# Disjoint Key Establishment Protocol for Wireless Sensor and Actor Networks

Authors: AtaUllah Ghafoor; Muhammad Sher; Muhammad Imran; Imran Baig
Journal: Journal of Sensors
 (2016)

---

## Abstract

Key distribution is essential for providing secure communication between commercial and sensitive applications of wireless sensor and actor networks (WSANs). It becomes more challenging when any of the intermediate sensor nodes is compromised by the adversaries as the messages carrying secure keys will be exposed and links will be unreliable. This paper presents a Disjoint Key Establishment Protocol (DKEP) that does not require transmitting keys across the nodes. In DKEP, each node is preloaded with one row and one column from a matrix. After the deployment, indices for row and column are exchanged between the two nodes and values at intersection of row and column index will be used to calculate the key on each node. DKEP is verified by performing formal analysis using Rubin Logic and validated using simulations in NS-2. Simulation results demonstrate the effectiveness and efficiency of DKEP compared to contemporary schemes in terms of reducing storage and communication cost and improving resilience against node compromise attacks. Moreover, the proposed scheme is implemented in a group-based mobile application scenario for secure message exchange.


---

## Body

## 1. Introduction

Recent developments in sensing, actuation, computing, communication, and networking have led to the emergence of wireless sensor and actor networks (WSANs) [1–3] that allow autonomous and intelligent interaction with the environment. These networks employ number of miniaturized sensors with scarce resources (in terms of computation, communication, and energy) besides fewer powerful actor nodes. Sensors continuously monitor an event of interest and report it wirelessly to corresponding actors for coordinated action. Example applications include border protection, search and rescue, fire containment, and autonomous monitoring and maintenance of lifeline infrastructures [4]. Figure 1 depicts a typical WSAN environment. While most of these applications are critical, however, nodes are vulnerable to a number of attacks including node compromising, traffic capturing, and DOS attacks [5, 6]. Among others, secure key establishment is one of the most prominent barriers in deploying WSAN for sensitive applications.Figure 1
An autonomous WSAN environment for sensitive applications.Key establishment is indispensable for secure communication between distant nodes because key is used for encryption and decryption [7, 8]. In many applications, matrix-based key distribution schemes are preferred because transmission of actual key is not required and nodes can independently calculate keys. Most of the existing matrix-based schemes either share randomly selected rows and columns values [9–11] from precalculated secret and public matrices or some values based on a pattern [12] from the matrices.The main problem in these schemes is that a compromised node can reveal the rows and columns transmitted through it. At intermediate nodes, message is decrypted to plain text and then encrypted again using symmetric key of next node on the path. These messages cannot be encrypted because there is no prior end to end key between two distant nodes. The link is compromised before its establishment and many schemes such as [8–12] suffer from key exposure problem. Moreover, most of the existing schemes only rely on nonformal (i.e., simulations) approaches for validation and hardly employ formal techniques for verifying the correctness.Formal methods are advanced mathematical mechanism that are based on some computer tools for designing a system model and then apply the formal specifications. The use of formal specifications has evolved in past few years with the advent of new analyzing tools to verify the characteristics of network and security protocols. Informal methods cause a number of ambiguities during the implementation phase where bugs are produced due to misinterpretation of steps [13]. Different formal modeling techniques including BAN Logic [14], PCL [15], and Rubin Logic [16] are used for formalizing the security schemes for the verification of authentication, integrity protection, send, receive, formatting, and key freshness.This paper presents a Disjoint Key Establishment Protocol (DKEP) for secure communication between nodes. In DKEP, only row and column indices are exchanged along with nonce and timestamp between sender and receiver instead of complete row and column values. After receiving these credentials, sender and receiver identify the common values at the intersection of rows and columns and then obtain the symmetric key taking XOR with exchanged credentials. Both the nodes simultaneously obtain keys in a disjoint manner. It increases the security level because adversary will not be able to reveal the key from the transmitted messages because actual key is never transmitted on the network. We use formal approach to verify the correctness and validate the performance of the proposed protocol. Rubin logic [16] is used for formal modeling of DKEP protocol for verifying and analyzing the operation. Moreover, performance of DKEP is validated using simulation in NS-2.35. Simulation results demonstrate the performance supremacy of DKEP over contemporary schemes in terms of resilience against malicious nodes, storage, and communication costs. The performance results encourage using DKEP for many applications. We also implement DKEP to demonstrate its suitability for securing mobile applications.The rest of the paper is organized as follows: Section2 highlights some of the existing schemes related to this work. System model is described in Section 3. Section 4 describes the working of DKEP in various scenarios. Formal modeling and analysis of the proposed protocol using Rubin Logic are presented in Section 5. Simulation results and analysis are discussed in Section 6. Implementation of the proposed protocol on android based mobile phones is discussed in Section 7. Finally, the conclusion and future works are discussed in Section 8.


## 2. Related Work

Key management is mandatory for secure sharing of information among different nodes in the network by using encryption and decryption. Generally, key management schemes can broadly be categorized into asymmetric and symmetric, while the former provides higher degree of confidence to communicate securely over any open channel since it does not require transmitting private key for message decryption. However, it may not be suitable for resource-constrained sensor nodes as it requires high processing time (i.e., computationally slow) which reduces transmission speed. On the other hand, later is more appropriate for WSN as it uses same shared key for message encryption and decryption. However, secure key distribution over insecure channels is a challenging task especially in mission-critical application as some of the intermediate nodes might be compromised by the adversary. Few recent studies have investigated the challenges of key management in WSN [17, 18]. However, most of the existing key establishment schemes are proposed in the context of wireless sensor networks (WSNs) which may not be directly applicable to WSAN because of various unique characteristics such as actor mobility. Unlike most existing schemes, we focus on devising a matrix-based key establishment scheme that does not require directly exchanging the key between the communicating nodes. Therefore, we limit our discussion on matrix-based symmetric key establishment schemes afterwards.Blom’s proposed a matrix-based symmetric key establishment scheme that contained a public matrixG with a size of N
×
(
λ
+
1
), where N is network size and λ is level of security because Blom’s scheme was λ-secure [9]. Secret matrix D of size λ
+
1
×
(
λ
+
1
) and matrix A
=
(
D
·
G
)
T of size N
×
(
λ
+
1
) is generated where T is transpose. Sink node preloads a row from a matrix A and a column from matrix G in each sensor. During key K
i
k establishment between sender S
i and receiver S
k, each node exchanges its column with neighbors in a plain text. Key is calculated by multiplying A’s row with G’s column as described in (1), where r and m are row and column indices. Due to symmetric matrix, keys calculated at both nodes are the same: that is, K
i
k
=
K
k
i:(1)
K
i
k
=
A
r
,
1
,
A
r
,
2
,
…
,
A
r
,
λ
+
1
G
1
,
m
⋮
G
λ
+
1
,
m
.Blom’s scheme is λ-secure and an adversary needs to compromise λ nodes to compromise rows of matrix A for calculating a number of keys between any two nodes in the network. Blom’s scheme increases memory storage, communication, and computation overheads. However, our scheme only exchange single rows and column indices and hence reduces storage, communication, and computational overheads. Moreover, our scheme is not λ nodes resistant and adversary cannot access other keys by compromising even a large number of nodes. The author in [10] proposed a modified Blom’s scheme (MBS) where Vandermonde matrix [19] was replaced by adjacency matrix. It was filled with 1’s and remaining 0’s were replaced by q
-
1 where q was a prime number. It supposed a network size of 6 nodes with λ = 3 and q
=
29. An adjacency matrix of size N
×
N with N
=
6 was generated and then matrix G was created by taking N
×
(
λ
+
1
) means 6 × 4 submatrix from the adjacency matrix. A secret matrix D of size λ
+
1
×
(
λ
+
1
) means 4 × 4 is generated to calculate A
=
(
D
·
G
)
T of size N
×
(
λ
+
1
) which means 6 × 4 where T is transpose as elucidated in (2) which is taken from scheme.Modified Blom’s scheme using adjacency matrix is as follows:(2)
28
1
1
28
28
28
1
28
28
1
28
28
1
28
28
28
1
28
28
1
28
28
28
28
28
28
1
28
28
1
28
28
28
28
1
28
Adjacency  Matrix
28
1
1
28
28
28
1
28
28
1
28
28
1
28
28
28
1
28
28
1
28
28
28
28
Public  Matrix
G
3
5
2
7
5
6
9
1
2
9
3
5
7
1
5
4
Secret  Matrix
D
26
9
5
24
3
20
24
5
18
18
14
26
22
20
28
14
16
26
16
22
12
8
10
12
A
=
D
·
G
T
mod
⁡
29
.Sink node loads only a single row from matrix A where row id equals sensor id; that is, second row is loaded in sensor 2. In this scheme, column from adjacency matrix is not loaded in sensor because it can be calculated at node during key establishment. Sender S
i can set up a key by multiplying row R
i and column C
k whereas receiver S
k multiplies row R
k and column C
i where i and k are node ids and indices for rows and columns as well. It reduces storage overhead but the scheme is still λ-secure. Moreover, if an adversary captures a row of matrix A from some compromised node then key could be calculated by multiplying with column from identity matrix. Column id can be extracted from sender or receiver ID.Khan et al. proposed a symmetric key establishment scheme [20] where a symmetric matrix is used along with a generator matrix having maximum rank distance (MRD) codes. A symmetric matrix D of size k
×
k, where k represents number of symbols over a finite field. Sensors of count n are deployed in t groups where each group contains k
-
λ nodes with λ
≥
1. It also prepares t number of generating matrix G with a size of k
×
N where N represents degree of finite field. First group will get a vector g
1 of N elements from this matrix and same is the case for other (
t
-
1
) groups. After that key spaces matrix A
i
=
(
D
G
i
)
T is generated for i
=
1,2
,
3
,
…
,
t. Sensors of particular group are preloaded with a row from respective matrix A
i and a seed value from secret matrix G. After deployment, each sensor broadcasts its ID and a seed for the column from the matrix G. Each receiving sensor calculates the column from the provided seed value and then multiplies it with its own row preloaded from matrix A to calculate the key. Group formation improves the connectivity and reduces storage cost for matrix values and set up a link key between sender and receiver. It achieves node joining mechanism without changing existing values stored at nodes. Instead of seed, our scheme only transmits row and column indices to save communication cost. This scheme is limited for key establishment between the groups only and cross group or across the network communication will require calculating new matrices. Our scheme achieves cross WSN key establishment with very little storage cost. Chances of duplication are eliminated because in case of same timestamp, there is different nonce and cross sectional values that are used to generate a different key. Matrix of same values and size like α × α should be loaded in sensor located at different deployments of WSNs where value of α is fixed in all categories of networks.The authors in [21] devised a naïve scheme for key distribution using unital design theory where a unital in geometry is represented as set consisting of n
3
+
1 points that are divided into subsets having a size of n
+
1. It also imposes a condition that all pairs of distinct points of main set should be present in one subset. A unital is represented as 2
-
(
n
3
+
1
,
n
+
1,1
) design where author used a 2
-
(
9,3
,
1
) matrix with 9 points and 3 subsets with each pair of unique points existing in exactly one subset. The basic unital design and mapping to keying provide less probabilities in terms of key sharing; therefore, authors improved the unital design for achieving better network scalability and high key sharing probabilities. It achieves a better scalability and connectivity while providing secure key distribution and also reduces storage overhead. Our scheme reduces the risk of low percentage of finding common keys sharing among neighbors for establishing a secret key in larger networks. The proposed model also allows communication among different WSNs that are deployed nearby and rows and columns taken from a common matrix.Parakh and Kak proposed a Symmetric Matrix-based Keying (SMK) scheme that preloads a sensor node with a row-column pair fromX and Y matrices and X
Y
=
K, where K is an N
×
N symmetric matrix with N as network size [11]. The same row and column are loaded from two different matrices. For example, 5th row and column are loaded from X and Y matrices. For key establishment, nodes S
i and S
k exchange columns of Y and then calculate the key using (3) where Row
k is the row preloaded at S
k and Col
i is column received from S
i at S
k:(3)
K
i
j
=
Row
i
·
Col
k
=
Row
k
·
Col
i
=
K
j
i
.Matrices X and Y are generated by taking Y as a square and nonsingular matrix and then calculate X
=
K
·
Y
-
1. Another approach is to calculate bivariate polynomials where size of X and Y matrices is less than K matrix as illustrated in (4) that is redrawn from scheme.Calculation ofX and Y matrices is as follows:(4)
1
3
1
3
4
1
9
9
1
4
6
1
5
1
1
X
1
1
1
1
1
1
5
3
2
4
1
3
9
4
5
Y
5
8
8
0
7
8
4
2
4
2
8
2
1
9
6
0
4
9
9
0
7
2
6
0
3
K
.Authors also proposed a new Commuting Matrix-based Keying (CMK) scheme to eliminate the use of symmetric matrix K and select matrices X and Y with a condition that X
Y
=
Y
X, where matrix Y is symmetric. Each node was preloaded with randomly selected rth row of X and rth column of matrix Y. For key establishment, nodes S
i and S
k exchange columns of matrix Y. S
i calculates key by taking hash of K
i
j concatenated with K
j
i as illustrated in(5)
K
=
H
K
i
j
∥
K
j
i
,
K
i
j
=
Row
i
X
·
Col
k
Y
,
K
j
i
=
Col
k
′
Y
·
Col
i
X
.Quorum based key Management Scheme (QKM) [12] requires preloading a subset of key matrix in each sensor. For key establishment, sender and receiver find a common key using preloaded subset of secret matrix as shown in Figure 2 taken from scheme.Figure 2
Common key calculation.After that both the nodes generate random number and then exchange it by encrypting with common key. Shared key is obtained by calculating XOR of common key along with random values using (6). Similarly sensor node y also obtains the shared key that is used for future secure message transmission:(6)
SK
x
-
y
=
CK
x
-
y
⊕
R
x
⊕
R
y
.Dai and Xu provided a key distribution scheme using L
U matrix [22] where two groups of polynomials are selected from a pool to create lower and upper triangular matrices L and U, respectively. In case of a 3 × 3 matrix six polynomials are selected for each L and U matrices. It imposes a condition that the product of L and U should result in a symmetric matrix K. Each sensor is preloaded with one row of L and one column of U where row and column index number should be same like ith row of L and ith column of U. After deployment, any two sensors S
i and R
k initiate the key establishment process by exchanging their rows Row
i and Row
k with each other. After that, S
i obtains the key K
j
i
=
L
Row
j
×
U
Col
i and R
k obtains the key K
i
j
=
L
Row
i
×
U
Col
j by multiplying the row of other sensors with their own column. The row and column are from symmetric matrix; therefore, the same key will be generated at both nodes. Our scheme also loads one row and one column but we relax the restriction that row and column index should be the same. Sensors can have randomly selected row and column indices. Moreover, we do not exchange row or column values because it increases communication overhead; instead we share indices only. In this scheme, row and column values are directly used to calculate the secret keys and compromising a row through traffic analysis attack can expose the large amount of actual keys. In our scheme, row and column values are just used to get a common value and then nonce and time stamp are also used to generate a unique key which is not entirely dependent of row and column values.In existing schemes, communication across the WSAN is not supported due to confined set of key pools that support specific number of network size. After that, the chances of key duplication increases. Size of matrix increases for larger networks and hence becomes infeasible in terms of storage for ordinary sensor nodes. Our scheme will resolve it by using a matrix with a fix size and values like a WSN1 with 2000 nodes and WSN2 with 1400 nodes. The matrix size and values should remain the same across the network.


## 3. System Model

This section elaborates the possible key exchange scenarios. We consider WSAN model in which actors are responsible for managing sensors in their cluster. Both sensors and actors are randomly deployed and they exchange security credentials once the network is set up. Sensors are stationary while actors can move on demand. Afterwards, any two nodes can distribute the key using DKEP procedure where an actor node is considered first priority to act as the intermediate node between sender and receiver. In other scenarios, ordinary sensor nodes or mixer of both is used as intermediaries between distant sender and receiver. We have considered scenarios where an actor is either stationary or mobile to collect desired data from sensor nodes. We assume that an actor contains the symmetric keys of all the sensor nodes in the network, and the sink node maintains a list of all actors and sensor nodes. It is also assumed that an intrusion detection system is available to detect the malicious nodes.We consider four possible scenarios for message exchange between senderS
i and receiver R
k containing security parameters. In the first scenario, S
i and R
k can directly exchange messages when both are within direct communication range of each other. In second scenario, an actor A
x serves as an intermediary between S
i and R
k when they are not within range of each other as shown in Figure 3. In third scenario, both S
i and R
k belong to different clusters managed by the actors A
x and A
y, respectively, which require intercluster communication as illustrated in Figure 3.Figure 3
Intra- and intercluster communication scenarios.In the fourth scenario we have considered that multiple WSANs are deployed in a region to perform activities for different categories of applications. ActorsA
x and A
y are not in direct communication range and want to communicate for establishing secret key between distant nodes located in different WSAN. In this scenario, an intermediate ordinary sensor node named gateway node (GN) which is located at common boundary of both WSAN can exchange messages to a distant receiver R
k via A
y as illustrated in Figure 4. The GN receives key messages from A
x and A
y and then proceeds with key establishment. It does not use an actor-actor link during such type of communication. Node S
i transmits encrypted message to A
x that decrypts the message and then reencrypts it with a key E
K
A
x
-GN established between A
x and the GN. Similarly, GN decrypts and reencrypts the message to forward towards actorA
y that further transmit to receiver R
k. After exchanging security parameters, both the nodes simultaneously perform XOR to obtain the keys.Figure 4
Inter-WSAN key establishment using gateway nodes.This work is also applicable to mobile environments such as mobile ad hoc networks and vehicular ad hoc networks where same sized matrix can be preloaded on all devices. Most of the modern WSN applications such as [23] have to be integrated with other networks which may require establishing keys across the network. For example, the proposed DKEP can provide such ability to establish keys in these networks.


## 4. Disjoint Key Establishment Protocol (DKEP)

This section elaborates our proposed DKEP protocol. Key exchange between the communicating parties including sender, receiver, actor, and intermediaries is discussed in this protocol to ensure the secure transmission. Message structure for encryption and decryption procedure is elucidated in stepwise manner along with security parameters that are part of message. Role of message authentication code (MAC) is also highlighted to ensure integrity for each message. Finally key establishment procedure is explored. Moreover, the key establishment scenarios for sensor-sensor and actor-actor are illustrated briefly to show relevant steps of DKEP in those cases. A brief description for all notations used in proposed DKEP is provided in Notations.In DKEP, security credentials are exchanged using intermediaries to obtain actual key at sender and receiver. We have used a matrix-based approach for key establishment scheme that securely distributes the key without transmitting the actual key on the network. Key distribution begins when rows and columns are taken fromα
×
α matrix where α is selected as per security requirement and much less than cluster size. Before deployment, each node is preloaded with randomly selected rows and columns. After deployment, rows and column indices and security credentials can be exchanged between the sender and receiver. After receiving the parameters, both nodes decrypt the message, check message freshness by comparing timestamps, and check message integrity by using hash values. After that, common values are located at intersection of row and column indices. Finally the key is obtained simultaneously on both nodes by taking XOR of parameters and the common values as illustrated in Figure 5 where S
i and R
k represent sender and receiver.Figure 5
Matrix-based key establishment.This section provides the detailed discussion on secure key distribution protocol for second scenario discussed earlier in Section3. Key distribution process begins when sender node S
i encrypts message (
Row
i
,
Col
i
,
ts
i
,
rn
i
,
R
k
,
MAC
Row
i
∥
Col
i
∥
ts
i
∥
rn
i
) using preestablished key E
K
S
i
-
A
xbetween sender S
i and actor A
x as illustrated in (7). In the message, Row
i is row index, Col
i is column index, ts
i is timestamp, rn
i is the nonce from node S
i, and hash of values is also concatenated: (7)
C
1
=
E
K
S
i
-
A
x
Row
i
,
Col
i
,
ts
i
,
rn
i
,
R
k
,
MAC
Row
i
∥
Col
i
∥
ts
i
∥
rn
i
.Sender node S
i sends the message (
ID
S
i
,
C
1
) to the actor node A
x. The message is decrypted by actor A
x to extract the values as illustrated in(8)
Row
i
,
Col
i
,
ts
i
,
rn
i
,
R
k
,
MAC
Row
i
∥
Col
i
∥
ts
i
∥
rn
i
=
D
K
S
i
-
A
x
ID
S
i
,
C
1
.Actor node A
x checks the message freshness by calculating difference of system’s timestamp with ts
i and then comparing with threshold value. In case of successful result, actor A
x checks integrity of message by concatenating and then taking hash of values to compare it with hash value in the message. Finally the message is reencrypted using key E
K
A
x
-
R
kpreestablished between actor A
x and receiver R
k as shown in(9)
C
2
=
E
K
A
x
-
R
k
Row
i
,
Col
i
,
ts
i
,
rn
i
,
R
k
,
MAC
Row
i
∥
Col
i
∥
ts
i
∥
rn
i
.Actor node A
x sends the message (
ID
A
x
,
C
2
) to the receiver R
k. The message is decrypted by receiver R
k to extract the values as illustrated in(10)
Row
i
,
Col
i
,
ts
i
,
rn
i
,
R
k
,
MAC
Row
i
∥
Col
i
∥
ts
i
∥
rn
i
=
D
K
A
x
-
R
k
ID
A
x
,
C
2
.Similarly receiver R
k validates the freshness and integrity of message. In case of success, R
k sends a message (Row
k
,
Col
k
,
ts
k
,
rn
k
,
S
i
,
MAC
Row
k
∥
Col
k
∥
ts
k
∥
rn
k
) after encrypting with key E
K
R
k
-
A
x preestablished between sender R
k and actor A
x as illustrated in (11). In the message, Row
k is row index, Col
k is column index, ts
k is timestamp, rn
k is the nonce from node R
k, and hash of these values is also concatenated:(11)
C
3
=
E
K
R
k
-
A
x
Row
k
,
Col
k
,
ts
k
,
rn
k
,
S
i
,
MAC
Row
k
∥
Col
k
∥
ts
k
∥
rn
k
.Receiver R
k responds to the actor A
x with a message (
ID
R
k
,
C
3
) for forwarding to node S
i. The message is further decrypted by the actor A
x to extract the values as illustrated in(12)
Row
k
,
Col
k
,
ts
k
,
rn
k
,
S
i
,
MAC
Row
k
∥
Col
k
∥
ts
k
∥
rn
k
=
D
K
R
k
-
A
x
ID
R
k
,
C
3
.Actor A
x checks freshness and integrity of the message. In case of success a message is sent towards S
i after encrypting it using key E
K
A
x
-
S
i preestablished between actor A
x and S
i as shown in (13)
C
4
=
E
K
A
x
-
S
i
Row
k
,
Col
k
,
ts
k
,
rn
k
,
S
i
,
MAC
Row
k
∥
Col
k
∥
ts
k
∥
rn
k
.Actor node A
x sends the message (
ID
A
x
,
C
4
) to the sender S
i. The message is decrypted by S
i to extract the values as illustrated in (14)
Row
k
,
Col
k
,
ts
k
,
rn
k
,
S
i
,
MAC
Row
k
∥
Col
k
∥
ts
k
∥
rn
k
=
D
K
A
x
-
S
i
ID
A
x
,
C
4
.Symmetric key can be obtained after exchanging row and column indices along with timestamp and nonce values. The sender S
i and receiver R
k simultaneously obtain keys by taking XOR of two nonce values (
rn
i
,
rn
k
) with time stamps (
t
s
i
,
t
s
k
) and the common value V
RC as illustrated in(15)
K
S
i
-
R
k
=
rn
i
⊕
ts
i
⊕
V
RC
⊕
ts
k
⊕
rn
k
.In this equation, ⊕ represents XOR and V
RC is the set of values at intersection of rows and columns of two nodes, for example, row Row
i, column Col
k, and row Row
k, column Col
i as illustrated in(16)
V
RC
=
V
Row
i
Col
k
⊕
V
Row
k
Col
i
.For example, node S
i contains 5th row and 3rd column and node R
k contains 4th row and 1st column; then V
RC
=
V
Row
5
Col
1
⊕
V
Row
4
Col
3. Both the nodes contain the row and column indices of each other; therefore, V
RC could be calculated using (16) on both nodes by identifying the values at intersection. Same values are selected at both sender S
i and receiver R
k. Moreover, same key value is obtained at both nodes and key is never transmitted on the network as illustrated in Figure 6. In case of sensor-sensor key distribution scenario, there is no end to end key and messages are not encrypted as illustrated in(17)
S
i
⟶
R
k
:
Row
i
,
Col
i
,
ts
i
,
rn
i
,
R
k
,
MAC
Row
i
∥
Col
i
∥
ts
i
∥
rn
i
R
k
⟶
S
i
:
Row
k
,
Col
k
,
ts
k
,
rn
k
,
S
i
,
MAC
Row
k
∥
Col
k
∥
ts
k
∥
rn
k
K
S
i
-
R
k
=
rn
i
⊕
ts
i
⊕
V
RC
⊕
ts
k
⊕
rn
k
.In case of actor-actor key distribution scenario, actors are preloaded with three row and column pairs. During key establishment between A
x and A
y, one row and one column indices are randomly selected to exchange between them. After that, key is calculated using(18)
A
x
⟶
A
y
:
Row
x
,
Col
x
,
ts
x
,
rn
x
,
A
y
,
MAC
Row
x
∥
Col
x
∥
ts
x
∥
rn
x
A
y
⟶
A
x
:
Row
y
,
Col
y
,
ts
y
,
rn
y
,
A
x
,
MAC
Row
y
∥
Col
y
∥
ts
y
∥
rn
y
K
A
x
-
A
y
=
rn
x
⊕
ts
x
⊕
V
RC
⊕
rn
y
⊕
ts
y
.In DKEP, the communication is not stopped even if the actor is compromised or damaged. Only the routing paths that were using the actor as intermediary node are affected and an alternate node can be selected for that path by establishing on demand symmetric keys. It also reduces the memory overhead as compared to the existing cluster based schemes because each node does not require γ
-
1 nodes at the beginning. The number of keys stored in the memory grows according to the on demand contact with other nodes of the cluster. This contact can be done only to route the query to neighboring nodes and then route the required data towards the sink node. If a node is compromised and its rows and columns are exposed to the attacker then attacker is not able to get those keys that were established particularly using these rows and columns. These keys were calculated by using one value from matrix and taking its XOR with the two nonce values with timestamp which are not stored in the permanent memory. It means nothing is revealed by retrieving the rows and columns. It also does not affect the keys in other nodes. It achieves much better resilience against node and traffic capturing attacks. In this way the key exposure problem at intermediate node is also resolved. It also ensures that any two distant nodes can establish keys securely and hence achieves much better connectivity. Moreover, the receiver transmits message using disjoint paths that confuse the traffic analysis attacker and strengthens the proposed scheme. If symmetric key is compromised from a node then intruder cannot recover any past keys established earlier or current keys between other nodes.Figure 6
V
RC calculation at sender S
i and receiver R
k.A possible variation in the scheme could be the use of lightweight public key cryptography like Elliptic Curve Cryptography (ECC) to secure only those key exchange messages that are shared between the ordinary nodes where actor nodes are not present nearby. In other scenarios discussed in system model, ordinary nodes encrypt the key exchange messages using preestablished secret keys between ordinary sensors and actor nodes.


## 5. DKEP Formal Specification

To verify correctness of DKEP, we use Rubin Logic [16] and performed stepwise formal modeling of the scheme. It verifies the proposed protocol for the standardized requirements of cryptographic functions including encryption, decryption, authentication, integrity protection, and freshness of message. Rubin Logic is equally applicable to verify the send, receive, and update operations performed during message exchange between distant nodes. This modeling technique includes the formalization steps that are similar to the flow of programming functions in real implementation of the scheme. A global set is maintained that contains information about entities, their roles, and global variables of protocol. The information saved in global set can be subdivided into observer, rule, secret, and principal sets. The schemes that provide stepwise discussion on formalization [24–26] of WSAN security protocols are illustrated in the form of case studies.A list of notations is provided earlier in Notations to elaborate the symbols used to describe DKEP protocol. In this section, additional notations are included in Notations to further elaborate the symbols used in local set during formal specification of DKEP.Each entity maintains a local set that is subdivided into possession set POSS, belief set BEL, seen set, and behavior List BL where detailed discussion is provided in [16, 27]. Local set for DKEP scenario is illustrated in Table 1 that includes the procedural steps performed at sender, receiver, and the actor individually. In this scenario, POSS(S
i) and BEL(S
i) sets explore the storage requirements during and after execution of protocol steps at sender node S
i. Computational and communication oriented details of the DKEP are enumerated in BL(S
i). All these steps are performed individually for each entity including S
i, R
k, and A
x. It also highlights the parameters and operations that are performed during protocol implementation of the scheme using C language for adding it in NS-2 protocols.Table 1
Local set for DKEP.
(1) Sender (S
i)
(3) Receiver (R
k)
POSS(S
i) = I
D
S
i, K
S
i
-
A
x, R
o
w
V
a
l
i, C
o
l
V
a
l
i
POSS(R
k) = I
D
R
k, K
A
x
-
S
i, R
o
w
V
a
l
k, C
o
l
V
a
l
k
BEL(S
i) = #(I
D
S
i), #(K
S
i
-
A
x), #(R
o
w
V
a
l
i), #(C
o
l
V
a
l
i)
BEL(R
k) = #(I
D
R
k), #(K
A
x
-
S
i), #(R
o
w
V
a
l
k), #(C
o
l
V
a
l
k)
BL(S
i) = H
a
s
h
(
h
(
.
)
;
R
o
w
i
,
C
o
l
i
,
r
n
i
,
t
s
i
)
→
H
S
i
R
C
BL(R
k) = H
a
s
h
(
h
.
;
R
o
w
k
,
C
o
l
k
,
r
n
k
,
t
s
k
)
→
H
R
k
R
C
C
o
n
c
a
t
(
R
o
w
i
,
C
o
l
i
,
r
n
i
,
t
s
i
,
R
k
,
H
S
i
R
C
)
→
P
S
i
R
C
C
o
n
c
a
t
(
R
o
w
k
,
C
o
l
k
,
r
n
k
,
t
s
k
,
S
i
,
H
R
k
R
C
)
→
P
R
k
R
C
E
n
c
r
y
p
t
(
P
S
i
R
C
K
S
i
-
A
x
)
→
C
1
E
n
c
r
y
p
t
(
P
R
k
R
C
K
R
k
-
A
x
)
→
C
2
S
e
n
d
(
A
x
,
C
o
n
c
a
t
I
D
S
i
,
C
1
)
→
M
1
S
e
n
d
(
A
x
,
C
o
n
c
a
t
I
D
R
k
,
C
2
)
→
M
2
U
p
d
a
t
e
(
r
n
i
,
t
s
i
)
U
p
d
a
t
e
(
r
n
k
,
t
s
k
)
R
e
c
e
i
v
e
(
A
x
,
I
D
A
x
,
C
4
)
R
e
c
e
i
v
e
(
A
x
,
I
D
A
x
,
C
3
)
S
p
l
i
t
(
I
D
A
x
,
C
4
)
S
p
l
i
t
(
I
D
A
x
,
C
3
)
D
e
c
r
y
p
t
(
C
4
K
A
x
-
S
i
)
→
P
R
k
R
C
D
e
c
r
y
p
t
(
C
3
K
A
x
-
R
k
)
→
P
S
i
R
C
S
p
l
i
t
(
P
R
k
R
C
)
→
(
R
o
w
k
,
C
o
l
k
,
r
n
k
,
t
s
k
,
S
i
,
H
R
k
R
C
)
S
p
l
i
t
(
P
S
i
R
C
)
→
(
R
o
w
i
,
C
o
l
i
,
r
n
i
,
t
s
i
,
R
k
,
H
S
i
R
C
)
F
r
e
s
h
n
e
s
s
(
(
t
s
S
i
-
t
s
k
)
≥
Δ
t
)
→
A
b
o
r
t
F
r
e
s
h
n
e
s
s
(
(
t
s
R
k
-
t
s
i
)
≥
Δ
t
)
→
A
b
o
r
t
M
A
C
(
C
o
n
c
a
t
(
R
o
w
k
,
C
o
l
k
,
r
n
k
,
t
s
k
)
)
→
H
+
M
A
C
(
C
o
n
c
a
t
(
R
o
w
i
,
C
o
l
i
,
r
n
i
,
t
s
i
)
)
→
H
∧
C
h
e
c
k
(
H
R
k
R
C
,
H
+
)
→
A
b
o
r
t
C
h
e
c
k
(
H
S
i
R
C
,
H
∧
)
X
O
R
(
V
R
o
w
i
C
o
l
k
,
V
R
o
w
k
C
o
l
i
)
→
V
R
C
X
O
R
(
V
R
o
w
i
C
o
l
k
,
V
R
o
w
k
C
o
l
i
)
→
V
R
C
X
O
R
(
r
n
i
,
t
s
i
,
V
R
C
,
r
n
k
,
t
s
k
)
→
K
S
i
-
R
k
X
O
R
(
r
n
i
,
t
s
i
,
V
R
C
,
r
n
k
,
t
s
k
)
→
K
S
i
-
R
k
H
a
s
h
(
h
(
.
)
;
r
n
k
,
K
e
y
S
u
c
c
e
s
s
)
→
H
S
i
H
a
s
h
(
h
(
.
)
;
r
n
i
,
K
e
y
S
u
c
c
e
s
s
)
→
H
R
k
C
o
n
c
a
t
(
r
n
k
,
K
e
y
S
u
c
c
e
s
s
,
H
S
i
)
→
P
S
i
C
o
n
c
a
t
(
r
n
i
,
K
e
y
S
u
c
c
e
s
s
)
→
P
R
k
E
n
c
r
y
p
t
(
P
S
i
K
S
i
-
R
k
)
→
C
6
E
n
c
r
y
p
t
(
P
R
k
K
S
i
-
R
k
)
→
C
5
S
e
n
d
(
R
k
,
C
o
n
c
a
t
I
D
S
i
,
C
6
)
→
M
6
S
e
n
d
(
S
i
,
C
o
n
c
a
t
I
D
R
k
,
C
5
)
→
M
5
U
p
d
a
t
e
(
M
I
D
)
U
p
d
a
t
e
(
M
I
D
)
R
e
c
e
i
v
e
(
R
k
,
I
D
R
k
,
C
5
)
R
e
c
e
i
v
e
(
S
i
,
I
D
S
i
,
C
6
)
S
p
l
i
t
(
I
D
R
k
,
C
5
)
S
p
l
i
t
(
I
D
S
i
,
C
6
)
D
e
c
r
y
p
t
(
C
5
K
S
i
-
R
k
)
→
P
R
k
D
e
c
r
y
p
t
(
C
6
K
S
i
-
R
k
)
→
P
S
i
S
p
l
i
t
(
P
R
k
)
→
(
r
n
k
,
K
e
y
S
u
c
c
e
s
s
,
H
R
k
)
S
p
l
i
t
(
P
S
i
)
→
(
r
n
k
,
K
e
y
S
u
c
c
e
s
s
,
H
S
i
)
F
r
e
s
h
n
e
s
s
(
(
t
s
S
i
-
t
s
k
)
≥
Δ
t
)
→
A
b
o
r
t
F
r
e
s
h
n
e
s
s
(
(
t
s
R
k
-
t
s
i
)
≥
Δ
t
)
→
A
b
o
r
t
C
h
e
c
k
(
M
A
C
(
C
o
n
c
a
t
(
r
n
i
,
K
e
y
S
u
c
c
e
s
s
)
)
,
H
R
k
)
C
h
e
c
k
(
M
A
C
(
C
o
n
c
a
t
(
r
n
k
,
K
e
y
S
u
c
c
e
s
s
)
)
,
H
S
i
)
C
h
e
c
k
(
r
n
i
,
K
e
y
S
u
c
c
e
s
s
)
→
U
p
d
a
t
e
(
K
S
i
-
R
k
)
C
h
e
c
k
(
r
n
k
,
K
e
y
S
u
c
c
e
s
s
)
→
U
p
d
a
t
e
(
K
S
i
-
R
k
)
(2) Actor (A
x)
POSS(A
x) = I
D
A
x
,
K
A
x
-
S
i
,
K
A
x
-
R
k
R
e
c
e
i
v
e
(
R
k
,
I
D
R
k
,
C
2
)
BEL(A
x) = #(I
D
A
x), #(K
A
x
-
S
i), #(K
A
x
-
R
k)
S
p
l
i
t
(
I
D
R
k
,
C
2
)
BL(A
x) = R
e
c
e
i
v
e
(
S
i
,
I
D
S
i
,
C
1
)
D
e
c
r
y
p
t
(
C
2
K
A
x
-
R
k
)
→
P
R
k
R
C
S
p
l
i
t
(
I
D
S
i
,
C
1
)
S
p
l
i
t
(
P
R
k
RC
)
→
(
R
o
w
k
,
C
o
l
k
,
r
n
k
,
t
s
k
,
S
i
,
H
R
k
R
C
)
D
e
c
r
y
p
t
(
C
1
K
A
x
-
S
i
)
→
P
S
i
R
C
F
r
e
s
h
n
e
s
s
(
(
t
s
A
x
-
t
s
k
)
≥
Δ
t
)
→
A
b
o
r
t
S
p
l
i
t
(
P
S
i
R
C
)
→
(
R
o
w
i
,
C
o
l
i
,
r
n
i
,
t
s
i
,
R
k
,
H
S
i
R
C
)
M
A
C
(
C
o
n
c
a
t
(
R
o
w
k
,
C
o
l
k
,
r
n
k
,
t
s
k
)
)
→
H
~
F
r
e
s
h
n
e
s
s
(
(
t
s
A
x
-
t
s
i
)
≥
Δ
t
)
→
A
b
o
r
t
C
h
e
c
k
(
H
R
k
R
C
,
H
~
)
→
A
b
o
r
t
M
A
C
(
C
o
n
c
a
t
(
R
o
w
i
,
C
o
l
i
,
r
n
i
,
t
s
i
)
)
→
H
∗
E
n
c
r
y
p
t
(
P
R
k
R
C
K
A
x
-
S
i
)
→
C
4
C
h
e
c
k
(
H
S
i
R
C
,
H
∗
)
→
A
b
o
r
t
S
e
n
d
(
S
i
,
C
o
n
c
a
t
I
D
A
x
,
C
4
)
→
M
4
E
n
c
r
y
p
t
(
P
S
i
R
C
K
A
x
-
R
k
)
→
C
3
U
p
d
a
t
e
(
M
I
D
)
S
e
n
d
(
R
k
,
C
o
n
c
a
t
I
D
A
x
,
C
3
)
→
M
3
U
p
d
a
t
e
(
M
I
D
)


### 5.1. DKEP Analysis and Verification

In this section, DKEP is analyzed for intracluster key distribution scenario where both the distant sensor nodes are in communication range of one actor. In this scenario, initially senderS
i transmits message M
1 to actor node A
x. After the send operation, system calls the update procedure to refresh the rn
i
,
ts
i values in the observer list as shown below:(i)
Hash
(
h
·
;
Row
i
,
Col
i
,
rn
i
,
ts
i
)
→
H
S
i
RC
.
(ii)
Concat
(
Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC
)
→
P
S
i
RC
.
(iii)
Encrypt
(
P
S
i
RC
K
S
i
-
A
x
)
→
C
1.
(iv)
Send
(
A
x
,
Concat
ID
S
i
,
C
1
)
→
M
1.
(v)
Update
(
rn
i
,
ts
i
).All the parameters including message M
1, cipher text C
1, hash H
S
i
RC, concatenated string P
S
i
RC, nonce and timestamp values rn
i
,
ts
i, and row and column indices Row
i
,
Col
i are saved in possession set at S
i as illustrated below. Belief set also appends the message M
1 in the list:POSS
S
i
=
{
I
D
S
i
,
K
S
i
-
A
x
,
P
S
i
RC
,
Row
i
,
Col
i
,
rn
i
,
ts
i, H
S
i
RC
,
C
1
,
M
1
,
R
k
}.
BEL
(
S
i
)
=
#
I
D
S
i
,
#
K
S
i
-
A
x
,
#
M
1.Similarly R
k also transmits the message containing row and column indices along with timestamp and nonce values: (i)
Hash
(
h
·
;
Row
k
,
Col
k
,
rn
k
,
ts
k
)
→
H
R
k
RC
.
(ii)
Concat
(
Row
k
,
Col
k
,
rn
k
,
ts
k
,
S
i
,
H
R
k
RC
)
→
P
R
k
RC.
(iii)
Encrypt
(
P
R
k
RC
K
R
k
-
A
x
)
→
C
2.
(iv)
Send
(
A
x
,
Concat
ID
R
k
,
C
2
)
→
M
2.
(v)
Update
(
rn
k
,
ts
k
).Similarly the related parameters are saved in possession set at receiver node R
k as illustrated below: POSS
S
i
=
{
I
D
S
i
,
K
S
i
-
A
x
,
Row
k
,
Col
k
,
rn
k
,
ts
k, H
R
k
RC
,
P
R
k
RC
,
C
2
,
M
2
,
S
i
}.
BEL
(
S
i
)
=
#
I
D
S
i
,
#
K
S
i
-
A
x
,
#
M
2.After the exchange of messages between sender and receiver, each sensor node splits the message to extract the cipher text. After that, it is decrypted using the shared key between actor and the sensor node S
i to retrieve concatenated string P
S
i
RC that is further split to extract Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC values. For freshness evaluation of the message, initially timestamp ts
A
x is calculated at actor A
x and then received time stamp value ts
i is subtracted from it. A message can be aborted when timestamp difference is larger than the threshold time Δ
t. Otherwise, node R
k calculates the MAC of Row
i
,
Col
i
,
rn
i
,
ts
i and compares it with hash H
S
i
RC to ensure integrity protection. Actor node proceeds with next steps by checking that both the hash values are equal otherwise message is discarded. Similar steps are followed by A
x to receive message M
2 from node R
k with different parameters:POSS
(
A
x
)
=
I
D
A
x
,
K
A
x
-
S
i
,
K
A
x
-
R
k.
BEL
(
A
x
)
=
#
I
D
A
x
,
#
K
A
x
-
S
i
,
#
K
A
x
-
R
k.
B
L
(
A
x
)
=
(i)
Receive
S
i
,
ID
S
i
,
C
1,
(ii)
Split
ID
S
i
,
C
1,
(iii)
Decrypt
C
1
K
A
x
-
S
i
→
P
S
i
RC,
(iv)
Split
P
S
i
RC
→
Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC,
(v)
Freshness
ts
A
x
-
ts
i
≥
Δ
t
→
Abort,
(vi)
MAC
Concat
Row
i
,
Col
i
,
rn
i
,
ts
i
→
H
∗,
(vii)
Check
H
S
i
RC
,
H
∗
→
Abort.Actor node A
x further prepares message by encrypting received concatenated string P
S
i
RC using preestablished key K
A
x
-
R
k between A
x and receiver node. The encrypted message is transmitted towards R
k and then temporary values (
P
S
i
RC
,
rn
i
,
ts
i
,
R
k
,
C
3
,
M
3
,
H
∗) used during calculations are removed from memory using Forget procedure:(viii)
Encrypt
(
P
S
i
RC
K
A
x
-
R
k
)
→
C
3.
(ix)
Send
(
R
k
,
Concat
ID
A
x
,
C
3
)
→
M
3.
(x)
Update
(
M
ID
).
(xi)
Forget
(
P
S
i
RC
,
rn
i
,
ts
i
,
R
k
,
C
3
,
M
3
,
H
∗
)
.Actor node A
x maintains a list of variables and parameters in possession set to perform calculations during key establishment: POSS
A
x
=
{
I
D
A
x
,
K
A
x
-
S
i
,
K
A
x
-
R
k
,
P
S
i
RC
,
R
k
,
rn
i
,
ts
i, C
3
,
M
3
,
H
∗
}
.
BEL
(
A
x
)
=
#
I
D
A
x
,
#
K
A
x
-
S
i
,
#
K
A
x
-
R
k.Actor node A
x performs the same operation for message received from R
k to forward towards sensor node S
i with different parameters. The receiver R
k receives the message from A
x and then splits the message to get C
3 which is decrypted to extract the concatenated string. It is further tokenized to get the security parameters including Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC. Freshness of message is checked and then comparison of the hash values is performed for integrity protection: (i)
Receive
(
A
x
,
ID
A
x
,
C
3
).
(ii)
Split
ID
A
x
,
C
3.
(iii)
Decrypt
C
3
K
A
x
-
R
k
→
P
S
i
RC
.
(iv)
Split
P
S
i
RC
→
(
Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC
).
(v)
Freshness
ts
R
k
-
ts
i
≥
Δ
t
→
Abort  MAC
(
Concat
(
Row
i
,
Col
i
,
rn
i
,
ts
i
)
)
→
H
∧.
(vi)
Check
(
H
S
i
RC
,
H
∧
)
.Finally the symmetric key is obtained by calculating XOR of time stamps and nonce values exchanged between sender and receiver. It also includes the value V
RC which is obtained by taking XOR of common value at the intersection of rows and columns of sender and receiver as shown below. After that a key success message is exchanged between sender and receiver to confirm the secret key establishment as per the following steps. At the end, Message ID is updated in the belief set and Forget operation is executed to remove the out of scope values from the memory of R
k: (vii)
XOR
V
Row
i
Col
k
,
V
Row
k
Col
i
→
V
RC
.
(viii)
XOR
rn
i
,
ts
i
,
V
RC
,
rn
k
,
ts
k
→
K
S
i
-
R
k.
(ix)
Hash
(
h
·
;
rn
i
,
KeySuccess
)
→
H
R
k.
(x)
Concat
rn
i
,
KeySuccess
→
P
R
k.
(xi)
Encrypt
(
P
R
k
K
S
i
-
R
k
)
→
C
5
.
(xii)
Send
(
S
i
,
Concat
ID
R
k
,
C
5
)
→
M
5.
(xiii)
Update
(
M
ID
).
(xiv)
Forget
(
Row
i
,
Col
i
,
Row
k
,
Col
k
,
H
S
i
RC
,
P
S
i
RC
,
rn
k
,
ts
k,C
3
,
M
3
,
H
∧
,
V
RC
,
H
R
k
,
P
R
k
,
C
5
,
M
5
).Possession set contains the variables and parameters used during calculations regarding key distribution and message extraction as shown below:POSS
R
k
=
ID
R
k
,
K
R
k
-
A
x
,
Row
i
,
Col
i
,
Row
k
,
Col
k,H
S
i
RC
,
P
S
i
RC
,
rn
k
,
ts
k
,
C
3
,
M
3
,
H
∧
,
V
RC
,
H
R
k
,
P
R
k
,
C
5,M
5
,
K
S
i
-
R
k
.
BEL
R
k
=
#
(
ID
R
k
)
,
#
(
K
R
k
-
A
x
)
,
#
(
K
S
i
-
R
k
).After execution of all steps illustrated above, the newly established key K
S
i
-
R
k is stored in the belief set. Unnecessary and out of scope values are removed from the possession set and hence the memory of sender node S
i and receiver node R
k. For this purpose, it calls a function Forget
(
Row
i
,
Col
i
,
Row
k
,
Col
k
,
H
S
i
RC
,
P
S
i
RC
,
rn
k
,
ts
k
,
C
3
,
M
3
,
H
∧
,
V
RC
,
H
R
k
,
P
R
k
,
C
5
,
M
5
) after successful exchange of key success message between sender and receiver. The sender node S
i receives the cipher text C
5 for the key success message M
5 encrypted with currently established key K
S
i
-
R
k. Node S
i decrypts the cipher text C
5 to get (
rn
i
,
KeySuccess
) and verify the nonce value rn
i as shown in the following steps. Node S
i calls the Forget procedure to clear the out of scope variables from possession set and memory as well:(i)
Receive
(
R
k
,
ID
R
k
,
C
5
).
(ii)
Split
(
ID
R
k
,
C
5
).
(iii)
Decrypt
C
5
K
S
i
-
R
k
→
P
R
k.
(iv)
Split
P
R
k
→
(
rn
k
,
KeySuccess
,
H
R
k
).
(v)
Freshness
ts
S
i
-
ts
k
≥
Δ
t
→
Abort  Check
MAC
Concat
rn
i
,
KeySuccess
,
H
R
k.
(vi)
Check
rn
i
,
KeySuccess
→
Update
(
K
S
i
-
R
k
).
(vii)
Forget
(
rn
k
,
ts
k
,
C
5
,
P
R
k
,
H
R
k
).Similarly, the receiver node R
k also receives the cipher text C
6 for the key success message M
6 and performs all the steps illustrated above.


## 5.1. DKEP Analysis and Verification

In this section, DKEP is analyzed for intracluster key distribution scenario where both the distant sensor nodes are in communication range of one actor. In this scenario, initially senderS
i transmits message M
1 to actor node A
x. After the send operation, system calls the update procedure to refresh the rn
i
,
ts
i values in the observer list as shown below:(i)
Hash
(
h
·
;
Row
i
,
Col
i
,
rn
i
,
ts
i
)
→
H
S
i
RC
.
(ii)
Concat
(
Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC
)
→
P
S
i
RC
.
(iii)
Encrypt
(
P
S
i
RC
K
S
i
-
A
x
)
→
C
1.
(iv)
Send
(
A
x
,
Concat
ID
S
i
,
C
1
)
→
M
1.
(v)
Update
(
rn
i
,
ts
i
).All the parameters including message M
1, cipher text C
1, hash H
S
i
RC, concatenated string P
S
i
RC, nonce and timestamp values rn
i
,
ts
i, and row and column indices Row
i
,
Col
i are saved in possession set at S
i as illustrated below. Belief set also appends the message M
1 in the list:POSS
S
i
=
{
I
D
S
i
,
K
S
i
-
A
x
,
P
S
i
RC
,
Row
i
,
Col
i
,
rn
i
,
ts
i, H
S
i
RC
,
C
1
,
M
1
,
R
k
}.
BEL
(
S
i
)
=
#
I
D
S
i
,
#
K
S
i
-
A
x
,
#
M
1.Similarly R
k also transmits the message containing row and column indices along with timestamp and nonce values: (i)
Hash
(
h
·
;
Row
k
,
Col
k
,
rn
k
,
ts
k
)
→
H
R
k
RC
.
(ii)
Concat
(
Row
k
,
Col
k
,
rn
k
,
ts
k
,
S
i
,
H
R
k
RC
)
→
P
R
k
RC.
(iii)
Encrypt
(
P
R
k
RC
K
R
k
-
A
x
)
→
C
2.
(iv)
Send
(
A
x
,
Concat
ID
R
k
,
C
2
)
→
M
2.
(v)
Update
(
rn
k
,
ts
k
).Similarly the related parameters are saved in possession set at receiver node R
k as illustrated below: POSS
S
i
=
{
I
D
S
i
,
K
S
i
-
A
x
,
Row
k
,
Col
k
,
rn
k
,
ts
k, H
R
k
RC
,
P
R
k
RC
,
C
2
,
M
2
,
S
i
}.
BEL
(
S
i
)
=
#
I
D
S
i
,
#
K
S
i
-
A
x
,
#
M
2.After the exchange of messages between sender and receiver, each sensor node splits the message to extract the cipher text. After that, it is decrypted using the shared key between actor and the sensor node S
i to retrieve concatenated string P
S
i
RC that is further split to extract Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC values. For freshness evaluation of the message, initially timestamp ts
A
x is calculated at actor A
x and then received time stamp value ts
i is subtracted from it. A message can be aborted when timestamp difference is larger than the threshold time Δ
t. Otherwise, node R
k calculates the MAC of Row
i
,
Col
i
,
rn
i
,
ts
i and compares it with hash H
S
i
RC to ensure integrity protection. Actor node proceeds with next steps by checking that both the hash values are equal otherwise message is discarded. Similar steps are followed by A
x to receive message M
2 from node R
k with different parameters:POSS
(
A
x
)
=
I
D
A
x
,
K
A
x
-
S
i
,
K
A
x
-
R
k.
BEL
(
A
x
)
=
#
I
D
A
x
,
#
K
A
x
-
S
i
,
#
K
A
x
-
R
k.
B
L
(
A
x
)
=
(i)
Receive
S
i
,
ID
S
i
,
C
1,
(ii)
Split
ID
S
i
,
C
1,
(iii)
Decrypt
C
1
K
A
x
-
S
i
→
P
S
i
RC,
(iv)
Split
P
S
i
RC
→
Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC,
(v)
Freshness
ts
A
x
-
ts
i
≥
Δ
t
→
Abort,
(vi)
MAC
Concat
Row
i
,
Col
i
,
rn
i
,
ts
i
→
H
∗,
(vii)
Check
H
S
i
RC
,
H
∗
→
Abort.Actor node A
x further prepares message by encrypting received concatenated string P
S
i
RC using preestablished key K
A
x
-
R
k between A
x and receiver node. The encrypted message is transmitted towards R
k and then temporary values (
P
S
i
RC
,
rn
i
,
ts
i
,
R
k
,
C
3
,
M
3
,
H
∗) used during calculations are removed from memory using Forget procedure:(viii)
Encrypt
(
P
S
i
RC
K
A
x
-
R
k
)
→
C
3.
(ix)
Send
(
R
k
,
Concat
ID
A
x
,
C
3
)
→
M
3.
(x)
Update
(
M
ID
).
(xi)
Forget
(
P
S
i
RC
,
rn
i
,
ts
i
,
R
k
,
C
3
,
M
3
,
H
∗
)
.Actor node A
x maintains a list of variables and parameters in possession set to perform calculations during key establishment: POSS
A
x
=
{
I
D
A
x
,
K
A
x
-
S
i
,
K
A
x
-
R
k
,
P
S
i
RC
,
R
k
,
rn
i
,
ts
i, C
3
,
M
3
,
H
∗
}
.
BEL
(
A
x
)
=
#
I
D
A
x
,
#
K
A
x
-
S
i
,
#
K
A
x
-
R
k.Actor node A
x performs the same operation for message received from R
k to forward towards sensor node S
i with different parameters. The receiver R
k receives the message from A
x and then splits the message to get C
3 which is decrypted to extract the concatenated string. It is further tokenized to get the security parameters including Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC. Freshness of message is checked and then comparison of the hash values is performed for integrity protection: (i)
Receive
(
A
x
,
ID
A
x
,
C
3
).
(ii)
Split
ID
A
x
,
C
3.
(iii)
Decrypt
C
3
K
A
x
-
R
k
→
P
S
i
RC
.
(iv)
Split
P
S
i
RC
→
(
Row
i
,
Col
i
,
rn
i
,
ts
i
,
R
k
,
H
S
i
RC
).
(v)
Freshness
ts
R
k
-
ts
i
≥
Δ
t
→
Abort  MAC
(
Concat
(
Row
i
,
Col
i
,
rn
i
,
ts
i
)
)
→
H
∧.
(vi)
Check
(
H
S
i
RC
,
H
∧
)
.Finally the symmetric key is obtained by calculating XOR of time stamps and nonce values exchanged between sender and receiver. It also includes the value V
RC which is obtained by taking XOR of common value at the intersection of rows and columns of sender and receiver as shown below. After that a key success message is exchanged between sender and receiver to confirm the secret key establishment as per the following steps. At the end, Message ID is updated in the belief set and Forget operation is executed to remove the out of scope values from the memory of R
k: (vii)
XOR
V
Row
i
Col
k
,
V
Row
k
Col
i
→
V
RC
.
(viii)
XOR
rn
i
,
ts
i
,
V
RC
,
rn
k
,
ts
k
→
K
S
i
-
R
k.
(ix)
Hash
(
h
·
;
rn
i
,
KeySuccess
)
→
H
R
k.
(x)
Concat
rn
i
,
KeySuccess
→
P
R
k.
(xi)
Encrypt
(
P
R
k
K
S
i
-
R
k
)
→
C
5
.
(xii)
Send
(
S
i
,
Concat
ID
R
k
,
C
5
)
→
M
5.
(xiii)
Update
(
M
ID
).
(xiv)
Forget
(
Row
i
,
Col
i
,
Row
k
,
Col
k
,
H
S
i
RC
,
P
S
i
RC
,
rn
k
,
ts
k,C
3
,
M
3
,
H
∧
,
V
RC
,
H
R
k
,
P
R
k
,
C
5
,
M
5
).Possession set contains the variables and parameters used during calculations regarding key distribution and message extraction as shown below:POSS
R
k
=
ID
R
k
,
K
R
k
-
A
x
,
Row
i
,
Col
i
,
Row
k
,
Col
k,H
S
i
RC
,
P
S
i
RC
,
rn
k
,
ts
k
,
C
3
,
M
3
,
H
∧
,
V
RC
,
H
R
k
,
P
R
k
,
C
5,M
5
,
K
S
i
-
R
k
.
BEL
R
k
=
#
(
ID
R
k
)
,
#
(
K
R
k
-
A
x
)
,
#
(
K
S
i
-
R
k
).After execution of all steps illustrated above, the newly established key K
S
i
-
R
k is stored in the belief set. Unnecessary and out of scope values are removed from the possession set and hence the memory of sender node S
i and receiver node R
k. For this purpose, it calls a function Forget
(
Row
i
,
Col
i
,
Row
k
,
Col
k
,
H
S
i
RC
,
P
S
i
RC
,
rn
k
,
ts
k
,
C
3
,
M
3
,
H
∧
,
V
RC
,
H
R
k
,
P
R
k
,
C
5
,
M
5
) after successful exchange of key success message between sender and receiver. The sender node S
i receives the cipher text C
5 for the key success message M
5 encrypted with currently established key K
S
i
-
R
k. Node S
i decrypts the cipher text C
5 to get (
rn
i
,
KeySuccess
) and verify the nonce value rn
i as shown in the following steps. Node S
i calls the Forget procedure to clear the out of scope variables from possession set and memory as well:(i)
Receive
(
R
k
,
ID
R
k
,
C
5
).
(ii)
Split
(
ID
R
k
,
C
5
).
(iii)
Decrypt
C
5
K
S
i
-
R
k
→
P
R
k.
(iv)
Split
P
R
k
→
(
rn
k
,
KeySuccess
,
H
R
k
).
(v)
Freshness
ts
S
i
-
ts
k
≥
Δ
t
→
Abort  Check
MAC
Concat
rn
i
,
KeySuccess
,
H
R
k.
(vi)
Check
rn
i
,
KeySuccess
→
Update
(
K
S
i
-
R
k
).
(vii)
Forget
(
rn
k
,
ts
k
,
C
5
,
P
R
k
,
H
R
k
).Similarly, the receiver node R
k also receives the cipher text C
6 for the key success message M
6 and performs all the steps illustrated above.


## 6. Results and Analysis

The proposed model is simulated for a clustered WSAN using NS-2 where an actor is the cluster head. Running times for critical computations are calculated using C++ language with ns-2 and C# in visual studio 2013 as well. In WSAN, nodes and actors are randomly deployed in a region of 1200 × 1200 meters where nodes were static and actors can move within the network field. Cluster sizes are varied from 50 to 500 nodes and 2 to 20 actors were deployed with an increase of one actor per 25 nodes. Queue type is assigned as Queue/DropTail/PriQue as shown in Table2.Table 2
Simulation parameters.
Simulation setup
Parameters
Values
Network field
1200 × 1200 meters
Initial energy at node
1000 J
Tx power at node
0.819 J
Receiving power
0.049 J
Queue type
Queue/DropTail/PriQue
Max packet in queue
50
Routing protocol
DSDV
Agent trace
ON
Router trace
ON
Cluster size
50–500 nodes
Network size
1000–10000
Neighbor count
5–25
Associations count
1–5
Intermediaries count
3,4,5
Captured gateway
1–4
Row column compromised
1 + 1DKEP scheme is evaluated to measure the resilience, storage, and communication overhead during key establishment for intra- and intercluster scenarios.


### 6.1. Storage Overhead

Each sensor node is preloaded with matrix elements including row, column, or both. These elements are preloaded for future calculation for key establishment after deployment. In the following section, we have analyzed the storage required for preloading these matrix elements only. Figure7(a) elucidates the storage per node in bytes for different cluster sizes and fixes network size of 1000 nodes. Different relevant existing schemes need to store key credentials like Blom’s scheme [9] that requires 2
λ
+
1 values of one row and column. If each value in matrix is S bytes which is considered 8 bytes in this scenario, then 2
λ
+
1
×
S bytes whereas MBS [10] requires λ
+
1
×
S bytes that is reduced due to the fact that one column is calculated from identity matrix.Figure 7
Storage per node is shown in (a) and network wide storage is shown in (b).
(a)
(b)QKM scheme [12] requires γ
-
1
×
S bytes where γ represents cluster size and SMK scheme [11] reserves 3
γ
×
S bytes. Proposed DKEP scheme requires 2
×
γ
×
S bytes for storing row-column pair. Results prove the dominance of DKEP as compared to preliminaries. Figure 7(b) elucidates the storage per whole network in existing and proposed schemes for different network sizes with same cluster size equal to 100 nodes. Individual node requires needs to store λ
+
1
×
S bytes for preloaded key material in MBS [10] and network wide storage cost is λ
+
1
×
S
×
N bytes, where N represents network size. Similarly the network wide cost of QKM scheme [12] is γ
-
1
×
S
×
N bytes, SMK scheme [11] reserves 2
λ
+
1
×
S
×
N bytes, and proposed DKEP scheme requires 2
×
γ
×
S
×
N bytes. Results prove that proposed DKEP scheme is much more scalable and can be applied to large networks.Gateway node stores two rows and columns in existing schemes whereas DKEP needs to load only one pair. DKEP requires to load row and column pair from same matrix in all clusters because key is not fully dependent on matrix values and cannot be calculated mathematically even intruder obtains all rows and columns. These stored matrix elements are also refreshed after regular interval to keep the network more resilient against node capturing attacks.


### 6.2. Communication Overhead

Source and destination nodes exchange messages during key establishment within the cluster. Figure8(a) illustrates number of bytes transmitted during message exchange for keying between neighboring nodes. Cluster size is equal to 100 nodes and λ
=
50 and number of neighbors are varied from 5 to 25. In QKM scheme [12], two nodes transmit two messages of size S for exchanging their IDs and two more messages of size T for exchanging random values that costs (2
×
S
+
(
2
×
T
)) bits. SMK scheme [11] requires to transmit one column of matrix Y from each node that costs total 2
×
C
o
l
S
i
z
e
×
EC
size bits where EC
size is size of each element in column. MBS [10] requires transmitting one row and indices from each node that exchanges total 2
×
Row
Size
×
ER
size
+
4 bits, where ER
size represents size of row elements. Blom’s scheme [9] requires transmitting one row and one column that transmits 2
×
(
Row
size
+
Col
size
)
×
EM
size bits where EM
size represents size of matrix elements which is considered 8 bits per value.Figure 8
Communication cost for intracluster keying is shown in (a) and intercluster scenario is shown in (b).
(a)
(b)DKEP requires(
2
×
P
size) bits where P
size is sum of 16-bit node ID, 16-bit nonce, 16-bit timestamp, 8-bit row, and column index each. Communication cost increases rapidly in SMK, MBS, and Blom’s scheme with the increase in cluster size and hence number of neighboring nodes. QKM is suitable in terms of communication cost but it is not scalable due to storage overhead. Results ensure the applicability of DKEP for large cluster sizes and hence larger networks.During intercluster path key establishment, messages are exchanged between senderS
i and receiver R
k across the cluster where actors A
x and A
y are also involved in this process along with gateway node GN. In this scenario, we have ignored the messages transmission cost between actors and considered the ordinary member nodes that transmit only 4 messages during Si to A
x, GN to A
y, S
i back to A
y, and from node GN back to A
x transmission. Figure 8(b) elucidates message transmission cost for managing t associations across the cluster where t represents the number of path keys established with neighboring cluster. QKM scheme [12] requires (4
×
S
+
(
4
×
T
)) bits, SMK scheme [11] requires 4
×
C
o
l
S
i
z
e
×
EC
size bits, MBS [10] requires (
4
×
Row
Size
×
ER
size
+
4
) bits, and proposed DKEP requires (
4
×
P
size) bits for message exchange.Figure9 elucidates the cost for establishing the path key using intermediaries in the following communication scenarios including intracluster, intercluster, and inter-WSAN with gateway node. Communication cost Comm
cost is calculated using (19) where message size Msg
size is calculated in such a way that Blom’s scheme [9] requires (
Row
size
+
Col
size
)
×
EM
size bits, QKM scheme [12] requires S
+
T bits, SMK scheme [11] requires C
o
l
S
i
z
e
×
EC
size bits, MBS [10] requires (
R
o
w
Size
×
ER
size
+
4
) bits, and DKEP requires P
size bits: (19)
Comm
cost
=
Interm
count
∗
Msg
size
∗
MsgCount
node
.The number of intermediate nodes Interm
count during path key is 3, 4, and 5 for intracluster, intercluster, and inter-WSAN with gateway node based communication scenarios. Each intermediate node sends total 2 messages that is represented as MsgCount
node.Figure 9
Communication cost for path key distribution.


### 6.3. Resilience

During inter-WSAN communication, two ordinary nodes from different regions communicate using two actors and gateway node. ProbabilityPr
⁡
Gateway_Node to calculate the existence of an uncompromised gateway node in the path can be calculated using (20) where γ is the cluster size and ψ is number of nodes captured by an attacker in the network:(20)
Pr
⁡
Gateway_Node
=
γ
-
3
ψ
γ
-
2
ψ
.Total uncompromised nodes γ
-
2 represent that 2 ordinary nodes are excluded from compromised nodes in network whereas γ
-
3 represents the further exclusion of one gateway node. The probability Pr
⁡
G
_Compromised that a selected gateway node is captured at either sender or receiver side can be calculated using(21)
Pr
⁡
G
_Compromised
=
1
-
Pr
⁡
Gateway_Node
=
ψ
γ
-
2
.Figure 10 elucidates the probability of compromising a gateway node during intercluster key establishment scenario for different cluster sizes. It considers scenario for calculating the probability Pr
⁡
G
C
=
1, Pr
⁡
G
C
=
2up to 4 nodes compromised where cluster size varies from 100 nodes to 450 nodes. By compromising 3 nodes in a cluster size of 250 nodes, there is 1 percent chance that gateway node is compromised.Figure 10
Probability of compromised gateway node.If an ordinary node is compromised then a single row and column pair are revealed to adversary. Probability that a particular row and column are compromised is calculated using (22) where ω rows and columns are compromised, respectively,(22)
Pr
⁡
RC_Compromised
=
1
-
M
-
1
ω
-
1
M
ω
=
ω
M
.A column and row pair is loaded in a node; therefore, compromising an ordinary node reveals one row and column pair in Blom’s scheme [9], QKM scheme [12], MBS [10], and proposed DKEP scheme. In case of SMK scheme [11], one row and two columns are revealed. Figure 11 illustrates the exposure of number of matrix values when a node is compromised by an attacker. Network size is equal to 1000 nodes whereas cluster size varies from 100 to 500 and λ
=
60. Results prove the strong resilience of DKEP as compared to existing schemes. It is much secure than these results because in existing schemes exposure of rows and columns results in key exposure as keys are calculated by multiplying row and column values. In DKEP scheme exposure of row and column does not expose the key because values at particular index of row and column are taken as one part of the key. Row and column values are also refreshed after regular intervals to further protect against node capture attacks.Figure 11
Matrix values revealed on node compromise.


## 6.1. Storage Overhead

Each sensor node is preloaded with matrix elements including row, column, or both. These elements are preloaded for future calculation for key establishment after deployment. In the following section, we have analyzed the storage required for preloading these matrix elements only. Figure7(a) elucidates the storage per node in bytes for different cluster sizes and fixes network size of 1000 nodes. Different relevant existing schemes need to store key credentials like Blom’s scheme [9] that requires 2
λ
+
1 values of one row and column. If each value in matrix is S bytes which is considered 8 bytes in this scenario, then 2
λ
+
1
×
S bytes whereas MBS [10] requires λ
+
1
×
S bytes that is reduced due to the fact that one column is calculated from identity matrix.Figure 7
Storage per node is shown in (a) and network wide storage is shown in (b).
(a)
(b)QKM scheme [12] requires γ
-
1
×
S bytes where γ represents cluster size and SMK scheme [11] reserves 3
γ
×
S bytes. Proposed DKEP scheme requires 2
×
γ
×
S bytes for storing row-column pair. Results prove the dominance of DKEP as compared to preliminaries. Figure 7(b) elucidates the storage per whole network in existing and proposed schemes for different network sizes with same cluster size equal to 100 nodes. Individual node requires needs to store λ
+
1
×
S bytes for preloaded key material in MBS [10] and network wide storage cost is λ
+
1
×
S
×
N bytes, where N represents network size. Similarly the network wide cost of QKM scheme [12] is γ
-
1
×
S
×
N bytes, SMK scheme [11] reserves 2
λ
+
1
×
S
×
N bytes, and proposed DKEP scheme requires 2
×
γ
×
S
×
N bytes. Results prove that proposed DKEP scheme is much more scalable and can be applied to large networks.Gateway node stores two rows and columns in existing schemes whereas DKEP needs to load only one pair. DKEP requires to load row and column pair from same matrix in all clusters because key is not fully dependent on matrix values and cannot be calculated mathematically even intruder obtains all rows and columns. These stored matrix elements are also refreshed after regular interval to keep the network more resilient against node capturing attacks.


## 6.2. Communication Overhead

Source and destination nodes exchange messages during key establishment within the cluster. Figure8(a) illustrates number of bytes transmitted during message exchange for keying between neighboring nodes. Cluster size is equal to 100 nodes and λ
=
50 and number of neighbors are varied from 5 to 25. In QKM scheme [12], two nodes transmit two messages of size S for exchanging their IDs and two more messages of size T for exchanging random values that costs (2
×
S
+
(
2
×
T
)) bits. SMK scheme [11] requires to transmit one column of matrix Y from each node that costs total 2
×
C
o
l
S
i
z
e
×
EC
size bits where EC
size is size of each element in column. MBS [10] requires transmitting one row and indices from each node that exchanges total 2
×
Row
Size
×
ER
size
+
4 bits, where ER
size represents size of row elements. Blom’s scheme [9] requires transmitting one row and one column that transmits 2
×
(
Row
size
+
Col
size
)
×
EM
size bits where EM
size represents size of matrix elements which is considered 8 bits per value.Figure 8
Communication cost for intracluster keying is shown in (a) and intercluster scenario is shown in (b).
(a)
(b)DKEP requires(
2
×
P
size) bits where P
size is sum of 16-bit node ID, 16-bit nonce, 16-bit timestamp, 8-bit row, and column index each. Communication cost increases rapidly in SMK, MBS, and Blom’s scheme with the increase in cluster size and hence number of neighboring nodes. QKM is suitable in terms of communication cost but it is not scalable due to storage overhead. Results ensure the applicability of DKEP for large cluster sizes and hence larger networks.During intercluster path key establishment, messages are exchanged between senderS
i and receiver R
k across the cluster where actors A
x and A
y are also involved in this process along with gateway node GN. In this scenario, we have ignored the messages transmission cost between actors and considered the ordinary member nodes that transmit only 4 messages during Si to A
x, GN to A
y, S
i back to A
y, and from node GN back to A
x transmission. Figure 8(b) elucidates message transmission cost for managing t associations across the cluster where t represents the number of path keys established with neighboring cluster. QKM scheme [12] requires (4
×
S
+
(
4
×
T
)) bits, SMK scheme [11] requires 4
×
C
o
l
S
i
z
e
×
EC
size bits, MBS [10] requires (
4
×
Row
Size
×
ER
size
+
4
) bits, and proposed DKEP requires (
4
×
P
size) bits for message exchange.Figure9 elucidates the cost for establishing the path key using intermediaries in the following communication scenarios including intracluster, intercluster, and inter-WSAN with gateway node. Communication cost Comm
cost is calculated using (19) where message size Msg
size is calculated in such a way that Blom’s scheme [9] requires (
Row
size
+
Col
size
)
×
EM
size bits, QKM scheme [12] requires S
+
T bits, SMK scheme [11] requires C
o
l
S
i
z
e
×
EC
size bits, MBS [10] requires (
R
o
w
Size
×
ER
size
+
4
) bits, and DKEP requires P
size bits: (19)
Comm
cost
=
Interm
count
∗
Msg
size
∗
MsgCount
node
.The number of intermediate nodes Interm
count during path key is 3, 4, and 5 for intracluster, intercluster, and inter-WSAN with gateway node based communication scenarios. Each intermediate node sends total 2 messages that is represented as MsgCount
node.Figure 9
Communication cost for path key distribution.


## 6.3. Resilience

During inter-WSAN communication, two ordinary nodes from different regions communicate using two actors and gateway node. ProbabilityPr
⁡
Gateway_Node to calculate the existence of an uncompromised gateway node in the path can be calculated using (20) where γ is the cluster size and ψ is number of nodes captured by an attacker in the network:(20)
Pr
⁡
Gateway_Node
=
γ
-
3
ψ
γ
-
2
ψ
.Total uncompromised nodes γ
-
2 represent that 2 ordinary nodes are excluded from compromised nodes in network whereas γ
-
3 represents the further exclusion of one gateway node. The probability Pr
⁡
G
_Compromised that a selected gateway node is captured at either sender or receiver side can be calculated using(21)
Pr
⁡
G
_Compromised
=
1
-
Pr
⁡
Gateway_Node
=
ψ
γ
-
2
.Figure 10 elucidates the probability of compromising a gateway node during intercluster key establishment scenario for different cluster sizes. It considers scenario for calculating the probability Pr
⁡
G
C
=
1, Pr
⁡
G
C
=
2up to 4 nodes compromised where cluster size varies from 100 nodes to 450 nodes. By compromising 3 nodes in a cluster size of 250 nodes, there is 1 percent chance that gateway node is compromised.Figure 10
Probability of compromised gateway node.If an ordinary node is compromised then a single row and column pair are revealed to adversary. Probability that a particular row and column are compromised is calculated using (22) where ω rows and columns are compromised, respectively,(22)
Pr
⁡
RC_Compromised
=
1
-
M
-
1
ω
-
1
M
ω
=
ω
M
.A column and row pair is loaded in a node; therefore, compromising an ordinary node reveals one row and column pair in Blom’s scheme [9], QKM scheme [12], MBS [10], and proposed DKEP scheme. In case of SMK scheme [11], one row and two columns are revealed. Figure 11 illustrates the exposure of number of matrix values when a node is compromised by an attacker. Network size is equal to 1000 nodes whereas cluster size varies from 100 to 500 and λ
=
60. Results prove the strong resilience of DKEP as compared to existing schemes. It is much secure than these results because in existing schemes exposure of rows and columns results in key exposure as keys are calculated by multiplying row and column values. In DKEP scheme exposure of row and column does not expose the key because values at particular index of row and column are taken as one part of the key. Row and column values are also refreshed after regular intervals to further protect against node capture attacks.Figure 11
Matrix values revealed on node compromise.


## 7. DKEP Based Security in Mobile Applications

Proposed scheme is equally applicable in mobile applications for providing security in mobile ad hoc networks. Client and server applications are developed to operate in a peer to peer and cluster based scenario as illustrated in Figure12. These applications are developed for the proof of the concept and verification of protocol steps in a practical scenario.Figure 12
Client-server communication using DKEP.Client and server nodes are preloaded with one row and column fromα × α matrix. Member nodes and server mobile exchange row and column indices along with timestamp and nonce values. Keys are established by taking XOR of these security credentials according to DKEP specifications. Established keys and related details are saved in an XML file in flash memory of android mobile. It was tested by establishing keys with four mobiles and then sending encrypted SMS. Application at receiver side reads cipher message and decrypts it using preestablished key. It was also tested for chatting application between two android mobiles. Both client and server application are successfully performing the intended functionalities. DKEP is equally applicable in securing MANET based application scenarios.


### 7.1. Key Generation Phase

If two nodes do not contain a preestablished key then following steps are followed to establish a secret key between two mobiles. Established keys are saved in an XML and can be retrieved for encrypting or decrypting the SMS for secure communication between mobile nodes. Specifications of DKEP are adopted to establish keys.Sender Side
(1)
Getting Mobile Number from User.
(2)
Checking the Mobile Number from XML File.
(a)
If Mobile number already in File
“Continue Messaging”.
(b)
else
Call DKEP_KeyInit and DKEP_KeyGen functions.
(c)
end if
(3)
Procedure DKEP_KeyInit()
(4)
Randomly Generate Rows and Column Indices.
(5)
Concatenate Magic Word (MW), indices, time stamp and nonce.
(6)
Send SMS.
(7)
Saving values in XML File.
(8)
(9)
Procedure DKEP_KeyGen()
(10)
Obtain Magic Word (MW), indices, time stamp and nonce from receiver
(11)
Take XOR of these values using DKEP to obtain Key
(12)
Save Key in XML file.
(13)Receiver Side
(1)
Receive SMS.
(2)
If first 12 bits equals Magic Word then
(3)
Split the concatenated string
(4)
Save received values in XML File
(5)
Call DKEP_KeyInit function.
(6)
Call DKEP_KeyGen function.
(7)
else
(8)
Discard Message
(9)
end if


### 7.2. Secure Messaging between Cell Phones

A mobile user can communicate securely with mobile phones that are registered earlier through key generation phase. To validate steps of DKEP, user can select the secure option to transmit the message in a cipher text form. SMS is sent towards receiver by concatenating with a magic word where receiver first checks magic word to avoid unnecessary decryption efforts. Plain text message is displayed to user after successful decryption using preestablished key saved in XML file.Sender Side
(1)
Getting Mobile Number and Message of Receiver.
(2)
If Mobile number not exist in XML file.
(a)
Start Key Initialization and Generation Process
(3)
else
(a)
Encrypt message using pre-established key.
(b)
Converting them in to byte Array.
(4)
Concatenate the Magic Word “∗
∗
∗DKEP∗
∗
∗” with cipher text.
(5)
Send SMSReceiver Side
(1)
Receive SMS and split the concatenated message.
(2)
If first 10 characters of Message equals “∗
∗
∗DKEP∗
∗
∗”.
(a)
Decrypt the message
(b)
Displaying Original Message.
(3)
else
(a)
Displaying Original Message in list.


## 7.1. Key Generation Phase

If two nodes do not contain a preestablished key then following steps are followed to establish a secret key between two mobiles. Established keys are saved in an XML and can be retrieved for encrypting or decrypting the SMS for secure communication between mobile nodes. Specifications of DKEP are adopted to establish keys.Sender Side
(1)
Getting Mobile Number from User.
(2)
Checking the Mobile Number from XML File.
(a)
If Mobile number already in File
“Continue Messaging”.
(b)
else
Call DKEP_KeyInit and DKEP_KeyGen functions.
(c)
end if
(3)
Procedure DKEP_KeyInit()
(4)
Randomly Generate Rows and Column Indices.
(5)
Concatenate Magic Word (MW), indices, time stamp and nonce.
(6)
Send SMS.
(7)
Saving values in XML File.
(8)
(9)
Procedure DKEP_KeyGen()
(10)
Obtain Magic Word (MW), indices, time stamp and nonce from receiver
(11)
Take XOR of these values using DKEP to obtain Key
(12)
Save Key in XML file.
(13)Receiver Side
(1)
Receive SMS.
(2)
If first 12 bits equals Magic Word then
(3)
Split the concatenated string
(4)
Save received values in XML File
(5)
Call DKEP_KeyInit function.
(6)
Call DKEP_KeyGen function.
(7)
else
(8)
Discard Message
(9)
end if


## 7.2. Secure Messaging between Cell Phones

A mobile user can communicate securely with mobile phones that are registered earlier through key generation phase. To validate steps of DKEP, user can select the secure option to transmit the message in a cipher text form. SMS is sent towards receiver by concatenating with a magic word where receiver first checks magic word to avoid unnecessary decryption efforts. Plain text message is displayed to user after successful decryption using preestablished key saved in XML file.Sender Side
(1)
Getting Mobile Number and Message of Receiver.
(2)
If Mobile number not exist in XML file.
(a)
Start Key Initialization and Generation Process
(3)
else
(a)
Encrypt message using pre-established key.
(b)
Converting them in to byte Array.
(4)
Concatenate the Magic Word “∗
∗
∗DKEP∗
∗
∗” with cipher text.
(5)
Send SMSReceiver Side
(1)
Receive SMS and split the concatenated message.
(2)
If first 10 characters of Message equals “∗
∗
∗DKEP∗
∗
∗”.
(a)
Decrypt the message
(b)
Displaying Original Message.
(3)
else
(a)
Displaying Original Message in list.


## 8. Conclusion

Secure key distribution is the essential requirement of industrial, medical, and military applications of WSN and WSAN for providing secure messaging between sensor nodes. During key distribution between two nodes across the clusters, an intermediate gateway node that has established keys in both clusters across WSAN plays a vital role for message exchange. A compromised gateway node can extract the key before the link establishment because sender and receiver have no prior end to end key to encrypt messages. In this scheme, indices for row and column are exchanged between the sender and receiver nodes and values at intersection of row and column index are used to calculate the key on both nodes. It can establish keys with neighboring nodes, actors, and sink and even across different WSN. Simulation results prove the dominance of DKEP as compared to existing schemes. DKEP reduces communication overhead as compared to existing schemes and achieves resilience against node compromising attacks because key is never transmitted across the nodes. The proposed scheme is verified using Rubin Logic and results are validated with simulations using NS-2. DKEP is also tested for secure messaging between android mobiles in a group-based scenario.



---

*Source: 5071617-2016-08-07.xml*