij=aji, i,j=1,…,n,A=AT.
A key management scheme based on quadratic for WSN is proposed in [17] by the author Xiaogang Wang, where, assuming fwi(x1,x2,…,xn) is the quadratic polynomial of node i, λi1,λi2,…,λin are the eigenvalues of fwi(x1,x2,…,xn), ξi1,ξi2,…,ξin are the eigenvectors of fwi(x1,x2,…,xn), and assume that (19)Ci=λi10⋯00λi2⋯0⋮⋮⋮⋮00⋯λin,Di=ξi1,ξi2,…,ξin.
We can assume that nodeni has achieved forward authentication work for base station and responded to the base station with a message M=f(x)∥h(Ci)∥h(Di)∥IDi and the base station will make reverse authentication upon receiving the message M=f(x)∥h(Ci)∥h(Di)∥IDi.
Based on [17], we can get that the eigenvalues λi1,λi2,…,λin of quadratic polynomial fwi(x1,x2,…,xn) in different sequence or incorrectness will affect the accuracy of eigenvectors ξi1,ξi2,…,ξin or Di, and the eigenvectors in different sequence that belonged to the same eigenvalue also can affect the accuracy of Di. For this reason, we can assume that the sequence of eigenvalues and eigenvectors of each sensor node are predistributed by base station, which can avoid the same response information by different nodes and ensure the independence of the reverse authentication work. For example, M=f(x)∥h(Ci)∥h(Di)∥IDi is the response information of node ni, and the base station can get Ci′ and Di′ based on the sequence of eigenvalues and eigenvectors of node ni. If h(Ci)≠h(Ci′) or h(Di)≠h(Di′), it is showed that node ni is captured by enemy and removed by base station. If h(Ci)=h(Ci′) and h(Di)=h(Di′), it is showed that identity of node ni is authenticated base station.
Therefore, a mutual broadcasting authentication work is achieved by now and Deduction2 is proved.Step  7 (update
f
(
x
)
). For the network security, f(x) should be updated periodically, so we modify the broadcast authentication information Li by the base station and set (20)Li′=Pit∥hai∥hbi∥MAC=hKi,Pit,it∥Kifxnew∥hfxnew∥it,where the first part Pit∥hai∥hbi∥MAC=h(K(i),Pit,it) of L(i)′ is still the broadcast authentication information Li, so the common sensor nodes can still make forward authentication work. After forward authentication, each sensor node can get fxnew by Ki and verify fxnew by hfxnew, removing the old f(x) at last.And the updating forf(x) is completed by now.


## 4. Security Analysis

Because of the limited resource in WSN, it should meet 3 basic requirements for designing efficient broadcast authentication protocol: Firstly, insure the lower computation and communication cost. Secondly, the base station can make authentication randomly. Thirdly, the sensor nodes can make a real-time authentication. In this paper, the TWBAP protocol has some own security features besides the above the 3 conditions.


### 4.1. Anticapture

In MBAP, we know thatf(x) is the key point of authentication, and the network will not be safe once f(x) leaked, so the selection of f(x) is very important. On the basis of [17], we assume that f(x) is n-variate quadratic polynomial in field P, which has a high anticapture. For example, a key management scheme for distributed sensor networks is proposed by Eschenauer and Gligor in [18], and the main idea of this scheme is based on the binary tth symmetric polynomials, if the enemy captures some nodes which all include the same binary tth symmetric polynomial, and the nodes’ number is more than t, such that the communication key will be decrypted by enemy, it is also called t-collusion attack. In MBAP, if the enemy wants to get the communication keys, it should decrypt the binary tth symmetric polynomial f(x) or the matrix A in formula (18), but A is a symmetric matrix, it means that there are n(n+1)/2 different elements in matrix A needed to be decrypted, and the difficulty of decrypting A will be multiplied when the dimension n of matrix A is slightly changed (as shown in Figure 4). So it shows that it is very difficult to capture the binary tth symmetric polynomialf(x).Figure 4
Anticapture performance of MBAP.In addition to this, we assume that the size of the network in WSN isN, and if N<n(n+1)/2, it shows that the enemy is unable to decrypt matrix A and also unable to decrypt f(x). Therefore, for the small or middle size network, the network is absolutely safe as long as N<n(n+1)/2. And, for the large network, it also can guarantee the network security as long as there is reasonable network structure, such as increasing the number of clusters space and limiting the number of cluster members. It shows that MBAP in this paper has good anticapture performance.


### 4.2. Low Cost

In this paper, the computation cost and communication cost of MBAP protocol are relatively low, which can meet the requirements of low cost. Firstly, the broadcast authentication informationLi=Pit∥hai∥hbi∥MAC=h(K(i),Pit,it)∥it is verified by single hash operation, while the μTESLA is operated by key chain. Secondly, we can get K′i=K(i-1)+ai′cos⁡ix+bi′sin⁡ix in (16), where K(i-1) is the authentication key on time slice i-1 which has been authenticated on last time slice, so we can get K′i=K(i) by verifying hai′=hai and hbi′=hbi in Step4 of Section 3.3, which shows that the calculation of K(i) avoids amounts of the calculation for Fourier series coefficients each time and reduces the computation cost greatly.


### 4.3. Instant Authentication

In MBAP, we can make authentication immediately based on the characteristics of Fourier series coefficients when the authentication informationL(i) is broadcasted by the base station. But the μTESLA protocol needs to make the authentication after the delay time δ, which may cause a communication blocking.


### 4.4. Delay

InμTESLA, we know that the time interval of sending message MACKiPi∥Ki-2∥Pi∥it will be increased gradually, and the time for buffering data packets is also increased because of the authentication delay, which also makes the protocol more vulnerable to be attacked by DoS.In MBAP, the authentication informationLi=Pit∥hai∥hbi∥MAC=h(K(i),Pit,it)∥it and we get that the plaintext message Pit and authentication key K(i) are sent together in L(i), and there is no such problem that the time interval of sending message is increased gradually.We know that authentication delay includes the transmission cost and the computation cost, where the transmission cost is the necessary cost which cannot be avoided. ForμTESLA, the authentication delay should also include delay time δ.In order to analyze the delay problems between MBAP andμTESLA by simulation, we assume that T is the authentication delay and D is the length of time slice, which can be set to 1 in here, and assume delay time δ=2, K0 is the initial key, and t is the computation time of a hash calculation.InμTESLA, MACKiPi∥Ki-2∥Pi∥it is the message authentication code on time slice i, we can judge the correctness of Ki-2 by K0=Hi-2Ki-2, it shows that the entity authentication is completed by i-2 times hash calculation, and we can verify the integrity of Pi-2 by MACKi-2Pi-2, and it shows that the source attestation is completed by a hash calculation. So, we assume that T1 is the authentication cost on time slice i in μTESLA, and(21)T1=i-2t+t+δ=i-1t+δ=i-1t+2.In MBAP,Li=Pit∥hai∥hbi∥MAC=h(K(i),Pit,it)∥it is the message authentication code on time slice i, for the entity authentication, we should calculate ai′=1/π∫-ππfxcos⁡ixdx and bi′=(1/π)∫-ππfxsin⁡ixdx by two conventional operation and calculate hai′=hai and hbi′=hbi by two times hash calculation, for the source attestation, and we should calculate Ki′=a0′/2+∑k=1iak′cos⁡kx+bk′sin⁡kx by a conventional operation and calculate h(K′(i),Pit,it)=h(K(i),Pit,it) by a hash calculation. For ease of calculation, we assume that a conventional operation cost also is t and T2 is the authentication cost on time slice i in MBAP, and(22)T2=4t.And the authentication cost ofT1 and T2 is showed in Figure 5, where t=0.01s. It is obvious that T1 is increased gradually with the time change, which also shows that the μTESLA needs more authentication cost with the time change, while the authentication cost of MBAP is not changed all the time.Figure 5
T changes.It shows the cost changes of once authentication calculation on different time slices in Figure5, but there will be amounts of authentication calculation happening on each time slice actually, which can cause some time delay for each authentication calculation. So, the authentication delay is increased with the time changes. For this reason, we assume that there will be n times authentication calculation happening on each time slice, and we assume that T3 is the authentication cost on time slice i by n times authentication calculation in μTESLA, and(23)T3=ni-2t+t+δ=ni-1t+δ=ni-1t+2.Similarly, we assume thatT4 is the authentication cost on time slice i by n times authentication calculation in MBAP, and(24)T4=n4t=4nt.For ease of calculating, we assumen=10, and the authentication cost of these two protocols is showed in Figures 6, 7, and 8.Figure 6
T changes of μTESLA protocol.Figure 7
T changes of MBAP protocol.Figure 8
T changes between two protocols.It is indicated in Figures6 and 7 that the authentication delays of these two protocols are all increased with the time changes, but the authentication delays of μTESLA are increased much faster with the authentication calculation increasing, while the authentication delay of MBAP is changed stably.It is indicated in Figure8 that there will be some messages abandoned on some slices with the authentication delay increasing in μTESLA; it is one of the issues in μTESLA analyzed in Section 2.


### 4.5. Initialization Parameter

In MBAP, the only predistributed initialization parameter isf(x), and if f(x) is a quadratic polynomial, this can make a mutual authentication.While inμTESLA the initialization parameters are K0,δ,D,T0 and if the nodes send the initialization parameters K0,δ,D,T0 in unicast way upon network initialization, that will cause much resource consumption, because the sending node needs to encrypt K0,δ,D,T0 in different keys shared with the receiving node, which will cause the delay for data packet transmission and authentication, and the delay may lead to DoS attacks.


### 4.6. Length of the Key Chain

InμTESLA, when the sensor nodes receive the published key Kj, we can verify the correctness of Kj by K0=HjKj or Ki=Hj-iKj, where Ki is the verified key before Kj and K0 is the initial key. So in order to complete the authentication task in μTESLA, it needs to save a long secret key chain and needs to reconstruct the key chain sometimes, which makes a large network load.In MBAP, the authentication keyK(i) is Fourier series, and we can get K′i=K(i-1)+ai′cos⁡ix+bi′sin⁡ix in (16), where K(i-1) is the authentication key on time slice i-1 which has been authenticated on last time slice, so we can get K′i=K(i) by verifying hai′=hai and hbi′=hbi in Step  4 of Section 3.3, which shows that the calculation of K(i) avoids amounts of the calculation of Fourier series coefficients each time and reduces the computation cost greatly.


## 4.1. Anticapture

In MBAP, we know thatf(x) is the key point of authentication, and the network will not be safe once f(x) leaked, so the selection of f(x) is very important. On the basis of [17], we assume that f(x) is n-variate quadratic polynomial in field P, which has a high anticapture. For example, a key management scheme for distributed sensor networks is proposed by Eschenauer and Gligor in [18], and the main idea of this scheme is based on the binary tth symmetric polynomials, if the enemy captures some nodes which all include the same binary tth symmetric polynomial, and the nodes’ number is more than t, such that the communication key will be decrypted by enemy, it is also called t-collusion attack. In MBAP, if the enemy wants to get the communication keys, it should decrypt the binary tth symmetric polynomial f(x) or the matrix A in formula (18), but A is a symmetric matrix, it means that there are n(n+1)/2 different elements in matrix A needed to be decrypted, and the difficulty of decrypting A will be multiplied when the dimension n of matrix A is slightly changed (as shown in Figure 4). So it shows that it is very difficult to capture the binary tth symmetric polynomialf(x).Figure 4
Anticapture performance of MBAP.In addition to this, we assume that the size of the network in WSN isN, and if N<n(n+1)/2, it shows that the enemy is unable to decrypt matrix A and also unable to decrypt f(x). Therefore, for the small or middle size network, the network is absolutely safe as long as N<n(n+1)/2. And, for the large network, it also can guarantee the network security as long as there is reasonable network structure, such as increasing the number of clusters space and limiting the number of cluster members. It shows that MBAP in this paper has good anticapture performance.


## 4.2. Low Cost

In this paper, the computation cost and communication cost of MBAP protocol are relatively low, which can meet the requirements of low cost. Firstly, the broadcast authentication informationLi=Pit∥hai∥hbi∥MAC=h(K(i),Pit,it)∥it is verified by single hash operation, while the μTESLA is operated by key chain. Secondly, we can get K′i=K(i-1)+ai′cos⁡ix+bi′sin⁡ix in (16), where K(i-1) is the authentication key on time slice i-1 which has been authenticated on last time slice, so we can get K′i=K(i) by verifying hai′=hai and hbi′=hbi in Step4 of Section 3.3, which shows that the calculation of K(i) avoids amounts of the calculation for Fourier series coefficients each time and reduces the computation cost greatly.


## 4.3. Instant Authentication

In MBAP, we can make authentication immediately based on the characteristics of Fourier series coefficients when the authentication informationL(i) is broadcasted by the base station. But the μTESLA protocol needs to make the authentication after the delay time δ, which may cause a communication blocking.


## 4.4. Delay

InμTESLA, we know that the time interval of sending message MACKiPi∥Ki-2∥Pi∥it will be increased gradually, and the time for buffering data packets is also increased because of the authentication delay, which also makes the protocol more vulnerable to be attacked by DoS.In MBAP, the authentication informationLi=Pit∥hai∥hbi∥MAC=h(K(i),Pit,it)∥it and we get that the plaintext message Pit and authentication key K(i) are sent together in L(i), and there is no such problem that the time interval of sending message is increased gradually.We know that authentication delay includes the transmission cost and the computation cost, where the transmission cost is the necessary cost which cannot be avoided. ForμTESLA, the authentication delay should also include delay time δ.In order to analyze the delay problems between MBAP andμTESLA by simulation, we assume that T is the authentication delay and D is the length of time slice, which can be set to 1 in here, and assume delay time δ=2, K0 is the initial key, and t is the computation time of a hash calculation.InμTESLA, MACKiPi∥Ki-2∥Pi∥it is the message authentication code on time slice i, we can judge the correctness of Ki-2 by K0=Hi-2Ki-2, it shows that the entity authentication is completed by i-2 times hash calculation, and we can verify the integrity of Pi-2 by MACKi-2Pi-2, and it shows that the source attestation is completed by a hash calculation. So, we assume that T1 is the authentication cost on time slice i in μTESLA, and(21)T1=i-2t+t+δ=i-1t+δ=i-1t+2.In MBAP,Li=Pit∥hai∥hbi∥MAC=h(K(i),Pit,it)∥it is the message authentication code on time slice i, for the entity authentication, we should calculate ai′=1/π∫-ππfxcos⁡ixdx and bi′=(1/π)∫-ππfxsin⁡ixdx by two conventional operation and calculate hai′=hai and hbi′=hbi by two times hash calculation, for the source attestation, and we should calculate Ki′=a0′/2+∑k=1iak′cos⁡kx+bk′sin⁡kx by a conventional operation and calculate h(K′(i),Pit,it)=h(K(i),Pit,it) by a hash calculation. For ease of calculation, we assume that a conventional operation cost also is t and T2 is the authentication cost on time slice i in MBAP, and(22)T2=4t.And the authentication cost ofT1 and T2 is showed in Figure 5, where t=0.01s. It is obvious that T1 is increased gradually with the time change, which also shows that the μTESLA needs more authentication cost with the time change, while the authentication cost of MBAP is not changed all the time.Figure 5
T changes.It shows the cost changes of once authentication calculation on different time slices in Figure5, but there will be amounts of authentication calculation happening on each time slice actually, which can cause some time delay for each authentication calculation. So, the authentication delay is increased with the time changes. For this reason, we assume that there will be n times authentication calculation happening on each time slice, and we assume that T3 is the authentication cost on time slice i by n times authentication calculation in μTESLA, and(23)T3=ni-2t+t+δ=ni-1t+δ=ni-1t+2.Similarly, we assume thatT4 is the authentication cost on time slice i by n times authentication calculation in MBAP, and(24)T4=n4t=4nt.For ease of calculating, we assumen=10, and the authentication cost of these two protocols is showed in Figures 6, 7, and 8.Figure 6
T changes of μTESLA protocol.Figure 7
T changes of MBAP protocol.Figure 8
T changes between two protocols.It is indicated in Figures6 and 7 that the authentication delays of these two protocols are all increased with the time changes, but the authentication delays of μTESLA are increased much faster with the authentication calculation increasing, while the authentication delay of MBAP is changed stably.It is indicated in Figure8 that there will be some messages abandoned on some slices with the authentication delay increasing in μTESLA; it is one of the issues in μTESLA analyzed in Section 2.


## 4.5. Initialization Parameter

In MBAP, the only predistributed initialization parameter isf(x), and if f(x) is a quadratic polynomial, this can make a mutual authentication.While inμTESLA the initialization parameters are K0,δ,D,T0 and if the nodes send the initialization parameters K0,δ,D,T0 in unicast way upon network initialization, that will cause much resource consumption, because the sending node needs to encrypt K0,δ,D,T0 in different keys shared with the receiving node, which will cause the delay for data packet transmission and authentication, and the delay may lead to DoS attacks.


## 4.6. Length of the Key Chain

InμTESLA, when the sensor nodes receive the published key Kj, we can verify the correctness of Kj by K0=HjKj or Ki=Hj-iKj, where Ki is the verified key before Kj and K0 is the initial key. So in order to complete the authentication task in μTESLA, it needs to save a long secret key chain and needs to reconstruct the key chain sometimes, which makes a large network load.In MBAP, the authentication keyK(i) is Fourier series, and we can get K′i=K(i-1)+ai′cos⁡ix+bi′sin⁡ix in (16), where K(i-1) is the authentication key on time slice i-1 which has been authenticated on last time slice, so we can get K′i=K(i) by verifying hai′=hai and hbi′=hbi in Step  4 of Section 3.3, which shows that the calculation of K(i) avoids amounts of the calculation of Fourier series coefficients each time and reduces the computation cost greatly.


## 5. Summary

This thesis presents a mutual broadcast authentication protocol (MBAP) for wireless sensor networks based on Fourier series according to the problems of the main broadcasting authentication protocolμTESLA being limited in authentication delay, more initial parameters, limited time, large key chain, and network congestion. And the mutual authentication between nodes and base station is achieved according to the characteristic of continuous-integrability function f(x) in -π,π which could be expanded into Fourier series. Firstly, one has predistributing f(x) for each node upon network initializing, calculating the current Fourier series coefficients, establishing authentication key K′, verifying the correctness of the broadcast authentication information, achieving entity authentication, and source attestation. Secondly, assuming that f(x) is the quadratic form function and achieving the reverse authentication work for base station to common sensor nodes by detecting the security of f(x), it also means that the MBAP protocol can achieve mutual security authentication. The analysis results of safety performance in MBAP show that the captured nodes in WSN will not affect the security of broadcast authentication protocol and have a low computation and communication cost, the base station can make broadcast randomly, and common sensor nodes can authenticate messages instantly, which solves the problem of network congestion well. The most important thing of MBAP is the mutual broadcast authentication method which ensures the security of the network greatly.



---

*Source: 397130-2015-12-22.xml*