Pairwise Keys Research Articles

SBK: A Self-Configuring Framework for Bootstrapping Keys in Sensor Networks

Key pre-distribution has been claimed to be the only viable approach for establishing shared keys between neighboring sensors after deployment for a typical sensor network. However, none of the proposed key pre-distribution schemes simultaneously achieves good performance in terms of scalability in network size, key-sharing probability between neighboring sensors, memory overhead for keying information storage, and resilience against node capture attacks. In this paper, we propose SBK, an in-situ self-configuring framework to bootstrap keys in large-scale sensor networks. SBK is fundamentally different compared to all key pre-distribution schemes. It requires no keying information pre-deployment. In SBK, sensors differentiate their roles as either service nodes or worker nodes after deployment. Service sensors construct key spaces, and distribute keying information in order for worker sensors to bootstrap pairwise keys. An improved scheme, iSBK, is also proposed to speed up the bootstrapping procedure. We conduct both theoretical analysis and simulation study to evaluate the performances of SBK and iSBK. To the best of our knowledge, SBK and iSBK are the only key establishment protocols that simultaneously achieve good performance in scalability, key-sharing probability, storage overhead, and resilience against node capture attacks.

An unconditionally secure location-aware key management scheme for static sensor networks

Location-adaptive key establishment schemes may or may not start with prior knowledge of the deployed sensor nodes, but they adapt to the geography of the deployment field (target field) in a sensor network. On the other hand, location-aware schemes use prior knowledge of the deployed sensor nodes of some target field in a sensor network. Such location-aware schemes improve substantially higher network connectivity and resilience against node captures if the deployment error between the actual and expected locations of the deployed sensor nodes is smaller. In this paper, we present a new location-aware key pre-distribution scheme in static sensor networks based on an existing polynomial-based key pre-distribution scheme proposed by Blundo et al. Our scheme makes use of the shares of symmetric bivariate polynomials over a finite field in order to establish pairwise keys between sensor nodes. Our scheme always guarantees that no matter how many nodes are captured in the network, the non-compromised nodes can still communicate between them with 100% secrecy. As a result, our scheme provides unconditionally security against sensor node capture attack, that is, our scheme is perfectly secure against sensor node capture attack. Moreover, it provides a better trade-off among network connectivity, communication overhead, computational overhead, storage requirement and security against node capture compared to those for the existing schemes. It also supports the addition of new sensor nodes after the initial deployment of sensor nodes.

Tree-based key predistribution for wireless sensor networks

The establishment of secure links between neighboring nodes is one of the most challenging problems in wireless sensor networks. In this article, we present an efficient key predistribution scheme for sensor networks such that pairwise keys are defined by iterated hash computations based on a tree structure. Our scheme can be regarded as an improvement of HARPS, Ramkumar and Memon (IEEE J Sel Area Commun 23(3):611---621, 2005),or a generalization of Leighton and Micali's scheme (Lect Notes Comput Sci 773:456---479, 1994). We rigorously analyze our scheme focusing on the resiliency of the network and hash computational complexity for each node and compare the performance with existing schemes. Specifically, we show that our scheme provides stronger resiliency and requires less hash computational complexity than HARPS.

Group-based key predistribution for wireless sensor networks

Many key predistribution techniques have been developed recently to establish pairwise keys between sensor nodes in wireless sensor networks. To further improve these schemes, researchers have also proposed to take advantage of the sensors' expected locations and discovered locations to help the predistribution of the keying materials. However, in many cases, it is very difficult to deploy sensor nodes at their expected locations or guarantee the correct location discovery at sensor nodes in hostile environments. In this article, a group-based deployment model is developed to improve key predistribution. In this model, sensor nodes are only required to be deployed in groups. The critical observation in the article is that the sensor nodes in the same group are usually close to each other after deployment . This deployment model is practical; it greatly simplifies the deployment of sensor nodes, while still providing an opportunity to improve key predistribution. Specifically, the article presents a novel framework for improving key predistribution using the group-based deployment knowledge. This framework does not require the knowledge of the sensors' expected or discovered locations and is thus suitable for applications where it is difficult to deploy the sensor nodes at their expected locations or correctly estimate the sensors' locations after deployment. To seek practical key predistribution schemes, the article presents two efficient instantiations of this framework, a hash key-based scheme and a polynomial-based scheme . The evaluation shows that these two schemes are efficient and effective for pairwise key establishment in sensor networks; they can achieve much better performance than the previous key predistribution schemes when the sensor nodes are deployed in groups.

Distributed Authentication of Program Integrity Verification in Wireless Sensor Networks

Security in wireless sensor networks has become important as they are being developed and deployed for an increasing number of applications. The severe resource constraints in each sensor make it very challenging to secure sensor networks. Moreover, sensors are usually deployed in hostile and unattended environments and hence are susceptible to various attacks, including node capture, physical tampering, and manipulation of the sensor program. Park and Shin [2005] proposed a soft tamper-proofing scheme that verifies the integrity of the program in each sensor device, called the program integrity verification (PIV), in which sensors authenticate PIV servers (PIVSs) using centralized and trusted third-party entities, such as authentication servers (ASs). This article presents a distributed authentication protocol of PIVSs (DAPP) without requiring the commonly used ASs. DAPP uses the Blundo scheme [Blundo et al. 1992] for sensors and PIVSs to establish pairwise keys and for PIVSs to authenticate one another. We also present a protocol for PIVSs to cooperatively detect and revoke malicious PIVSs in the network. We implement and evaluate both DAPP and PIV on Mica2 Motes and laptops, showing that DAPP reduces the sensors' communication traffic in the network by more than 90% and the energy consumption on each sensor by up to 85%, as compared to the case of using a centralized AS for authenticating PIVSs. We also analyze the security of DAPP under various attack models, demonstrating its capability in dealing with diverse types of attacks.

An one-way function based framework for pairwise key establishment in sensor networks

We develop a one-way function based key establishment framework for Wireless Sensor Networks (WSNs). The proposed framework allows sensors to establish pairwise session keys at an arbitrary network operation stage using pre-loaded one-way functions. We also present an efficient instantiation of the proposed framework using Cellular Automata (CA). The analysis based on the CA instantiation indicates that our framework possesses a number of nice properties: inherent support for rekeying; quasi-perfect resilience against node compromise; computational efficiency; strong cryptographic strength of generated pairwise keys; a high probability to establish pairwise keys between sensors.

Two attacks on a sensor network key distribution scheme of Cheng and Agrawal

A sensor network key distribution scheme for hierarchical sensor networks was recently proposed by Cheng and Agrawal. A feature of their scheme is that pairwise keys exist between any pair of high-level nodes (which are called cluster heads) and between any (low-level) sensor node and the nearest cluster head. We present two attacks on their scheme. The first attack can be applied for certain parameter sets. If it is applicable, then this attack can result in the compromise of most if not all of the sensor node keys after a small number of cluster heads are compromised. The second attack can always be applied, though it is weaker.

Modeling Pairwise Key Establishment for Random Key Predistribution in Large-Scale Sensor Networks

Sensor networks are composed of a large number of low power sensor devices. For secure communication among sensors, secret keys are required to be established between them. Considering the storage limitations and the lack of post-deployment configuration information of sensors, random key predistribution schemes have been proposed. Due to limited number of keys, sensors can only share keys with a subset of the neighboring sensors. Sensors then use these neighbors to establish pairwise keys with the remaining neighbors. In order to study the communication overhead incurred due to pairwise key establishment, we derive probability models to design and analyze pairwise key establishment schemes for large-scale sensor networks. Our model applies the binomial distribution and a modified binomial distribution and analyzes the key path length in a hop-by-hop fashion. We also validate our models through a systematic validation procedure. We then show the robustness of our results and illustrate how our models can be used for addressing sensor network design problems.

Combinatorial Design of Key Distribution Mechanisms for Wireless Sensor Networks

Secure communications in wireless sensor networks operating under adversarial conditions require providing pairwise (symmetric) keys to sensor nodes. In large scale deployment scenarios, there is no priory knowledge of post deployment network configuration since nodes may be randomly scattered over a hostile territory. Thus, shared keys must be distributed before deployment to provide each node a key-chain. For large sensor networks it is infeasible to store a unique key for all other nodes in the key-chain of a sensor node. Consequently, for secure communication either two nodes have a key in common in their key-chains and they have a wireless link between them, or there is a path, called key-path, among these two nodes where each pair of neighboring nodes on this path have a key in common. Length of the key-path is the key factor for efficiency of the design. This paper presents novel deterministic and hybrid approaches based on Combinatorial Design for deciding how many and which keys to assign to each key-chain before the sensor network deployment. In particular, Balanced Incomplete Block Designs (BIBD) and Generalized Quadrangles (GQ) are mapped to obtain efficient key distribution schemes. Performance and security properties of the proposed schemes are studied both analytically and computationally. Comparison to related work shows that the combinatorial approach produces better connectivity with smaller key-chain sizes.

A Reliable Pairwise Key-Updating Scheme for Sensor Networks

This paper proposes a reliable pairwise key-updating (RPKU) scheme for clustered WSNs via predistribution and local collaboration approaches. Based on the modified version of Blom's matrix construction, this scheme can extend and shrink the pairwise keys in WSNs with the network topology changes. This scheme also presents a hierarchical key distribution method in the clustered WSNs, guaranteeing that any pair of neighboring nodes can find a common secret key between themselves. Comparison and simulation results show that the proposed scheme outperforms most of the existing pairwise key establishment schemes in terms of network security,

Non-interactive key establishment in mobile ad hoc networks

We present a new non-interactive key agreement and progression (NIKAP) scheme for mobile ad hoc networks (MANETs), which does not require an on-line centralized authority, can non-interactively establish and update pairwise keys between nodes, is configurable to operate synchronously or asynchronously, and supports differentiated security services w.r.t. the given security policies. NIKAP is valuable to scenarios where pairwise keys are desired to be established without explicit negotiation over insecure channels, and also need to be updated frequently.

Compromise-Resistant Pairwise Key Establishments for Mobile Ad hoc Networks

This letter presents a pairwise key establishment scheme that is robust against the compromise of nodes in mobile ad hoc networks. Each node establishes local keys with its neighbor nodes that are at most three hops away at network boot-up time. When any two nodes establish a pairwise key, they receive the secret information from the nodes on the route between them, and construct the pairwise key using the secret information. Here, the local keys are utilized by the nodes on the route to send the secret information securely. The simulation results have proven that the proposed scheme provides better security than the key pre-distribution-based scheme.

배치정보를 이용한 클러스터 기반 센서 네트워크 키 설정 메커니즘

센서 네트워크를 실생활에 적용하기 위해서는 보안 서비스가 반드시 같이 제공되어야하며 보안에 있어서 핵심은 노드 간에 안전한 통신을 가능하게 하는 pairwise 키 설정이다. 본 연구에서는 센서 네트워크를 사전에 클러스터링하고 각 클러스터에 헤드를 두어 기본적인 정보는 사전에 예측된 배치정보에 의해 배분하고 노드 배치 후 실제적으로 이웃 노드를 파악하여 정보가 필요한 노드들만이 클러스터헤드에게 해당 정보를 요청하는 메커니즘을 제안한다. 제안 메커니즘은 클러스터헤드가 좀 더 많은 정보를 사전 분배받는 대신 일반 노드의 메모리 부담을 훨씬 줄였으며 불필요한 정보를 분배하지 않음으로써 노드 포획 시에도 이에 대한 저항성을 높여 보안성을 한층 강화할 수 있을 뿐 아니라 모든 이웃 노드 간 직접키 설정을 보장함으로써 효율적인 키 설정과 통신이 가능하다. For applying sensor networking technology for our daily life, security service is essential, and pairwise key establishment is the key point for security. In this paper, we propose fairwise key establishment mechanism for secure coumunication in sensor networks. In the mechanism, we cluster the network field before deployment and predistribute key materials to normal sensor nodes and clusterheads. For clusterheads, more key materials are predistributed, and after deployment, sensor nodes which need to establish pairwise keys with other sensor nodes in different clusters make request for related key materials to their own clusterheads. Our proposal reduces the memory requirements for normal sensor nodes by distributing more information to clusterheads, and it raises the security level and resilience against node captures. In addition, it guarantees perfect pairwise key establishments for every pair of neighboring nodes and provides efficient and secure sensor communications.

Pairwise Key Agreement Protocols Based on the Weil Pairing

To achieve security in the networks, it is important to be able to encrypt and authenticate messages sent between the users. Keys for encryption and authentication purposes must be agreed upon by the users in the networks. Three new pairwise key agreement protocols based on Weil pairing are proposed in this paper. In those protocols, all the users share common secret information. They may arrange the pairwise key and authenticate each other by fewer messages. The proposed protocols have the security attributes such as known session key security, perfect forward secrecy, no key-compromise impersonation, no unknown key-share and no key control.

Improving key predistribution with deployment knowledge in static sensor networks

Pairwise key establishment is a fundamental security service for sensor networks. However, establishing pairwise keys in sensor networks is a challenging problem, particularly due to the resource constraints on sensor nodes and the threat of node compromises. This article proposes to use both predeployment and postdeployment knowledge to improve pairwise key predistribution in static sensor networks. By exploiting the predeployment knowledge, this article first develops two key predistribution schemes, a closest pairwise keys scheme and a closest polynomials scheme . The analysis shows that these schemes can achieve better performance if the expected location information is available and that the smaller the deployment error is, the better performance they can achieve. The article then investigates how to use postdeployment knowledge to improve pairwise key predistribution in static sensor networks. The idea is to load an excessive amount of predistributed keys on sensor nodes, prioritize these keys based on sensors' actual locations discovered after deployment, and discard low-priority keys to thwart node compromise attacks. This approach is then used to improve the random subset assignment scheme proposed recently to demonstrate its practicality and effectiveness. The analysis indicates that the postdeployment knowledge can also greatly improve the performance and security of key predistribution.

센서 네트워크에서의 안전한 통신을 위한 클러스터 기반 키 분배 구조

We can obtain useful information by deploying large scale sensor networks in various situations. Security is also a major concern in sensor networks, and we need to establish pairwise keys between sensor nodes for secure communication. In this paper, we propose new pairwise key establishment mechanism based on clustering and polynomial sharing. In the mechanism, we divide the network field into clusters, and based on the polynomial-based key distribution mechanism we create bivariate Polynomials and assign unique polynomial to each cluster. Each pair of sensor nodes located in the same cluster can compute their own pairwise keys through assigned polynomial shares from the same polynomial. Also, in our proposed scheme, sensors, which are in each other`s transmission range and located in different clusters, can establish path key through their clusterheads. However, path key establishment can increase the network overhead. The number of the path keys and tine for path key establishment of our scheme depend on the number of sensors, cluster size, sensor density and sensor transmission range. The simulation result indicates that these schemes can achieve better performance if suitable conditions are met.

Establishing pairwise keys in distributed sensor networks

Pairwise key establishment is a fundamental security service in sensor networks; it enables sensor nodes to communicate securely with each other using cryptographic techniques. However, due to the resource constraints on sensor nodes, it is not feasible to use traditional key management techniques such as public key cryptography and key distribution center (KDC). A number of key predistribution techniques have been proposed for pairwise key establishment in sensor networks recently. To facilitate the study of novel pairwise key predistribution techniques, this paper develops a general framework for establishing pairwise keys between sensor nodes using bivariate polynomials. This paper then proposes two efficient instantiations of the general framework: a random subset assignment key predistribution scheme, and a hypercube-based key predistribution scheme. The analysis shows that both schemes have a number of nice properties, including high probability, or guarantee to establish pairwise keys, tolerance of node captures, and low storage, communication, and computation overhead. To further reduce the computation at sensor nodes, this paper presents an optimization technique for polynomial evaluation, which is used to compute pairwise keys. This paper also reports the implementation and the performance of the proposed schemes on MICA2 motes running TinyOS, an operating system for networked sensors. The results indicate that the proposed techniques can be applied efficiently in resource-constrained sensor networks.

New Directions in Sensor Network Key Management

Sensor networks require efficient, low latency key management techniques that enable strong security and tolerance of node compromise. Conventional interactive approaches using public key certificate-based key management techniques are not communications efficient and are very time-consuming. Protocols that leverage elliptic curve cryptography reduce communications but still require considerable interactive exchange. Noninteractive techniques that leverage identity-based public-key cryptography show considerable promise, but these techniques are relatively immature and require considerable computations. Conversely, random key predistribution techniques reduce computations, but at the expense of many interactions. In this paper, we describe recent work in the cryptographic community that combines the benefits of both identity-based cryptography and random-key predistribution into a framework we call identity-based random-key predistribution (IBRKP). IBRKP establishes pair-wise keys with virtually no extra communications and provides security versus node memory trade-offs for the sensor network designer to engineer.