Secure Distributed Cluster Formation in Wireless Sensor Networks

Transcription

1 Secure Dstrbuted Cluster Formaton n Wreless Sensor Networks Kun Sun Intellgent Automaton, Inc. ksun@-a-.com Pa Peng Opsware Inc. ppeng@opsware.com Clff Wang Army Research Offce clff.wang@us.army.ml Peng Nng NC State Unversty pnng@ncsu.edu Abstract In wreless sensor networks, clusterng sensor nodes nto small groups s an effectve technque to acheve scalablty, self-organzaton, power savng, channel access, routng, etc. A number of cluster formaton protocols have been proposed recently. However, most exstng protocols assume bengn envronments, and are vulnerable to attacks from malcous nodes. In ths paper, we propose a secure dstrbuted cluster formaton protocol to organze sensor networks nto mutually dsjont clques. Our protocol has the followng propertes: (1) normal nodes are dvded nto mutually dsjont clques; (2) all the normal nodes n each clque agree on the same clque membershps; (3) whle external attackers can be prevented from partcpatng n the cluster formaton process, nsde attackers that do not follow the protocol semantcs can be dentfed and removed from the network; (4) the communcaton overhead s moderate; (5) the protocol s fully dstrbuted. 1 Introducton A wreless sensor network typcally conssts of a potentally large number of resource constraned sensor nodes and a few relatvely powerful control nodes such as moble laptops. Each sensor node s usually battery powered, and has a low-end processor, a lmted amount of memory, and a lowpower communcaton module capable of short-range wreless communcaton. The sensor nodes form an ad-hoc network through the wreless lnks. Wreless sensor networks are deal canddates for a wde range of applcatons, such as target trackng and montorng of crtcal nfrastructures. In large sensor networks, the sensor nodes can be grouped nto small clusters by ther physcal proxmty to acheve better effcency, and each cluster may elect a cluster-head to Ths work s partally supported by the Natonal Scence Foundaton (NSF) under grant CAREER Wang s work s supported by the US Army Research Offce (ARO) under staff research grant W911NF-04- D The work of Sun and Peng were performed when they were graduate students at NC State Unversty. coordnate the nodes n the cluster. Many effcent clusterbased protocols have been developed for sensor networks to acheve scalablty, power savng, channel access, routng, etc. For example, the cluster structure can prolong the lfetme of the sensor network by makng the cluster-head aggregate data from the nodes n the cluster and reduce the data sent to the base staton (e.g., [4, 14, 30]). As another example, a cluster-head can arrange a tme-slotted schedulng for wreless channel access so that message collsons can be reduced by allowng only one node n the cluster to access the channel at any tme (e.g., [20, 28]). A randomly deployed sensor network requres a cluster formaton protocol to partton the network nto clusters. When cluster heads are requred, nodes n each cluster may also perform a leader electon protocol to determne ther cluster head. Several cluster formaton protocols have been proposed for wreless sensor networks (e.g., [2 7, 11, 14, 16 18, 27, 30]). Based on the order n whch cluster formaton and leader electon are performed, we can dvde the cluster formaton protocols nto two categores: Leader-Frst (LF) approaches and Cluster-Frst (CF) approaches. In Leader- Frst approaches (e.g., [2, 3, 14, 30], cluster-heads are frst elected based on certan metrcs (e.g., degree of connectvty, remanng energy), and then they agree on how to assgn other nodes to dfferent clusters. In Cluster-Frst approaches (e.g., [16, 18, 24, 27]), all the sensor nodes frst form clusters, and each cluster then elects ts cluster-head. Such approaches requre all the nodes n one cluster agree on the same membershp before electng ther cluster-head, and sensor nodes are almost always dvded nto clques so that nodes n each clque can drectly communcate wth each other. Most exstng cluster formaton protocols assume bengn envronments, and cannot survve attacks from malcous partcpants n hostle envronments. In the Leader-Frst approaches, malcous nodes may le about ther metrcs (e.g., ncrease transmsson power for cluster-head advertsement messages n LEACH [14]) to make themselves elected as cluster-heads. As a result, they can control all the nodes n ther clusters. Smlarly, none of the Cluster-Frst protocols can guarantee a consstent vew on clque membershps when

2 malcous nodes send false nformaton. Vasudevan et al. proposed two secure leader electon algorthms by usng a trusted authorty to certfy each node s metrcs used n the leader electon process [26]. However, these algorthms assume all the partcpatng nodes are relable and no messages are lost or delayed, whch cannot be guaranteed when there are malcous nodes. In ths paper, we propose a Cluster-Frst, secure and dstrbuted cluster formaton protocol. By exchangng nformaton wth 1-hop neghbors, normal sensor nodes are dvded nto mutually dsjont clques, n whch all the nodes can drectly communcate wth each other. Our protocol guarantees that all the normal nodes n each clque agree on the same clque membershp even under the attacks from both external and nternal malcous nodes. We use the protocol semantcs to dstngush malcous behavors from normal ones, dentfy and remove nsde attackers that devate from the protocol. Our secure cluster formaton protocol s dfferent from the authentcated Byzantne Agreement algorthms (e.g., [8, 12, 25]), whch can successfully solve the tradtonal Byzantne General problem [19]. These authentcated Byzantne Agreement algorthms can guarantee all the normal nodes n one group agree on a sngle or a set of value(s) by usng the sgnature-based authentcaton. Our protocol ams to dvde a sensor network (one large group) nto multple small groups (clques) and guarantee all the normal nodes n each small group agree on the same group membershp. All the normal nodes have to fgure out consstently how to partton the network, and the normal nodes n dfferent groups have dfferent group membershp. Our secure dstrbuted cluster formaton protocol has the followng propertes even f there are external and nsder attackers: The protocol s fully dstrbuted. Each node computes ts clque only usng the nformaton from ts 1-hop neghbors. The protocol s guaranteed to termnate. Partcpatng nodes that do not follow the protocol specfcaton (e.g., send conflctng messages) wll be dentfed and removed from all clques. After the protocol termnates, all normal nodes are dvded nto mutually dsjont clques. All normal nodes are guaranteed to have consstent vews on ther clque membershps even n hostle envronments. The rest of ths paper s organzed as follows. Secton 2 presents the problem and the system model. Secton 3 descrbes the secure dstrbuted cluster formaton protocol and proves ts securty. Secton 4 evaluates the performance of the protocol through smulatons. Secton 5 dscusses the related work. Secton 6 concludes ths paper. 2 Problem Statement Objectve: The objectve of our clque formaton protocol s to dvde the normal nodes n a sensor network nto mutually dsjont clques so that all the nodes n the same clques can drectly communcate wth each other. Each node should ndvdually compute ts vew of clque based on the nformaton exchanged wth ts 1-hop neghbors. We denote the vew of clque for node as C. For brevty, we call C as the clque of node. We call a node a normal node f t follows our protocol. Otherwse, t s a malcous node. We would lke to guarantee that all normal nodes have consstent clques, as reflected by the followng clque agreement property. Clque agreement for a normal node s defned as: Defnton 1 (Clque Agreement) For each node j C, C j = C. Defnton 1 mples that for each normal node j / C, / C j must hold. That s, each normal node belongs to only one clque. Clque agreement s broken f Clque Inconsstency s detected. For node, clque nconsstency s defned as: Defnton 2 (Clque Inconsstency) There exsts a node j C such that C j C. It s desrable that each node can fnd as large a clque as possble. We do not consder trval solutons wth whch each node forms a clque that only ncludes tself. Threat Model: We assume an adversary may launch arbtrary attacks aganst the cluster formaton protocol except for completely jammng the communcaton channel. An external attacker may eavesdrop, nject, and replay packets to dsrupt the cluster formaton protocol. However, these attacks can be easly defeated wth message authentcaton. An attacker may generate more severe mpact by partcpatng n the clusterng formaton process usng malcous nodes (e.g., those compromsed by the adversary). The malcous nodes may arbtrarly devate from the protocol n order to ntroduce clque nconsstency. In partcular, a malcous node may use drectonal antenna to send dfferent messages to dfferent neghbor nodes. Moreover, t can communcate wth some normal nodes whle ntentonally keep slence to others. (We call ths slence attack.) The malcous nodes may launch Sybl attacks [9] or Wormhole attacks [15]. However, we assume these two knds of attacks can be detected by usng the technques proposed n [22] and [15], respectvely. Assumptons: We assume each node knows ts 1-hop neghbors. A message sent by a normal node can be receved correctly by all ts (1-hop) neghbors n a fnte amount of tme. We assume each sensor node has a unque ID, and each node can be unquely dentfed due to ts keyng materals (e.g., unque parwse keys shared wth other nodes, prvate

3 keys used for dgtal sgnatures). All uncast messages exchanged between nodes are authentcated wth the key shared between the two nodes. We assume the sensor nodes can perform publc key based dgtal sgnature operatons. It has been shown n recent nvestgatons [13, 21] that low-end sensor nodes (e.g., MICA2 motes wth 8-bt processors) can perform publc key cryptographc operatons. Moreover, recent development of sensor platforms such as Intel motes 1 uses more advanced hardware, and can perform publc key cryptographc operatons effcently. We use a combnaton of µtesla [23] and dgtal sgnature to authentcate broadcast messages. We use dgtal sgnatures when non-repudaton s necessary, and µtesla for effcent broadcast authentcaton n other cases. We assume the clocks of the normal nodes are loosely synchronzed, as requred by µtesla. We also assume the publc keys used by the sensor nodes are properly authentcated. One approach to ensure ths s to ssue to each node a certfcate for ts publc key so that other nodes can valdate the node s publc key by verfyng the certfcate. 3 The Secure Dstrbuted Cluster Formaton Protocol In ths secton, we frst present the detals of our protocol, and then analyze ts propertes n normal stuaton and hostle envronments, ncludng clque consstency property and performance overheads. 3.1 Protocol Specfcaton Our secure dstrbuted cluster formaton protocol conssts of fve steps. When all the nodes are normal, the cluster formaton process termnates after the frst four steps. In hostle envronments, when clque nconsstency s detected, the protocol provdes an extra Step 5 to remove the dentfed malcous nodes from the network and restart the protocol from Step 1. The protocol s summarzed below: Step 1: Each node exchanges ts neghbor lsts wth ts neghbors, and computes ts local maxmum clque. Step 2: Each node exchanges ts local maxmum clque wth ts neghbors, and updates ts maxmum clque accordng to ts neghbor nodes local maxmum clques. Step 3: Each node exchanges the updated clque wth ts neghbors, and derves ts fnal clque. Step 4: Each node exchanges the fnal clque wth ts neghbors. If no clque nconsstency s detected, t termnates successfully. Otherwse, t enters Step motes.htm Step 5: Each node performs conformty checkng. If t dentfes malcous (neghbor) nodes, t removes them from the network, and restarts the protocol from Step 1. Otherwse, t enforces the clque agreement and termnates. In the followng, we wll explan these steps n detal. To facltate the dscusson, we wll use the smple example shown n Fgure 1. Fgure 1(a) shows a sensor network consstng of 8 sensor nodes. A drectonal edge from node to node j represents node j can receve messages from node. Consderng asymmetrc communcaton, we assume node 0 can hear from node 3, whle node 3 cannot hear from node 0. Fgure 1(b) shows the results of our clque formaton protocol when all the 8 nodes are normal. (a) A network wth 8 nodes (b) Cluster formaton Fgure 1. An Example of Cluster Formaton Step 1: Calculatng Local Maxmum Clque Based on our assumptons, each node can obtan a neghbor lst L that contans the IDs of ts 1-hop neghbor nodes. In the frst step, all the nodes exchange ther neghbor lsts wth all ther neghbors. As dscussed earler, such messages should be authentcated wth the parwse key shared between neghbors. After recevng ts neghbors neghbor lsts, each node can buld a neghbor matrx M that records the connectvty between ts neghbor nodes. Each element n a neghbor matrx s ether 1 or 0. The element n the th row and jth column of the neghbor matrx s 1 f node contans node j n ts neghbor lst, or 0 otherwse. If node fals to receve the neghbor lst from a (prevous) neghbor node j, t removes j from ts neghbor lst. Each node then symmetrzes ts neghbor matrx by consderng undrectonal lnks as no lnks at all. For example, n Fgure 1, node 1 consders that node 0 and node 3 are not connected, snce node 0 s not n node 3 s neghbor lst. The neghbor matrx of node 1 n Fgure 1(a) s shown n Table 1. Based on the neghbor matrx, each node ndvdually computes a local maxmum clque that ncludes tself. Based on node s neghbor matrx, we can construct a graph G =

4 Table 1. Node 1 s Neghbor Matrx {V, E }, where V conssts of node and ts neghbors, and E conssts of the bdrectonal edges between nodes n V. It s well known that fndng the maxmum clque n a random graph s an NP-complete problem [10]. For node, t s also NP-complete [29] to fnd the maxmum clque contanng node n G. To reduce the computaton complexty, we propose a heurstc algorthm for node to compute ts local maxmum clque, as shown n Algorthm 1. Algorthm 1 Heurstc Algorthm to Fnd the Local Maxmum Clque INPUT: G = {V, E }, V OUTPUT: C STEPS: S = {j (, j) E }; C = {}; whle ( S ) do Fnd k S wth maxmum L L k L L L k C C {k} S S {k} {j (j, k) / E, j S } end whle The heurstc algorthm runs n rounds. L ncludes node s 1-hop neghbor nodes that are elgble to be n the same clque as node. In each round, node chooses one neghbor node and adds t nto ts local maxmum clque C. Node mantans a set S contanng ts neghbor nodes that are elgble to be chosen n the next round. Intally, all the neghbors of node are ncluded n S, and C only contans node tself. In the frst round, node computes the number of common neghbors between tself and each neghbor, and fnds a neghbor k wth the maxmum common neghbors L L k. We use node ID to break the te. Then node removes node k from S and adds t nto C. Node also removes the nodes that are not drectly connected wth k from set S. In the second round, from the updated S, node fnds the neghbor node that has the maxmum number of common neghbors wth all the nodes n C (.e., nodes and k). Node then removes ths node from S and adds t nto C. Those nodes that are not drectly connected wth ths node wll then be removed from set S. Node contnues dong so untl the set S s empty. After ths algorthm fnshes, node sorts the nodes n C ascendngly by node IDs and gets ts local maxmum clque C 1. In our protocol, we use Ck to denote the clque derved by node n the kth step (1 k 4). Our heurstc algorthm cannot guarantee to fnd the optmal clque; however, t provdes a sub-optmal soluton wth less computaton overhead. We show t through the smulaton result n Secton 4 Let us see how ths algorthm works on node 1 n Fgure 1. Intally, node 1 has C 1 = {1}, L 1 = {0, 2, 3, 4, 7}, and S 1 = {0, 2, 3, 4, 7}. In the frst round, node 2 has 2 common neghbors L 1 L 2 = {0, 3} wth node 1; node 3 also has 2 common neghbors L 1 L 3 = {2, 4} wth node 1. Because node 2 and node 3 have the same maxmum number of common neghbors wth node 1, we prefer the smaller ID to break the te. Thus, node 1 adds node 2 nto C 1, and C 1 = {1, 2}. Then, node 1 removes node 2 from S 1,.e., S 1 = {0, 3, 4, 7}. Because nodes 4 and 7 cannot drectly communcate wth node 2, node 1 also removes nodes 4 and 7 from S 1 and S 1 = {0, 3}. In the second round, node 0 and node 3 have the same number of common neghbors wth both node 1 and node 2. Node 1 chooses node 0 that has a smaller ID nto C 1. Then, C = {0, 1, 2}, and S 1 = after removng node 0 and node 3. Node 3 s removed from S 1 snce node 3 s not connected wth node 0. Fnally, node 1 s local maxmum clque s C = {0, 1, 2}. Smlarly, we have C0 1 = C1 2 = {0, 1, 2}, C1 3 = C1 4 = C1 5 = C1 6 = {3, 4, 5, 6}, and C7 1 = {1, 7} Step 2: Orderng and Updatng Maxmum Clques The local maxmum clque computed n step 1 at dfferent nodes are lkely to be dfferent. In step 2, each node looks at the local maxmum clques derved by ts neghbors, and updates ts local maxmum clque to prepare for fnal clque agreement. In ths step, each node broadcasts ts local maxmum clque C 1 to all ts neghbors. For effcency, such broadcast messages can be authentcated wth µtesla. Because node calculates ts local maxmum clque C 1 by a heurstc algorthm based on ts local neghbor nformaton, t s possble for node to receve a larger local maxmum clque Cj 1 that contans from a neghbor j. Therefore, after recevng the local maxmum clques from ts neghbors, node checks f there exsts any clque Cj 1 whch s better than ts clque C 1. To compare clques computed by dfferent nodes, we defne a relaton on clques as follows: Defnton 3 C j C k f and only f 1. C j, C k, and 2. a). C j < C k, or b). C j = C k, but c j < c k, where c j = mn{a a C j a / C k } and c k = mn{b b C k b / C j }, or c). C j = C k, but j < k. The relaton gves a total order for the local maxmum clques receved by node. We can compare two clques C j and C k by relaton only f both clques contan node. We have C j C k f the number of nodes n C k s greater than

5 that n C j ; or both clques contan the same number of nodes, but for the frst two dfferent IDs c j C j and c k C k we have c j < c k ; or C j contans the same nodes as C k, but j < k. In two ascendngly ordered local maxmum clques, the frst two dfferent IDs are also the smallest two dfferent IDs. For example, f C j = {1, 2, 3} and C k = {1, 3, 4}, then 1 c j = 2 and c k = 3, and C j C k. Suppose node receves n clques that contan node. Node orders these clques as Cα... C 1... Cα 1 n, and updates ts clque to the best clque Cα 1 n. After Step 2, node has an updated clque C 2 = C1 α n. We call C 2 as node s updated clque. Let us llustrate ths step wth the example n Fgure 1. After recevng the local maxmum clques from neghbor nodes, node 1 has C0 1 = C = C1 2 = {0, 1, 2}, C1 3 = C1 4 = {3, 4, 5, 6}, and C7 1 = {1, 7}. Node 1 can mmedately drop the clques from nodes 3 and 4, snce they do not contan node 1. Because C7 1 < C0 1, node 1 has C7 C0 1. Because C0 1 = C = C2 1 but node IDs 0 < 1 < 2, we have C0 C1 C2 1. Therefore, node 1 orders the clques from node 0, 1, 2 and 7 as C7 C0 C1 C2 1, and updates ts clque to C1 2 = C1 2 = {0, 1, 2}. Consder node 7. It wll keep ts clque unchanged snce node 1 s clque C = {0, 1, 2} does not contan node 7. After Step 2, we have C0 2 = C2 1 = C2 2 = {0, 1, 2}, C2 3 = C2 4 = C2 5 = C2 6 = {3, 4, 5, 6}, and C7 2 = {1, 7}. We can see that node 7 stll has clque nconsstency wth node Step 3: Obtanng Fnal Clque In ths step, each node broadcasts ts updated clque C 2 to ts neghbors. Smlarly to the broadcast messages n step 2, these messages should also be authentcated wth µtesla. For every node j n C 2, node checks f t s ncluded n j s clque Cj 2. If not, node removes j from ts clque C2. After ths step, each node obtans ts fnal clque C 3. If node does not receve node j s updated clque, node smply keeps node j n ts clque. For our example n Fgure 1, because C1 2 = {0, 1, 2} does not contan node 7, node 7 removes node 1 from C7 2 = {1, 7}, and obtan ts fnal clque C7 3 = {7}. Fnally, all the nodes are grouped nto 3 clques, whch are C0 3 = C3 1 = C3 2 = {0, 1, 2}, C3 3 = C4 3 = C5 3 = C6 3 = {3, 4, 5, 6} and C7 3 = {7}. If all the nodes are normal, after the frst three steps, we can guarantee the clque agreement. We prove ths n Secton 3.2. However, n hostle envronments, snce compromsed nodes may devate from the protocol, we need extra steps to detect the potental clque nconsstency and dentfy the malcous nodes Step 4: Checkng Clque Agreement All the nodes broadcast ther fnal clques to ther neghbors. Each node also calculates a secure hash over all the four messages sent n the frst four steps, sgn ths hash value, and append t nto the message that contans the fnal clque. When a normal node receves the frst copy of a fnal clque Cj 3 from ts neghbor j or forwarded by another neghbor, f j C 3, node rebroadcasts the clque C3 j. The goal of ths rebroadcast s to prevent slence attacks. Each node verfes the clque agreement. That s, node verfes for all j C 3, whether C3 j = C3 holds. When clque nconsstency s detected, node enters Step 5; otherwse, t termnates the clque formaton process Step 5: Identfyng Insder or Enforcng Clque Agreement Ths step conssts of two stages. In Stage I, node performs conformty checkng to dentfy malcous nodes that send nconsstent messages n the prevous four steps. The basc dea s to use the protocol semantcs to dstngush malcous behavors from normal ones. When malcous nodes are dentfed, node sends an alert to other nodes, usng the malcous nodes sgnatures as proofs. After removng the malcous nodes from the network, all the remanng nodes restart the protocol from Step 1 agan. The malcous nodes that have been dentfed wll be removed from normal nodes neghbor lst and thus cannot launch further attacks. A malcous node may send messages to some normal neghbor nodes, but keep slence to others. Accordng our assumptons, the messages sent from normal nodes can be receved n a fnte amount of tme. Thus, a normal node may detect a malcous node f certan messages are not receved from the malcous node. However, the normal node does not have any proof to convnce other normal nodes who do receve the messages from the malcous node. A normal node cannot dstngush a normal node who really detects a malcous node from a malcous node who forges a false alert on a normal node. In such cases, node enters Stage II to enforce the clque agreement, and fnsh the clque formaton protocol. We descrbe these two stages n detal below. Stage I: Conformty Checkng. Suppose a normal node detects a clque nconsstency wth node j. Node requests node j to forward the messages that node j receved n the frst four steps. Because node j has receved node s authentcated fnal clque C 3 n Step 4, only f C 3 C3 j, node j wll provde ts prevously receved messages to node. Node j need sgn these messages to prove that these messages are forwarded by node j. For effcent sgnng, node j may calculate a secure hash over all the messages, and smply sgn and send ths hash value n one message. After verfyng node j s sgnature, node performs the followng conformty checkng for node j. Conformty Checkng 1 Node j follows the clque formaton protocol correctly n the frst four steps. In the above checkng, node re-computes the frst three

6 steps of the cluster formaton protocol for node j. If the derved fnal clque s not the same as what node receved from node j n Step 4, node j s a malcous node. Node can use node j s sgnatures as a proof to notfy other normal nodes n the network. If node j passes checkng 1, node performs the followng checkng on all the common neghbors of nodes and j. Conformty Checkng 2 For any node k L L j, k sends the same messages to and j n every step. Because node has messages drectly receved from node k and the message from node k receved and forwarded by node j, f node k sends dfferent messages to nodes and j n any step, node can detect the malcous node k and use the conflctng messages from node k as proofs to convnce all the other nodes. Conformty Checkng 1 and 2 guarantee to detect the malcous nodes f clque nconsstency s caused by malcous nodes sendng nconsstent messages. It s proved by Theorem 2 n Secton Node enters Stage II when no malcous node s dentfed. Stage II: Consstency Enforcement When a malcous node launches slence attacks, a normal node may detect the malcous node f certan messages are not receved from the malcous node. However, the normal node does not have any proof to convnce other normal nodes who do receve the messages from the malcous node. Moreover, a normal node cannot dstngush a normal node who really detects a malcous node from a malcous node who forges a false alert on a normal node. In such cases, our protocol can ensure that all the normal nodes acheve clque agreement by performng the followng consstency enforcement. Suppose two normal nodes and j fnd nconsstency,.e., j C 3, C3 j (whch s proved n Lemma 3) and C 3 Cj 3. Wthout loss of generalty, we assume k C 3 and k / C3 j. Consstency Enforcement 1 If k C 2, k / C2 j, node receves Ck 1, and node j does not receve C1 k, then node removes j from C 3, node j removes from C3 j. Consstency Enforcement 1 deals wth the slence attack n Step 2, when a malcous node k sends ts local maxmum clque to node and keep slence to node j. However, smply removng k from C 3 s not a good opton, because node j may be malcous and le about the recept of Ck 1. As a result, a normal node k may become solated. Thus, the safest way s to splt nodes and j nto dfferent clques. Consstency Enforcement 2 If k C 2 C2 j, node j receves Ck 2 and j / C2 k, node does not receve C2 k, then node removes k from C 3. Consstency Enforcement 2 deals wth the slence attack n Step 3, when a malcous node k sends ts updated clque to node j, but does not send t to node. Snce node k s the only possble malcous node (among nodes, j, and k), node smply removes t from C 3. After performng the above two enforcements, we name the new clques as C and Cj for and j, respectvely. In Secton 3.3.2, we prove that our protocol can guarantee clque agreement through these enforcements. 3.2 Effectveness n Bengn Envronments When all the nodes are normal, our protocol guarantees all the nodes n one clque agree on the same clque membershp by followng the frst three steps. Lemma 1 For two nodes and j, f C 2 j and j C2, then C 2 = C2 j. PROOF. In Step 2 of our protocol, after node receves clques from all ts neghbors, t orders these clques as C 1 α 1... C 1... Cα 1 n, and updates ts clque to the best clque C 2 = Cα 1 n. Smlarly, node j can have an updated clque Cj 2 = C1 β n From Cj 2 = C1 β n, node can compare Cβ 1 n wth Cα 1 n. Node has Cβ 1 n Cα 1 n snce Cα 1 n s the best clque among from the clques from all the neghbors. Because j C 2 = Cα 1 n, node can also derve Cβ 1 j n Cα 1 n. However, from j C 2, node j has j C1 α n C 1 βn. Ths can happens only f α n = β n, so we can prove C 2 = C2 j. Lemma 1 guarantees that f node and node j contan each other n ther updated clques at the end of Step 2, then ther updated clques must contan the same clque membershp. Lemma 2 Consder nodes, j and k, where k C 2 = C 2 j. If / C 2 k, then j / C2 k. PROOF. We prove t by contradcton. Suppose j Ck 2. Because / Ck 2 and C2 = Cj 2, we have C2 k C2 j. Because k C 2 = Cj 2, by Lemma 1, we have C2 j = C2 k. Snce Ck 2 = C2 j = C2, t contradcts to / C2 k. From Lemma 1, when node k s ncluded n both node and node s updated clques at the end of Step 2, f node s not ncluded n node k s updated clque, node j wll not be ncluded ether. Based on Lemmas 1 and 2, we have the followng clque agreement theorem that guarantees all the normal nodes n each clque agree on the same clque membershp. Theorem 1 For node and any node j C 3, f all the nodes are normal, we must have C 3 = C3 j. PROOF. For any node j C 3, j C2 must hold. We also have Cj 2, otherwse j should be removed from C3. By

7 Lemma 1, we have C 2 = Cj 2. For any node k that k C2 but k / C 3, we know / C2 k. Then by Lemma 2, we have j / Ck 2. Then k wll not appear n C3 j. It means for every node that s removed from C 3, t must also be removed from Cj 3. Therefore, we can prove that C3 = C3 j. 3.3 Securty Analyss n Hostle Envronments Malcous nodes may employ dfferent methods to compromse clque agreement among normal nodes. Our protocol can prevent external attacks by usng (uncast and broadcast) message authentcaton. Thus, a malcous node cannot use a fake dentty n our protocol wthout graspng the keyng materals. In the followng, we focus on the nsder attacks n whch some partcpatng nodes are malcous. If malcous nodes broadcast the same false messages or keep slence to all the normal neghbors, they cannot ntroduce clque nconsstency. Malcous nodes may send nconsstent messages n dfferent steps, so that the clques are not correctly derved. However, snce such attacks generate the same mpact on all the normal neghbors, they cannot ntroduce clque nconsstency ether. Therefore, clque nconsstency can only result from sendng dfferent messages to dfferent normal nodes, or launchng slence attacks from malcous nodes. In Secton 3.3.1, we prove that malcous nodes wll be detected and dentfed f clque nconsstency s caused by sendng nconsstent messages. In Secton 3.3.2, we prove that our protocol can tolerate slence attacks and clque agreement can be enforced by removng the conflctng nodes Identfyng Malcous Nodes We frst ntroduce Lemma 3, and then use t to prove Theorem 2. Lemma 3 For two normal nodes and j, f j C 3, then we must have Cj 3. PROOF. We prove t by contradcton. Suppose / Cj 3. Snce j C 3, we must have j C2. We consder two cases. If / Cj 2, j wll send C2 j to, then should remove j from C 3 n Step 3. It s contrary to our condton that j C 3. Otherwse, f Cj 2 but / C3 j, t means j has removed from Cj 2. The only reason s that s clque C2 does not nclude j,.e., j / C 2. It contradcts to j C2. Lemma 3 guarantees that f node j s ncluded n node s fnal clque, then node j must nclude node n ts fnal clque, even n hostle envronments. Theorem 2 If clque nconsstency s caused by malcous nodes sendng nconsstent messages to dfferent normal nodes, our protocol can dentfy the malcous nodes. PROOF. Suppose a normal node detects clque nconsstency wth node j n Step 4,.e., j C 3 but C 3 Cj 3. To detect the malcous nodes, node asks node j to provde ts prevously receved messages and performs Conformty Checkng 1 on j. If j passes ths checkng, t means j follows the protocol correctly, and the nconsstency must come from other nodes. Otherwse, j s malcous. Consder the case when j performs normally. By Lemma 3, f normal node j C 3, we must have C3 j. So any node k that s not a common neghbor of both node and j cannot appear n ether C 3 and Cj 3. Therefore the nconsstency must come from common neghbors of nodes and j. By performng Conformty Checkng 2 on all the common neghbors of and j, we wll fnd the dfferent messages sent to and j, and dentfy the malcous nodes. If node j s malcous, node can detect the conflcts between the messages receved from node j n Step 4 and the messages receved from node j n Step 5. Because node j provdes sgnatures on these messages, other nodes cannot mpersonate t to send fake messages. Thus, node can use these messages from node j as proofs to nform other nodes n the network. The malcous node j wll be removed from the network. Smlarly, f a common neghbor node k of node and node j s malcous, node can use the messages drectly receved from node k and node k s messages receved and forwarded by node j as proof to remove node k from the network Enforcng Clque Agreement We observe that slence attacks can ntroduce clque nconsstency only n Steps 2 and 3. In Step 1, a malcous node may send ts neghbor lst to some neghbor nodes, but wthhold t from other neghbor nodes. However, n Step 2, our protocol allows a normal node update ts clque to a better clque, even f the better clque contans some nodes that dd not send ther neghbor lsts to node n Step 1. Thus, the slence attack n Step 1 wll not cause clque nconsstency. In Step 2, clque nconsstency can only come from the better clques sent by malcous nodes, snce a normal node wll update ts clque to a better clque. Suppose nodes and j are normal. A malcous node k may send a better clque Ck 1 that ncludes and j, but wthhold the message from node j. Then node updates ts clque to Ck 1. If node j receves the better clque from node, t updates ts clque to C 1. Therefore, node and j nclude each other n ther clques that are nconsstent. However, Consstency Enforcement 1 can remove such clque nconsstency. In Step 3, clque nconsstency can only be ntroduced by removng nodes from clques. Suppose k C 2 C2 j. In Step 3, node k can send a clque to remove tself from s clque, whle keepng slence to j. Then the fnal clque of j contans k, whch s not n node s fnal clque. In Step 4, after a normal node receves a fnal clque Ck 3 from node k, node rebroadcasts Ck 3 f k C3. Because

8 we assume the messages from a normal node can be receved correctly by ts normal neghbors, ths rebroadcast can guarantee that f one normal node receves Ck 3 from node k, all the other normal nodes n the same clque can receve Ck 3. Thus, t can prevent slence attacks n Step 4. In the followng Theorem 3, we prove that by removng the nconsstent nodes from clques through the consstency enforcement, all the normal nodes can acheve clque agreement even f malcous nodes ntentonally keep slence to certan normal nodes. Theorem 3 For any two normal nodes and j, after Step 5, f j C, we have C = C j. PROOF. We prove t by contradcton. Suppose C Cj. Snce our protocol can only remove nodes from clques when nconsstency s detected, C 3 must contan all the nodes n C. Therefore j C3. By lemma 3, we have C3 j. We consder two cases. Frst, suppose C 3 Cj 3 and C Cj. Wthout loss of generalty, we assume node k C 3 but k / Cj 3. Nodes and j fnd nconsstency after exchangng C 3 and C3 j. By Consstency Enforcement 1, node removes j from ts clque, and node j also removes from ts clque. Therefore we have j / C. It s contrary to the condton j C. Second, we assume C 3 = C3 j, but C C j. Wthout loss of generalty, suppose node k C but k / Cj. Because nodes can only be removed to enforce clque agreement n Step 5, k cannot be added to C, but removed from C j. Ths means Ck 3 s nconsstent wth C3 j. Snce C3 = Cj 3, C3 k s also nconsstent wth C 3. Because node j re-broadcasts the clque Ck 3 receved from k, node wll receve C3 k even f node k keeps slence to. Thus, should remove k from C. We fnd contradcton. In our protocol, the clque consstency checkng s only performed n Step 4, though t can be executed n each step. The reason s to reduce the computaton overhead by decreasng the number of sgnature generaton/verfcaton. Each node need not verfy the sgnatures from other nodes unless t detects clque nconsstency. Even f clque nconsstency s detected, each node only generates and verfes the sgnatures of the messages exchanged n Step 4 and Step 5. If the protocol checks the consstency n every step, malcous nodes may be detected n an earler step. However, the computaton overhead wll be ncreased a lot. 3.4 Performance Analyss Computaton Overhead: We make several efforts to lower the computaton overhead n our protocol. In all the fve steps, each node uses µtesla to authentcate ts broadcast messages. Because µtesla uses secure key cryptography that has much less computaton overhead than publc key cryptography, we only analyze the computaton overhead on publc key operatons. In Step 4, each node sgns the secure hash of ts local messages sent n the frst four steps, nstead of sgnng each message ndvdually. Each node need not verfy the sgnatures from other nodes unless t detects clque nconsstency wth them. Therefore, n bengn envronments, no sgnature verfcaton s necessary. In hostle envronments, after detectng a clque nconsstency wth node j, node verfes the sgnature from node j. In Step 5, after recevng node s request, node j generates a sgnature on the secure hash over the prevous receved messages from ts neghbors. Then, node needs to verfy node j s sgnature on the forwarded messages. If node j passes Conformty Checkng 1, node needs to verfy L L j sgnatures from the common neghbors of and j. Because a node may verfy more messages than those t sgns, we propose to choose publc key cryptosystems wth a fast decrypton speed, such as RSA, whch can verfy one sgnature n 0.43s on ATmega128 [13]. Snce the clque formaton process wll not be performed frequently, the computaton overhead s acceptable for sensor nodes. Communcaton Overhead: Each node broadcasts one message n each of the frst three steps. In Step 4, besdes broadcastng ts fnal clque, node also rebroadcasts the frst copy of the fnal clque message about a neghbor n node s fnal clque C 3. In total, node sends C3 + 3 messages. Suppose node j has L j neghbors. When node detects a clque nconsstency and requests node j to forward ts prevously receved messages n Step 5, node j needs to forward 4 L j messages receved n the frst four steps, plus one message ncludng the sgnature for the secure hash over all the forwarded messages. Storage Overhead: Accordng to the analyss of the computaton overhead, each node should store all the 4 L messages receved n the four steps, where L s the neghbor number of node. When node detects a clque nconsstency wth node j, node needs to store 4 L j + 1 messages from node j. Node can release the memory after verfyng these messages. 4 Expermental Results Through smulaton, we show that our protocol can provde secure cluster formaton wthout sacrfcng the performance of the clusters. We use the followng metrcs to evaluate the cluster characterstcs: average cluster sze, maxmum sze of clusters, varance of the cluster sze, and number of sngle-node clusters. The average cluster sze depends on the densty of the networks and the transmsson range of the sensor nodes. The average cluster sze should not be too small. In sensor networks, t s not desrable to nclude too many nodes n a large cluster due to the ncreasng message collsons and transmsson delay n a large cluster. We use Coeffcent of Varance (CV) = 100*(Standard Devaton)/(mean value of set) to evaluate the varance of the cluster sze. We expect to dvde nodes nto clusters wth a low coeffcent of varance. A

9 Average Cluster Sze Sze of Maxmum Cluster LCA Centralzed Clque Formaton Our Protocol Number of Nodes (a) Average Cluster Sze LCA Centralzed Clque Formaton Our Protocol Number of Nodes (c) Sze of the Maxmum Cluster Coeffcent of Varance (%) # of Sngle Node Clusters LCA Centralzed Clque Formaton Our Protocol Number of Nodes (b) CV (%) on Cluster Sze LCA Centralzed Clque Formaton Our Protocol Number of Nodes (d) # of Sngle-Node Clusters Fgure 2. Comparson of Cluster Metrcs cluster formaton protocol should mnmze the clusters wth a sngle node. In our smulaton, we unformly deploy 100, 200, 300, 400 and 500 sensor nodes n a (m 2 ) smulaton area, respectvely. The transmsson range of all the sensor nodes s fxed to 20 meters. Each pont n the result fgures s the average result of 1000 experments. We compare the cluster characterstcs of our dstrbuted protocol to LCA [3], one typcal Leader-Frst based cluster formaton protocol, and a centralzed clque formaton protocol. In LCA, from the lowest ID node to the hghest ID node, a node declares tself to be a cluster-head f t has the lowest ID among the non-covered neghbor nodes. A node s covered f t s n the 1-hop neghborhood of a node who has declared tself to be a cluster-head. In the centralzed clque formaton protocol, we assume a snk node has obtaned the topology graph G of the whole network. The snk node frst fnds the maxmum clque C 1 n G, and updates G by removng C 1 from G. Then, t fnds the maxmum clque C 2 n the remanng G, and then removes C 2 from current G. The algorthm completes when G becomes empty. We borrow the C mplementaton (dfmax) from [1] to fnd a maxmum clque n a random graph. Fgure 2 compares the cluster characterstcs of three protocols. As Fgure 2(a) shows, the average cluster szes of the three protocols ncrease wth the node densty of the network. Our protocol has a smaller average cluster sze than the other two protocols. The reason s that our protocol requres all the nodes n a clque be able to drectly communcate wth each other. Whle, n LCA, the maxmum dstance between any two nodes n one cluster s two hops. Compared to the centralzed clque formaton protocol, our heurstc protocol n Step 1 may not fnd the maxmum local clque. Thus, the average cluster number s a lttle smaller. Fgure 2(b) shows the varance of the cluster szes. Our protocol has a smaller coeffcent of varance than the other two protocols, whch means our protocol generates more unform clusters. Fgure 2(c) presents the maxmum cluster szes n three protocols. Our protocol has a moderate maxmum cluster sze. As Fgure 2(d) shows, our protocol has fewer sngle-node clusters than the other two protocols. The reason s that LCA and the centralzed clque formaton protocol attempt to form the largest cluster frst, and thus leave some nodes nto small clusters. Whle n our protocol, because all the nodes choose ther clusters n a dstrbuted and parallel way, t decreases the chances to form large clusters and sngle-node clusters. 5 Related Work The cluster structure n sensor networks can help to acheve scalablty, power savng, channel access, routng, etc. In recent years, many Leader-Frst cluster formaton protocols have been proposed by selectng the cluster heads wth respect to one or multple metrcs, such as node IDs (e.g., [3]), node connectvty (e.g., [6, 11]), node moblty (e.g., [5, 7]), resdual energy (e.g., [4, 7, 14, 30]). Several cluster formaton protocols (e.g., [2, 17]) have been proposed by consderng the cluster heads selecton problem as a specal case of fndng the mnmum domnatng set (MDS) problem. Several Cluster-Frst clque formaton protocols (e.g., [16, 18, 24, 27]) have been proposed for sensor networks. All the above cluster formaton protocols assume bengn

10 envronments, but cannot resst attacks n hostle envronments. In [26], two secure clusterng formaton algorthms are proposed for wreless ad hoc networks. It depends on a trusted authorty to certfy each node s metrcs used n the leader electon process. However, these algorthms are not fault tolerant, snce they assume all the partcpatng nodes are relable and no messages are lost or delayed, whch cannot be guaranteed when there exst malcous nodes. Moreover, a centralzed trusted authorty may not be always avalable. In malcous envronments, our secure cluster formaton protocol guarantees that all the normal nodes n each group (clque) agree on the same group membershp. The cluster formaton problem s dfferent from the tradtonal Byzantne Agreement problem [19], whch s to guarantee all the correct nodes n a group agree on a sngle value sent from a sngle (possble malcous) node. Tradtonal authentcated Byzantne Agreement algorthms (e.g., [8, 12, 25]) cannot be drectly appled to acheve secure cluster formaton. 6 Concluson and Future Work We proposed a secure and dstrbuted clque formaton protocol for sensor networks to dvde sensor nodes nto mutually dsjont clques. The clque structures bult by our protocol can be wdely used n sensor network applcatons, such as routng, data fuson, tme-slotted schedulng, etc. Currently, our protocol s sutable for statc sensor networks, n whch nodes do not move frequently. We plan to nvestgate how to extend our protocol nto moble sensor networks. References [1] dfmax.c. ftp://dmacs.rutgers.edu/pub/ challenge/graph/solvers/. [2] A. Ams, R. Prakash, T. Vuong, and D. Huynh. Max-Mn D- cluster formaton n wreless ad hoc networks. In INFOCOM, [3] D. Baker, A. Ephremdes, and J. Flynn. The desgn and smulaton of a moble rado networkwth dstrbuted control. IEEE Journal on Selected Areas n Communcatons, SAC- 2(1): , [4] S. Bandyopadhyay and E. Coyle. An energy effcent herarchcal clusterng algorthm for wreless sensor networks. In INFOCOM, [5] S. Basagn. Dstrbuted clusterng for ad hoc networks. In Internatonal Symposum on Parallel Archtectures, Algorthms and Networks (ISPAN 99), [6] H. Chan and A. Perrg. ACE: An emergent algorthm for hghly unform cluster formaton. In European Workshop on Wreless Sensor Networks (EWSN 2004), Jan [7] M. Chatterjee, S. Das, and D. Turgut. WCA: A weghted clusterng algorthm for moble ad hoc networks. Journal of Cluster Computng (Specal Issue on Moble Ad hoc Networks), 5(2): , [8] D. Dolev and H. Strong. Authentcated algorthms for byzantne agreement. SIAM Journal of Computng, 12(4): , [9] J. R. Douceur. The sybl attack. In Frst Internatonal Workshop on Peer-to-Peer Systems (IPTPS 02), Mar [10] M. Garey and D. Johnson. Computers and Intractablty: A Gude to the Theory of NP-Completeness. W.H. Freeman And Company, [11] M. Gerla and J. T. Tsa. Multcluster, moble, multmeda rado network. Wreless Networks, 1(3): , [12] L. Gong, P. Lncoln, and J. Rushby. Byzantne agreement wth authentcaton: Observatons and applcatons n toleratng hybrd and lnk faults. In Dependable Computng for Crtcal Applcatons 5, volume 10, pages , sep [13] N. Gura, A. Patel, and A. Wander. Comparng ellptc curve cryptography and RSA on 8-bt CPUs. In Proceedngs of the 2004 Workshop on Cryptographc Hardware and Embedded Systems (CHES), [14] W. R. Henzelman, A. Chandrakasan, and H. Balakrshnan. Energy-effcent communcaton protocol for wreless mcrosensor networks. In HICSS, [15] Y. Hu, A. Perrg, and D. Johnson. Packet leashes: A defense aganst wormhole attacks n wreless ad hoc networks. In IN- FOCOM, Aprl [16] H. Ish and H. Kakugawan. A self-stablzng algorthm for fndng clques n dstrbuted systems. In 21st IEEE Symposum on Relable Dstrbuted Systems (SRDS 02), Oct [17] L. Ja, R. Rajaraman, and T. Suel. An effcent dstrbuted algorthm for constructng small domnatng sets. In Proceedngs of the Annual ACM Symposum on Prncples of Dstrbuted Computng, [18] P. Krshna, N. H. Vadya, M. Chatterjee, and D. K. Pradhan. A cluster-based approach for routng n dynamc networks. SIG- COMM Computer Communcaton Revew, 27(2), [19] L. Lamport, R. Shostak, and M. Pease. The byzantne generals problem. ACM Transactons on Programmng Languages and Systems (TOPLAS), 4(3): , [20] C. R. Ln and M. Gerla. Adaptve clusterng for moble wreless networks. IEEE Journal of Selected Areas n Communcatons, 15(7): , [21] D. J. Malan, M. Welsh, and M. D. Smth. A publc-key nfrastructure for key dstrbuton n tnyos based on ellptc curve cryptography. In SECON, October [22] B. Parno, A. Perrg, and V. Glgor. Dstrbuted detecton of node replcaton attacks n sensor networks. In IEEE Symposum on Securty and Prvacy, May [23] A. Perrg, R. Szewczyk, V. Wen, D. Culler, and D. Tygar. SPINS: Securty protocols for sensor networks. In Proceedngs of Seventh Annual Internatonal Conference on Moble Computng and Networks, July [24] T. Predrag and G. Agha. Maxmal clque based dstrbuted group formaton for autonomous agent coaltons. In Coaltons and Teams Workshop (W10), 3rd Int l Jont Conf. on Agents and Mult Agent Systems, [25] M. K. Reter. A secure group membershp protocol. IEEE Transactons on Software Engneerng, 22(1), [26] S. Vasudevan, B. DeCleene, N. Immerman, J. Kurose, and D. Towsley. Leader electon algorthms for wreless ad hoc networks. In DARPA Informaton Survvablty Conference and Exposton DISCEX, [27] Y. Xu, J. Hedemann, and D. Estrn. Geography-nformed energy conservaton for ad hoc routng. In MobCom, [28] W. Ye, J. Hedemann, and D. Estrn. An energy-effcent mac protocol for wreless sensor networks. In INFOCOM, June 2002.

11 [29] C. Young and J. A. Stevens. Clque actvaton multple access (cama): A dstrbuted heurstc for buldng wreless datagram networks. In MILCOM, [30] O. Youns and S. Fahmy. Dstrbuted clusterng n ad-hoc sensor networks: A hybrd, energy-effcent approach. In INFO- COM, 2004.