# New Lattice-Based Broadcast Authentication Protocol for Wireless Sensor Networks

Authors: Wangke Yu; Limeihui Yang; Shuhua Wang
Journal: Security and Communication Networks
 (2022)

---

## Abstract

At present, wireless sensor networks have become one of the indispensable infrastructures in people’s lives. Considering the frequent mobility of wireless sensor network nodes, an efficient lattice-based random broadcast authentication protocol is proposed. The security of the proposed protocol is based on the SIS problem which helps to resist against quantum attacks. In this paper, we propose two forms of broadcast authentication, that is, one-to-many broadcast authentication and one-to-one broadcast authentication. The proposed protocol satisfies the broadcast authentication property. Moreover, the resistance against man in the middle attack, antireplay attack, unforgeability, and scalability properties are achieved. Moreover, its efficiency has certain advantages with other lattice-based studies.


---

## Body

## 1. Introduction

With the development of the industry and technological advances, distributed renewable energy sources are increasingly connected to the electricity Internet, bringing large challenges to the operation and management of wireless sensor networks [1–13]. Quantum computing will potentially enable ordinary computers to compute much more than they do today [14–19]. In 1997, Shor proposed quantum algorithms for solving decompositions of large integers and discrete logarithms and demonstrated that the time complexity of their algorithmic operations was polynomial in the level [20]. With the development of quantum computing and quantum computers, it has gradually become apparent that the hard problems currently used in traditional asymmetric cryptographic regimes will likely no longer be secure [21–29]. 2009 saw the development of the first programmable general-purpose quantum computer, and then asymmetric ciphers based on the hard problem of solving the decomposition of large integers and discrete logarithms will likely no longer be secure in the quantum computer environment. Therefore, it is essential to study secure asymmetric cryptosystems in the quantum computer environment, and it has become a key research direction and hotspot in the cryptography and information security community. As one of the typical representatives of asymmetric cryptosystems in the post-quantum computer era, the lattice public key cryptosystem occupies an essential position in the field of quantum cryptography [30–35].The rest of the paper is organized as follows: in Section2, we introduce the related work. In Section 3, we introduce some basic concepts and algorithms of lattice schemes. In Section 4, we give the network model. In Section 5, we give our lattice-based broadcast authentication protocol. In Section 6, we analyze the correctness, security, and comparison. In Section 7, finally, we summarize this lattice-based authentication protocol.


## 2. Related Work

In recent years, increasingly scholars have studied security control in wireless sensor networks. In 2012, Sankar et al. proposed a signature-based security access scheme using attribute-based public key encryption [36], in which there is only one key distribution centrum, but the key centrum must have strong computing power, and with the increase in the number of wireless sensor networks and node devices, the key centrum may become bottleneck. In 2014, Wu et al. proposed an access control scheme with fault tolerance [37], which can also achieve secure access control when the access control bits are corrupted and is applicable to the environment of wireless sensor networks deployment. Zhou and Cai proposed a decentralized access control algorithm [38] for the access control problem of wireless sensor networks. Liu et al. proposed an attribute-based secure access control protocol [39] in which the introduction of trusted third parties is utilis to address the efficient management of user rights revocation. It is a control scheme [40] that enables dynamic access and provides secure control of the user. In 2016, Xie et al. proposed to apply cloud computing to the wireless sensor network environment by reducing the demand for computing power of wireless sensor network devices through cloud computing and using a node hierarchy of attribute-based encryption schemes to secure information in wireless sensor networks [41]. In 2017, Guan et al. proposed a secure access scheme with delay tolerance using a secret sharing scheme for the unpredictability of sensitive information generated by electricity consumption transactions between wireless sensor network nodes and node enterprises [42], many authentication and signature schemes that can avoid various complications between users trying to tamper or read data, and some legitimate power users who are honest but may have expired authentication message to access wireless sensor networks have been proposed [43–57].In this paper, we propose an effective lattice-based wireless sensor network authentication scheme that exploits the solid security foundation and higher computational efficiency of the lattice to output authentication information through probability and make the distribution of the output authentication information independent of the private key of the authentication subject. Nodes are able to broadcast authentication with a high probability in only a few steps.


## 3. Basic Knowledge

### 3.1. Lattice

Definition 1.
Taken (m≥n) linearly independent vectors in the m-dimensional vector space and define the lattice generated by these n vectors as(1)ℒb1,b2,…bn=∑i=1nxibi|xi∈Z,where the vector b1,b2,…bn is called the basis of the lattice. If the dimensional m×n matrices B, whose column vectors are b1,b2,…bn , are defined, then the lattice generated by the matrix B can be defined as(2)ℒb1,b2,…bn=BX|X∈Z,where n is the rank of the lattice; m is the dimension of the lattice; and the lattice of m=n is a full-rank lattice.


### 3.2. Lattice Difficulty Problems

The most difficult problems on lattices are the shortest vector problem (SVP), the closest vector problem (CVP), and the shortest independent vector problem (SM). In addition, the security of the general encryption scheme is based on the learning with errors (LWE) problem, and the security of the signature scheme is based on the small integer solution (SIS) problem. The following gives the specific definition of related issues.Definition 2.
Shortest vector problem: Given a basis B of a latticeℒ⊆Zm of rank n, find a non-zero vector u∈ℒ that satisfies the following conditions:(3)u=minv∈ζ\ov.
Some shortest vectors on a lattice are not unique, e.g., ifu is a shortest vector, then -u is also a shortest vector. In 1981, Boas proved that the shortest vector problems are all NP-hard under the paradigm [23]. In 1998, Ajtai et al. proved that the shortest vector problems are all NP-hard under the paradigm ℓ2 [24].Definition 3.
Closest vector problem: Given a base B of a latticeℒ⊆Zm of rank n and a target vector x∈spanℒ, find a non-zero vector u∈ℒ that satisfies the following conditions:(4)x−u=minv∈ℒ\ox−v.
In 1997, Henk et al. showed that the nearest vector problem is more difficult than the shortest vector problem by means of reduction and absurdum [25], and a predictive machine for solving the nearest vector problem was used in literature to solve the shortest vector problem in the same dimensions.Definition 4.
Small integer solution (SIS) problem: Given a positive integerq, a random matrix A∈Zqn×m and a real number β>0, define the small integer solution problem as: find a non-zero vector v⊆Zm such that Av=0modq , and satisfy v≤β.
Difficulty of the SIS problem: For anymn=Θnlogn, there exists a such that qn=On2logn solving the mean case problem with non-negligible probability SISq,n,m,β for any function γn=Θnlogn, is at least as difficult as solving the worst case SVPγ [20].


### 3.3. Relevant Algorithms Lattice over Lattice

The sampling technique, first proposed by Gentry et al.as a perfect combination of the SIS problem and Gaussian measurement functions, is an essential technique that emerged during the development of lattice public key cryptography [27]. The technique was first used to design the first provably secure lattice signature scheme and the first lattice identity-based encryption scheme. Subsequently, many lattice public key cryptographic protocols require the use of this technique.Theorem 1.
(Trapdoor generation algorithm) Letq≥3 be an odd number, m=⌈6nlogq⌉. There exists a probabilistic polynomial-time algorithm Trap Genq,n. The output matrix pair Α,ΤΑ∈Zqn×m×Zn×m , where A the distribution is statistically close to the uniform distribution on Zqn×m , ΤΑ is a set of short bases on the lattice Λq⊥Α, while ΤΑ∼≤Onlogq and ΤΑ≤Onlogq holds with overwhelming probability.
In 2012, Micciancio et al.proposed a new trapdoor on the lattice (G-trapdoor) [26].Theorem 2.
(G-trapdoor generation algorithm) Given matricesΑ∈Zqn×m, Τ∈Zqm0×kn and Μ∈Zqn×n , where n,m,m0,k are positive integers. If(5)ΑΤΙ=ΜG.
AndΤ small enough, then T do it A for the label M of the trapdoor G.
In view of the computational complexity of the sampling technique proposed by Gentry et al. Reference [27], Lyubashevsky et al.proposed a signature algorithm that does not require a sampling operation on the lattice, hence the name sampling-free technique [22]. The core idea is to force the distribution of the output signature to be independent of the signer’s signature private key by probabilistically outputting candidate signatures. To achieve this, the no-sampling technique works as follows: the signer’s signature key ks and message m are input, the signer first selects a random one y from some distribution and then computes the candidate signatures sks,m,y.


## 3.1. Lattice

Definition 1.
Taken (m≥n) linearly independent vectors in the m-dimensional vector space and define the lattice generated by these n vectors as(1)ℒb1,b2,…bn=∑i=1nxibi|xi∈Z,where the vector b1,b2,…bn is called the basis of the lattice. If the dimensional m×n matrices B, whose column vectors are b1,b2,…bn , are defined, then the lattice generated by the matrix B can be defined as(2)ℒb1,b2,…bn=BX|X∈Z,where n is the rank of the lattice; m is the dimension of the lattice; and the lattice of m=n is a full-rank lattice.


## 3.2. Lattice Difficulty Problems

The most difficult problems on lattices are the shortest vector problem (SVP), the closest vector problem (CVP), and the shortest independent vector problem (SM). In addition, the security of the general encryption scheme is based on the learning with errors (LWE) problem, and the security of the signature scheme is based on the small integer solution (SIS) problem. The following gives the specific definition of related issues.Definition 2.
Shortest vector problem: Given a basis B of a latticeℒ⊆Zm of rank n, find a non-zero vector u∈ℒ that satisfies the following conditions:(3)u=minv∈ζ\ov.
Some shortest vectors on a lattice are not unique, e.g., ifu is a shortest vector, then -u is also a shortest vector. In 1981, Boas proved that the shortest vector problems are all NP-hard under the paradigm [23]. In 1998, Ajtai et al. proved that the shortest vector problems are all NP-hard under the paradigm ℓ2 [24].Definition 3.
Closest vector problem: Given a base B of a latticeℒ⊆Zm of rank n and a target vector x∈spanℒ, find a non-zero vector u∈ℒ that satisfies the following conditions:(4)x−u=minv∈ℒ\ox−v.
In 1997, Henk et al. showed that the nearest vector problem is more difficult than the shortest vector problem by means of reduction and absurdum [25], and a predictive machine for solving the nearest vector problem was used in literature to solve the shortest vector problem in the same dimensions.Definition 4.
Small integer solution (SIS) problem: Given a positive integerq, a random matrix A∈Zqn×m and a real number β>0, define the small integer solution problem as: find a non-zero vector v⊆Zm such that Av=0modq , and satisfy v≤β.
Difficulty of the SIS problem: For anymn=Θnlogn, there exists a such that qn=On2logn solving the mean case problem with non-negligible probability SISq,n,m,β for any function γn=Θnlogn, is at least as difficult as solving the worst case SVPγ [20].


## 3.3. Relevant Algorithms Lattice over Lattice

The sampling technique, first proposed by Gentry et al.as a perfect combination of the SIS problem and Gaussian measurement functions, is an essential technique that emerged during the development of lattice public key cryptography [27]. The technique was first used to design the first provably secure lattice signature scheme and the first lattice identity-based encryption scheme. Subsequently, many lattice public key cryptographic protocols require the use of this technique.Theorem 1.
(Trapdoor generation algorithm) Letq≥3 be an odd number, m=⌈6nlogq⌉. There exists a probabilistic polynomial-time algorithm Trap Genq,n. The output matrix pair Α,ΤΑ∈Zqn×m×Zn×m , where A the distribution is statistically close to the uniform distribution on Zqn×m , ΤΑ is a set of short bases on the lattice Λq⊥Α, while ΤΑ∼≤Onlogq and ΤΑ≤Onlogq holds with overwhelming probability.
In 2012, Micciancio et al.proposed a new trapdoor on the lattice (G-trapdoor) [26].Theorem 2.
(G-trapdoor generation algorithm) Given matricesΑ∈Zqn×m, Τ∈Zqm0×kn and Μ∈Zqn×n , where n,m,m0,k are positive integers. If(5)ΑΤΙ=ΜG.
AndΤ small enough, then T do it A for the label M of the trapdoor G.
In view of the computational complexity of the sampling technique proposed by Gentry et al. Reference [27], Lyubashevsky et al.proposed a signature algorithm that does not require a sampling operation on the lattice, hence the name sampling-free technique [22]. The core idea is to force the distribution of the output signature to be independent of the signer’s signature private key by probabilistically outputting candidate signatures. To achieve this, the no-sampling technique works as follows: the signer’s signature key ks and message m are input, the signer first selects a random one y from some distribution and then computes the candidate signatures sks,m,y.


## 4. Network Model

In the wireless sensor network broadcast authentication protocol proposed in this paper, a heterogeneous wireless sensor network deployment model will be used for key management. This wireless sensor network model consists of two types of wireless sensor network nodes, a minority of cluster head nodes (C) and a majority of common nodes (T), with the following assumptions.(1)
All wireless sensor network nodes are not equipped with hardware devices specifically to resist attacks because of their limited energy. When they are attacked, the adversary is able to access all key-related information on that wireless sensor network node, including data and identity information.(2)
Each wireless sensor networks node has its own unique identityIDi∈0,1∗,i∈1,2,…,N.(3)
The base station in the agreement is honest and reliable.The topology of the wireless sensor network broadcast authentication protocol is shown in Figure1.Figure 1
Network model.In Figure1, the base station (B) is characteristic with unlimited energy, high computing power, and sufficient storage space and is honest and reliable. The function of cluster head wireless sensor network node C is to collect information and send it to B; ordinary wireless sensor network node T is responsible for sensing the surrounding environment and sending the collected data to C. Both C and T have relatively limited energy, computing power, and storage space.


## 5. Broadcast Authentication Protocol

The lattice-based wireless sensor network broadcast authentication protocol proposed in this paper uses a basic key predistribution model, where the base station (B) first generates system parameters and public-private key pairs for all wireless sensor network nodes and assigns the key pairs to the corresponding wireless sensor network nodes.


### 5.1. System Parameters and Keys

The system parameters and keys are generated as follows:(1)
Let the system security parameters be1n.(2)
First, choose the prime numbersq, the positive integers d,m,k,λ,l, which m must satisfy m≥64+nlogq/log2d+1; choose the real numbers σ, which satisfy the equation: σ≥12dλm.(3)
Choose a random matrixA∈Zqn×m.(4)
Select two secure hash functions:(6)H1:0,1∗⟶v:v∈−1,0,1k,v1≤k,H2:Zqn⟶0,1l.(5)
Generate the key of the wireless sensor network node, randomly select the matrixSi as the private key of the number i wireless sensor networks node, then Ti=ASi is the public key of the number i wireless sensor networks node, where Si is(7)Si∈Zqm×k,i∈1,2,…,N.Finally, the output system public parameters are(8)PP=Ti∈N,H1,H2.The key pairs of wireless sensor network nodes are(9)Pki,Ski=Ti,Si,i∈1,2,K,N.


### 5.2. One-to-Many Broadcast Authentication

#### 5.2.1. Generate Authentication Messages

If a wireless sensor network node wants to broadcast a message to other wireless sensor network nodes, the wireless sensor network node first generates the corresponding broadcast authentication message and then forwards the generated broadcast authentication message. After receiving the forwarded message, other relevant wireless sensor network nodes first verify the message, if it passes the authentication, they receive the corresponding message, otherwise they reject the message or discard the broadcast authentication message, the detailed process of broadcast authentication is as follows:Enter the system common parameterPP=Ti∈N,H1,H2, assume that the number of the wireless sensor network node needs to forward the authentication message. The specific process of broadcast authentication packet generation is shown below:(1)
Select a random timestampy←Dσm, where ti indicates that the authentication message was generated by the number i wireless sensor network node at the time t moments.(2)
Calculateuy=H2Ti⋅y and u′=u⊕uy。(3)
Calculatec=H1Ti⋅y,IDi⊕ti and z=SiT⋅c+y。(4)
Output the numberwireless sensor networks node broadcast authentication message z,c with probability min1,Dσmz/MDσ,Si,cmz.Finally, the numberi wireless sensor network node forwards the packet ti,u′,z,c, where the time stamp ti is used to determine the time validity of the packet and whether it has been received repeatedly; z,c for verification; and u′ for extracting the correct message after verification.


#### 5.2.2. Verify the Authentication Message

When the corresponding wireless sensor network node (xth node, x represents any sensor node) receives the broadcast authentication message from the ith wireless sensor network node, it first verifies the validity of the broadcast authentication message, and if the verification passes, it extracts and receives the message forwarded from the ith wireless sensor networks node, and if the verification fails, it discards the broadcast authentication packet. The specific verification process is as follows:(1)
Calculate and verifyc=H1Ti⋅z−TxSxT⋅c,IDi⊕ti and z≤2σm both of these equations hold.If both above equations hold, the authentication is passed and will continue to the next step; otherwise, the authentication fails and the broadcast authentication packet is discarded.(2)
Calculateuy=H2Ti⋅z−TxSxT⋅c.(3)
Extract messagesu: u=u′⊕uy.Finally, the wireless sensor network node that receives this broadcast authentication message is authenticated and extracts the corresponding message.Thus, any wireless sensor network node in the network that can receive the broadcast authentication message can authenticate and get the corresponding message.


### 5.3. One-to-One Broadcast Authentication

#### 5.3.1. Generate Authentication Messages

If a wireless sensor network node wants to broadcast a message to another wireless sensor network node, the detailed process of one-to-one broadcast authentication is as follows.Assume that theith wireless sensor network node needs to forward the authentication message to the jth wireless sensor network node. The specific process of broadcast authentication packet generation is shown below:(1)
Select a random timestampyj←Dσm, where tj indicates that the authentication message was generated by the ith wireless sensor network node at the time t moments.(2)
Calculateuj=H2Ti⋅yj and uj=uj′⊕uj.(3)
Calculatecj=H1Ti⋅y,IDi⊕ti and zj=SiT⋅Tj⋅cj+yj.(4)
Output the number wireless sensor networks node broadcast authentication messagezj,cj with probability min1,Dσmzj/MjDσ,Si,cjmzj.Finally, theith wireless sensor network node forward the packet tj,uj′,zj,cj, where the time stamp tj is used to determine the time validity of the packet and whether it has been received repeatedly; zj,cj for verification; and uj′ for extracting the correct message after verification.


#### 5.3.2. Verify the Authentication Message

When thejth wireless sensor network node receives the broadcast authentication message from ith wireless sensor network node, it first verifies the validity of the broadcast authentication message, and the specific verification process is as follows:(1)
Calculate and verifycj=H1Ti⋅zj−Tj⋅SjT⋅Tj⋅cj,IDi⊕tj and zj≤2σm both of these equations hold.If both above equations hold, the authentication is passed and will continue to the next step; otherwise, the authentication fails and the broadcast authentication packet is discarded.(2)
Calculate the following formula as(10)Ti⋅zj−Tj⋅SjT⋅Tj⋅cj=Ti⋅SiT⋅Tj⋅cj+yj−A⋅Tj⋅cj=Ti⋅SiT⋅Tj⋅cj+Ti⋅yj−A⋅Tj⋅cj=A⋅Tj⋅cj+Ti⋅yj−A⋅Tj⋅cj=Ti⋅yj.(3)
Calculate:uj=H2Ti⋅yj,(4)
Extract messages:uj=uj′⊕uj.Finally, thejth node that receives this broadcast authentication message is authenticated and extracts the corresponding message.


## 5.1. System Parameters and Keys

The system parameters and keys are generated as follows:(1)
Let the system security parameters be1n.(2)
First, choose the prime numbersq, the positive integers d,m,k,λ,l, which m must satisfy m≥64+nlogq/log2d+1; choose the real numbers σ, which satisfy the equation: σ≥12dλm.(3)
Choose a random matrixA∈Zqn×m.(4)
Select two secure hash functions:(6)H1:0,1∗⟶v:v∈−1,0,1k,v1≤k,H2:Zqn⟶0,1l.(5)
Generate the key of the wireless sensor network node, randomly select the matrixSi as the private key of the number i wireless sensor networks node, then Ti=ASi is the public key of the number i wireless sensor networks node, where Si is(7)Si∈Zqm×k,i∈1,2,…,N.Finally, the output system public parameters are(8)PP=Ti∈N,H1,H2.The key pairs of wireless sensor network nodes are(9)Pki,Ski=Ti,Si,i∈1,2,K,N.


## 5.2. One-to-Many Broadcast Authentication

### 5.2.1. Generate Authentication Messages

If a wireless sensor network node wants to broadcast a message to other wireless sensor network nodes, the wireless sensor network node first generates the corresponding broadcast authentication message and then forwards the generated broadcast authentication message. After receiving the forwarded message, other relevant wireless sensor network nodes first verify the message, if it passes the authentication, they receive the corresponding message, otherwise they reject the message or discard the broadcast authentication message, the detailed process of broadcast authentication is as follows:Enter the system common parameterPP=Ti∈N,H1,H2, assume that the number of the wireless sensor network node needs to forward the authentication message. The specific process of broadcast authentication packet generation is shown below:(1)
Select a random timestampy←Dσm, where ti indicates that the authentication message was generated by the number i wireless sensor network node at the time t moments.(2)
Calculateuy=H2Ti⋅y and u′=u⊕uy。(3)
Calculatec=H1Ti⋅y,IDi⊕ti and z=SiT⋅c+y。(4)
Output the numberwireless sensor networks node broadcast authentication message z,c with probability min1,Dσmz/MDσ,Si,cmz.Finally, the numberi wireless sensor network node forwards the packet ti,u′,z,c, where the time stamp ti is used to determine the time validity of the packet and whether it has been received repeatedly; z,c for verification; and u′ for extracting the correct message after verification.


### 5.2.2. Verify the Authentication Message

When the corresponding wireless sensor network node (xth node, x represents any sensor node) receives the broadcast authentication message from the ith wireless sensor network node, it first verifies the validity of the broadcast authentication message, and if the verification passes, it extracts and receives the message forwarded from the ith wireless sensor networks node, and if the verification fails, it discards the broadcast authentication packet. The specific verification process is as follows:(1)
Calculate and verifyc=H1Ti⋅z−TxSxT⋅c,IDi⊕ti and z≤2σm both of these equations hold.If both above equations hold, the authentication is passed and will continue to the next step; otherwise, the authentication fails and the broadcast authentication packet is discarded.(2)
Calculateuy=H2Ti⋅z−TxSxT⋅c.(3)
Extract messagesu: u=u′⊕uy.Finally, the wireless sensor network node that receives this broadcast authentication message is authenticated and extracts the corresponding message.Thus, any wireless sensor network node in the network that can receive the broadcast authentication message can authenticate and get the corresponding message.


## 5.2.1. Generate Authentication Messages

If a wireless sensor network node wants to broadcast a message to other wireless sensor network nodes, the wireless sensor network node first generates the corresponding broadcast authentication message and then forwards the generated broadcast authentication message. After receiving the forwarded message, other relevant wireless sensor network nodes first verify the message, if it passes the authentication, they receive the corresponding message, otherwise they reject the message or discard the broadcast authentication message, the detailed process of broadcast authentication is as follows:Enter the system common parameterPP=Ti∈N,H1,H2, assume that the number of the wireless sensor network node needs to forward the authentication message. The specific process of broadcast authentication packet generation is shown below:(1)
Select a random timestampy←Dσm, where ti indicates that the authentication message was generated by the number i wireless sensor network node at the time t moments.(2)
Calculateuy=H2Ti⋅y and u′=u⊕uy。(3)
Calculatec=H1Ti⋅y,IDi⊕ti and z=SiT⋅c+y。(4)
Output the numberwireless sensor networks node broadcast authentication message z,c with probability min1,Dσmz/MDσ,Si,cmz.Finally, the numberi wireless sensor network node forwards the packet ti,u′,z,c, where the time stamp ti is used to determine the time validity of the packet and whether it has been received repeatedly; z,c for verification; and u′ for extracting the correct message after verification.


## 5.2.2. Verify the Authentication Message

When the corresponding wireless sensor network node (xth node, x represents any sensor node) receives the broadcast authentication message from the ith wireless sensor network node, it first verifies the validity of the broadcast authentication message, and if the verification passes, it extracts and receives the message forwarded from the ith wireless sensor networks node, and if the verification fails, it discards the broadcast authentication packet. The specific verification process is as follows:(1)
Calculate and verifyc=H1Ti⋅z−TxSxT⋅c,IDi⊕ti and z≤2σm both of these equations hold.If both above equations hold, the authentication is passed and will continue to the next step; otherwise, the authentication fails and the broadcast authentication packet is discarded.(2)
Calculateuy=H2Ti⋅z−TxSxT⋅c.(3)
Extract messagesu: u=u′⊕uy.Finally, the wireless sensor network node that receives this broadcast authentication message is authenticated and extracts the corresponding message.Thus, any wireless sensor network node in the network that can receive the broadcast authentication message can authenticate and get the corresponding message.


## 5.3. One-to-One Broadcast Authentication

### 5.3.1. Generate Authentication Messages

If a wireless sensor network node wants to broadcast a message to another wireless sensor network node, the detailed process of one-to-one broadcast authentication is as follows.Assume that theith wireless sensor network node needs to forward the authentication message to the jth wireless sensor network node. The specific process of broadcast authentication packet generation is shown below:(1)
Select a random timestampyj←Dσm, where tj indicates that the authentication message was generated by the ith wireless sensor network node at the time t moments.(2)
Calculateuj=H2Ti⋅yj and uj=uj′⊕uj.(3)
Calculatecj=H1Ti⋅y,IDi⊕ti and zj=SiT⋅Tj⋅cj+yj.(4)
Output the number wireless sensor networks node broadcast authentication messagezj,cj with probability min1,Dσmzj/MjDσ,Si,cjmzj.Finally, theith wireless sensor network node forward the packet tj,uj′,zj,cj, where the time stamp tj is used to determine the time validity of the packet and whether it has been received repeatedly; zj,cj for verification; and uj′ for extracting the correct message after verification.


### 5.3.2. Verify the Authentication Message

When thejth wireless sensor network node receives the broadcast authentication message from ith wireless sensor network node, it first verifies the validity of the broadcast authentication message, and the specific verification process is as follows:(1)
Calculate and verifycj=H1Ti⋅zj−Tj⋅SjT⋅Tj⋅cj,IDi⊕tj and zj≤2σm both of these equations hold.If both above equations hold, the authentication is passed and will continue to the next step; otherwise, the authentication fails and the broadcast authentication packet is discarded.(2)
Calculate the following formula as(10)Ti⋅zj−Tj⋅SjT⋅Tj⋅cj=Ti⋅SiT⋅Tj⋅cj+yj−A⋅Tj⋅cj=Ti⋅SiT⋅Tj⋅cj+Ti⋅yj−A⋅Tj⋅cj=A⋅Tj⋅cj+Ti⋅yj−A⋅Tj⋅cj=Ti⋅yj.(3)
Calculate:uj=H2Ti⋅yj,(4)
Extract messages:uj=uj′⊕uj.Finally, thejth node that receives this broadcast authentication message is authenticated and extracts the corresponding message.


## 5.3.1. Generate Authentication Messages

If a wireless sensor network node wants to broadcast a message to another wireless sensor network node, the detailed process of one-to-one broadcast authentication is as follows.Assume that theith wireless sensor network node needs to forward the authentication message to the jth wireless sensor network node. The specific process of broadcast authentication packet generation is shown below:(1)
Select a random timestampyj←Dσm, where tj indicates that the authentication message was generated by the ith wireless sensor network node at the time t moments.(2)
Calculateuj=H2Ti⋅yj and uj=uj′⊕uj.(3)
Calculatecj=H1Ti⋅y,IDi⊕ti and zj=SiT⋅Tj⋅cj+yj.(4)
Output the number wireless sensor networks node broadcast authentication messagezj,cj with probability min1,Dσmzj/MjDσ,Si,cjmzj.Finally, theith wireless sensor network node forward the packet tj,uj′,zj,cj, where the time stamp tj is used to determine the time validity of the packet and whether it has been received repeatedly; zj,cj for verification; and uj′ for extracting the correct message after verification.


## 5.3.2. Verify the Authentication Message

When thejth wireless sensor network node receives the broadcast authentication message from ith wireless sensor network node, it first verifies the validity of the broadcast authentication message, and the specific verification process is as follows:(1)
Calculate and verifycj=H1Ti⋅zj−Tj⋅SjT⋅Tj⋅cj,IDi⊕tj and zj≤2σm both of these equations hold.If both above equations hold, the authentication is passed and will continue to the next step; otherwise, the authentication fails and the broadcast authentication packet is discarded.(2)
Calculate the following formula as(10)Ti⋅zj−Tj⋅SjT⋅Tj⋅cj=Ti⋅SiT⋅Tj⋅cj+yj−A⋅Tj⋅cj=Ti⋅SiT⋅Tj⋅cj+Ti⋅yj−A⋅Tj⋅cj=A⋅Tj⋅cj+Ti⋅yj−A⋅Tj⋅cj=Ti⋅yj.(3)
Calculate:uj=H2Ti⋅yj,(4)
Extract messages:uj=uj′⊕uj.Finally, thejth node that receives this broadcast authentication message is authenticated and extracts the corresponding message.


## 6. Protocol Analysis

In this paper, we evaluate the new scheme in terms of 3 aspects: consistency, security, and efficiency.


### 6.1. Consistency Analysis

Following the specific process of the certification protocol described above, it can be concluded that(11)Ti⋅z−TxSxT⋅c=TiSiT⋅c+y−A⋅c=Ti⋅SiT⋅c+Ti⋅y−A⋅c=A⋅c+Ti⋅y−A⋅c=Ti⋅y.Thus,(12)H1Ti⋅z−TxSxT⋅c,IDi⊕ti=H1Ti⋅y,IDi⊕ti=c.Before proving that the inequality holds with an overwhelming probability of satisfactionz≤2σm look at the following two lemmas.Lemma 1.
For any real numberσ≥0 and positive integer m, the following inequality holds [21](13)Pry←Dσm:y>2σm<2−m.Lemma 2.
For any vectorv⊆Zm , if σ=ωvlogm, then the following equation holds(14)Pry←Dσm:DσmyDσ,vmx=O1=1−2ωlogm.
According to the principle of the no-sampling technique described by Lyubashevsky et al. and Lemma1, it follows that the distribution of z is very close Dσm; from Lemma 2 it z follows that the inequality z≤2σm will be satisfied with probability greater than or equal to 1−2−m, i.e., with overwhelming probability [21].
Proof of message correctness is written as(15)u=u′⊕uy=u′⊕H2Ti⋅z−TxSxT⋅c=u′⊕H2Ti⋅y=u⊕uy⊕H2Ti⋅y=u⊕H2Ti⋅y⊕H2Ti⋅y=u.


### 6.2. Safety Analysis

#### 6.2.1. Anti-Replay Attack

In the authentication protocol, the random numbertj and yi, where tj indicates that the authentication message was generated by the wireless sensor network node at the time t moments, yi indicates the random Gaussian parameter. The random number tj and yi are used to resist replay attacks, which are used to ensure the freshness and independence of the exchanged messages. In addition, there is a random number freshness detection mechanism in the wireless sensor networks, and even if the attacker replays the user’s first message, it cannot pass authentication. Therefore, the authentication message can resist replay attacks.


#### 6.2.2. Unforgeability

A successful interaction between a signer and a user generates only one valid authentication message. Here, we prove that if there has an adversary ability to resist unforgeable against the enemy, there is a polynomial crack SIS difficult time algorithm. Assume there exists an adversaryQ who can forge a valid proxy authentication message with non-negligible probability δ, then there will exist a polynomial-time algorithm C which can solve SIS difficult problem.Proof.
The proposed proxy authentication protocol follows the fact that the output is independent of the authentication key. While the main outputs are the hash value and authentication of the message, the forger only needs to make the hash queries and authentication queries.Hash queries: ChallengerC builds an initial empty List1 to store the hash value H2Ti⋅y of message Ti⋅y. When the Forger sends queries for message Ti⋅y to C, firstly he will check whether the pair, Ti⋅y,H2Ti⋅y exists in the List1 or not. If it is, C take Ti⋅y,H2Ti⋅y as the answer of the Forger’s hash queries; if not, C will compute the new hash value of message Ti⋅y and send the new pair Ti⋅y,H2Ti⋅y to Forger and restore it to List1.Authentication queries:C holds an initial empty List2 which contains the blind authentication pairs z,c. When the Forger sends the queries for the authentication about message uy, firstly C will check whether this pair z,c exists in the List2. If it is, C will take pair z,c as the answer of the Forger’s authentication queries; if not, C will run the authentication process to generate an authentication of the message uy, send the new authentication pair z,c to the Forger and restore it to List2.


#### 6.2.3. Forge

Assume thatC is the answer to a hash query made by the adversary, then from Definition 4 in Section 3, the small integer solution of the problem with parameter q,m,4σ+2dλm.Given a random matrixA∈Zqn×m and a real number 4σ+2dλm>0, find a non-zero vector v⊆Zm, such that Av=0modq , and satisfy v≤4σ+2dλm.First, construct a polynomial-time algorithmξ and assume that the algorithm obtains a new forged authentication signature z∗,c∗ and Ti⋅y∗,H2Ti⋅y∗ for the message with non-negligible probability, such that we get(16)Ti⋅z−TxSxT⋅c=Ti⋅z∗−TxSxT⋅c∗.SinceTi=A⋅Si, TxSxT=A, then(17)Ti⋅z−A⋅c−Ti⋅z∗−A⋅c∗=A⋅Si⋅z−A⋅c−A⋅Si⋅z∗−A⋅c∗=ASi⋅z−c−Si⋅z∗+c∗=0.Based on the consistency of the authentication message, it follows thatz≤2σm, z∗≤2σm and Si⋅z≤dλm, Si⋅z∗≤dλm holds with overwhelming probability that then(18)Si⋅z−c−Si⋅z∗+c∗≤2dλm+4σm.So as long as the probability ofSi⋅z−c−Si⋅z∗+c∗≠0 proving the authentication protocol is non-negligible, the protocol can be shown to be secure.According to Lemma2 of Section 6, it follows that a new private key Si′ is generated with probability greater than or equal 1−2−m to that of A⋅Si=A⋅Si′ [22]. Then(19)Si⋅z−c−Si⋅z∗+c∗−Si⋅z+c+Si′⋅z∗−c∗=Si−Si′z−z∗≠0.Then(20)Si⋅z−c−Si⋅z∗+c∗≠0.SinceTi⋅y≠Ti⋅y∗, then(21)H2Ti⋅y≠H2Ti⋅y∗.


#### 6.2.4. Anti-Man in the Middle Attack

According to the analysis in the above sections, the authentication protocol can successfully achieve mutual authentication. In addition, the transmitted messages are protected by secret valuesz and private key Si and no one can forge legitimate information without knowing these secret values. Therefore, the authentication protocol can resist to man in the middle attacks. Therefore, the broadcast authentication protocol proposed in this paper is secure.


### 6.3. Efficiency Analysis

The proposed scheme is first compared with other related schemes in terms of computational effort, security, and quantum attacks. The proposed broadcast authentication protocol does not require the relevant wireless sensor network node to send a separatep packet, as the information containing the authentication is already embedded in the broadcast authentication packet, and the number j wireless sensor network node receiving the broadcast authentication packet can verify the broadcast authentication packet. As the proposed broadcast authentication protocol does not require additional messages to be sent, the communication overhead of the wireless sensor networks can be reduced, resulting in lower energy consumption. In terms of computational complexity, the main operations of the proposed broadcast authentication protocol are simple hash operations and logical operations, which generally consume more energy to transmit data than to compute bits.The wireless sensor network broadcast authentication protocol proposed in this paper is a lattice-based quantum attack resistant protocol with a high level of security. One of them, the elliptic curve-based security scheme proposed by Javeed et al. Reference [43], achieves authentication security under the difficulty assumption of the elliptic curve discrete logarithm problem, which is vulnerable to quantum attacks, although the discrete logarithm problem is highly secure under the security model. The authentication key scheme proposed by Zhang et al. is based on the ideal loop learning by error problem (R-LWE) [[44], the lattice-based error learning problem (LWE) [45] proposed by Fujioka et al. and the use of private key encapsulation techniques leads to the protocol, requiring a larger amount of computation and storage space, which is also the direction in which the broadcast authentication protocol proposed in this paper needs further improvement. The wireless sensor network broadcast authentication protocol proposed in this paper does not use the corresponding cryptographic method to encapsulate private keys and so on for authentication, so it has less storage space and computation than the scheme proposed by Fujioka et al. In addition, the authentication protocol proposed in this paper is based on the lattice-based small integer solution problem (SIS), so it only involves the product operation of vectors and matrices and does not involve exponential operations, which makes the computation. This is simple, efficient, and resistant to quantum attacks due to the lattice-based small integer solution problem. The performance comparison is shown in Table 1.Table 1
Performance comparison of different schemes.
SchemeSecurity problemType of operationResistance quantum[43]Discrete logarithmExponential operationsNo[44]R-LWEMatrix vectorsYes[45]LWEMatrix vectorsYesOur protocolSISMatrix vectorsYesAs can be seen from Table1, the proposed cryptographic scheme has certain advantages in terms of security, computational volume, and storage space.The key size of the proposed scheme is compared with other related schemes through theory and simulation in specific quantitative simulations.n is the security parameter, q is the modulus, d=⌈logn⌉, m=6nlogq, and l is the bit length of the message. In literature [25], the public and private key sizes in the scheme proposed by Micciancio et al. are: l+1n2k+m¯+nk+1n and m¯nk, respectively, and the public and private key sizes in the scheme proposed by Ducas and Micciancio in literature [46] are 2d+3n2⌈log3q⌉+n and 4⌈logn⌉+1n2⌈log3q⌉. The public and private key sizes for this paper are 2dm¯n+4nk and m¯nd. The public and private key sizes of the scheme proposed in this paper have certain advantages.According to the above analysis, the message authentication size of the proposed authentication protocol ismlog12σ, which is only related to the message m and the parameter σ. The authentication sizes corresponding to different security levels (such as 128 bits, 256 bits, and 512 bits) can be calculated when the selected system parameter is n=256,q=232. The results are shown in Table 2. The authentication sizes of RSA and ECC authentication algorithms corresponding to different security levels are given. As shown in Table 2, the authentication size of the RSA algorithm increases rapidly with the improvement of the security level, but the signature size of the authentication protocol proposed in this paper changes little. No matter how the security level increases, the size of the authentication remains at a stable level. Although the growth rate of ECC algorithm is slow, it is always twice the size of the security level. In addition, RSA and ECC algorithms cannot resist quantum attacks, so the lattice-based authentication protocol in this paper has good anti-quantum security. With the development of quantum computer and quantum computing, lattice cipher will be a very practical cryptographic algorithm in the quantum era.Table 2
Comparison with RSA and ECC algorithms.
Security level (B)RSA algorithm (kB)ECC algorithm (kB)Our algorithm (kB)1288.0720.25662.7225616.1440.51263.0851232.2881.02463.57Therefore, the authentication protocol proposed in this paper has high security and efficiency.


## 6.1. Consistency Analysis

Following the specific process of the certification protocol described above, it can be concluded that(11)Ti⋅z−TxSxT⋅c=TiSiT⋅c+y−A⋅c=Ti⋅SiT⋅c+Ti⋅y−A⋅c=A⋅c+Ti⋅y−A⋅c=Ti⋅y.Thus,(12)H1Ti⋅z−TxSxT⋅c,IDi⊕ti=H1Ti⋅y,IDi⊕ti=c.Before proving that the inequality holds with an overwhelming probability of satisfactionz≤2σm look at the following two lemmas.Lemma 1.
For any real numberσ≥0 and positive integer m, the following inequality holds [21](13)Pry←Dσm:y>2σm<2−m.Lemma 2.
For any vectorv⊆Zm , if σ=ωvlogm, then the following equation holds(14)Pry←Dσm:DσmyDσ,vmx=O1=1−2ωlogm.
According to the principle of the no-sampling technique described by Lyubashevsky et al. and Lemma1, it follows that the distribution of z is very close Dσm; from Lemma 2 it z follows that the inequality z≤2σm will be satisfied with probability greater than or equal to 1−2−m, i.e., with overwhelming probability [21].
Proof of message correctness is written as(15)u=u′⊕uy=u′⊕H2Ti⋅z−TxSxT⋅c=u′⊕H2Ti⋅y=u⊕uy⊕H2Ti⋅y=u⊕H2Ti⋅y⊕H2Ti⋅y=u.


## 6.2. Safety Analysis

### 6.2.1. Anti-Replay Attack

In the authentication protocol, the random numbertj and yi, where tj indicates that the authentication message was generated by the wireless sensor network node at the time t moments, yi indicates the random Gaussian parameter. The random number tj and yi are used to resist replay attacks, which are used to ensure the freshness and independence of the exchanged messages. In addition, there is a random number freshness detection mechanism in the wireless sensor networks, and even if the attacker replays the user’s first message, it cannot pass authentication. Therefore, the authentication message can resist replay attacks.


### 6.2.2. Unforgeability

A successful interaction between a signer and a user generates only one valid authentication message. Here, we prove that if there has an adversary ability to resist unforgeable against the enemy, there is a polynomial crack SIS difficult time algorithm. Assume there exists an adversaryQ who can forge a valid proxy authentication message with non-negligible probability δ, then there will exist a polynomial-time algorithm C which can solve SIS difficult problem.Proof.
The proposed proxy authentication protocol follows the fact that the output is independent of the authentication key. While the main outputs are the hash value and authentication of the message, the forger only needs to make the hash queries and authentication queries.Hash queries: ChallengerC builds an initial empty List1 to store the hash value H2Ti⋅y of message Ti⋅y. When the Forger sends queries for message Ti⋅y to C, firstly he will check whether the pair, Ti⋅y,H2Ti⋅y exists in the List1 or not. If it is, C take Ti⋅y,H2Ti⋅y as the answer of the Forger’s hash queries; if not, C will compute the new hash value of message Ti⋅y and send the new pair Ti⋅y,H2Ti⋅y to Forger and restore it to List1.Authentication queries:C holds an initial empty List2 which contains the blind authentication pairs z,c. When the Forger sends the queries for the authentication about message uy, firstly C will check whether this pair z,c exists in the List2. If it is, C will take pair z,c as the answer of the Forger’s authentication queries; if not, C will run the authentication process to generate an authentication of the message uy, send the new authentication pair z,c to the Forger and restore it to List2.


### 6.2.3. Forge

Assume thatC is the answer to a hash query made by the adversary, then from Definition 4 in Section 3, the small integer solution of the problem with parameter q,m,4σ+2dλm.Given a random matrixA∈Zqn×m and a real number 4σ+2dλm>0, find a non-zero vector v⊆Zm, such that Av=0modq , and satisfy v≤4σ+2dλm.First, construct a polynomial-time algorithmξ and assume that the algorithm obtains a new forged authentication signature z∗,c∗ and Ti⋅y∗,H2Ti⋅y∗ for the message with non-negligible probability, such that we get(16)Ti⋅z−TxSxT⋅c=Ti⋅z∗−TxSxT⋅c∗.SinceTi=A⋅Si, TxSxT=A, then(17)Ti⋅z−A⋅c−Ti⋅z∗−A⋅c∗=A⋅Si⋅z−A⋅c−A⋅Si⋅z∗−A⋅c∗=ASi⋅z−c−Si⋅z∗+c∗=0.Based on the consistency of the authentication message, it follows thatz≤2σm, z∗≤2σm and Si⋅z≤dλm, Si⋅z∗≤dλm holds with overwhelming probability that then(18)Si⋅z−c−Si⋅z∗+c∗≤2dλm+4σm.So as long as the probability ofSi⋅z−c−Si⋅z∗+c∗≠0 proving the authentication protocol is non-negligible, the protocol can be shown to be secure.According to Lemma2 of Section 6, it follows that a new private key Si′ is generated with probability greater than or equal 1−2−m to that of A⋅Si=A⋅Si′ [22]. Then(19)Si⋅z−c−Si⋅z∗+c∗−Si⋅z+c+Si′⋅z∗−c∗=Si−Si′z−z∗≠0.Then(20)Si⋅z−c−Si⋅z∗+c∗≠0.SinceTi⋅y≠Ti⋅y∗, then(21)H2Ti⋅y≠H2Ti⋅y∗.


### 6.2.4. Anti-Man in the Middle Attack

According to the analysis in the above sections, the authentication protocol can successfully achieve mutual authentication. In addition, the transmitted messages are protected by secret valuesz and private key Si and no one can forge legitimate information without knowing these secret values. Therefore, the authentication protocol can resist to man in the middle attacks. Therefore, the broadcast authentication protocol proposed in this paper is secure.


## 6.2.1. Anti-Replay Attack

In the authentication protocol, the random numbertj and yi, where tj indicates that the authentication message was generated by the wireless sensor network node at the time t moments, yi indicates the random Gaussian parameter. The random number tj and yi are used to resist replay attacks, which are used to ensure the freshness and independence of the exchanged messages. In addition, there is a random number freshness detection mechanism in the wireless sensor networks, and even if the attacker replays the user’s first message, it cannot pass authentication. Therefore, the authentication message can resist replay attacks.


## 6.2.2. Unforgeability

A successful interaction between a signer and a user generates only one valid authentication message. Here, we prove that if there has an adversary ability to resist unforgeable against the enemy, there is a polynomial crack SIS difficult time algorithm. Assume there exists an adversaryQ who can forge a valid proxy authentication message with non-negligible probability δ, then there will exist a polynomial-time algorithm C which can solve SIS difficult problem.Proof.
The proposed proxy authentication protocol follows the fact that the output is independent of the authentication key. While the main outputs are the hash value and authentication of the message, the forger only needs to make the hash queries and authentication queries.Hash queries: ChallengerC builds an initial empty List1 to store the hash value H2Ti⋅y of message Ti⋅y. When the Forger sends queries for message Ti⋅y to C, firstly he will check whether the pair, Ti⋅y,H2Ti⋅y exists in the List1 or not. If it is, C take Ti⋅y,H2Ti⋅y as the answer of the Forger’s hash queries; if not, C will compute the new hash value of message Ti⋅y and send the new pair Ti⋅y,H2Ti⋅y to Forger and restore it to List1.Authentication queries:C holds an initial empty List2 which contains the blind authentication pairs z,c. When the Forger sends the queries for the authentication about message uy, firstly C will check whether this pair z,c exists in the List2. If it is, C will take pair z,c as the answer of the Forger’s authentication queries; if not, C will run the authentication process to generate an authentication of the message uy, send the new authentication pair z,c to the Forger and restore it to List2.


## 6.2.3. Forge

Assume thatC is the answer to a hash query made by the adversary, then from Definition 4 in Section 3, the small integer solution of the problem with parameter q,m,4σ+2dλm.Given a random matrixA∈Zqn×m and a real number 4σ+2dλm>0, find a non-zero vector v⊆Zm, such that Av=0modq , and satisfy v≤4σ+2dλm.First, construct a polynomial-time algorithmξ and assume that the algorithm obtains a new forged authentication signature z∗,c∗ and Ti⋅y∗,H2Ti⋅y∗ for the message with non-negligible probability, such that we get(16)Ti⋅z−TxSxT⋅c=Ti⋅z∗−TxSxT⋅c∗.SinceTi=A⋅Si, TxSxT=A, then(17)Ti⋅z−A⋅c−Ti⋅z∗−A⋅c∗=A⋅Si⋅z−A⋅c−A⋅Si⋅z∗−A⋅c∗=ASi⋅z−c−Si⋅z∗+c∗=0.Based on the consistency of the authentication message, it follows thatz≤2σm, z∗≤2σm and Si⋅z≤dλm, Si⋅z∗≤dλm holds with overwhelming probability that then(18)Si⋅z−c−Si⋅z∗+c∗≤2dλm+4σm.So as long as the probability ofSi⋅z−c−Si⋅z∗+c∗≠0 proving the authentication protocol is non-negligible, the protocol can be shown to be secure.According to Lemma2 of Section 6, it follows that a new private key Si′ is generated with probability greater than or equal 1−2−m to that of A⋅Si=A⋅Si′ [22]. Then(19)Si⋅z−c−Si⋅z∗+c∗−Si⋅z+c+Si′⋅z∗−c∗=Si−Si′z−z∗≠0.Then(20)Si⋅z−c−Si⋅z∗+c∗≠0.SinceTi⋅y≠Ti⋅y∗, then(21)H2Ti⋅y≠H2Ti⋅y∗.


## 6.2.4. Anti-Man in the Middle Attack

According to the analysis in the above sections, the authentication protocol can successfully achieve mutual authentication. In addition, the transmitted messages are protected by secret valuesz and private key Si and no one can forge legitimate information without knowing these secret values. Therefore, the authentication protocol can resist to man in the middle attacks. Therefore, the broadcast authentication protocol proposed in this paper is secure.


## 6.3. Efficiency Analysis

The proposed scheme is first compared with other related schemes in terms of computational effort, security, and quantum attacks. The proposed broadcast authentication protocol does not require the relevant wireless sensor network node to send a separatep packet, as the information containing the authentication is already embedded in the broadcast authentication packet, and the number j wireless sensor network node receiving the broadcast authentication packet can verify the broadcast authentication packet. As the proposed broadcast authentication protocol does not require additional messages to be sent, the communication overhead of the wireless sensor networks can be reduced, resulting in lower energy consumption. In terms of computational complexity, the main operations of the proposed broadcast authentication protocol are simple hash operations and logical operations, which generally consume more energy to transmit data than to compute bits.The wireless sensor network broadcast authentication protocol proposed in this paper is a lattice-based quantum attack resistant protocol with a high level of security. One of them, the elliptic curve-based security scheme proposed by Javeed et al. Reference [43], achieves authentication security under the difficulty assumption of the elliptic curve discrete logarithm problem, which is vulnerable to quantum attacks, although the discrete logarithm problem is highly secure under the security model. The authentication key scheme proposed by Zhang et al. is based on the ideal loop learning by error problem (R-LWE) [[44], the lattice-based error learning problem (LWE) [45] proposed by Fujioka et al. and the use of private key encapsulation techniques leads to the protocol, requiring a larger amount of computation and storage space, which is also the direction in which the broadcast authentication protocol proposed in this paper needs further improvement. The wireless sensor network broadcast authentication protocol proposed in this paper does not use the corresponding cryptographic method to encapsulate private keys and so on for authentication, so it has less storage space and computation than the scheme proposed by Fujioka et al. In addition, the authentication protocol proposed in this paper is based on the lattice-based small integer solution problem (SIS), so it only involves the product operation of vectors and matrices and does not involve exponential operations, which makes the computation. This is simple, efficient, and resistant to quantum attacks due to the lattice-based small integer solution problem. The performance comparison is shown in Table 1.Table 1
Performance comparison of different schemes.
SchemeSecurity problemType of operationResistance quantum[43]Discrete logarithmExponential operationsNo[44]R-LWEMatrix vectorsYes[45]LWEMatrix vectorsYesOur protocolSISMatrix vectorsYesAs can be seen from Table1, the proposed cryptographic scheme has certain advantages in terms of security, computational volume, and storage space.The key size of the proposed scheme is compared with other related schemes through theory and simulation in specific quantitative simulations.n is the security parameter, q is the modulus, d=⌈logn⌉, m=6nlogq, and l is the bit length of the message. In literature [25], the public and private key sizes in the scheme proposed by Micciancio et al. are: l+1n2k+m¯+nk+1n and m¯nk, respectively, and the public and private key sizes in the scheme proposed by Ducas and Micciancio in literature [46] are 2d+3n2⌈log3q⌉+n and 4⌈logn⌉+1n2⌈log3q⌉. The public and private key sizes for this paper are 2dm¯n+4nk and m¯nd. The public and private key sizes of the scheme proposed in this paper have certain advantages.According to the above analysis, the message authentication size of the proposed authentication protocol ismlog12σ, which is only related to the message m and the parameter σ. The authentication sizes corresponding to different security levels (such as 128 bits, 256 bits, and 512 bits) can be calculated when the selected system parameter is n=256,q=232. The results are shown in Table 2. The authentication sizes of RSA and ECC authentication algorithms corresponding to different security levels are given. As shown in Table 2, the authentication size of the RSA algorithm increases rapidly with the improvement of the security level, but the signature size of the authentication protocol proposed in this paper changes little. No matter how the security level increases, the size of the authentication remains at a stable level. Although the growth rate of ECC algorithm is slow, it is always twice the size of the security level. In addition, RSA and ECC algorithms cannot resist quantum attacks, so the lattice-based authentication protocol in this paper has good anti-quantum security. With the development of quantum computer and quantum computing, lattice cipher will be a very practical cryptographic algorithm in the quantum era.Table 2
Comparison with RSA and ECC algorithms.
Security level (B)RSA algorithm (kB)ECC algorithm (kB)Our algorithm (kB)1288.0720.25662.7225616.1440.51263.0851232.2881.02463.57Therefore, the authentication protocol proposed in this paper has high security and efficiency.


## 7. Conclusion

The proposed wireless sensor network broadcast authentication protocol does not require the wireless sensor network node to send a separate message, as the information is already embedded in the broadcast authentication message and the wireless sensor network node receives the broadcast authentication message to verify as the embedded information. As the proposed wireless sensor network broadcast authentication protocol does not require multiple messages to be sent, it can reduce the communication overhead of the wireless sensor network. In terms of computational complexity, the broadcast authentication protocol proposed in this paper is more efficient as the main operations are vector and matrix operations rather than exponential operations. In addition, the broadcast authentication protocol proposed in this paper is based on lattice, which can resist quantum attacks and is more secure. Since this paper adopts a lattice public key cryptosystem that is resistant to quantum, although it improves a lot in terms of security, it is still less efficient than the traditional public key cryptosystem. Further research on lattice public key cryptosystems will be conducted in the future, in terms of how they can improve the authentication and communication efficiency of wireless sensor networks pending research.In future work, we will continue to study the lattice-based authentication protocol for wireless sensor networks, and some new methods, such as that support flexible partially hid predicate encryption policy or fully homomorphic encryption et al. Additionally, the efficiency of the protocol can be further improved.



---

*Source: 6809875-2022-09-30.xml*