Combinatorial Design of Key Distribution Mechanisms for Wireless Sensor Networks

Secure communications in wireless sensor networks operating under adversarial conditions require providing pairwise (symmetric) keys to sensor nodes. In large scale deployment scenarios, there is no priory knowledge of post deployment network configuration since nodes may be randomly scattered over a hostile territory. Thus, shared keys must be distributed before deployment to provide each node a key-chain. For large sensor networks it is infeasible to store a unique key for all other nodes in the key-chain of a sensor node. Consequently, for secure communication either two nodes have a key in common in their key-chains and they have a wireless link between them, or there is a path, called key-path, among these two nodes where each pair of neighboring nodes on this path have a key in common. Length of the key-path is the key factor for efficiency of the design. This paper presents novel deterministic and hybrid approaches based on Combinatorial Design for deciding how many and which keys to assign to each key-chain before the sensor network deployment. In particular, Balanced Incomplete Block Designs (BIBD) and Generalized Quadrangles (GQ) are mapped to obtain efficient key distribution schemes. Performance and security properties of the proposed schemes are studied both analytically and computationally. Comparison to related work shows that the combinatorial approach produces better connectivity with smaller key-chain sizes     

SBK: A Self-Configuring Framework for Bootstrapping Keys in Sensor Networks

Key pre-distribution has been claimed to be the only viable approach for establishing shared keys between neighboring sensors after deployment for a typical sensor network. However, none of the proposed key pre-distribution schemes simultaneously achieves good performance in terms of scalability in network size, key-sharing probability between neighboring sensors, memory overhead for keying information storage, and resilience against node capture attacks. In this paper, we propose SBK, an in-situ self-configuring framework to bootstrap keys in large-scale sensor networks. SBK is fundamentally different compared to all key pre-distribution schemes. It requires no keying information pre-deployment. In SBK, sensors differentiate their roles as either service nodes or worker nodes after deployment. Service sensors construct key spaces, and distribute keying information in order for worker sensors to bootstrap pairwise keys. An improved scheme, iSBK, is also proposed to speed up the bootstrapping procedure. We conduct both theoretical analysis and simulation study to evaluate the performances of SBK and iSBK. To the best of our knowledge, SBK and iSBK are the only key establishment protocols that simultaneously achieve good performance in scalability, key-sharing probability, storage overhead, and resilience against node capture attacks.     

An Efficient Grid-Based Pairwise Key Predistribution Scheme for Wireless Sensor Networks

Research on wireless sensor networks (WSNs) has been receiving a lot of attention recently. Because of the constraints on the cost of hardware, there are a lot of restrictions regarding memory, computational ability, and energy consumption, hampering WSN research. So far, many key establishment schemes have been proposed for WSNs. For the proposed schemes, random key predistribution is a practical solution. With this, each sensor shares a common key with its neighbors via predistributed keys. However, it may happen that two sensor nodes do not share a common key. In this paper, an efficient grid-based pairwise key predistribution scheme for WSNs is proposed. In the proposed scheme, multiple polynomials for each row, each column, and each diagonal in the grid are constructed. Then, each sensor node in each row, column, and diagonal in the grid establishes a pairwise key with the other node using the predistributed symmetric polynomial. Simulation results demonstrate the effectiveness of the proposed scheme in increasing the probability of establishing pairwise keys and reducing communication overhead.     

A Two-Layer Key Establishment Scheme for Wireless Sensor Networks

In a large scale sensor network, it is infeasible to assign a unique Transport Layer Key (TLK) for each pair of nodes to provide the end-to-end security due to the huge memory cost per node. Thus, conventional key establishment schemes follow a key predistribution approach to establish a Link Layer Key (LLK) infrastructure between neighboring nodes and rely on multihop paths to provide the end-to-end security. Their drawbacks include vulnerability to the node compromise attack, large memory cost, and energy inefficiency in the key establishment between neighboring nodes. In this paper, we propose a novel key establishment scheme, called LAKE, for sensor networks. LAKE uses a t-degree trivariate symmetric polynomial to facilitate the establishment of both TLKs and LLKs between sensor nodes in a two-dimensional space, where each node can calculate direct TLKs and LLKs with some logically neighboring nodes and rely on those nodes to negotiate indirect TLKs and LLKs with other nodes. Any two end nodes can negotiate a TLK on demand directly or with the help of only one intermediate node, which can be determined in advance. As for the LLK establishment, LAKE is more secure under the node compromise attack with much less memory cost than conventional solutions. Due to the location-based deployment, LAKE is also energy efficient in that each node has direct LLKs with most neighbors without spending too much energy on the establishment of indirect LLKs with neighbors through multihop routing.     

Dynamic key management in sensor networks

Numerous key management schemes have been proposed for sensor networks. The objective of key management is to dynamically establish and maintain secure channels among communicating nodes. Desired features of key management in sensor networks include energy awareness, localized impact of attacks, and scaling to a large number of nodes. A primary challenge is managing the trade-off between providing acceptable levels of security and conserving scarce resources, in particular energy, needed for network operations. Many schemes, referred to as static schemes, have adopted the principle of key predistribution with the underlying assumption of a relatively static short-lived network (node replenishments are rare, and keys outlive the network). An emerging class of schemes, dynamic key management schemes, assumes long-lived networks with more frequent addition of new nodes, thus requiring network rekeying for sustained security and survivability. In this article we present a classification of key management schemes in sensor networks delineating their similarities and differences. We also describe a novel dynamic key management scheme, localized combinatorial keying (LOCK), and compare its security and performance with a representative static key management scheme. Finally, we outline future research directions.     

Predistribution and local collaboration-based group rekeying for wireless sensor networks

When a sensor network is deployed in a hostile environment, an adversary may launch such attacks as eavesdropping the communications and compromising sensor nodes. Using the compromised nodes, he may inject false sensing reports or modify the reports sent by other nodes. To defend against these attacks, researchers have proposed symmetric group key-based schemes. In these schemes, however, if a large number of nodes are compromised, many (sub)group keys will be revealed. This greatly endangers the filtering schemes, making them very ineffective or even useless. To address this problem, we propose a family of predistribution and local collaboration-based group rekeying (PCGR) schemes, which update the compromised group keys to prevent the compromised nodes from understanding the communications between noncompromised nodes or injecting false data. These schemes are designed based on a simple while controversial idea – preload future group keys into sensor nodes before their deployment. To protect the preloaded keys from being disclosed by compromised nodes, we propose a novel technique that requires neighboring nodes to collaborate to derive the future group keys. To the best of our knowledge, our schemes are the first set of distributed group rekeying schemes for sensor networks without involving online key servers. Extensive analysis and simulations are conducted to evaluate the proposed schemes, and the results show that the proposed schemes can achieve a good level of security, outperform several previous group rekeying schemes, and significantly improve the effectiveness of false data filtering.     

Key-management scheme for wireless sensor networks based on merging blocks of symmetric design

Wireless sensor networks as the key infrastructure of the new networking paradigm are vulnerable against different kinds of attacks. Therefore, ensuring a secure communication between the sensor nodes is important. One of the most critical issues in this regard is the key distribution mechanism. Due to the random deployment of the sensors in the target area, key pre-distribution is a promising approach, in which a list of keys, so-called key-ring, is pre-distributed to each sensor node before deployment. To establish a secure communication, two nodes must share a common key from their key-rings. In this paper, we consider a hybrid key pre-distribution approach based on the symmetric design. We propose a new scheme, which is a modification of the hybrid symmetric design in order to improve the connectivity and resilience. Considering the trade-off between resilience and connectivity, we introduce a new parameter based on the application requirement. The experimental results and analytical analysis approve the efficiency of our proposed approach and introduced parameter.     

Ad hoc网中基于哈希的对偶密钥预分配方案

随机密钥预分配是无线Ad hoc网络中最有效的密钥管理机制。提出了一个适用于Ad hoc网络的基于哈希函数的对偶密钥预分配方案。方案利用哈希函数的单向性,由哈希链形成密钥池,节点仅需预分发数量较少的密钥,就能与邻近节点有效建立对偶密钥。方案具有较低的存储成本与计算开销,同时能达到完全连通性,并能动态管理节点与密钥。分析表明,方案具有较好的有效性和安全性,更适合Ad hoc网络。     

Secure and Energy-Efficient Traffic-Aware Key Management Scheme for Wireless Sensor Network

In Wireless Sensor Network (WSN), a sensor node may communicate with a small set of neighbor sensor nodes. Existing key management schemes, did not consider this communication between these nodes. They establish shared keys for all pairs of neighbor sensor nodes. When the number of sensor nodes in WSN is augmented, large number of keys is to be loaded in each sensor node, which in turn causes supplementary energy consumption. If any two close sensor nodes are seldom in the active-state the assignment of shared keys may be gratuitous, since they may be hardly exploited.In this paper, based on this information, secure and Energy-Efficient Traffic Aware key Management (EETKM) is developed for WSN. This determines shared keys for active sensors which takes part in the direct communication. In order to broadcast keys without retransmission or acknowledgements, the proposed scheme gives an efficient Re-keying mechanism. The proposed scheme attains high connectivity which is shown through numerical results. The proposed scheme is applied for various routing protocols and the simulation results shows the stronger resilience, low energy consumption and increased delivery ratio.     

一种无状态的传感器网络密钥预分配方案

 在无线传感器网络中,节点被敌方捕获以后将泄露节点内存储的群组密钥等秘密信息,所以需要建立一种安全高效的群组密钥管理系统来及时对被捕获节点进行撤销,以保证无线传感器网络中群组通信的安全.提出一种基于逻辑密钥树结构的密钥预分配方案,群组控制者和密钥服务器(GCKS)为逻辑密钥树中每一逻辑节点分配一个密钥集,每一sensor节点对应一个叶节点,以及一条从该叶节点到根节点的路径,GCKS将该路径上所有节点的密钥植入sensor节点.节点撤销时,GCKS将逻辑密钥树分成互不相连的子树,利用子树中sensor节点的共享密钥进行群组密钥的更新.分析表明本方案满足无状态性,以及正确性、群组密钥保密性、前向保密性和后向保密性等安全性质,具有较低的存储、通信和计算开销,适用于无线传感器网络环境.     

一种基于ID的传感器网络密钥管理方案

对偶密钥的建立是无线传感器网络的安全基础,它使得节点之间能够进行安全通信。但是由于节点资源的限制,传统的密钥管理方法在传感器网络中并不适用。在分析了现有密钥预分配协议的前提下,该文提出一种新的基于ID的密钥预分配协议。此协议用计算和比较散列值的方式替代广播方式协商密钥,减少了传感器节点大量的通信消耗。然后,分析了所提出方案的安全性、通信量和计算量,并和已有协议进行了比较。结果表明本文的方法不仅能保证安全性,而且节约了大量通信资源。     

A new hybrid key pre-distribution scheme for wireless sensor networks

This article presents a novel hybrid key pre-distribution scheme based on combinatorial design keys and pair-wise keys. For the presented scheme, the deployment zone is cleft into equal-sized cells. We use the combinatorial design based keys to secure intra-cell communication, which helps to maintain low key storage overhead in the network. For inter-cell communication, each cell maintain multiple associations with all the other cells within communication range and these associations are secured with pair-wise keys. This helps to ensure high resiliency against compromised sensor nodes in the network. We provide in-depth analysis for the presented scheme. We measure the resiliency of the presented scheme by calculating fraction of links effected and fraction of nodes disconnected when adversary compromises some sensor nodes in the network. We find that the presented scheme has high resiliency than majority of existing schemes. Our presented scheme also has low storage overhead than existing schemes.

     

A Secure Key Predistribution Scheme for WSN Using Elliptic Curve Cryptography

Security in wireless sensor networks (WSNs) is an upcoming research field which is quite different from traditional network security mechanisms. Many applications are dependent on the secure operation of a WSN, and have serious effects if the network is disrupted. Therefore, it is necessary to protect communication between sensor nodes. Key management plays an essential role in achieving security in WSNs. To achieve security, various key predistribution schemes have been proposed in the literature. A secure key management technique in WSN is a real challenging task. In this paper, a novel approach to the above problem by making use of elliptic curve cryptography (ECC) is presented. In the proposed scheme, a seed key, which is a distinct point in an elliptic curve, is assigned to each sensor node prior to its deployment. The private key ring for each sensor node is generated using the point doubling mathematical operation over the seed key. When two nodes share a common private key, then a link is established between these two nodes. By suitably choosing the value of the prime field and key ring size, the probability of two nodes sharing the same private key could be increased. The performance is evaluated in terms of connectivity and resilience against node capture. The results show that the performance is better for the proposed scheme with ECC compared to the other basic schemes.     

Modeling Pairwise Key Establishment for Random Key Predistribution in Large-Scale Sensor Networks

Sensor networks are composed of a large number of low power sensor devices. For secure communication among sensors, secret keys are required to be established between them. Considering the storage limitations and the lack of post-deployment configuration information of sensors, random key predistribution schemes have been proposed. Due to limited number of keys, sensors can only share keys with a subset of the neighboring sensors. Sensors then use these neighbors to establish pairwise keys with the remaining neighbors. In order to study the communication overhead incurred due to pairwise key establishment, we derive probability models to design and analyze pairwise key establishment schemes for large-scale sensor networks. Our model applies the binomial distribution and a modified binomial distribution and analyzes the key path length in a hop-by-hop fashion. We also validate our models through a systematic validation procedure. We then show the robustness of our results and illustrate how our models can be used for addressing sensor network design problems.     

Two-Tier,Scalable and Highly Resilient Key Predistribution Scheme for Location-Aware Wireless Sensor Network Deployments

We propose a probabilistic key predistribution scheme for wireless sensor networks, where keying materials are distributed to sensor nodes for secure communication. We use a two-tier approach in which there are two types of nodes: regular nodes and agent nodes. Agent nodes are more capable than regular nodes. Our node deployment model is zone-based such that the nodes that may end up with closer positions on ground are grouped together. The keying material of nodes that belong to different zones is non-overlapping. However, it is still possible for nodes that belong to different zones to communicate with each other via agent nodes when needed. We give a comparative analysis of our scheme through simulations and show that our scheme provides good connectivity figures at reasonable communication cost by using minimal flooding in key distribution. Moreover, we show that our scheme is scalable such that no extra overhead in incurred in case of increased number of nodes and sensor field size. Most importantly, simulation results show that our scheme is highly resilient to node captures.     

New key pre-distribution scheme using symplectic geometry over finite fields for wireless sensor networks

To achieve secure communication in wireless sensor networks (WSNs), where sensor nodes with limited computation capability are randomly scattered over a hostile territory, various key pre-distribution schemes (KPSs) have been proposed. In this paper, a new KPS is proposed based on symplectic geometry over finite fields. A fixed dimensional subspace in a symplectic space represents a node, all 1-dimensional subspaces represent keys and every pair of nodes has shared keys. But this naive mapping does not guarantee a good network resiliency. Therefore, it is proposed an enhanced KPS where two nodes have to compute a pairwise key, only if they share at least q common keys. This approach enhances the resilience against nodes capture attacks. Compared with the existence of solution, the results show that new approach enhances the network scalability considerably, and achieves good connectivity and good overall performance.     

On the Detection of Clones in Sensor Networks Using Random Key Predistribution

Random key predistribution security schemes are well suited for use in sensor networks due to their low overhead. However, the security of a network using predistributed keys can be compromised by cloning attacks. In this attack, an adversary breaks into a sensor node, reprograms it, and inserts several copies of the node back into the sensor network. Cloning gives the adversary an easy way to build an army of malicious nodes that can cripple the sensor network. In this paper, we propose an algorithm that a sensor network can use to detect the presence of clones. Keys that are present on the cloned nodes are detected by looking at how often they are used to authenticate nodes in the network. Simulations verify that the proposed method accurately detects the presence of clones in the system and supports their removal. We quantify the extent of false positives and false negatives in the clone detection process.     

Location dependent key management in sensor networks without using deployment knowledge

In this paper we propose an approach for key management in sensor networks which takes the location of sensor nodes into consideration while deciding the keys to be deployed on each node. As a result, this approach not only reduces the number of keys that have to be stored on each sensor node but also provides for the containment of node compromise. Thus compromise of a node in a location affects the communications only around that location. This approach which we call as location dependent key management does not require any knowledge about the deployment of sensor nodes. The proposed scheme starts off with loading a single key on each sensor node prior to deployment. The actual keys are then derived from this single key once the sensor nodes are deployed. The proposed scheme allows for additions of sensor nodes to the network at any point in time. We study the proposed scheme using both analysis and simulations and point out the advantages.     

无线传感器网络密钥预分配蜂窝模型

要达到无线传感器网络的安全通信,必须对网络中节点之间的通讯数据用密钥进行必要的加密。文章使用蜂窝模型分组方案,把节点按照预测的地理位置关系分组,给处于相同组或是相邻组的节点之间分配共享密钥,使节点的分组模式和查询更符合节点广播特征。蜂窝模型密钥预分配机制极大的提高密钥利用率,减少了密钥分配和维护代价,使传感器网络的安全性和连通性极大的提高。     

无线传感器网络门限密钥共享模型

针对现有传感器网络密钥管理方案存在的网络连通度低、抗俘获性差、节点能耗高等问题,该文提出一种基于(q,l)门限秘密共享的密钥共享模型,采用虚拟簇头共享密钥,物理簇头重构密钥的方式完成簇头与簇成员的密钥协商。该模型实现了簇成员能耗最低、抗俘获性最优的目标,同时门限参数l和q能够调节簇头的抗俘获性、容错性和高效性。理论分析与实验证明,与传统的概率型方案相比,该模型有效地提高了节点抗俘获性和网络连通度,并降低了节点能耗。