# A Bilinear Pairing-Based Dynamic Key Management and Authentication for Wireless Sensor Networks

Authors: Chin-Ling Chen; Tzay-Farn Shih; Yu-Ting Tsai; De-Kui Li
Journal: Journal of Sensors
 (2015)

---

## Abstract

In recent years, wireless sensor networks have been used in a variety of environments; a wireless network infrastructure, established to communicate and exchange information in a monitoring area, has also been applied in different environments. However, for sensitive applications, security is the paramount issue. In this paper, we propose using bilinear pairing to design dynamic key management and authentication scheme of the hierarchical sensor network. We use the dynamic key management and the pairing-based cryptography (PBC) to establish the session key and the hash message authentication code (HMAC) to support the mutual authentication between the sensors and the base station. In addition, we also embed the capability of the Global Positioning System (GPS) to cluster nodes to find the best path of the sensor network. The proposed scheme can also provide the requisite security of the dynamic key management, mutual authentication, and session key protection. Our scheme can defend against impersonation attack, replay attack, wormhole attack, and message manipulation attack.


---

## Body

## 1. Introduction

In recent years, wireless sensor networks have been used in a variety of environments; a wireless network infrastructure, established to communicate and exchange information in a monitoring area, has also been applied in different environments, including disaster relief operations, seismic data collecting, monitoring wildlife, and collecting battlefield information.Due to their small size, the sensors can be spatially scattered to form an ad hoc network. The sensors have an inherent limitation. The wireless sensor network requires an appropriate encryption or decryption system to protect the collected information [1]. The high cost of an encryption/decryption mechanism (e.g., Diffie and Hellman key management [2] or Rivest et al. encryption [3]) is unsuitable for use in a wireless sensor network.In addition, the topology of the network environment is another important issue. The hierarchical predistribution protocol [4] allows some of the cluster nodes to aggregate the events of the sensor nodes to communicate with the base station. The hierarchical predistribution protocol includes several cluster nodes, sensor nodes, and base station; the most common hierarchical networks are two-level, and the two classes of sensor are sensor node and cluster node. The advantage of this scheme is the easy management of the data aggregation [5–7]. The process of aggregating the data from multiple nodes involves eliminating redundant transmission and providing fused data to the base station. It is also considered as an effectual technique for wireless sensor networks to save energy [8]. The most popular data aggregation algorithms are cluster-based data aggregation algorithms, in which the nodes are grouped into clusters: each cluster consists of a cluster node and some sensors; each sensor transmits data to its cluster node; and each cluster node aggregates the collected data; it then transmits the fused data to the base station.The key management scheme is divided into four types: the Random Key Predistribution Protocol (RKP), the Group-Based Key Predistribution Protocol (GKP), the Hierarchical Key Predistribution Protocol (HKP), and the Pairing-Based Protocol (PBC). In 2003, Chan et al. proposed a Random Key Predistribution scheme [9]. Since each node randomly picks keys from a large key pool such that any two sensor nodes share at least one common key, ensuring adequate storage space and the range of the network is a challenge. The PIKE scheme [10] addressed the problem of high density deployment requirements in RKP. But in this scheme the session key is segmented into many key fragments. Therefore, the combination of the session key is complex. However, the PIKE solved the storage problem of RKP. Cheng and Agrawal proposed an improved key distribution mechanism [11]. The IKDM established a session key which used the exchange information between sensors; it can easily generate a session key by the polynomial function. In recent years, the pairing-based cryptography [12], TinyPBC, is a tiny pairing-based protocol and its computation cost is lower than other corresponding bilinear pairing-based schemes. The pairing-based mechanism was used in the sensor network to accomplish the key management of the sensor’s session key. It can use the sensors’ identity for sensors to send data to each other via the sensor network. After the identity exchange, the sensors key can easily compute the session key via the bilinear pairing. In such design, the security can also be enhanced.In this paper, we propose using bilinear pairing to design dynamic key management and authentication scheme of the hierarchical sensor network. We use the dynamic key management mechanism [13, 14] and the pairing-based cryptography (PBC) [12, 15, 16] to establish the session key. We also use the hash message authentication code (HMAC) [15, 17] to offer mutual authentication between the sensors and the base station. Moreover, we also involve the capability of the Global Positioning System (GPS) [18, 19] to cluster nodes, in order to find the best path of the sensor network.The remainder of this paper is organized as follows. The preliminaries are presented in Section2. The proposed scheme is described in Section 3. The security analysis of our scheme is given in Section 4. And the discussions are offered in Section 5. Finally, conclusions are presented in the last section.


## 2. Preliminaries

### 2.1. Sensor Network Architecture

Categories of sensor networks significantly affect key establishment design [4]. The relative capabilities of different sensors are divided into the following two classes:(1)
homogeneity: all sensors have the same capabilities;
(2)
heterogeneity: there is an inherent hierarchy of sensors with respect to their capabilities (with fewer sensors at higher, more “powerful” levels). The most common hierarchical networks are two-level, where there are two classes of sensors.We choose the hierarchical sensors network’s model, and the architecture is described as follows: a small number high class sensors (cluster node), large number low class sensors (sensor node), and a sink node (base station). High class sensors have more powerful ability, they have been equipped with tamper-resistant hardware and GPS capability, the cluster node with powerful ability can plan routing table and achieve more security of sensor network, and the low class sensors have not been equipped with tamper-resistant hardware and GPS capability.


### 2.2. Bilinear Pairing

The bilinear map can be constructed on elliptic curves. Each operation for computinge
P
,
Q is a pairing operation [8]. Let G be a cyclic additive group, and let G
T be a cyclic multiplicative group. Both groups G and G
T have the same prime order q. Groups G and G
T are called bilinear groups. The security of the bilinear pairing-based scheme relies on the difficulty of the Discrete Logarithm Problem (DLP); that is, given the point Q
=
a
P, no efficient algorithm exists to obtain a given P and Q. The mapping e
:
G
×
G
→
G
T is called a bilinear map if it satisfies the following properties:(1)
bilinear:
∀
P
,
Q
,
R
∈
G, ∀
a
,
b
∈
Z,
e
Q
,
P
+
R
=
e
P
+
R
,
Q
=
e
P
,
Q
·
e
R
,
Q,
e
a
P
,
b
P
=
e
P
,
b
P
a
=
e
a
P
,
P
b
=
e
P
,
P
a
b,
(2)
nondegenerate:
P
,
Q
∈
G exists such that e
P
,
Q
≠
1
G
T,
(3)
computable:
an efficient algorithm exists to computee
P
,
Q for any P
,
Q
∈
G.


### 2.3. Hash Massage Authentication Code (HMAC)

We combine the message authentication code [20, 21] and the bilinear pairing key to accomplish the hash-based message authentication code (HMAC); this is a specific construction for computing a message authentication code (MAC) using a cryptographic hash function in combination with a secret key. Both data integrity and authenticity of a message can be achieved by using a hash-based message authentication code in such a technique. We note HMAC (i.e., H
K
· is a HMAC which signifies a one-way hash function with pairing key K).


### 2.4. Pairing-Based Cryptography (PBC)

Since pairing-based cryptography (PBC), based on the identity-based cryptography (IBC) [22, 23], is used in many environments of cryptographic protocols and applications [12], the IBC has some drawbacks; this method needs a private key generator (PKG); it is a trusted entity in charge of generating and escrowing user’s private keys. In wireless sensor networks, if the sensors need to be deployed in an unattended environment, a sensor node should be a PKG, and this is difficult in a wireless sensor network. If we can easily generate a session key via a simple mechanism, it can reduce the complexity. PBC technology does not need a PKG and the sensors can authenticate themselves in the wireless sensor network. Therefore, the PBC is the best technology for key management.


## 2.1. Sensor Network Architecture

Categories of sensor networks significantly affect key establishment design [4]. The relative capabilities of different sensors are divided into the following two classes:(1)
homogeneity: all sensors have the same capabilities;
(2)
heterogeneity: there is an inherent hierarchy of sensors with respect to their capabilities (with fewer sensors at higher, more “powerful” levels). The most common hierarchical networks are two-level, where there are two classes of sensors.We choose the hierarchical sensors network’s model, and the architecture is described as follows: a small number high class sensors (cluster node), large number low class sensors (sensor node), and a sink node (base station). High class sensors have more powerful ability, they have been equipped with tamper-resistant hardware and GPS capability, the cluster node with powerful ability can plan routing table and achieve more security of sensor network, and the low class sensors have not been equipped with tamper-resistant hardware and GPS capability.


## 2.2. Bilinear Pairing

The bilinear map can be constructed on elliptic curves. Each operation for computinge
P
,
Q is a pairing operation [8]. Let G be a cyclic additive group, and let G
T be a cyclic multiplicative group. Both groups G and G
T have the same prime order q. Groups G and G
T are called bilinear groups. The security of the bilinear pairing-based scheme relies on the difficulty of the Discrete Logarithm Problem (DLP); that is, given the point Q
=
a
P, no efficient algorithm exists to obtain a given P and Q. The mapping e
:
G
×
G
→
G
T is called a bilinear map if it satisfies the following properties:(1)
bilinear:
∀
P
,
Q
,
R
∈
G, ∀
a
,
b
∈
Z,
e
Q
,
P
+
R
=
e
P
+
R
,
Q
=
e
P
,
Q
·
e
R
,
Q,
e
a
P
,
b
P
=
e
P
,
b
P
a
=
e
a
P
,
P
b
=
e
P
,
P
a
b,
(2)
nondegenerate:
P
,
Q
∈
G exists such that e
P
,
Q
≠
1
G
T,
(3)
computable:
an efficient algorithm exists to computee
P
,
Q for any P
,
Q
∈
G.


## 2.3. Hash Massage Authentication Code (HMAC)

We combine the message authentication code [20, 21] and the bilinear pairing key to accomplish the hash-based message authentication code (HMAC); this is a specific construction for computing a message authentication code (MAC) using a cryptographic hash function in combination with a secret key. Both data integrity and authenticity of a message can be achieved by using a hash-based message authentication code in such a technique. We note HMAC (i.e., H
K
· is a HMAC which signifies a one-way hash function with pairing key K).


## 2.4. Pairing-Based Cryptography (PBC)

Since pairing-based cryptography (PBC), based on the identity-based cryptography (IBC) [22, 23], is used in many environments of cryptographic protocols and applications [12], the IBC has some drawbacks; this method needs a private key generator (PKG); it is a trusted entity in charge of generating and escrowing user’s private keys. In wireless sensor networks, if the sensors need to be deployed in an unattended environment, a sensor node should be a PKG, and this is difficult in a wireless sensor network. If we can easily generate a session key via a simple mechanism, it can reduce the complexity. PBC technology does not need a PKG and the sensors can authenticate themselves in the wireless sensor network. Therefore, the PBC is the best technology for key management.


## 3. The Proposed Scheme

In this paper, we propose a bilinear pairing-based scheme to design a dynamic key management for wireless sensor network. We first introduce the proposed protocol architecture as in Figure1.(1)
Base station broadcasts the starting message to cluster nodes.
(2)
Cluster nodes respond the message authentication code to the base station.
(3)
After authentication, the base station sends a response message to allow cluster nodes to rule its group members of the sensor nodes.
(4)
Cluster node broadcasts the request message to find the members from the neighboring sensor nodes.
(5)
Sensor nodes reply the request and respond the message authentication code to the cluster node.
(6)
In order to get the sensor nodes’ session key, if the cluster node can transmit to the base station, enter into Step 6.1; else if the cluster node needs to transmit the collected information via the next neighboring, enter into Step 6.2.
(7)
After authentication, the base station sends the corresponding session key of sensor nodes to the cluster nodes.
(8)
After receiving the session keys, the cluster nodes can verify the message authentication code from Step 5. After that, the cluster nodes send the updated identities to the sensor nodes.Figure 1
The architecture of wireless sensor network.


### 3.1. Initialization Phase

In this phase, the base station computes the parameters to predistribute into the sensor nodes and the cluster node. The overview of the initialization phase is shown in Figure2.Figure 2
The overview of the initialization.Step 1.
First, the base station selects a random numberx and computes the sensor node identity P
S
N
i:(1)
P
S
N
i
=
H
x
.Then, the base station randomly selects a secret parameters and uses the secret parameter s and sensor node identity P
S
N
i to compute the secret parameter SP
1
S
N
i:(2)
SP
1
S
N
i
=
s
P
S
N
i
.The base station randomly computes a key poolK
P
1, where K
P
1
=
K
S
N
1
,
K
S
N
2
,
…
,
K
S
N
i, and distributes a session key K
S
N
i to the ith sensor node. It then stores the sensor node identity P
S
N
i and the K
S
N
i in the key list K
lis
t
S
N
i:(3)
K
lis
t
S
N
i
=
P
S
N
i
,
K
S
N
i
.After that, the base station sends the parameters (SP
1
S
N
i, P
S
N
i, K
S
N
i) to the corresponding sensor node.Step 2.
The base station selects a random numbery and computes the cluster node identity P
C
N
i:(4)
P
C
N
i
=
H
y
.Then the base station randomly selects a secret parameterr and uses the random secret parameters s
,
r to compute the secret parameters (SP
1
C
N
i
,
SP
2
C
N
i), respectively:(5)
SP
1
C
N
i
=
s
P
C
N
i
SP
2
C
N
i
=
r
P
C
N
i
.The base station randomly computes a key poolK
P
2, where K
P
2
=
K
C
N
1
,
K
C
N
2
,
…
,
K
C
N
i, and distributes a session key K
C
N
i to the ith cluster node. It then stores the cluster node identity P
C
N
i and the K
C
N
i in the key list K
lis
t
C
N
i:(6)
K
lis
t
C
N
i
=
P
C
N
i
,
K
C
N
i
.The base station sends the parameters (SP
1
C
N
i, SP
2
C
N
i, P
C
N
i, K
C
N
i) to the cluster node.


### 3.2. Location-Based Routing Determination Phase

#### 3.2.1. The Starting Cluster Node Process

After the sensors are deployed, we must start the cluster node and get the path routing. In Figure3, we authenticate the cluster node to confirm the legality of the cluster node. Next, the cluster node can rely on the location-based routing to find the best routing path.Figure 3
The overview of the starting cluster node.Step 1.
First, the base station selects a random numberr
1 and broadcasts the message Ms
g
start
,
r
1 to the sensor network.Step 2.
When the cluster nodeC
N
i receives the message, it can select a random number r
2 and compute the message authentication code with key K
C
N
i:(7)
MA
C
C
N
i
=
H
K
C
N
i
r
1
′
r
2
Ms
g
start
.The cluster nodeC
N
i then sends the message P
C
N
i
,
r
2
,
MA
C
C
N
i to the base station.Step 3.
Upon receiving the message, the base station can use identityP
C
N
i to find key K
C
N
i from the K
lis
t
C
N
i:(8)
K
lis
t
C
N
i
=
P
C
N
i
,
K
C
N
i
.It then computes the message authentication codeMA
C
C
N
i
′
(9)
MA
C
C
N
i
′
=
H
K
C
N
i
r
1
r
2
′
Ms
g
startand checks if it is equal to MA
C
C
N
i:(10)
MA
C
C
N
i
=
?
MA
C
C
N
i
′
.


### 3.3. Location-Based Routing Phase

The cluster nodes can establish the best route on the basis of receiving the broadcast location message in a monitoring area.Step 1.
After the initialization phase, the sensor nodes and cluster nodes store the operating parameters and then distribute the associated messages within their monitoring environment.Step 2.
The base station broadcasts the starting messageMs
g
start to the cluster nodes.Step 3.
Upon receiving the starting message, the cluster node (equipped with a GPS receiver) broadcasts the messageMs
g
location concerning its location to the neighbor cluster nodes.Step 4.
After receiving the messageMs
g
location, the cluster nodes know the location of the source of the neighboring cluster such that it can transmit the monitoring data to the cluster node which is the nearest node to the base station.For example, in Figure4, cluster nodes R
1, R
2, R
3, R
4, R
5, R
6, R
7, and R
8 can receive the nearest distance message to the base station from the neighbor cluster nodes R
1, R
2, R
3, R
4, R
5, R
6, R
7, R
8, and R
9. It can compare the received location messages to select the nearest node from the base station and establish the multihop routing path to the cluster node R
1. The cluster node R
1 will be used to relay communications to the base station, so the best path of the cluster node R
5 will be established as follows: R
5
→
R
1
→
BS. On the basis of the shortest distance between the cluster node and the base station, each cluster node will establish the best routing path.Figure 4
Each cluster node broadcasts its location to its neighbor cluster nodes.In Figure5, the cluster node R
9 can determine that the neighbor cluster node on the best path is R
5, and the cluster node R
5 can determine the R
1 and BS, respectively. The best path for the cluster node R
9 can be established as follows: R
9
→
R
5
→
R
1
→
BS. In the same way, the cluster node R
3 can determine the best path: R
3
→
R
2
→
R
1
→
BS. Every pair of nodes along the resulting multihop path can establish a pairwise key for encrypted communication in such a way that each intermediate node can relay data towards the base station in a totally secure way. Location awareness also increases the probability that the geographically closest node pairs establish a pairwise session key along the best path to the BS, with the effect of saving energy on all the nodes involved in multihop routing.Figure 5
Establishing the best routing overview.


### 3.4. The Authentication Phase of the Cluster Node and the Sensor Node

The base station sends the broadcast messageMs
g
start to the cluster nodes; when the cluster node receives the message, it will broadcast the request message Ms
g
req to find the neighboring sensor node to join the group. The overview of the authentication phase of the cluster node and the sensor node is shown in Figure 6.Figure 6
The overview of the authentication phase of the cluster node and the sensor node.Step 1.
When the cluster nodeC
N
i receives the starting message Ms
g
start, the cluster node C
N
i selects a nonce n
1 and sends P
C
N
i
,
n
1
,
Ms
g
req to the neighboring sensor nodes.Step 2.
Upon receiving the message, the sensor nodeS
N
i selects a nonce n
2 and uses n
1
n
2
Ms
g
rep to compute the message authentication code MA
C
1:(11)
MA
C
1
=
H
K
S
N
i
n
1
′
n
2
Ms
g
rep
.The sensor nodeS
N
i sends P
S
N
i
,
n
2
,
Ms
g
rep
,
MA
C
1 to the ith cluster node C
N
i.Step 3.
The cluster nodeC
N
i adds the sensor node’s identity P
S
N
i into the identity list SNI
D
list:(12)
SNI
D
list
=
P
S
N
1
,
P
S
N
2
,
…
,
P
S
N
i
.It then sends the cluster node’s identity and the sensor node’s identity listSNI
D
list to the base station. If the cluster node is the nearest base station, then it directly enters into Section 3.4, the Authentication Phase of the Base Station and the Cluster Node. Otherwise, the cluster node needs to transmit the collected information via the next neighboring cluster node and enters into Section 3.5, the Authentication Phase of the Cluster Node and the Cluster Node.After the authentication and obtaining the session key of the sensor node, the cluster nodeC
N
i computes the message authentication code MA
C
1
′ and checks if it is equal to MA
C
1 or not:(13)
MA
C
1
′
=
H
K
S
N
i
n
1
n
2
′
Ms
g
rep
MA
C
1
′
=
?
MA
C
1
.Then the cluster nodeC
N
i selects a random integer number α, computes the new parameter α
P
C
N
i
,
α
P
S
N
i, and updates into P
C
N
i
,
P
S
N
i, respectively:(14)
P
C
N
i
=
α
P
C
N
i
P
S
N
i
=
α
P
S
N
i
.The cluster nodeC
N
i uses the session key to encrypt the new parameter P
S
N
i of the sensor node S
N
i:(15)
C
1
=
E
K
S
N
i
P
S
N
i
.The cluster nodeC
N
i randomly selects a nonce n
3 and computes the message authentication code MA
C
2:(16)
MA
C
2
=
H
K
S
N
i
n
3
n
2
′
C
1
.Then the cluster nodeC
N
i sends the message (P
C
N
i, C
1, n
3, MA
C
2) to the sensor nodes.Step 4.
The sensor nodeS
N
i computes the message authentication code MA
C
2
′ and checks if it is equal to MA
C
2:(17)
MA
C
2
′
=
H
K
S
N
i
n
3
′
n
2
C
1
′
MA
C
2
′
=
?
MA
C
2
.After authentication, the sensor nodeS
N
i decrypts the encrypted message C
1:(18)
P
S
N
i
′
=
D
K
S
N
i
C
1
.Then the sensor node updates parameterP
S
N
i:(19)
P
S
N
i
=
P
S
N
i
′
.


### 3.5. The Authentication Phase of the Base Station and the Cluster Node

In this phase, the cluster node sends the message to the base station to find the corresponding sensor node’s session key. The overview of the authentication phase of the base station and the cluster node is shown in Figure7.Figure 7
The overview of the authentication phase of the base station and the cluster node.Step 1.
First, the cluster nodeC
N
i collects the sensor nodes identity P
S
N
i into the identity list SNI
D
list:(20)
SNI
D
list
=
P
S
N
1
,
P
S
N
2
,
…
,
P
S
N
i
.Then the cluster nodeC
N
i uses the pairing function to compute the pairing session key K
C
N
i
-
BS:(21)
K
C
N
i
-
BS
=
e
SP
2
C
N
i
,
P
BS
.It computes the message authentication codeMA
C
C
N
i
-
BS:(22)
MA
C
C
N
i
-
BS
=
H
K
CN
-
BS
P
C
N
i
n
C
N
i
SNI
D
list
.Then the cluster nodeC
N
i sends the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS to the base station.Step 2.
After receiving, the base station uses the pairing function to compute the pairing session keyK
BS
-
C
N
i:(23)
K
BS
-
C
N
i
=
e
r
P
BS
,
P
C
N
i
.The base station computes the message authentication codeMA
C
C
N
i
-
BS
′:(24)
MA
C
C
N
i
-
BS
′
=
H
K
BS
-
C
N
i
P
C
N
i
′
n
C
N
i
′
SNI
D
list
′
.It checks if it is equal toMA
C
C
N
i
-
BS:(25)
MA
C
C
N
i
-
BS
′
=
?
MA
C
C
N
i
-
BS
.After authentication, the base station uses the identity listSNI
D
list to find the corresponding session key K
S
N
i, makes the key list K
lis
t
S
N
i, and enters it into SN
K
C
N
i:(26)
K
lis
t
S
N
i
=
P
S
N
i
,
K
S
N
i
SN
K
C
N
i
=
K
lis
t
S
N
1
,
K
lis
t
S
N
2
,
…
,
K
lis
t
S
N
i
.The base station randomly selects a noncen
BS and computes the message authentication code MA
C
BS
-
C
N
i:(27)
MA
C
BS
-
C
N
i
=
H
K
BS
-
C
N
i
n
BS
n
C
N
i
′
P
BS
.Then, the base station uses the pairing session key to encrypt the sensor node’s session key listSN
K
C
N
i:(28)
C
2
=
E
K
BS
-
C
N
i
SN
K
C
N
i
.The base station sends the message (P
BS, n
BS, C
2, MA
C
BS
-
C
N
i) to the corresponding cluster node C
N
i.Step 3.
When the cluster nodeC
N
i receives the message, it computes the message authentication code MA
C
BS
-
C
N
i
′:(29)
MA
C
BS
-
C
N
i
′
=
H
K
C
N
i
-
BS
n
BS
′
n
C
N
i
P
BS
′
.It checks if it is equal toMA
C
BS
-
C
N
i:(30)
MA
C
BS
-
C
N
i
′
=
?
MA
C
BS
-
C
N
i
.Then, the cluster nodeC
N
i decrypts the encrypted message C
2:(31)
SN
K
C
N
i
=
D
K
C
N
i
-
BS
C
2
.In this phase, the cluster nodeC
N
i obtains the sensor node’s session key K
S
N
i and finishes the mutual authentication with the base station.


### 3.6. The Authentication Phase of theith Cluster Node and the jth Cluster Node

When the cluster cannot directly transmit the message to the base station, it will enter into this phase. The overview of the authentication of the cluster node and the cluster node is shown in Figure8.Figure 8
The overview of the authentication phase of theith cluster node and the jth cluster node.Step 1.
The cluster nodeC
N
i computes the pairing session key K
C
N
i
-
C
N
j and randomly selects a nonce n
1 to compute the message authentication code MA
C
C
N
i
-
C
N
j:(32)
K
C
N
i
-
C
N
j
=
e
SP
2
C
N
i
,
P
C
N
j
MA
C
C
N
i
-
C
N
j
=
H
K
C
N
i
-
C
N
j
P
C
N
i
n
1
Ms
g
collect
.Then, the cluster nodeC
N
i sends the message P
C
N
i
,
n
1
,
Ms
g
collect
,
MA
C
C
N
i
-
C
N
j to the cluster node C
N
j.Step 2.
When receiving the message, the cluster nodeC
N
j computes the pairing session key K
C
N
j
-
C
N
i:(33)
K
C
N
j
-
C
N
i
=
e
SP
2
C
N
j
,
P
C
N
i
.Then, the cluster nodeC
N
j uses the pairing session key K
C
N
j
-
C
N
i to compute the message authentication code MA
C
C
N
i
-
C
N
j
′ and checks if it is equal to MA
C
C
N
i
-
C
N
j:(34)
MA
C
C
N
i
-
C
N
j
′
=
H
K
C
N
j
-
C
N
i
P
C
N
i
′
n
1
′
Ms
g
collect
′
MA
C
C
N
i
-
C
N
j
′
=
?
MA
C
C
N
i
-
C
N
j
.The cluster nodeC
N
j randomly selects a nonce n
2 and computes the message authentication code MA
C
C
N
j
-
C
N
i:(35)
MA
C
C
N
j
-
C
N
i
=
H
K
C
N
j
-
C
N
i
P
C
N
j
n
1
′
n
2
.The cluster nodeC
N
j sends the message P
C
N
j
,
n
2
,
MA
C
C
N
j
-
C
N
i to the cluster node C
N
i.Step 3.
After receiving the message (P
C
N
j, n
2, MA
C
C
N
j
-
C
N
i) the cluster node C
N
i computes the message authentication code MA
C
C
N
j
-
C
N
i
′ and checks if it is equal to MA
C
C
N
j
-
C
N
i as follows:(36)
MA
C
C
N
j
-
C
N
i
′
=
H
K
C
N
i
-
C
N
j
P
C
N
j
′
n
1
n
2
′
MA
C
C
N
j
-
C
N
i
′
=
?
MA
C
C
N
j
-
C
N
i
.


## 3.1. Initialization Phase

In this phase, the base station computes the parameters to predistribute into the sensor nodes and the cluster node. The overview of the initialization phase is shown in Figure2.Figure 2
The overview of the initialization.Step 1.
First, the base station selects a random numberx and computes the sensor node identity P
S
N
i:(1)
P
S
N
i
=
H
x
.Then, the base station randomly selects a secret parameters and uses the secret parameter s and sensor node identity P
S
N
i to compute the secret parameter SP
1
S
N
i:(2)
SP
1
S
N
i
=
s
P
S
N
i
.The base station randomly computes a key poolK
P
1, where K
P
1
=
K
S
N
1
,
K
S
N
2
,
…
,
K
S
N
i, and distributes a session key K
S
N
i to the ith sensor node. It then stores the sensor node identity P
S
N
i and the K
S
N
i in the key list K
lis
t
S
N
i:(3)
K
lis
t
S
N
i
=
P
S
N
i
,
K
S
N
i
.After that, the base station sends the parameters (SP
1
S
N
i, P
S
N
i, K
S
N
i) to the corresponding sensor node.Step 2.
The base station selects a random numbery and computes the cluster node identity P
C
N
i:(4)
P
C
N
i
=
H
y
.Then the base station randomly selects a secret parameterr and uses the random secret parameters s
,
r to compute the secret parameters (SP
1
C
N
i
,
SP
2
C
N
i), respectively:(5)
SP
1
C
N
i
=
s
P
C
N
i
SP
2
C
N
i
=
r
P
C
N
i
.The base station randomly computes a key poolK
P
2, where K
P
2
=
K
C
N
1
,
K
C
N
2
,
…
,
K
C
N
i, and distributes a session key K
C
N
i to the ith cluster node. It then stores the cluster node identity P
C
N
i and the K
C
N
i in the key list K
lis
t
C
N
i:(6)
K
lis
t
C
N
i
=
P
C
N
i
,
K
C
N
i
.The base station sends the parameters (SP
1
C
N
i, SP
2
C
N
i, P
C
N
i, K
C
N
i) to the cluster node.


## 3.2. Location-Based Routing Determination Phase

### 3.2.1. The Starting Cluster Node Process

After the sensors are deployed, we must start the cluster node and get the path routing. In Figure3, we authenticate the cluster node to confirm the legality of the cluster node. Next, the cluster node can rely on the location-based routing to find the best routing path.Figure 3
The overview of the starting cluster node.Step 1.
First, the base station selects a random numberr
1 and broadcasts the message Ms
g
start
,
r
1 to the sensor network.Step 2.
When the cluster nodeC
N
i receives the message, it can select a random number r
2 and compute the message authentication code with key K
C
N
i:(7)
MA
C
C
N
i
=
H
K
C
N
i
r
1
′
r
2
Ms
g
start
.The cluster nodeC
N
i then sends the message P
C
N
i
,
r
2
,
MA
C
C
N
i to the base station.Step 3.
Upon receiving the message, the base station can use identityP
C
N
i to find key K
C
N
i from the K
lis
t
C
N
i:(8)
K
lis
t
C
N
i
=
P
C
N
i
,
K
C
N
i
.It then computes the message authentication codeMA
C
C
N
i
′
(9)
MA
C
C
N
i
′
=
H
K
C
N
i
r
1
r
2
′
Ms
g
startand checks if it is equal to MA
C
C
N
i:(10)
MA
C
C
N
i
=
?
MA
C
C
N
i
′
.


## 3.2.1. The Starting Cluster Node Process

After the sensors are deployed, we must start the cluster node and get the path routing. In Figure3, we authenticate the cluster node to confirm the legality of the cluster node. Next, the cluster node can rely on the location-based routing to find the best routing path.Figure 3
The overview of the starting cluster node.Step 1.
First, the base station selects a random numberr
1 and broadcasts the message Ms
g
start
,
r
1 to the sensor network.Step 2.
When the cluster nodeC
N
i receives the message, it can select a random number r
2 and compute the message authentication code with key K
C
N
i:(7)
MA
C
C
N
i
=
H
K
C
N
i
r
1
′
r
2
Ms
g
start
.The cluster nodeC
N
i then sends the message P
C
N
i
,
r
2
,
MA
C
C
N
i to the base station.Step 3.
Upon receiving the message, the base station can use identityP
C
N
i to find key K
C
N
i from the K
lis
t
C
N
i:(8)
K
lis
t
C
N
i
=
P
C
N
i
,
K
C
N
i
.It then computes the message authentication codeMA
C
C
N
i
′
(9)
MA
C
C
N
i
′
=
H
K
C
N
i
r
1
r
2
′
Ms
g
startand checks if it is equal to MA
C
C
N
i:(10)
MA
C
C
N
i
=
?
MA
C
C
N
i
′
.


## 3.3. Location-Based Routing Phase

The cluster nodes can establish the best route on the basis of receiving the broadcast location message in a monitoring area.Step 1.
After the initialization phase, the sensor nodes and cluster nodes store the operating parameters and then distribute the associated messages within their monitoring environment.Step 2.
The base station broadcasts the starting messageMs
g
start to the cluster nodes.Step 3.
Upon receiving the starting message, the cluster node (equipped with a GPS receiver) broadcasts the messageMs
g
location concerning its location to the neighbor cluster nodes.Step 4.
After receiving the messageMs
g
location, the cluster nodes know the location of the source of the neighboring cluster such that it can transmit the monitoring data to the cluster node which is the nearest node to the base station.For example, in Figure4, cluster nodes R
1, R
2, R
3, R
4, R
5, R
6, R
7, and R
8 can receive the nearest distance message to the base station from the neighbor cluster nodes R
1, R
2, R
3, R
4, R
5, R
6, R
7, R
8, and R
9. It can compare the received location messages to select the nearest node from the base station and establish the multihop routing path to the cluster node R
1. The cluster node R
1 will be used to relay communications to the base station, so the best path of the cluster node R
5 will be established as follows: R
5
→
R
1
→
BS. On the basis of the shortest distance between the cluster node and the base station, each cluster node will establish the best routing path.Figure 4
Each cluster node broadcasts its location to its neighbor cluster nodes.In Figure5, the cluster node R
9 can determine that the neighbor cluster node on the best path is R
5, and the cluster node R
5 can determine the R
1 and BS, respectively. The best path for the cluster node R
9 can be established as follows: R
9
→
R
5
→
R
1
→
BS. In the same way, the cluster node R
3 can determine the best path: R
3
→
R
2
→
R
1
→
BS. Every pair of nodes along the resulting multihop path can establish a pairwise key for encrypted communication in such a way that each intermediate node can relay data towards the base station in a totally secure way. Location awareness also increases the probability that the geographically closest node pairs establish a pairwise session key along the best path to the BS, with the effect of saving energy on all the nodes involved in multihop routing.Figure 5
Establishing the best routing overview.


## 3.4. The Authentication Phase of the Cluster Node and the Sensor Node

The base station sends the broadcast messageMs
g
start to the cluster nodes; when the cluster node receives the message, it will broadcast the request message Ms
g
req to find the neighboring sensor node to join the group. The overview of the authentication phase of the cluster node and the sensor node is shown in Figure 6.Figure 6
The overview of the authentication phase of the cluster node and the sensor node.Step 1.
When the cluster nodeC
N
i receives the starting message Ms
g
start, the cluster node C
N
i selects a nonce n
1 and sends P
C
N
i
,
n
1
,
Ms
g
req to the neighboring sensor nodes.Step 2.
Upon receiving the message, the sensor nodeS
N
i selects a nonce n
2 and uses n
1
n
2
Ms
g
rep to compute the message authentication code MA
C
1:(11)
MA
C
1
=
H
K
S
N
i
n
1
′
n
2
Ms
g
rep
.The sensor nodeS
N
i sends P
S
N
i
,
n
2
,
Ms
g
rep
,
MA
C
1 to the ith cluster node C
N
i.Step 3.
The cluster nodeC
N
i adds the sensor node’s identity P
S
N
i into the identity list SNI
D
list:(12)
SNI
D
list
=
P
S
N
1
,
P
S
N
2
,
…
,
P
S
N
i
.It then sends the cluster node’s identity and the sensor node’s identity listSNI
D
list to the base station. If the cluster node is the nearest base station, then it directly enters into Section 3.4, the Authentication Phase of the Base Station and the Cluster Node. Otherwise, the cluster node needs to transmit the collected information via the next neighboring cluster node and enters into Section 3.5, the Authentication Phase of the Cluster Node and the Cluster Node.After the authentication and obtaining the session key of the sensor node, the cluster nodeC
N
i computes the message authentication code MA
C
1
′ and checks if it is equal to MA
C
1 or not:(13)
MA
C
1
′
=
H
K
S
N
i
n
1
n
2
′
Ms
g
rep
MA
C
1
′
=
?
MA
C
1
.Then the cluster nodeC
N
i selects a random integer number α, computes the new parameter α
P
C
N
i
,
α
P
S
N
i, and updates into P
C
N
i
,
P
S
N
i, respectively:(14)
P
C
N
i
=
α
P
C
N
i
P
S
N
i
=
α
P
S
N
i
.The cluster nodeC
N
i uses the session key to encrypt the new parameter P
S
N
i of the sensor node S
N
i:(15)
C
1
=
E
K
S
N
i
P
S
N
i
.The cluster nodeC
N
i randomly selects a nonce n
3 and computes the message authentication code MA
C
2:(16)
MA
C
2
=
H
K
S
N
i
n
3
n
2
′
C
1
.Then the cluster nodeC
N
i sends the message (P
C
N
i, C
1, n
3, MA
C
2) to the sensor nodes.Step 4.
The sensor nodeS
N
i computes the message authentication code MA
C
2
′ and checks if it is equal to MA
C
2:(17)
MA
C
2
′
=
H
K
S
N
i
n
3
′
n
2
C
1
′
MA
C
2
′
=
?
MA
C
2
.After authentication, the sensor nodeS
N
i decrypts the encrypted message C
1:(18)
P
S
N
i
′
=
D
K
S
N
i
C
1
.Then the sensor node updates parameterP
S
N
i:(19)
P
S
N
i
=
P
S
N
i
′
.


## 3.5. The Authentication Phase of the Base Station and the Cluster Node

In this phase, the cluster node sends the message to the base station to find the corresponding sensor node’s session key. The overview of the authentication phase of the base station and the cluster node is shown in Figure7.Figure 7
The overview of the authentication phase of the base station and the cluster node.Step 1.
First, the cluster nodeC
N
i collects the sensor nodes identity P
S
N
i into the identity list SNI
D
list:(20)
SNI
D
list
=
P
S
N
1
,
P
S
N
2
,
…
,
P
S
N
i
.Then the cluster nodeC
N
i uses the pairing function to compute the pairing session key K
C
N
i
-
BS:(21)
K
C
N
i
-
BS
=
e
SP
2
C
N
i
,
P
BS
.It computes the message authentication codeMA
C
C
N
i
-
BS:(22)
MA
C
C
N
i
-
BS
=
H
K
CN
-
BS
P
C
N
i
n
C
N
i
SNI
D
list
.Then the cluster nodeC
N
i sends the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS to the base station.Step 2.
After receiving, the base station uses the pairing function to compute the pairing session keyK
BS
-
C
N
i:(23)
K
BS
-
C
N
i
=
e
r
P
BS
,
P
C
N
i
.The base station computes the message authentication codeMA
C
C
N
i
-
BS
′:(24)
MA
C
C
N
i
-
BS
′
=
H
K
BS
-
C
N
i
P
C
N
i
′
n
C
N
i
′
SNI
D
list
′
.It checks if it is equal toMA
C
C
N
i
-
BS:(25)
MA
C
C
N
i
-
BS
′
=
?
MA
C
C
N
i
-
BS
.After authentication, the base station uses the identity listSNI
D
list to find the corresponding session key K
S
N
i, makes the key list K
lis
t
S
N
i, and enters it into SN
K
C
N
i:(26)
K
lis
t
S
N
i
=
P
S
N
i
,
K
S
N
i
SN
K
C
N
i
=
K
lis
t
S
N
1
,
K
lis
t
S
N
2
,
…
,
K
lis
t
S
N
i
.The base station randomly selects a noncen
BS and computes the message authentication code MA
C
BS
-
C
N
i:(27)
MA
C
BS
-
C
N
i
=
H
K
BS
-
C
N
i
n
BS
n
C
N
i
′
P
BS
.Then, the base station uses the pairing session key to encrypt the sensor node’s session key listSN
K
C
N
i:(28)
C
2
=
E
K
BS
-
C
N
i
SN
K
C
N
i
.The base station sends the message (P
BS, n
BS, C
2, MA
C
BS
-
C
N
i) to the corresponding cluster node C
N
i.Step 3.
When the cluster nodeC
N
i receives the message, it computes the message authentication code MA
C
BS
-
C
N
i
′:(29)
MA
C
BS
-
C
N
i
′
=
H
K
C
N
i
-
BS
n
BS
′
n
C
N
i
P
BS
′
.It checks if it is equal toMA
C
BS
-
C
N
i:(30)
MA
C
BS
-
C
N
i
′
=
?
MA
C
BS
-
C
N
i
.Then, the cluster nodeC
N
i decrypts the encrypted message C
2:(31)
SN
K
C
N
i
=
D
K
C
N
i
-
BS
C
2
.In this phase, the cluster nodeC
N
i obtains the sensor node’s session key K
S
N
i and finishes the mutual authentication with the base station.


## 3.6. The Authentication Phase of theith Cluster Node and the jth Cluster Node

When the cluster cannot directly transmit the message to the base station, it will enter into this phase. The overview of the authentication of the cluster node and the cluster node is shown in Figure8.Figure 8
The overview of the authentication phase of theith cluster node and the jth cluster node.Step 1.
The cluster nodeC
N
i computes the pairing session key K
C
N
i
-
C
N
j and randomly selects a nonce n
1 to compute the message authentication code MA
C
C
N
i
-
C
N
j:(32)
K
C
N
i
-
C
N
j
=
e
SP
2
C
N
i
,
P
C
N
j
MA
C
C
N
i
-
C
N
j
=
H
K
C
N
i
-
C
N
j
P
C
N
i
n
1
Ms
g
collect
.Then, the cluster nodeC
N
i sends the message P
C
N
i
,
n
1
,
Ms
g
collect
,
MA
C
C
N
i
-
C
N
j to the cluster node C
N
j.Step 2.
When receiving the message, the cluster nodeC
N
j computes the pairing session key K
C
N
j
-
C
N
i:(33)
K
C
N
j
-
C
N
i
=
e
SP
2
C
N
j
,
P
C
N
i
.Then, the cluster nodeC
N
j uses the pairing session key K
C
N
j
-
C
N
i to compute the message authentication code MA
C
C
N
i
-
C
N
j
′ and checks if it is equal to MA
C
C
N
i
-
C
N
j:(34)
MA
C
C
N
i
-
C
N
j
′
=
H
K
C
N
j
-
C
N
i
P
C
N
i
′
n
1
′
Ms
g
collect
′
MA
C
C
N
i
-
C
N
j
′
=
?
MA
C
C
N
i
-
C
N
j
.The cluster nodeC
N
j randomly selects a nonce n
2 and computes the message authentication code MA
C
C
N
j
-
C
N
i:(35)
MA
C
C
N
j
-
C
N
i
=
H
K
C
N
j
-
C
N
i
P
C
N
j
n
1
′
n
2
.The cluster nodeC
N
j sends the message P
C
N
j
,
n
2
,
MA
C
C
N
j
-
C
N
i to the cluster node C
N
i.Step 3.
After receiving the message (P
C
N
j, n
2, MA
C
C
N
j
-
C
N
i) the cluster node C
N
i computes the message authentication code MA
C
C
N
j
-
C
N
i
′ and checks if it is equal to MA
C
C
N
j
-
C
N
i as follows:(36)
MA
C
C
N
j
-
C
N
i
′
=
H
K
C
N
i
-
C
N
j
P
C
N
j
′
n
1
n
2
′
MA
C
C
N
j
-
C
N
i
′
=
?
MA
C
C
N
j
-
C
N
i
.


## 4. Security Analysis

### 4.1. Mutual Authentication

#### 4.1.1. The Authentication between the Cluster Node and the Sensor Node

(1) The Cluster Node Authenticates Sensor Node. In the authentication phase of the cluster node and the sensor node, when the sensor node S
N
i receives the message P
C
N
i
,
n
1
,
Ms
g
req
,
Ms
g
location, the sensor node S
N
i selects a nonce n
2 and uses n
1
n
2
Ms
g
rep to compute the message authentication code MA
C
1:(37)
MA
C
1
=
H
K
S
N
i
n
1
′
n
2
Ms
g
rep
.After the authentication of the base station and cluster node, the cluster nodeC
N
i obtains the session key of the sensor nodes. The cluster node C
N
i computes the message authentication code MA
C
1
′ and checks if it is equal to MA
C
1:(38)
MA
C
1
′
=
H
K
S
N
i
n
1
n
2
′
Ms
g
rep
MA
C
1
′
=
?
MA
C
1
.
(2) The Sensor Node Authenticates the Cluster Node. The cluster node C
N
i uses the session key to encrypt the new parameter P
S
N
i of the sensor node S
N
i:(39)
C
1
=
E
K
S
N
i
P
S
N
i
.The cluster nodeC
N
i randomly selects a nonce n
3 and computes the message authentication code MA
C
2:(40)
MA
C
2
=
H
K
S
N
i
n
3
n
2
′
C
1
.Then the cluster nodeC
N
i sends the message P
C
N
i
,
C
1
,
n
3
,
MA
C
2 to the sensor nodes.When the sensor nodeS
N
i receives the message, it computes the message authentication code MA
C
2
′ and checks if it is equal to MA
C
2:(41)
MA
C
2
′
=
H
K
S
N
i
n
3
′
n
2
C
1
′
MA
C
2
′
=
?
MA
C
2
.Therefore, our schemes achieve the mutual authentication between the cluster node and sensor node.


#### 4.1.2. The Authentication between theith Cluster Node and the jth Cluster Node

(1) The
j
th Cluster Node Authenticates the
i
th Cluster Node. In the authentication phase of the cluster node and the cluster node, the cluster node C
N
i computes the pairing session key K
C
N
i
-
C
N
j and randomly selects a nonce n
1 to compute the message authentication code MA
C
C
N
i
-
C
N
j as follows:(42)
K
C
N
i
-
C
N
j
=
e
SP
2
C
N
i
,
P
C
N
j
MA
C
C
N
i
-
C
N
j
=
H
K
C
N
i
-
C
N
j
P
C
N
i
n
1
Ms
g
collect
.Then it sends the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j) to the sensor nodes.Upon receiving the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j), the cluster node C
N
i computes the pairing session key K
C
N
j
-
C
N
i:(43)
K
C
N
j
-
C
N
i
=
e
SP
2
C
N
j
,
P
C
N
i
.Then, the cluster nodeC
N
j uses the pairing session key K
C
N
j
-
C
N
i to compute the message authentication code MA
C
C
N
i
-
C
N
j
′ and checks if it is equal to MA
C
C
N
i
-
C
N
j or not:(44)
MA
C
C
N
i
-
C
N
j
′
=
H
K
C
N
j
-
C
N
i
P
C
N
i
′
n
1
′
Ms
g
collect
′
MA
C
C
N
i
-
C
N
j
′
=
?
MA
C
C
N
i
-
C
N
j
.
(2) The
i
th Cluster Node Authenticates the
j
th Cluster Node. Upon receiving the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j), the cluster node C
N
j randomly selects a nonce n
2 and computes the message authentication code MA
C
C
N
j
-
C
N
i:(45)
MA
C
C
N
j
-
C
N
i
=
H
K
C
N
j
-
C
N
i
P
C
N
j
n
1
′
n
2
.Then it sends the message (P
C
N
j, n
2, MA
C
C
N
j
-
C
N
i) to the cluster node C
N
i.When the cluster nodeC
N
i receives the message, it computes the message authentication code MA
C
C
N
j
-
C
N
i
′ and checks if it is equal to MA
C
C
N
j
-
C
N
i:(46)
MA
C
C
N
j
-
C
N
i
′
=
H
K
C
N
i
-
C
N
j
P
C
N
j
′
n
1
n
2
′
MA
C
C
N
j
-
C
N
i
′
=
?
MA
C
C
N
j
-
C
N
i
.Therefore, our scheme achieves mutual authentication among the cluster nodes.


#### 4.1.3. The Authentication between the Base Station and the Cluster Node

(1) The Base Station Authenticates the Cluster Node. In the authentication phase of the base station and the cluster node, when the cluster node C
N
i receives the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS, the cluster node C
N
i uses the pairing function to compute the pairing session key K
C
N
i
-
BS:(47)
K
C
N
i
-
BS
=
e
SP
2
C
N
i
,
P
BS
.It computes the message authentication codeMA
C
C
N
i
-
BS:(48)
MA
C
C
N
i
-
BS
=
H
K
CN
-
BS
P
C
N
i
n
C
N
i
SNI
D
list
.Then it sends the messageP
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS to the base station.When the base station receives the message, the base station uses the pairing function to compute the pairing session keyK
BS
-
C
N
i:(49)
K
BS
-
C
N
i
=
e
r
P
BS
,
P
C
N
i
.The base station computes the message authentication codeMA
C
C
N
i
-
BS
′:(50)
MA
C
C
N
i
-
BS
′
=
H
K
BS
-
C
N
i
P
C
N
i
′
n
C
N
i
′
SNI
D
list
′
.It checks if it is equal toMA
C
C
N
i
-
BS:(51)
MA
C
C
N
i
-
BS
′
=
?
MA
C
C
N
i
-
BS
.
(2) The Cluster Node Authenticates the Base Station. When the base station receives the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS, the base station randomly selects a nonce n
BS and computes the message authentication code MA
C
BS
-
C
N
i:(52)
MA
C
BS
-
C
N
i
=
H
K
BS
-
C
N
i
n
BS
n
C
N
i
′
P
BS
.Then it sends the messageP
BS
,
n
BS
,
C
2
,
MA
C
BS
-
C
N
i to the base station.Then, the cluster nodeC
N
i receives the message and computes the message authentication code MA
C
BS
-
C
N
i
′:(53)
MA
C
BS
-
C
N
i
′
=
H
K
C
N
i
-
BS
n
BS
′
n
C
N
i
P
BS
′
.It checks if it is equal toMA
C
BS
-
C
N
i:(54)
MA
C
BS
-
C
N
i
′
=
?
MA
C
BS
-
C
N
i
.Therefore, we complete the mutual authentication.


### 4.2. Dynamic Key Management

Our scheme offers random pairwise keys predistribution. After completing the information transmission, the cluster nodes and the sensor nodes update the session key for each session. It can prevent the replay attack. We divide it into two parts to analyze this process: the cluster node to sensor node and the cluster node to cluster node.(1) The Cluster Node to Sensor Node. For example, if the sensor node S
N
i wants to communicate with the cluster node C
N
i, it computes the dynamic key K
S
N
i
-
C
N
i:(55)
K
S
N
i
-
C
N
i
=
e
S
P
S
N
i
,
P
C
N
i
′
.Then, it encrypts the collected data with the keyK
S
N
i
-
C
N
i and sends the encrypted message E
K
S
N
i
-
C
N
i
M to the cluster node C
N
i.Upon receiving the message, the cluster nodeC
N
i computes the session key K
C
N
i
-
S
N
i:(56)
K
C
N
i
-
S
N
i
=
e
S
P
C
N
i
,
P
S
N
i
′
.Then, it decrypts the messageE
K
S
N
i
-
C
N
i
M and gets the collected data.After the transaction, the cluster node computes a new integer parameterα
new to update the identity of the cluster node and sensor nodes:(57)
P
C
N
i
=
α
new
P
C
N
i
P
S
N
i
=
α
new
P
S
N
i
.So, our scheme updates a new session key in each section.(2) The Base Station to Cluster Nodes. If the base station wants to update the session key, it can compute a new integer r
new to generate a new secret parameter SP
2
C
N
i
new:(58)
SP
2
C
N
i
new
=
r
new
P
C
N
i
.Then, it encrypts the new secret parameterSP
2
C
N
i
new with key K
BS
-
C
N
i
=
e
r
P
BS
,
P
C
N
i and sends to the corresponding cluster node C
N
i. This mechanism can prevent the cluster node be captured. If a perceptible attacker gets the cluster node and intercepts the secret parameters in the sensor network, we can change the secret parameter via the base station.


### 4.3. Providing Session Key Protection (Elliptic Curve Discrete Logarithm Problem)

The security of our scheme relies on the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP) concerning bilinear groups. We compute parameterS
P
S
N
i; given the point S
P
S
N
i
=
s
P
S
N
i, it is difficult to obtain the secret parameter s by giving the secret parameter S
P
S
N
i and the P
S
N
i. If an attacker steals the transferred traffic information, the attacker cannot crack the session key to decrypt the ciphertext.


### 4.4. Impersonation Attack

In the impersonation attack, if the attacker tries to steal the information between the sensors’ communications, our scheme can defend against the information being used to conduct falsification, modification, replacement, and retransmission. In order to prevent the impersonation attack, the session key is generated by using mutual authentication. In the mutual authentication phase, we useH
K
C
N
i
-
C
N
j
· and a one-way hash function with key K
C
N
i
-
C
N
j to implement message authentication; the key is difficult to crack and calculate. The related information is shown as follows:(59)
K
C
N
i
-
C
N
j
=
e
SP
2
C
N
i
,
P
C
N
j
MA
C
C
N
i
-
C
N
j
=
H
K
C
N
i
-
C
N
j
P
2
PUBC
N
j
n
1
Ms
g
collect
.So, the attacker cannot accomplish the impersonation attack.


### 4.5. Replay Attack

For the reply attack, we use dynamic key management to update the session key in each transaction, and we change the message authentication code in each section as follows. If an attacker tries to steal information to resend the same information to the target sensor node, it is impossible to pass the authentication.For example, in each section, the sensor node usesn
1
new, n
2
new, and Ms
g
rep to compute the new message authentication code MA
C
1
new; the cluster node uses n
3
new, n
2
new, and C
1 to compute a new message authentication code MA
C
2
new:(60)
MA
C
1
new
=
H
K
S
N
i
n
1
new
n
2
new
Ms
g
rep
MA
C
2
new
=
H
K
S
N
i
n
3
new
n
2
new
C
1
.If the attacker uses the message authentication code, the verifiers can verify the legality as follows:(61)
MA
C
1
=
?
MA
C
1
new
MA
C
2
=
?
MA
C
2
new
.Therefore, the attacker cannot successfully achieve the replay attack.


### 4.6. Wormhole Attack

In a wormhole attack, an attacker records a packet in one location of the network and sends it to another location, creating a tunnel between the attacker’s nodes. The packet is retransmitted to the network under the attacker’s control [24, 25]. In the location-based routing determination phase of our scheme, the cluster nodes can establish the best route on the basis of the received broadcast location message in a monitoring area.In Figure9, if an attacker deploys a malicious cluster node A, it can collect the message from the sensor nodes S
4, S
5, S
7 and successfully intercept the messages. But, in our schemes, we involve the starting cluster node process in the location-based routing determination phase to build the communication connections initially. Afterward, we also involve the mutual authentication between the cluster nodes and sensor nodes. So, the attacker cannot successfully complete the wormhole attack.Figure 9
The scenario of the wormhole attack.


### 4.7. Message Manipulation Attack

In a message manipulation attack, an attacker may drop, modify, or even forge exchanged messages in order to interrupt the communication process [15].In Figure10, an attacker deploys a malicious cluster node A and forges a fake cluster node; the malicious node A can receive messages from the cluster nodes, and the attacker may drop, modify, or even forge exchanged messages in order to interfere with the normal communication process. If a malicious cluster node A wants to interfere with a path among C
1, C
2, C
4, the cluster node C
4 communicates with the malicious cluster node A, and it cannot pass the mutual authentication successfully, because it is difficult to compute the HMAC’s key. Moreover, the routing path is established in the location-based routing determination phase. It is impossible for an attacker to interfere with the routing path and message.Figure 10
The scenario of the message manipulation attack.


## 4.1. Mutual Authentication

### 4.1.1. The Authentication between the Cluster Node and the Sensor Node

(1) The Cluster Node Authenticates Sensor Node. In the authentication phase of the cluster node and the sensor node, when the sensor node S
N
i receives the message P
C
N
i
,
n
1
,
Ms
g
req
,
Ms
g
location, the sensor node S
N
i selects a nonce n
2 and uses n
1
n
2
Ms
g
rep to compute the message authentication code MA
C
1:(37)
MA
C
1
=
H
K
S
N
i
n
1
′
n
2
Ms
g
rep
.After the authentication of the base station and cluster node, the cluster nodeC
N
i obtains the session key of the sensor nodes. The cluster node C
N
i computes the message authentication code MA
C
1
′ and checks if it is equal to MA
C
1:(38)
MA
C
1
′
=
H
K
S
N
i
n
1
n
2
′
Ms
g
rep
MA
C
1
′
=
?
MA
C
1
.
(2) The Sensor Node Authenticates the Cluster Node. The cluster node C
N
i uses the session key to encrypt the new parameter P
S
N
i of the sensor node S
N
i:(39)
C
1
=
E
K
S
N
i
P
S
N
i
.The cluster nodeC
N
i randomly selects a nonce n
3 and computes the message authentication code MA
C
2:(40)
MA
C
2
=
H
K
S
N
i
n
3
n
2
′
C
1
.Then the cluster nodeC
N
i sends the message P
C
N
i
,
C
1
,
n
3
,
MA
C
2 to the sensor nodes.When the sensor nodeS
N
i receives the message, it computes the message authentication code MA
C
2
′ and checks if it is equal to MA
C
2:(41)
MA
C
2
′
=
H
K
S
N
i
n
3
′
n
2
C
1
′
MA
C
2
′
=
?
MA
C
2
.Therefore, our schemes achieve the mutual authentication between the cluster node and sensor node.


### 4.1.2. The Authentication between theith Cluster Node and the jth Cluster Node

(1) The
j
th Cluster Node Authenticates the
i
th Cluster Node. In the authentication phase of the cluster node and the cluster node, the cluster node C
N
i computes the pairing session key K
C
N
i
-
C
N
j and randomly selects a nonce n
1 to compute the message authentication code MA
C
C
N
i
-
C
N
j as follows:(42)
K
C
N
i
-
C
N
j
=
e
SP
2
C
N
i
,
P
C
N
j
MA
C
C
N
i
-
C
N
j
=
H
K
C
N
i
-
C
N
j
P
C
N
i
n
1
Ms
g
collect
.Then it sends the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j) to the sensor nodes.Upon receiving the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j), the cluster node C
N
i computes the pairing session key K
C
N
j
-
C
N
i:(43)
K
C
N
j
-
C
N
i
=
e
SP
2
C
N
j
,
P
C
N
i
.Then, the cluster nodeC
N
j uses the pairing session key K
C
N
j
-
C
N
i to compute the message authentication code MA
C
C
N
i
-
C
N
j
′ and checks if it is equal to MA
C
C
N
i
-
C
N
j or not:(44)
MA
C
C
N
i
-
C
N
j
′
=
H
K
C
N
j
-
C
N
i
P
C
N
i
′
n
1
′
Ms
g
collect
′
MA
C
C
N
i
-
C
N
j
′
=
?
MA
C
C
N
i
-
C
N
j
.
(2) The
i
th Cluster Node Authenticates the
j
th Cluster Node. Upon receiving the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j), the cluster node C
N
j randomly selects a nonce n
2 and computes the message authentication code MA
C
C
N
j
-
C
N
i:(45)
MA
C
C
N
j
-
C
N
i
=
H
K
C
N
j
-
C
N
i
P
C
N
j
n
1
′
n
2
.Then it sends the message (P
C
N
j, n
2, MA
C
C
N
j
-
C
N
i) to the cluster node C
N
i.When the cluster nodeC
N
i receives the message, it computes the message authentication code MA
C
C
N
j
-
C
N
i
′ and checks if it is equal to MA
C
C
N
j
-
C
N
i:(46)
MA
C
C
N
j
-
C
N
i
′
=
H
K
C
N
i
-
C
N
j
P
C
N
j
′
n
1
n
2
′
MA
C
C
N
j
-
C
N
i
′
=
?
MA
C
C
N
j
-
C
N
i
.Therefore, our scheme achieves mutual authentication among the cluster nodes.


### 4.1.3. The Authentication between the Base Station and the Cluster Node

(1) The Base Station Authenticates the Cluster Node. In the authentication phase of the base station and the cluster node, when the cluster node C
N
i receives the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS, the cluster node C
N
i uses the pairing function to compute the pairing session key K
C
N
i
-
BS:(47)
K
C
N
i
-
BS
=
e
SP
2
C
N
i
,
P
BS
.It computes the message authentication codeMA
C
C
N
i
-
BS:(48)
MA
C
C
N
i
-
BS
=
H
K
CN
-
BS
P
C
N
i
n
C
N
i
SNI
D
list
.Then it sends the messageP
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS to the base station.When the base station receives the message, the base station uses the pairing function to compute the pairing session keyK
BS
-
C
N
i:(49)
K
BS
-
C
N
i
=
e
r
P
BS
,
P
C
N
i
.The base station computes the message authentication codeMA
C
C
N
i
-
BS
′:(50)
MA
C
C
N
i
-
BS
′
=
H
K
BS
-
C
N
i
P
C
N
i
′
n
C
N
i
′
SNI
D
list
′
.It checks if it is equal toMA
C
C
N
i
-
BS:(51)
MA
C
C
N
i
-
BS
′
=
?
MA
C
C
N
i
-
BS
.
(2) The Cluster Node Authenticates the Base Station. When the base station receives the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS, the base station randomly selects a nonce n
BS and computes the message authentication code MA
C
BS
-
C
N
i:(52)
MA
C
BS
-
C
N
i
=
H
K
BS
-
C
N
i
n
BS
n
C
N
i
′
P
BS
.Then it sends the messageP
BS
,
n
BS
,
C
2
,
MA
C
BS
-
C
N
i to the base station.Then, the cluster nodeC
N
i receives the message and computes the message authentication code MA
C
BS
-
C
N
i
′:(53)
MA
C
BS
-
C
N
i
′
=
H
K
C
N
i
-
BS
n
BS
′
n
C
N
i
P
BS
′
.It checks if it is equal toMA
C
BS
-
C
N
i:(54)
MA
C
BS
-
C
N
i
′
=
?
MA
C
BS
-
C
N
i
.Therefore, we complete the mutual authentication.


## 4.1.1. The Authentication between the Cluster Node and the Sensor Node

(1) The Cluster Node Authenticates Sensor Node. In the authentication phase of the cluster node and the sensor node, when the sensor node S
N
i receives the message P
C
N
i
,
n
1
,
Ms
g
req
,
Ms
g
location, the sensor node S
N
i selects a nonce n
2 and uses n
1
n
2
Ms
g
rep to compute the message authentication code MA
C
1:(37)
MA
C
1
=
H
K
S
N
i
n
1
′
n
2
Ms
g
rep
.After the authentication of the base station and cluster node, the cluster nodeC
N
i obtains the session key of the sensor nodes. The cluster node C
N
i computes the message authentication code MA
C
1
′ and checks if it is equal to MA
C
1:(38)
MA
C
1
′
=
H
K
S
N
i
n
1
n
2
′
Ms
g
rep
MA
C
1
′
=
?
MA
C
1
.
(2) The Sensor Node Authenticates the Cluster Node. The cluster node C
N
i uses the session key to encrypt the new parameter P
S
N
i of the sensor node S
N
i:(39)
C
1
=
E
K
S
N
i
P
S
N
i
.The cluster nodeC
N
i randomly selects a nonce n
3 and computes the message authentication code MA
C
2:(40)
MA
C
2
=
H
K
S
N
i
n
3
n
2
′
C
1
.Then the cluster nodeC
N
i sends the message P
C
N
i
,
C
1
,
n
3
,
MA
C
2 to the sensor nodes.When the sensor nodeS
N
i receives the message, it computes the message authentication code MA
C
2
′ and checks if it is equal to MA
C
2:(41)
MA
C
2
′
=
H
K
S
N
i
n
3
′
n
2
C
1
′
MA
C
2
′
=
?
MA
C
2
.Therefore, our schemes achieve the mutual authentication between the cluster node and sensor node.


## 4.1.2. The Authentication between theith Cluster Node and the jth Cluster Node

(1) The
j
th Cluster Node Authenticates the
i
th Cluster Node. In the authentication phase of the cluster node and the cluster node, the cluster node C
N
i computes the pairing session key K
C
N
i
-
C
N
j and randomly selects a nonce n
1 to compute the message authentication code MA
C
C
N
i
-
C
N
j as follows:(42)
K
C
N
i
-
C
N
j
=
e
SP
2
C
N
i
,
P
C
N
j
MA
C
C
N
i
-
C
N
j
=
H
K
C
N
i
-
C
N
j
P
C
N
i
n
1
Ms
g
collect
.Then it sends the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j) to the sensor nodes.Upon receiving the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j), the cluster node C
N
i computes the pairing session key K
C
N
j
-
C
N
i:(43)
K
C
N
j
-
C
N
i
=
e
SP
2
C
N
j
,
P
C
N
i
.Then, the cluster nodeC
N
j uses the pairing session key K
C
N
j
-
C
N
i to compute the message authentication code MA
C
C
N
i
-
C
N
j
′ and checks if it is equal to MA
C
C
N
i
-
C
N
j or not:(44)
MA
C
C
N
i
-
C
N
j
′
=
H
K
C
N
j
-
C
N
i
P
C
N
i
′
n
1
′
Ms
g
collect
′
MA
C
C
N
i
-
C
N
j
′
=
?
MA
C
C
N
i
-
C
N
j
.
(2) The
i
th Cluster Node Authenticates the
j
th Cluster Node. Upon receiving the message (P
C
N
i, n
1, Ms
g
collect, MA
C
C
N
i
-
C
N
j), the cluster node C
N
j randomly selects a nonce n
2 and computes the message authentication code MA
C
C
N
j
-
C
N
i:(45)
MA
C
C
N
j
-
C
N
i
=
H
K
C
N
j
-
C
N
i
P
C
N
j
n
1
′
n
2
.Then it sends the message (P
C
N
j, n
2, MA
C
C
N
j
-
C
N
i) to the cluster node C
N
i.When the cluster nodeC
N
i receives the message, it computes the message authentication code MA
C
C
N
j
-
C
N
i
′ and checks if it is equal to MA
C
C
N
j
-
C
N
i:(46)
MA
C
C
N
j
-
C
N
i
′
=
H
K
C
N
i
-
C
N
j
P
C
N
j
′
n
1
n
2
′
MA
C
C
N
j
-
C
N
i
′
=
?
MA
C
C
N
j
-
C
N
i
.Therefore, our scheme achieves mutual authentication among the cluster nodes.


## 4.1.3. The Authentication between the Base Station and the Cluster Node

(1) The Base Station Authenticates the Cluster Node. In the authentication phase of the base station and the cluster node, when the cluster node C
N
i receives the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS, the cluster node C
N
i uses the pairing function to compute the pairing session key K
C
N
i
-
BS:(47)
K
C
N
i
-
BS
=
e
SP
2
C
N
i
,
P
BS
.It computes the message authentication codeMA
C
C
N
i
-
BS:(48)
MA
C
C
N
i
-
BS
=
H
K
CN
-
BS
P
C
N
i
n
C
N
i
SNI
D
list
.Then it sends the messageP
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS to the base station.When the base station receives the message, the base station uses the pairing function to compute the pairing session keyK
BS
-
C
N
i:(49)
K
BS
-
C
N
i
=
e
r
P
BS
,
P
C
N
i
.The base station computes the message authentication codeMA
C
C
N
i
-
BS
′:(50)
MA
C
C
N
i
-
BS
′
=
H
K
BS
-
C
N
i
P
C
N
i
′
n
C
N
i
′
SNI
D
list
′
.It checks if it is equal toMA
C
C
N
i
-
BS:(51)
MA
C
C
N
i
-
BS
′
=
?
MA
C
C
N
i
-
BS
.
(2) The Cluster Node Authenticates the Base Station. When the base station receives the message P
C
N
i
,
n
C
N
i
,
SNI
D
list
,
MA
C
C
N
i
-
BS, the base station randomly selects a nonce n
BS and computes the message authentication code MA
C
BS
-
C
N
i:(52)
MA
C
BS
-
C
N
i
=
H
K
BS
-
C
N
i
n
BS
n
C
N
i
′
P
BS
.Then it sends the messageP
BS
,
n
BS
,
C
2
,
MA
C
BS
-
C
N
i to the base station.Then, the cluster nodeC
N
i receives the message and computes the message authentication code MA
C
BS
-
C
N
i
′:(53)
MA
C
BS
-
C
N
i
′
=
H
K
C
N
i
-
BS
n
BS
′
n
C
N
i
P
BS
′
.It checks if it is equal toMA
C
BS
-
C
N
i:(54)
MA
C
BS
-
C
N
i
′
=
?
MA
C
BS
-
C
N
i
.Therefore, we complete the mutual authentication.


## 4.2. Dynamic Key Management

Our scheme offers random pairwise keys predistribution. After completing the information transmission, the cluster nodes and the sensor nodes update the session key for each session. It can prevent the replay attack. We divide it into two parts to analyze this process: the cluster node to sensor node and the cluster node to cluster node.(1) The Cluster Node to Sensor Node. For example, if the sensor node S
N
i wants to communicate with the cluster node C
N
i, it computes the dynamic key K
S
N
i
-
C
N
i:(55)
K
S
N
i
-
C
N
i
=
e
S
P
S
N
i
,
P
C
N
i
′
.Then, it encrypts the collected data with the keyK
S
N
i
-
C
N
i and sends the encrypted message E
K
S
N
i
-
C
N
i
M to the cluster node C
N
i.Upon receiving the message, the cluster nodeC
N
i computes the session key K
C
N
i
-
S
N
i:(56)
K
C
N
i
-
S
N
i
=
e
S
P
C
N
i
,
P
S
N
i
′
.Then, it decrypts the messageE
K
S
N
i
-
C
N
i
M and gets the collected data.After the transaction, the cluster node computes a new integer parameterα
new to update the identity of the cluster node and sensor nodes:(57)
P
C
N
i
=
α
new
P
C
N
i
P
S
N
i
=
α
new
P
S
N
i
.So, our scheme updates a new session key in each section.(2) The Base Station to Cluster Nodes. If the base station wants to update the session key, it can compute a new integer r
new to generate a new secret parameter SP
2
C
N
i
new:(58)
SP
2
C
N
i
new
=
r
new
P
C
N
i
.Then, it encrypts the new secret parameterSP
2
C
N
i
new with key K
BS
-
C
N
i
=
e
r
P
BS
,
P
C
N
i and sends to the corresponding cluster node C
N
i. This mechanism can prevent the cluster node be captured. If a perceptible attacker gets the cluster node and intercepts the secret parameters in the sensor network, we can change the secret parameter via the base station.


## 4.3. Providing Session Key Protection (Elliptic Curve Discrete Logarithm Problem)

The security of our scheme relies on the difficulty of the Elliptic Curve Discrete Logarithm Problem (ECDLP) concerning bilinear groups. We compute parameterS
P
S
N
i; given the point S
P
S
N
i
=
s
P
S
N
i, it is difficult to obtain the secret parameter s by giving the secret parameter S
P
S
N
i and the P
S
N
i. If an attacker steals the transferred traffic information, the attacker cannot crack the session key to decrypt the ciphertext.


## 4.4. Impersonation Attack

In the impersonation attack, if the attacker tries to steal the information between the sensors’ communications, our scheme can defend against the information being used to conduct falsification, modification, replacement, and retransmission. In order to prevent the impersonation attack, the session key is generated by using mutual authentication. In the mutual authentication phase, we useH
K
C
N
i
-
C
N
j
· and a one-way hash function with key K
C
N
i
-
C
N
j to implement message authentication; the key is difficult to crack and calculate. The related information is shown as follows:(59)
K
C
N
i
-
C
N
j
=
e
SP
2
C
N
i
,
P
C
N
j
MA
C
C
N
i
-
C
N
j
=
H
K
C
N
i
-
C
N
j
P
2
PUBC
N
j
n
1
Ms
g
collect
.So, the attacker cannot accomplish the impersonation attack.


## 4.5. Replay Attack

For the reply attack, we use dynamic key management to update the session key in each transaction, and we change the message authentication code in each section as follows. If an attacker tries to steal information to resend the same information to the target sensor node, it is impossible to pass the authentication.For example, in each section, the sensor node usesn
1
new, n
2
new, and Ms
g
rep to compute the new message authentication code MA
C
1
new; the cluster node uses n
3
new, n
2
new, and C
1 to compute a new message authentication code MA
C
2
new:(60)
MA
C
1
new
=
H
K
S
N
i
n
1
new
n
2
new
Ms
g
rep
MA
C
2
new
=
H
K
S
N
i
n
3
new
n
2
new
C
1
.If the attacker uses the message authentication code, the verifiers can verify the legality as follows:(61)
MA
C
1
=
?
MA
C
1
new
MA
C
2
=
?
MA
C
2
new
.Therefore, the attacker cannot successfully achieve the replay attack.


## 4.6. Wormhole Attack

In a wormhole attack, an attacker records a packet in one location of the network and sends it to another location, creating a tunnel between the attacker’s nodes. The packet is retransmitted to the network under the attacker’s control [24, 25]. In the location-based routing determination phase of our scheme, the cluster nodes can establish the best route on the basis of the received broadcast location message in a monitoring area.In Figure9, if an attacker deploys a malicious cluster node A, it can collect the message from the sensor nodes S
4, S
5, S
7 and successfully intercept the messages. But, in our schemes, we involve the starting cluster node process in the location-based routing determination phase to build the communication connections initially. Afterward, we also involve the mutual authentication between the cluster nodes and sensor nodes. So, the attacker cannot successfully complete the wormhole attack.Figure 9
The scenario of the wormhole attack.


## 4.7. Message Manipulation Attack

In a message manipulation attack, an attacker may drop, modify, or even forge exchanged messages in order to interrupt the communication process [15].In Figure10, an attacker deploys a malicious cluster node A and forges a fake cluster node; the malicious node A can receive messages from the cluster nodes, and the attacker may drop, modify, or even forge exchanged messages in order to interfere with the normal communication process. If a malicious cluster node A wants to interfere with a path among C
1, C
2, C
4, the cluster node C
4 communicates with the malicious cluster node A, and it cannot pass the mutual authentication successfully, because it is difficult to compute the HMAC’s key. Moreover, the routing path is established in the location-based routing determination phase. It is impossible for an attacker to interfere with the routing path and message.Figure 10
The scenario of the message manipulation attack.


## 5. Discussions

In Table1, our scheme can prevent more attacks than other related schemes. In Table 2, the cluster node only needs to store 1 session key and 2 identity parameters; we can use the bilinear pairing function to calculate the session key between the clusters or the session key between the cluster and the base station. We use the GPS to support the path planning agreements and use the location-based routing determination to build the network routing path. The dynamic key management protocol can update the session key to enhance the security.Table 1
The comparisons of the prevention attacks.
IKDM [11]
TinyPBC [12]
KMTD [13]
Ours
Against impersonation attack
Yes
Yes
Yes
Yes
Against replay attack
No
No
Yes
Yes
Against wormhole attack
No
No
No
Yes
Against message manipulation attack
No
No
No
YesTable 2
The cost comparison of the stored key and method used.
IKDM [11]
TinyPBC [12]
KMTD [13]
Ours
Stored cost (cluster node)
1 SK + 2 IDs
N/A
2 SKs + 1 ID
1 SK + 2 IDs
Stored cost (sensor node)
2 SKs + 1 ID
1 SK + 2 IDs
2 SKs + 1 ID
1 SK + 2 IDs
New node algorithm
Yes
Yes
Yes
Yes
Detailed security analysis
No
No
Yes
Yes
Group-based protocol
Yes
No
Yes
Yes
Sensor’s homogeneity
Homogeneity
Homogeneity
Hierarchical
Hierarchical
GPS capability (cluster node)
No
No
No
Yes
Path planning agreements
No
No
No
Yes
Dynamic key management
No
No
Yes
Yes
SK: the session key.
ID: the identity.The proposed scheme provides complete authentication. In Table3, we make the computation cost of the session key agreement according to four stages.Table 3
The computation cost of the session key.
IKDM [11]
TinyPBC [12]
KMTD [13]
Ours
Sensor node to sensor node
N/A
2
T
h
+
2
T
P
+
1
T
E
1
+
1
T
D
+
2
T
n
N/A
N/A
Cluster node to sensor node
N/A
N/A
7
T
h
+
2
T
E
+
2
T
D
1
+
2
T
n
4
T
h
+
1
T
a
+
1
T
E
+
1
T
D
1
+
3
T
n
+
2
T
A
Cluster node to cluster node
4
T
h
+
2
T
pf
+
n
T
d
1
+
1
T
E
+
1
T
D
N/A
N/A
4
T
h
+
2
T
P
+
1
T
E
+
1
T
D
1
+
2
T
n
+
2
T
A
Cluster node to base station
N/A
N/A
6
T
h
+
3
T
E
+
4
T
D
1
+
2
T
n
+
2
T
A
4
T
h
+
2
T
P
+
1
T
E
+
1
T
D
1
+
2
T
n
+
2
T
A
T
P: the time cost of a pairing operation.
T
a: the time cost of an additive group G.
T
h: the time cost of a hash operation.
T
E: the time cost of an encryption.
T
D: the time cost of a decryption.
T
n: the time cost of generating a nonce.
T
pf: the time cost of the polynomial function.
T
d: the time cost of the combining key fragment degree.
T
A: the time cost of the authentication.(1) Sensor Node to Sensor Node. TinyPBC is a tiny pairing-based protocol and the computation cost is lower than the bilinear pairing-based protocol. In this stage, the scheme TinyPBC can use the cost 2
T
h
+
2
T
P
+
1
T
E
+
1
T
D
+
2
T
n to generate a session key. We have more cost 2
T
h
+
2
T
A than the TinyPBC scheme does. Our scheme inherits the advantage of the TinyPBC: we use the sensor level to build the hierarchical sensor network; that is, we use TinyPBC’s topology (sensor node to sensor node) to our scheme (cluster node to cluster node), and it provides more powerful key management in WSN. It can also easily carry out message data aggregation and generate the session key between the cluster node and sensor nodes. So, our scheme can prevent more attacks, such as wormhole and message manipulation attacks. The computation cost of the pairing-based cryptography is the same as the TinyPBC scheme, but our scheme has better performance and security.(2) Cluster Node to Sensor Node. According to the comparison of the KMTD, the sensor network is more convenient, complete, and secure. In order to achieve more security and easy key management, we use the bilinear pairing to generate the session key. We need not use the encryption and decryption to generate the session key or the base station’s help. The computation cost is reduced and 3
T
h
+
T
E
+
T
D and 2
T
A
+
T
a
+
T
n are added to help the session key generation. This method can defend against more attacks and also has the path planning agreement.(3) Cluster Node to Cluster Node. According to the comparison of the IKDM, the computation cost is reduced to 2
T
p
f
+
n
T
d and added the bilinear pairing cost 2
T
p
+
2
T
A
+
2
T
n. The polynomial function easily generates the session key between the cluster nodes. However, the IKDM generates a session key which is unsuitable for large scale sensor network.The construction methods of the session key need more key material of the cluster node to combine, so we chose the bilinear pairing to generate the session key in the cluster nodes and enhance security. It can more easily complete the session key.(4) Cluster Node to Base Station. According to the comparison of the KMTD, the computation cost is reduced to 2
T
h
+
2
T
E
+
3
T
D and 2
T
p is added. We combine the message authentication code and the bilinear pairing key to accomplish the HMAC. The security of our scheme relies on ECDLP; the attacker cannot compute the secret key, and this increases the security between the base station and the cluster node. The session key and the mutual authentication are generated by the bilinear pairing function. It has the characteristic of ECDLP; the attacker cannot compute the secret key and pass verification.Based on these concepts, we use the hierarchical topology which has more power and can easily implement key management. We combine the message authentication code and the bilinear pairing key to accomplish the message authentication.


## 6. Conclusion

We used bilinear pairing to design a dynamic key management and authentication of the hierarchical sensor network. We used the dynamic key management, pairing-based cryptography, hash message authentication code, and the GPS capability’s cluster nodes to establish the secure agreement of the wireless sensor network. Our scheme achieves the following goals:(1)
proposing the dynamic key management to update the session key;
(2)
overcoming the sensor node inherent limitations. We use the hierarchical network protocol in the wireless sensor network. It is more suitable for the large monitoring range in a wireless sensor network;
(3)
providing the mutual authentication among the sensor nodes, cluster nodes, and the base station;
(4)
using the characteristics of the Discrete Logarithm Problem to generate the session key, so that its security could be enhanced.



---

*Source: 534657-2015-03-15.xml*