the large energy consumption on the LLK establishment. Combinatorial design techniques are proposed in [8], [9]. They can

Transcription

1 I SCALABLE LINK-LAYER KEY AGREEMENT IN SENSOR NETWORKS Yun Zhou and Yuguang Fang Deparmen of Elecrical and Compuer Engineering Universiy of Florida, Gainesville, FL 326 Tel: (352) ; Fax: (352) ABSTRACT Link layer key agreemen beween neighboring nodes is a fundamenal issue for securing sensor neworks deployed in unaended and hosile environmens. Recen research ofen assumed a predisribuing approach so ha each pair of neighboring nodes agrees on a shared key direcly or indirecly hrough a mulihop pah. The shorcomings include large memory cos, poor resilience agains node compromise, low secure conneciviy, ec. In his paper, we presen a link-layer key agreemen scheme combining a scalable key agreemen model and space diversiy. In conras o previous proposals, our scheme have higher resilience o node compromise aacks wih much smaller memory coss and high secure conneciviy so ha much less energy needs o be consumed in esablishing indirec keys hrough muli-hop rouing. INTRODUCTION Key agreemen is very criical for securing wireless sensor neworks, because encrypion and auhenicaion services are based on he operaions involving keys. The simple pairwise key approach, which requires each pair of nodes in a nework wih N nodes share a disinc symmeric key, is no scalable due o is memory cos of N - keys per node. In [], [2], a hreshold-based mehod is proposed such ha each node sores A secres and any pair of nodes is able o agree on a unique shared key. The collusion of less han A nodes can no reveal any key held by oher normal nodes, i.e., A-secure. To guaranee perfec secure in a nework wih N nodes, i.e., every key beween a pair of nodes is secure no maer how many oher nodes collude, he (N -2)-secure scheme should be used, which means he memory cos per node is N-. Obviously, hese schemes are lack of scalabiliy and only suiable and opimum in small neworks. Mos recen research in sensor neworks [3][4] focuses on he applicaions of hose schemes in local area of sensor neworks o esablish Link-layer keys (called LLKs hereafer) among neighboring nodes, because he number of nodes in he neighborhood is limied. In he pioneering work [3] and is followers [4]-[6], a global se of secres is uniformly pre-disribued ino he nework so ha This work was suppored in par by he US Office of Naval Research under gran N (Young Invesigaor Award). each node has a secre subse and wo neighboring nodes can achieve a probabilisic key agreemen by he inersecion of heir secre subses. In his way, wo nodes can shared a key direcly or esablish an indirec key wih he help of several inermediae nodes hrough a muli-hop pah. These schemes are vulnerable o node compromise in ha he secres in compromised nodes can be used by he adversary o derive keys shared by oher noncompromised nodes. Moreover, he number of secres ha each node needs o keep is limied due o he memory consrains, which implies a smaller probabiliy ha wo neighboring nodes can esablish a direc LLK, i.e., lower local secure conneciviy, and much more communicaion overhead on indirec LLKs esablishmens hrough muli-hop pahs. Some deerminisic work is developed in [7]-[9]. In [7], all N nodes in a nework are organized ino a 2 dimensional grid. Each node is preloaded wih unique pairwise keys for 2(N- ) nodes, which have he same horizonal or verical coordinaes. Any wo neighboring nodes can esablish an LLK wih he help of no more han one inermediae node. Due o he uniform key predisribuion, he local secure conneciviy is very low, indicaing he large energy consumpion on he LLK esablishmen. Combinaorial design echniques are proposed in [8], [9]. They can ensure key sharing beween any pair of nodes. In heir schemes, however, each key is reused by many sensor nodes like ha in [3]. This leads o poor resilience o node compromise. In addiion, he memory cos of heir schemes is roughly 0)(XN) where N is he oal number of nodes. Some schemes [0]-[4] use locaion informaion o localize he impac of he node compromise aack and increase conneciviy by inenionally pre-disribue he same se of secres in small cells. They can achieve much higher conneciviy han uniform pre-disribuion schemes. However, hey are probabilisic schemes, and sill feaures vulnerabiliy o node compromise and high memory cos. In his paper, we propose a novel LLK agreemen scheme ha combines a scalable key agreemen model we have developed in [5] and node deploymen knowledge. Unlike he aforemenioned schemes, our scheme is scalable in ha i can can provide a high level of securiy and conneciviy wih very small memory cos, which is 0(3kN) per node, where k >. The res of he paper is organized as follows. We will describe

2 our scheme in Secion II. Analysis and evaluaion are carried ou in Secion III. Finally he paper is concluded in Secion IV. he polynomial symmery, he desired shared key beween nodes u and v is calculaed as DETAILS OF OUR SCHEME Kulv Our scheme is based on a mehod we have developed in [5]. Each sensor node carries a share of a global -degree mulivariae symmeric polynomial. If he shares of wo nodes are correlaed, he wo nodes can calculae a shared key direcly. Oherwise, hey can negoiae an indirec key wih he help of an inermediae node. We uilize node deploymen knowledge such ha nodes wih correlaed shares are deployed as close as possible. In his way, each node can direcly calculae LLKs wih mos of is neighbors. In his secion, we will elaborae he deails of our scheme. A. Mahemaical Model A -degree (k )-variae polynomial is defined as f(xi,2, Xk,Xk)... E - io i20 ik,ik... Sikk l Xili2 EEai,,i2,...,ik,ik,k. () iko ik0 All coefficiens of he polynomial are chosen from a finie field IFq, where q is a prime ha is large enough o accommodae a crypographic key. A (k )-uple permuaion is defined as a bijecive mapping (X: [,k] - [,kl] (2) By choosing all he coefficiens according o i2 i2... ik),ikl i () i(2..i () <()(3 for any permuaion u7, we can obain a symmeric polynomial in ha f (xi, X2, *.. Xk, Xkl) f(x(), SCx(2), *.. *, a(k), ff(kl)) (4) Every node should have k credenials, which are posiive and pairwise differen inegers. Suppose node u has credenials (U, U.,... Uk) and node v has credenials (vl, v2,..., vk). Before node deploymen, we can assign a polynomial share f (ul, U2.,..., Uk, Xk) o u and anoher share f (vi, v2.... Vk,Xkl) o v. By assigning polynomial shares, we mean ha he coefficiens of -degree univariae polynomials f(ul, 2,...*,k, k±) and f(vl, v2,...,x ±) are loaded ino node u's and v's memory, respecively. If he credenials of node u and node v have only one mismach, i.e., ) for some i C [, k], vii vi, and 2) forj,2,...,k, ji, Uj vj Cj, hen node u and node v can have a shared key. Node u can ake vi as he inpu o is share f (ui, U2,...., Uk, i), and node v can ake ui as he inpu o is share f(vl, v2,..., Vk, Xk±). Due o f (ClX2 (C,C2,... Ci-l: Ui:Cil:...,Ci-l Vi, Cil,...,Ck, Vi),Ck,Ui) (5) B. Nework Model We assume each node is idenified by an index-uple (n, n2,...,nk), where ni 0,,...,Ni -,i C {,2,....,k}, and we may use he index-uple as he node ID. Hence each node is mapped ino a poin in a k-dimension vecor se Si x S2 x * x Sk, where ni C Si c Z and he cardinaliy Si Ni, for i, 2,..., k. The maximum number of nodes ha he nework can consis of is N H Ni. Due o he broadcas characerisics of radio communicaions, adversaries can easily eavesdrop any messages, eiher non-encryped or encryped, ransmied over he air beween nodes. Adversaries may capure any node and compromise he secres sored in he node. Furhermore, adversaries can use he compromised secres o derive more secres shared beween oher non-compromised nodes. We ry o reduce he probabiliy ha he keys shared beween non-compromised nodes are exposed when some nodes have already been compromised. To furher evaluae he impac of node compromise, we assume he probabiliy of he compromise of a node is p. C. Share Disribuion Before nework deploymen, a global -degree (k )-variae symmeric polynomial is consruced as is saed in Secion II-A. This polynomial is used o derive shares for sensor nodes. To achieve key agreemen, every node n should have k credenials (Cl, C2,..., Ck), which are posiive and pairwise differen as is required in Secion II-A. These credenials can be creaed and preloaded ino nodes before deploymen. However, i requires addiional memory space per node. Forunaely, he k credenials can be derived from he k indices in node ID (n, n2,...,nk) by a bijecion, i.e., C C2 C3 ICk - Ck nl n2nl n3nin2 (6) Nl Nk2 N nk Nk nk where ni,,...,ni - for i,2,...,k. Thus, he k credenials are drawn from differen zones in ha cl e [, N] and ci CE [Nl N,_, N, Nj] for i' 2,... k, which guaranee hey are posiive and pairwise differen (Fig. ). For a node (nl, n2,..., nk), a polynomial share fk±(xk) 2 of 6 f (Cl, C2,. (7) Ck, Xk) ik 0

3 c2 cl 0 Ni c3 ck Nl...Nk NN2 Consrucion of posiive and pairwise differen credenials according o he equaion (6). ci are credenials derived from Figure. node ID. real nework opology of he example in Fig. 2 (a) is illusraed in Fig. 2 (b). is calculaed, where bik PI i E EE il 0 0 i2 bik~ ~~~ail,2, ~0k... k~~kc0lc2 c~ Cik ci2 Ck,ikl ik 0 (8) and (cl, c2,....,cc) is mapped from (n, n2,..., nk) according o he equaions (6). Then he polynomial share is assigned o he node. Here, he node only knows he coefficiens of he univariae polynomial share, bu no he coefficiens of he original (k )-variae polynomial. Therefore, even if he marginal bivariae polynomial is exposed, he global polynomial is sill safe if he degree is chosen properly. D. Node Deploymen According o Secion II-A, wo nodes can calculae a shared key if heir credenials have only one mismach in hem. Due o he one-o-one mapping in he equaions (6), wo nodes u wih ID (U, U2,..., Uk) and v wih ID (vl, v2,..., k) can direcly calculae a shared key wihou any ineracion if heir IDs have only one mismach. If he wo nodes are wihin he radio coverage of each, hen he key can be used as an LLK. Therefore, we need a deploymen mehod ha inenionally make nodes wih only one mismach in heir IDs be deployed as close as possible. In such a way, each node can esablish Link-layer keys wih mos of is neighbors. Because node ID is an index-uple (n, n2,*** nk), where ni 0,,..., Ni, i C {, 2,..., k}, he nework is logically consruced wih k levels. The i-h level consiss of N x N2 x... x Ni cells, each of which has N±i subcells, i.e., N±i x... x Nk nodes, where i, 2,..., k -2. The (k -)-h level consiss of N x N2 x... x Nk- cells, each of which has Nk nodes. Here, he noaion (n, n2,..., ni) can be seen as cell ID a he i-h level for i, 2,..., k -. An example is illusraed in Fig. 2 (a), where Ni N2 N3 9. To faciliae key agreemen, he logical nework opology is ransformed ino a real one, which decides he real node deploymen model. Suppose a level-(i -) cell has Ni Ri x Ci subcells. To do he ransformaion, he following wo seps are aken: ) in he firs sep, flip he even rows of he level- (i -) cell verically; 2) in he second sep, flip he even columns of he level-(i- ) cell horizonally. An example is depiced in Fig. 3. A cell a he (i- 2)-h level has Nii 3 x 5 level-(i -) subcells (Fig. 3 (a)), each of which again has Ni subcells. By he wo-sep ransformaion, we ge he real cell opology illusraed in Fig. 3 (b). The enire nework opology is consruced based on he wo-sep ransformaion. In his way, he nework is divided ino N x N2 x... x Nk- cells, where cells are locaed according o he space order deermined by he wo-sep ransformaion. All he nodes are deployed ino corresponding cells based on heir IDs. The E. Link-layer Key Agreemen As is saed before, wo nodes u wih ID (U, U2,..., Uk) and v wih ID (vl, v2,..., Vk) can direcly calculae a shared key wihou any ineracion if here is only one mismach, say he i-h indices, in heir IDs. Then node u can ake vin Ni as he inpu o is own share f(ci, C2,..., ck, Xk), and node v can as well ake ui N... Ni- as he inpu o is share f (ci, c2,..., c, Xk±). The direc shared key beween nodes u and v is hen calculaed as _KUlV fj(ci..., ui IN,., Ck Vi I N, f(ci...,vi I N, Ck.,ci, N,... Ni-, Ni-) Ni-,... Ni-) (9) Because all node credenials of u and v are drawn from differen subses where any wo subses have no inersecion and ui a vi, he k credenials used o calculae he shared key are pairwise differen, and he se of credenials is unique. Therefore he shared key calculaed by he nodes u and v is unique, i.e., oher nodes do no know he shared key. Consider our deploymen model. A he lowes level, he nework is divided ino N x N2 x... x Nk cells. All he nodes in each of hose cells have common ID prefix, which is he cell ID, and heir node IDs are only differen a he k-h posiion. Therefore, any pair of nodes in one cell can calculae a direc shared key. For example, wo nodes (04) and (044) in cell (04) (Fig. 2 (b)) can calculae a shared key direcly. For wo neighboring cells, if heir cell IDs has only one mismach, each node in one cell can find anoher node in he oher cell such ha he wo nodes have only one mismach in heir node IDs, i.e., he wo nodes can calculae a shared key direcly. In he example Fig. 2 (b), node (04) in cell (04) can calculae a shared key direcly wih node (08) in cell (08). Wih he help of node (08), node (04) can indirecly esablish a shared key wih every oher node in cell (08). For wo neighboring cells wih wo mismaches in heir cell IDs, hey are in he diagonal direcion of each oher and have a neighboring cell in common, which has only one mismach in cell ID wih each of hem. In Fig. 2 (b), node (08) in cell (08) can indirecly negoiae a shared key wih node (5) in cell (5) hrough node (8) in cell (8), because node (8) has direc keys wih node (08) and (5) respecively. Then node (08) can indirecly negoiae a shared key wih each of oher nodes in cell (5) hrough node (5). In our deploymen model, each node can calculae direc LLKs wih mos of is neighbors because mos of is neighbors are in 3 of 6

4 (a) (b) Figure 2. (a) Logical nework opology before deploymen. Each node has an ID (n,n22, n3), where ni C [, Nj] and N N2 N3 9. (b) Real nework opology afer deploymen. Each node (n, n2, n3) is deployed ino he corresponding cell (n, n2). II(a) each of w Ic Nsuc's () Iclpo (b) Figure 3. A cell a he (i -2)-h level has 5 level-i subcells,, each of which again has Ni subcells. (a) is he logical opology before deploymen. Afer flipping he even rows of he level-(i - 2) cell verically and hen he even columns horizonally, we ge (b), he real opology for node deploymen. he same cell as i, and negoiae indirec LLKs wih he res neighbors wih he help of only one inermediae node. Moreover, each node can even esablish shared keys wih oher nodes mulihop away. ANALYSIS AND EVALUATION In his secion, we will carry ou some analysis and evaluae our scheme in comparison wih some ypical schemes including [3], [7]-[0]. A. Memory Cos All nodes in he nework hold parial informaion of one - degree (k )-variae polynomial o achieve key agreemen. The memory cos of each node is because each node needs o sore a -degree univariae polynomial. The smaller is, he less memory cos. However, he value of should no be oo small. During he nework lifeime, some nodes may be compromised and hen collaborae o expose he polynomial wih he parial informaion hey hold whereby o direcly calculae keys beween oher nodes. Obviously, he polynomial degree is an indicaion of he difficuly o expose he polynomial, and i is direcly relaed o he securiy performance. By choosing he value of properly, we can guaranee ha no maer how many nodes are compromised, heir collaboraion canno expose direc keys held beween oher non-compromised nodes, i.e., he global -degree (k )-variae polynomial canno be exposed. I has been proved in [5] ha o guaranee he securiy of he global polynomial he following wo condiions mus be saisfied: 0 < N -2 <, i,2,...,k, (0) and I(H k ki 2 -N ((k I i i Obviously, he soluion should be >. ( ) (2) However, i is very difficul o ge * analyically. If we le Ni N for i, 2,..., k, i.e., all subspaces have he same number of indices, we can bound * as [5] * < r N, (3) 4 of 6

5 TABLE I. Bound and precise raios beween * and N k TABLE II. r PIKE [7] is similar o our scheme in ha any pair of nodes can esablish a shared key hrough no more han one inermediae node. The difference is ha i does no uilize deploymen knowledge o faciliae LLK agreemen and hus is more expensive in communicaion. Moreover, is memory cos per node is higher han ours. Obviously, our scheme is more secure han convenional schemes. * IN Memory cos of differen schemes Schemes E-G [3] LBKP [0] PIKE [7] Combinaorial schemes [8], [9] Ours C. Local Secure Conneciviy Memory Cos m 5( ) 2(N- O(VN) ) 9(kN) where raio r k(k2 )! (4) The second column in Table I gives some bound raios when k is small. The numerical value of * are given in he hird column in Table I when k is small. We compare he memory cos per node of our schemes wih oher schemes in TABLE II. In E-G scheme [3] each node has a subse of m keys, where m may be more han 00 if i needs o mainain a cerain securiy or conneciviy. In LBKP [0] each node is preloaded wih 5 polynomial shares, each of which has a degree of. However, in order o mainain srong securiy, he value of is very high. So is memory cos is much higher han ours. In PIKE [7], each node mus sore 2(N-) keys where N is he nework size. Combinaorial design echniques are proposed in [8], [9]. They are similar o E-G [3], bu hey can ensure key sharing beween any pair of nodes. The memory cos of heir schemes is roughly O(4N) where N is he oal number of nodes. However, he memory cos of our scheme can be 0( kvn), which is much less. Every node can calculae direc LLKs wih some neighbors, and esablish indirec LLKs wih oher neighbors hrough one inermediae node. The local secure conneciviy is direcly relaed o he communicaion overhead of key esablishmens. If a node has high probabiliy o calculae direc LLKs, i can save a lo of communicaion overhead on he esablishmen of indirec LLKs hrough muli-hop rouing. Hence, high local secure conneciviy, which is he probabiliy of esablishmen of direc LLKs, is desirable in sensor neworks. Suppose nodes are uniformly deployed in each cell. The local secure conneciviy can be calculaed as he raio of node coverage in is cell o he node ransmission area. Suppose he side lengh of each cell is 2D, node radio radius is R. Due o he symmery of square cell, we only consider he firs quadran in he Caresian coordinae plane (Fig. 4), where he cener of cell is locaed a he origin of he plane. The firs quadran is divided ino five areas, each of which is corresponding o differen node coverage A(x0, y,) in he cell, where (x0, y,) is he locaion of node. The A(x0, y,) can be calculaed as A(x, Y,) 7R2, R2 In convenional schemes [3], [8]-[0], when he number of compromised nodes is large, he direc keys among non-compromised nodes can be exposed. Moreover, he indirec keys are as well insecure because each indirec key has o be esablished wih he help of several inermediae nodes along a pah. If such a pah involve h inermediae nodes, hen he probabiliy ha an indirec key is exposed can be calculaed as Pc I_( _p)h (5) wheno<x,< D-R, O<y0< D-R 2 arccos(2y2 when ) Y0 0) O<xo<D-R,D-R<yo<D ) arccos(2x) ) X0 when D-R<xo<D,O<yo<D-R ) 2 arccos(2y) ) R2( _ arccos(2x) X0 X02 y Y2), when D-R < xo < D D-R < yo < D, R2 B. Securiy In our scheme, each node can calculae direc LLKs wih mos of is neighbors. Each direc LLK is only known by he pair of nodes ha shares i, and he key can no be derived by oher nodes, because we choose he value of such ha he global polynomial is secure in case of node compromise. As for oher neighbors, each node can negoiae an indirec LLK wih each of hem hrough only one inermediae node. So if he probabiliy of node compromise is p, hen he probabiliy of he exposure of he indirec key is jus p. (6) R2((Xo V (xo- D)2 (yo -D)2 > R2 y02)(y X02) I X02) Y0 arccos(- X ( X02)( XoYI) when D-R<xo<D,D-R<yo<D, (xo- D)2 (yo -D)2 < R2 _y02) (7) where XO DR-o YO D -yo Thus he local secure connecr iviy can be calculaed as D D C A (x, (8). ~~~~C7R2D2 (oy,) dx,dy In scheme [3], each node selecs M keys from S keys, hus he local secure conneciviy is roughly (SMM) /( ) where S > M. In PIKE [7], each node keeps unique pairwise keys wih 2(N- ) nodes, hus he local secure conneciviy of PIKE is abou 2/AN. Schemes [8], [9] are similar o PIKE 5 of 6

6 y D D-R 0 U-R U Figure 4. Node coverage in one cell. [7] in ha he local secure conneciviy is roughly 0(/VN). LBKP scheme [0] uses locaion informaion o faciliae key pre-disribuion so ha each node can esablish direc LLKs wih all neighbors in is cell and in neighboring cells, leading he local secure conneciviy o abou if all he nodes are uniformly deployed in heir home cell. The low local secure conneciviy of schemes [3], [7]-[9] is because each node canno sore oo much keys o increase he local secure conneciviy. However, in ours scheme he local secure conneciviy is unrelaed o memory cos. For example, suppose he size of cell size is 200 x 200m2 and node radio radius is 25m. The local secure conneciviy of ours scheme is 0.89, which is much higher han ha of [3], [7]-[9], which is usually much less han 0.5. CONCLUSION In his paper, we proposed a novel key agreemen scheme, which is scalable for large neworks wih small memory cos. Compared wih convenional schemes which have memory cos of a leas 0 (4N) in a nework wih N nodes, our scheme has only 0 ( kn) memory cos per node, where k >. Moreover, we uilize node deploymen knowledge o faciliae direc LLK agreemen so ha he local secure conneciviy is very high. In his way, he communicaion overhead of esablishing indirec LLKs is reduced significanly. The securiy of our scheme is very srong in ha mos LLKs are esablished direcly, and he oher indirec LLKs are esablished hrough only one inermediae node. REFERENCES r-, l-% pp [] R. Blom, "An opimal class of symmeric key generaion sysems," in Proc. of EUROCRYPT '84, pages , 985. [2] C. Blundo, A. De Sanis, A. Herzberg, S. Kuen, U. Vaccaro,and M. Yung, "Perfecly-secure key disribuion for dynamic conferences," in Advances in Crypology C CRYPTO 92, LNCS 740, pages , 992. [3] L. Eschenauer and V. Gligor, "A key managemen scheme for disribued sensor neworks," in ACM CCS'02, Washingon D.C., [4] H. Chan, A. Perrig, and D. Song, "Random key predisribuion schemes for sensor neworks," in Proceedings of he 2003 IEEE Symposium on Securiy and Privacy, p.l97, May -4, [5] W. Du, J. Deng, Y. S. Han, and P. K.Varshney, "A pairwise key predisribuion scheme for wireless sensor neworks," in CCS'03, Washingon, DC, Ocober 27-30, [6] D. Liu, and P. Ning, "Esablishing pairwise keys in disribuied sensor neworks," CCS'03, Washingon, DC, [7] H. Chan and A. Perrig, "Pike: peer inermediaries for key esablishmen in sensor neworks," in IEEE INFOCOM'05, March, [8] J. Lee and D. Sinson, "Deerminisic key predisribuion schemes for disribued sensor neworks," Seleced Areas in Crypography, [9] S. Camepe and B. Yener, "Combinaorial design of key disribuion mechanisms for wireless sensor neworks," Proc. Ninh European Symp. Research Compuer Securiy, [0] D. Liu, and P. Ning, "Locaion-based pairwise key esablishmens for relaively saic sensor neworks," In ACM Workshop on Securiy ofad Hoc and Sensor Neworks(SASN'03), Ocober [] W. Du, J. Deng, Y S. Han, S. Chen and P. K. Varshney, "A key managemen scheme for wireless sensor neworks using deploymen knowledge," in he IEEE INFOCOM 2004, Hong Kong, March [2] Y. Zhou, Y. Zhang, and Y. Fang, "LLK: A link-layer key esablishmen scheme in wireless sensor neworks," in IEEE WCNC'05, New Orleans, LA, March [3] Y. Zhou, Y. Zhang, and Y. Fang, "Key esablishmen in sensor neworks based on riangle grid deploymen model," IEEE Miliary Communicaions Conference (MILCOM'05), Alanic Ciy, New Jersey, Ocober 7-20, [4] D. Liu, P. Ning and W. Du, "Group-based key pre-disribuion in wireless sensor neworks," ACM WiSe'05, Sepember, [5] Y. Zhou and Y. Fang, "A scalable key agreemen scheme for large scale neworks," in 2006 IEEE Inernaional Conference on Neworking, Sensing and Conrol (ICNSC06), F. Lauderdale, Florida, USA, April 23-25, of 6