An energy-efficient random verification protocol for the detection of node clone attacks in wireless sensor networks

Transcription

1 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 htt://jwcn.eurasijournals.co/content/2014/1/163 RESEARCH Oen Access An energy-efficient rando verification rotocol for the detection of node clone attacks in wireless sensor networks Yuing Zhou 1*, Zhenjie Huang 1, Juan Wang 1, Rufeng Huang 1 and Dongei Yu 2 Abstract It is easy for adversaries to ount node relication attacks due to the unattended nature of wireless sensor networks. In several relica node detection schees, witness nodes fail to work before relicas are detected due to the lack of effective rando verification. This aer resents a novel distributed detection rotocol to counteract node relication attacks. Our schee distributes node location inforation to ultile randoly selected cells and then linear-ulticasts the inforation for verification fro the localized cells. Siulation results show that the roosed rotocol iroves detection efficiency coared with various existing rotocols and rolongs the lifetie of the overall network. Keywords: Wireless sensor networks; Linear ulticast; Node relication attacks; Rando verification 1 Introduction Wireless sensor networks are known as one of the three high-tech industries in the new century due to their great roise and otential with their various alications, such as in ilitary affairs, industrial roduction, and environental onitoring. Now, ore and ore security requireents continue to arise due to the wide alication and the oularization of wireless sensor networks. The ease of deloying sensor networks iroves their aeal. One sensor node can be easily inserted into an arbitrary location in a wireless sensor network without triggering any intervention fro the adinistrator and interaction with the base station. In fact, the intrusion is only realized by triggering a sile neighbor discovery rotocol. On the other hand, sensor nodes deloyed in an unattended environent lack rior knowledge and hardware shielding, which is advantageous for an adversary who wants to cature and corise the. Due to the sile structure of the sensor node, once the attacker catures one or ore of the sensor nodes in the network, the running rogra can be cracked through a reverse analysis technique. Furtherore, the rivate inforation of the nodes, * Corresondence: y_zhou@nnu.edu.cn 1 College of Couter Science, Minnan Noral University, Zhangzhou , China Full list of author inforation is available at the end of the article such as the node ID and key, is extracted to be used to establish a secure channel with other nodes. If the adversary relicates the sensor node by utilizing its credentials and injecting the into strategic locations, then the destructiveness would sread throughout the network. This attack is called node relication attack. Node relication attacks leave wireless sensor networks vulnerable to various insidious attacks, e.g., the adversary can our false data into the network to revent the success of the data aggregation rotocol or the node relication attack can revoke legitiate nodes and disconnect the network by triggering a correct execution of the node revocation rotocols [1]. In an effort to detect node relication attacks, researchers first roosed a ethod called centralized detection. While located in the wireless sensor networks, the node roduces its location clai and forwards it to several neighbors; then, one or ore neighbors transfer this clai to a trusted third arty, e.g., a base station, which is resonsible for detecting conflicting location clais. The adversary can then attack the trusted third arty to revent the detection of the clone nodes, which creates a single-oint failure [2]. As a result, the centralized onitor schee fails. Another roble is that an undue data counication burden is laced on the nodes surrounding the trusted third arty, 2014 Zhou et al.; licensee Sringer. This is an Oen Access article distributed under the ters of the Creative Coons Attribution License (htt://creativecoons.org/licenses/by/2.0), which erits unrestricted use, distribution, and reroduction in any ediu, rovided the original work is roerly credited.

2 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 2 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 which ay shorten the lifesan of the network. Hence, an effective and efficient detection echanis is highly desirable. Thus, the distributed aroach is roosed. In 2005 Parno et al. [3] resented two distributed detection systes designed to address node relication attacks. Both algoriths randoly select detecting witness nodes fro the entire wireless sensor networks. One rotocol, naed the randoized ulticast (RM) algorith, ulticasts the ffiffiffi location clais of a node to arbitrary n nodes, which act as witness nodes. Another rotocol is the line-selected ulticast (LSM), which exlores the routing toology of the network to select witness nodes for the location of a node and utilizes geoetric robability to detect relicated nodes. The colication is that there exists either a low relica detection success rate or a high counication cost; therefore, a balance between efficiency and security cannot be achieved. Thus, discovering an effective ethod forselectingthewitnessnodesisaseriousdilea. In this aer, a reliinary distributed rotocol is resented for its use in detecting node relication attacks, which is called the global deterinistic linear roagation verification rotocol (GDL). In a GDL schee, the location inforation of the node is roagated and stored along the horizontal and the vertical directions. The collision of conflicting location clais, which refers to the nodes with the sae location inforation or with the sae ID but in different locations, aears in the intersection of both the horizontal and vertical lines. The GDL schee is not resilient to a sart node relication attack due to its deterinistic verification rocess. In order to increase its robustness against a sart attack, we also describe an extension of the GDL schee, called the randoized arallel ultile cells linear roagation (RMC) verification rotocol. The basis of the RMC schee is the cobination of the localized ulticast and the linear ulticast. In the RMC schee, witness nodes are randoly selected fro several geograhically liited regions in the wireless sensor networks, which is naed cell. Within a line-selected cell, witness nodes along certain x-axes and y-axes detect the clone nodes. The Birthday Paradox is alied to a the location ffiffiffi clai of a node to arbitrary n cells. A collision will aear with high robability if clone nodes are inserted into the network. In other words, the location clais of the clone nodes with the sae ID but in different locations will be aed into the sae cell belonging to the ffiffiffi arbitrary n cells. One ajor advantage of the RMC rotocol is that rando verification is used to rovide a uch higher level of coroise-resilience; another advantage is the ability to increase both the resilience and the security of the rotocol. Coared with the rotocols of Parno et al., both are built on the rincile of onitoring randoization versus deterinistic onitoring; however, the detection rate is uch higher and the counication overhead is uch lower with our schee. The rest of this aer is organized as follows: In Section 2, soe of the revious research related to the rotocols used to detect clone attacks is suarized and their erforances are analyzed. In Section 3, a reliinary aroach is roosed, which utilizes global deterinistic verification. In Section 4, the reliinary aroach is extended and the novel distributed detection rotocol, which is based on localized linear ulticast rando verification, is resented. Analysis of the security and efficiency of the novel rotocol and the siulation results are shown in Sections 5 and 6, resectively. Finally, the conclusion is drawn in Section 7. 2 Related works In ters of the category of detective techniques used for node relication attacks, there are two tyes of known detecting ethods, including centralized techniques [4-7] and distributed techniques [3,8-13]. In centralized techniques, the base station is considered to be the center, which is resonsible for inforation-collecting and decision-aking. During the rocess, every node in the network sends its location clai to the base station through its neighboring nodes. Uon receiving all of the location clais, the base station checks the node IDs and their locations. If there are nodes with the sae ID, but in different locations, then the base station raises a clone node alar [1]. It is easy for this ethod to fall into a single-oint fault. Brooks et al. [14] roosed an algorith that would detect the node relication attacks by utilizing a statistical odel based on the occurrence nuber of keys used to authenticate the nodes in wireless sensor networks, but the ethod can only be alied successfully with certain rando key re-distribution schees. Choi et al. [4] roosed a SET rotocol in which the whole network is divided into exclusive subsets. Each of the subsets has a subset leader and ebers are one ho away fro the subset leader. Multile roots are randoly deterined to construct ultile subtrees. Each subset leader collects inforation fro its ebers and forwards it to the root of the subtree. The intersection oeration is erfored on each root of the subtree to detect clone nodes. Yu et al. [5] roosed a centralized technique, called coressed sensing-based clone identification, for wireless sensor networks. Znaidi et al. [8] roosed a cluster head selection-based hierarchical distributed algorith that detects clone nodes using a Bloo filter echanis that includes the network reactions. Conti et al. [6] roosed another centralized rotocol, called the randoized, efficient, and distributed (RED) rotocol. In this rotocol, the base station ulticasts a rando nuber to the global hash function in order to

3 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 3 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 outut the location of witness nodes in each round of detection. The general concet and the ain idea of the centralized solution were described for the first tie in the aer by Parno et al. [3]. According to this aer, there are several drawbacks inherent to a centralized syste. First, the trusted third arty (e.g., base station) lays an iortant role in the clone node detection. The base station is ore likely to be coroised and to fall into a single-oint failure. Second, the nodes surrounding the base station bear large aounts of the routing load. Adversaries ay block the tunnel of the counication, and thus circuvent detection. Meanwhile, the ower of those nodes is used u, so the lifesan of the network is shortened. Finally, for any networks, there is no owerful base station due to its high cost, so it is necessary to aly a distribution solution. Parno et al. [3] first roosed two distributed ethods for detecting clone nodes: the randoized ulticast and the line-selected ulticast. In these two ethods, a rando verification echanis with higher security is adoted. Unfortunately, the rando ulticast algorith also requires a higher counication cost and the line-selected ulticast has a low node relication attack detection success rate. Zhu et al. [15] resented a distributed aroach, called the single deterinistic cell (SDC). In their ethod, wireless sensor networks are divided into several cells, and the location clai of each node is aed to a cell and broadcasted within the cell. Nodes in the cell store location clais with certain robabilities and detect the conflicts. Zhu et al. revised the ethod and roosed the arallel ultile robabilistic cells (P-MPC) ethod. The difference between the SDC and the P-MPC is that the latter ethod as location clais to one or ore cells with different robabilities. Coared with the ethod of Parno et al. [3], localized ulticast is ore efficient in ters of its counication and eory costs; but, the level of coroise-resilience is low because the ethod is a variant of deterinistic verification. Different fro rando verification, the deterinistic verification eans that witness nodes can be redicted during the detection cycle. Adversaries escae detection by coroising or controlling witness nodes to rotect their clone nodes, which is called a sart attack. Rando verification is necessary for high resilience to sart attacks. Zhang et al. [9] roosed four eory efficient ulticast rotocols to detect relicated nodes, naely, eory efficient ulticast with Bloo filters (B-MEM), eory efficient ulticast with Bloo filters and cell forwarding (BC-MEM), eory efficient ulticast with crossforwarding (C-MEM), and eory efficient ulticast with cross and cell forwarding (CC-MEM). The B-MEM is an extension of the LSM, which generates ore eory cost er node and lower detection rates. The CC-MEM and C-MEM work oorly. In 2010, Zeng et al. [10] roosed two detection rotocols, naely, the Rando Walk (RAWL) and the Table-Assisted Rando Walk (TRAWL) to detect node relication attacks. Both of these rotocols are an extension of the LSM and thus ossess the sae drawbacks. Although they can achieve uch higher detection robabilities than the LSM, both the RAWL and TRAWL require ore than twice the counication overhead of the LSM. It is iortant that rando verification schees irove the efficiency of the algorith, including the counication and eory overhead required. Node relica detection techniques for obile WSNs have been develoed in recent years [16-24]. Ho et al. [16,17] roosed a obile relica detection schee based on the sequential robability ratio test (SPRT). Deng and Xiong [18] resented a new rotocol to detect the relicas in obile WSNs using the theory of olynoials based on the air-wise key re-distribution and Bloo filters. Lou et al. [22] roosed a node clone attack detection rotocol, naely, the single ho detection (SHP) for obile wireless sensor networks. Zhu et al. [23] roosed two relica detection algoriths for obile sensor networks. The first algorith is a token-based authentication schee; the second algorith is a statistics-based detection schee for detecting relicas that cooerates with one another. 3 The rotocol fraework 3.1 Protocol requireents Wireless sensor networks are vulnerable to a wide variety of hysical attacks. One of those attacks is known as the node relication attack, in which one or ore nodes are added into the network with a legitiate ID stolen fro a noral node. Detecting such an attet by centralized onitoring is not referred due to several inherent drawbacks. Utilizing distributed onitoring can avoid single-oint failures effectively. In order to revent the adversary fro redicting the witness nodes and causing the to fail in advance, it is necessary for the rotocol to utilize a rando and distributed technique when selecting nodes to act as witnesses. The revocation echanis is also needed. As soon as the clone node is discovered, the subverted node and its clone nodes should be illegitiized. Noral nodes in the network sto counicate with the illegal nodes. Sensor nodes distributed in the network suffer fro several inherent deficiencies, such as liited energy and a sall aount of eory, which is in the order of a few kilobytes. The rotocol ust decrease the aount of counication and coutation required to obtain the low counication and eory costs needed for satisfactory results. At the sae tie, we

4 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 4 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 evaluate the efficiency of the rotocol by analyzing its success rate in detecting node relication attacks. 3.2 The syste and network odel Wireless sensor networks are coosed of hundreds or thousands of sall low-cost sensor nodes. These sensor nodes are uniforly sread across a wide area and function in an unsuervised fashion. During the life cycle of the wireless sensor network, new nodes are added into the network and other nodes die due to ower loss or accidental daage and disaear. The base station in the wireless sensor network is assued to be safe and trusted. In our rotocol, each node knows its own location via GPS and the sensor network is considered a geograhic grid, in which each unit is called a cell. In our schee, an identity-based ublic key syste is alied, in which the rivate key is generated by signing its ublic key with a aster secret held only by the trusted authority (TA). So, it is iossible for an adversary to create a new identity for intruding nodes [25]. In fact, soe researchers have exlored all kinds of techniques to revent adversaries fro deloying nodes with arbitrary IDs in the network. For exale, Chan et al. [26] resented a key re-distribution schee, in which the ID of each node could corresond to the set of secret keys shared with its neighbors. In this case, the adversary cannot create a new ID without the aroriate keys. The only way for the attacker to coroise a legitiate node is to get a new ID. The energy consution of the sensor node includes three ain arts: data sensing, data rocessing, and data transission and recetion, aongst which the energy consued by counication is the ost critical. We adot the first-order radio odel in the transission and receiving odes. To transit a l-bit essage a distance d using the radio odel, the radio exends Esend ¼ le elec þ lε fs d 2 d d 0 le elec þ lε d 2 d d 0 ð1þ where E elec reresents the radio dissiates to run the transitter or receiver circuitry; ε fs reresents the ower alification loss in the free sace odel, and ε reresents the ower alification loss in the ultiath fading channel odel. As shown in Equation 1, if the transission distance is less than the threshold value d 0, then the ower alification loss in the free sace odel is used. If the transission distance is greater than or equal to the threshold value d 0,thentheower alification loss in the ultiath fading channel odel is adoted. To receive this l-bit essage, the radio exends E receive ¼ le elec ð2þ 3.3 Adversary odel In the syste, a sile and owerful attacker can cature a liited nuber of legitiate nodes and subvert these nodes to get their rivate inforation, such as a air of keys, credentials, and crytograh inforation. With this secret inforation, a clone node can counicate with any of the nodes in the network. It is easy to insert a clone node into the network because the original design for the sensor networks was to facilitate ad hoc deloyent. Once relicas are added into the networks, all kinds of attacks arise, including eavesdroing and odifying or relaying a essage. We assue that there are only a sall ercentage of subverted sensor nodes because if ost of the legitiate sensor nodes are coroised, then any rotocol to detect the relicas will no longer be in force within the network. We also suose that at least one neighbor of the relica is legitiate. It is assued that the adversary can reeber the nodes that have been subverted and do not reeat their attets to cature the sae nodes. In order to avoid triggering an autoated rotocol to swee the network and reove coroised nodes, we assue that the adversary oerates in a stealthy anner. 4 The rando ulticell linear ulticast aroach for detecting node relication attacks The GDL and its variant, the RMC, have been designed. 4.1 Global deterinistic linear roagation verification In the GDL schee, the forat of a location clai is exressed as fid L ; l L ; SIG SKL ðhid ð L jjl L ÞÞg where ID L is the identity of node L, and l L is the location inforation of node L, which can be described by either the two-diensional coordinate (x L, y L ) or threediensional coordinate (x L, y L, z L ); denotes the concatenation oeration, and SIG SKL (H(ID L l L )) denotes the encryting hash code of the data, which holds a concatenation of the identity and the location inforation of node L using its rivate key in order to verify its identity. When node L transits its location clai along the horizontal x L -axis and the vertical y L -axis lines, the neighbors within a one-ho distance on the both axes first verify the lausibility of l L, according to the location and the transission range of the sensor, and then verify the validity of the signature in the location clai by alying an identity-based signature schee. Only a signature generated using the rivate key corresonding to the claied identity can be aroved in the verification rocess, which eans that the adversary cannot achieve a legitiate signature without the right rivate key.

5 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 5 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 The node will store the location clai and continue to forward the inforation to the neighbors within a oneho distance on both the lines of the horizontal x L -axis and the vertical y L -axis as soon as verification is obtained. During this roagation rocedure, every node on both the lines of the horizontal x L -axis and the vertical y L -axis becoes a witness node. Whenever any witness node receives a location clai, it judges whether there is another node with the sae ID claiing a different location by coaring it with reviously stored clais. If conflicting location clais aear, then the witness node would forward both location clais to the base station. The base station would then broadcast a essage within the network to revoke the relicas and the subverted node. The roagation will not sto until a conflict is detected or the location clai acket reaches the border of the network. If witness nodes are selected fro the sensor nodes where the two lines intersect, then the robability of detecting relicas is relatively low. As shown in Figure 1, when the location clai of node L is forwarded fro oint a to oint b and the location clai of relica L is forwarded fro oint c to oint d, there is no sensor node deloyed at the oint where line ab intersects line cd to act as a witness node, so the detection of the relicas fails. In order to gain a high success rate, the scoe of the area in which witnesses are selected should be extended. Surface-intersecting verification takes the lace of lineintersecting verification, which can be interreted as a verification surface that is coosed of a circle area of witness nodes on the horizontal or vertical axes and its neighbors within a one-ho distance. Every node in the surface acts as a witness node. When a verification surface on the horizontal axis intersects with another verification surface on the vertical axis, there ust be at least one Figure 1 The invalidity of line intersection. intersecting oint on the intersection of the two surfaces, which can detect the relica. This is not the case with line-intersecting verification. The success rate for detecting node relication attacks reaches 100%, which is a great iroveent. For exale, in Figure 2, a node g with coordinate (x g,y g ) is suosed to be a relica of node a with coordinate (x α,y α ). Node a roagates its location clai along both the x α -axis and the y α -axis.atthesaetie,node g roagates its location clai along the x g -axis and the y g -axis. During the rocess of forwarding the acket, the witness nodes store received inforation and broadcast the to their one-ho distance neighbors, which also store inforation in order to detect relicas. As a result, the node, which is selected fro the intersection oints where the verification surface centered on the x α -axis eets the verification surface centered on the y g -axis (or on y α -axis and x g -axis), discovers the relica. A ajor advantage of the GDL is that the rotocol ensures a 100% success rate for the detection of node relication attacks. The counication cost and the eory cost are tightly related to the nuber of sensor nodes in the network. The counication cost is Oð ffiffiffi nþ and the eory cost is Oð ffiffiffi nþ. 4.2 Randoized arallel ultile cells linear roagation A otential risk coes fro a sart attack against the GDL rotocol. An adversary can redict the location of witness nodes and then cature and coroise the before the rotocol starts to work by launching a sart attack. In GDL, when a clone node is deloyed in the network, the adversary can block the forwarding of the relica's location clai on the horizontal or vertical axis. The roagation direction of the relica's location clai is deterinistic because the deloying location is known. The attacker can coroise the one-ho neighbors of the clone node on the horizontal or vertical axis in order to revent the roagation of the relica's location clai. The attacker can also subvert any node on the horizontal or vertical axis to revent relicas fro being detected. In our RMC schee, the wireless sensor networks are assued to be coosed of n sensor nodes and have a relative static detection cycle. The sensor node can be reoved or added within the detection interval. Every node deterines its geograhic location inforation by using GPS or the ositioning algorith and acquires one two-diensional coordinate (x,y), which creates a unique identity. The rotocol includes three stes: (1) Establishent stage for the geograhic grid (cell) In this stage, the whole network is divided into several exclusive clusters that are naed cells. The LEACH routing algorith [27] is adoted to deterine the cluster headers in the first detection cycle. After the

6 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 6 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 Figure 2 Protocol diagra. Ety circles denote the coon sensor nodes, filled circles denote sensor nodes deloyed in the forwarding ath of the location inforation, letter a denotes one sensor node, letter g denotes the relica of node a, letter t and letter denote sensor nodes deloyed in the intersection oints of the forwarding ath. first cycle, the leader in a grid cell is selected fro the sensor nodes based on the rincile of ore residual energy, ore riority in the network. Nodes coete to be the cluster header according to the current energy/average energy ratio within a cluster, and ultiho counication is used aong the cluster header nodes. In fact, the cluster header node broadcasts its inforation as soon as it is elected as the cluster header. Noral nodes that aly to take art in a certain cluster are selected based on the rincile of iniu counication cost (the counication costs are different between the node and different cluster headers). At the sae tie, the node records the inforation of the other cluster headers. The cluster header adds the node into its own routing table and the node identifies the cluster by using a geograhic grid algorith. As a result, a two-layer structure would be built into the network. Suose the whole sensor network is divided into = u v cells, which indicates that there are a total of u rows and v coluns in the network. A cell at the uth row and the vth colun is uniquely identified as w (where w =(u ' 1) v + v ', u ' {1, 2,, u}, v ' {1, 2,, v}). (2) Maing stage of verification cells At the beginning of the detection rotocol, the location clai forat of every node is exressed as fid L ; l L ; SIG SKL ðhid ð L jjl L ÞÞg where ID L is the identity of node L, and l L is the location inforation of node L, which can be described as either the two-diensional coordinate (x L,y L ) or the three-diensional coordinate (x L, y L, zl); denotes the concatenation oeration, and SIG SKL (H(ID L l L )) denotes the encryting hash code of the data, which holds a concatenation of the identity and the location inforation of node L using the key of node L in order to verifying the identity of node L. When a node relication attack haens, node L randoly selects q cells in the wireless sensor networks and as its own location inforation to the cells C ={C 1,C 2,,C q }. According to the Birthday Paradox Theore, in the sensor networks coosed of cells, every node as its location inforation ffiffiffiffi to cells for verification, creating a very high robability of at least one collision aearing. Make q be the order of Oð ffiffiffiffi Þ.Atfirst,nodesreceivea location clai within their resective cells; they authenticate its identity by unlocking the signature with the corresonding key and judge the rationality of the inforation according to its rough transission radius. The location clai ackets that cannot ass verification should be discarded. The location clai ackets that ass verification will then begin the linear-selected nodes verification rocess within the cells. (3) The linear-selected ulticast verification stage inside the cell Node L as its own location clai to a certain cell. Suose node a (x α, y α ) is the first one that receives the location clai of node L. Node a is the first to authenticate the identity of the acket; if the authentication fails, then the acket is discarded. If

7 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 7 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 the authentication succeeds, then the tie ffiffiffiffiffiffiffiffi to live (TTL) in the location clai is set to n=. Node a stores the location clai of node L to act as a witness node; in addition, node a forwards the location clai to its neighbors within a one-ho distance, which then act as auxiliary witness nodes in the sae way. In other words, the verification surface is centered in the witness node on or nearest to the x α -axis or the y α -axis and includes the neighbor nodes within a one-ho distance. Next, all of the nodes in the verification surface coare the location clai of node L with other stored location clais. If nodes aear that clai the sae ID but have different geograhic location, then the occurrence of a node relication attack would be deterined; the witness node reorts the ID of the clone nodes directly to the base station and the base station broadcasts a bulletin of the invalid ID within the network. Otherwise, node a roagates the location clai along both the horizontal x α -axis and the vertical y α -axis using a geograhic routing rotocol [28] and the TTL is decreased by 1. The neighbors nearest to the x α -axis or the y α -axis are selected to forward the acket until relicas are detected or the acket is discarded when the TTL equals to zero. During the verification rocess, all the witness nodes are either on the sae x α -axis or the sae y α -axis within the cell. Thus, when the two conflicting location clai ackets roagate along both the horizontal x α -axis and the vertical y α -axis in the sae cell resectively, they ust eet in the intersection of the verification surfaces and be detected with 100% robability. An exale is shown in Figure 2. To reduce the eory cost, the colete inforation of the location clai is only stored in the witness nodes, not in the auxiliary witness nodes, because the auxiliary witness nodes no longer need to forward the location clai. A coressed location clai, including ID L and l L but not SIG SKL (H(ID L l L )), will be stored in the auxiliary witness nodes. 5 Analysis of the RMC schee 5.1 Security analysis Suose clone node L is deloyed in l locations including L ={l 1,l 2,,l l }. According to the Birthday Paradox Theore, when the location clai of every node is aed ffiffiffiffi to cells for verification within the wireless sensor network coosed of cells, there is a very high robability of collision. In this case, collision refers to when location clais with the sae identity but in different locations are aed to the sae cell. Every node as its own location clai to q verification cells, which are selected randoly. According to the Birthday Paradox Theore, the robability that q cells selected to a the location clai containing the osition l 1 do not receive the q coies of the location clai containing the sae identity in osition l 2 is P nc1 : P nc1 ¼ 1 q q ð3þ In the sae way, the robability that q cells selected to a the location clai containing osition l 3 do not receive the 2q coies of the location clai containing the sae identity resectively in osition l 2 and osition l 1 is P nc2 : P nc2 ¼ 1 2q q ð4þ So, the robability that location clais with the sae identity but in different locations are not aed to the sae cell is P nc : P nc ¼ Yl 1 i¼1 1 i q q ð5þ According to the standard aroxiation that (1 + x) e x ake x ¼ i q and then substitute the standard aroxiation into Equation 5 to obtain P nc Yl 1 i¼1 According e q2 ð1 þ 2 þ l 1 e i q2 to Þ ¼ e q2 nc e q2 X l 1 i¼1 i nc e q2 ll 1 ð Þ Y l 1 i¼1 X l 1 e i q2 i¼1 i obtain ¼ e 1 q2 e 2 q2 ð6þ ðl 1Þ q e 2 ¼ ð7þ 2 ð8þ The robability of collision, in which the location clais with the sae ID but in different ositions are aed to the sae cell is c : c ¼ 1 nc Substitute Equation 8 into Equation 9 to obtain ð9þ c 1 e q2 ll 1 ð Þ 2 ð10þ Let q ¼ ffiffiffiffi. When l =1, there is only one clone node for node L, and the collision robability is 63%. When l =2, there are two clone nodes for node L, and the collision robability is over 96%, and so on. The greater the value of l, the greater the robability of collision is.

8 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 8 of 12 htt://jwcn.eurasijournals.co/content/2014/1/ Analysis of energy consution and efficiency The etrics used to evaluate the energy consution and efficiency of the RMC schee are the following: 1. Counication cost: the average nuber of ackets sent and received while running the relica detection algorith in a wireless sensor network coosed of n nodes, which is denoted as C co 2. Meory cost: the average nuber of coies of the location clais stored on a sensor, which is denoted as C e 3. Percentage of the energy-exhausted nodes: the roortion of energy-exhausted nodes to all nodes In the RMC schee, the counication cost C co is couted as follows: C co ¼ C f þ C s ð11þ where C f is the counication cost of aing the location clai to the cell, and C s is the counication cost of roagating the location clai along both the horizontal axis and the vertical axis for detection. Because nodes in the network are randoly deloyed on the square unit and the average distance between any two randoly ffiffiffi ffiffiffi chosen nodes is aroxiately n n =2 [3], the counication cost C f is in the order of Oq ffiffiffi ð n =2Þ and the counication cost C s is in the order of O q 2 ffiffiffiffiffiffiffiffiffi ffiffiffiffiffiffiffiffi n= Þ,where n= is the average length of the side of a cell, and q is the nuber of the cells; q is in the order of Oð ffiffiffiffi Þ, so according to Equation 11, the counication cost is C co ¼ O ffiffi ffiffiffi n 2. In ters of the eory cost C e, every location clai is stored and roagated along both the horizontal axis and the vertical axis, and during the rocess of verification, the node on the axis is taken as the center and works together with its one-ho distance neighbors to for a verification surface. In order to kee the collision robability over 63%, q is ade to be in the order of O ffiffiffiffi ð Þ, so the average eory cost for a node is in the ffiffiffi ffiffiffi, n order of O q d þ n 2 that is, O ð ffiffiffi nþ, where d is the average nuber of neighbors for every ffiffiffiffiffiffiffiffi node and n= is the average length of the side of a cell. In ters of security, ultile cells are selected randoly in every detection cycle. In the cells, the sensor node receiving the newest inforation first forwards the location clai along both horizontal and vertical directions. The randoness reflected in the different stages of the RMC schee is resistant to the sart attack of node relication. At the sae tie, the randoness can assist in avoiding a single-oint failure and the henoenon that energy consution at the local area is so large that the nodes erish. The RMC schee rolongs the lifesan of the network, while still achieving a high rate of detecting node relication attacks. According to several rando verification rotocols, as is shown in Table 1, the average counication overhead and eory overhead er node of the RMC rotocol is suarized, together with the LSM and RM rotocols roosed by Parno et al. and the P-MPC rotocol roosed by Zhu et al., where n is the nuber of sensor nodes in the network, d is the average nuber of neighbors of every node, g denotes the nuber of destinations to which a neighbor forwards the location clai, f is the robability that any neighbor of a node decides to forward the location clai fro the node, w is the nuber of witness nodes, and is the nuber of cells. The general node-aging roble is exained by considering the ercentage of the energy-exhausted nodes. In order to enhance the vitality of the network, ethods for reducing the energy consution should be considered in the design of a rotocol for the detection of node relication attacks. The energy consution of the counication odule in the sensor node is the largest ortion of the total energy consution. The counication odule is resonsible for receiving and sending inforation ackets, so a lower counication overhead akes the energy consution lower. On the other hand, different verification echaniss affect energy consution. Rando verification consues the energy of the network evenly, which rolongs the lifesan of the network, whereas deterinistic verification distributes the energy consution unevenly. The undue data counication flaw ay shorten the network's life exectancy. 6 Evaluation A siulation exerient is erfored to verify the accuracy of our schee through OMNeT++, which is an extensible, odular, coonent-based C++ siulation library and fraework, riarily used for building largescale network siulators. In our siulation, n nodes are deloyed uniforly at rando within a onitoring area. The counication between the different nodes follows the standard unit-disc bidirectional counication odel. The nuber of sensor nodes varies fro 1,000 to 10,000 at an increasing seed of 1,000. The counication range is adjusted to kee aroxiately 40 neighbors er node on average. Several hysical araeters of the energy consution odel are set: the initial energy of each node E =0.5 J, the ower alification loss in the free sace odel ε fs =10 J/bit/ 2, the ower alification loss in the ultiath fading channel odel ε = J/bit/ 4, the threshold distance d 0 = 88 ; the energy the radio dissiates to run the transitter or receiver circuitry E elec =50 nj/bit. Geograhic routing rotocol of greedy forwarding echanis [27] is adoted to forward the inforation

9 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 9 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 Table 1 Coarisons of average counication overhead and eory overhead Counication overhead Meory overhead Randoized ulticast (RM) O(n 2 ) Oð ffiffiffi nþ Line-selected ulticast (LSM) Og f d ffiffiffi ð nþ Og ð f d ffiffiffi nþ RMC O ffiffi ffiffiffiffi. n Oð ffiffiffi nþ 2 P-MPC Or ð ffiffiffi nþþos ðþ o(w) ackets. We assue that there is only one coroised node and one clone node in our exerient, which are deloyed randoly in the network onitoring area. The siulation exerient is run 100 ties for each araeter and the average value is the final result reorted. We assue the nuber of cells in the network is. Soe assutions in the forulation of the siulation that ay affect the results are iortant. In order to reflect the fairness of the evaluation, the sae assutions will be ade in this aer as are shown in the forulation used by Zhu et al. [15]. The secific configuration araeters are as follows: ¼ k 2. k ¼ round l ffiffi 2 R, qffiffiffiffiffiffiffiffiffiffiffiffiffiffi! ¼ round l ffiffi 2 dl 2 =πn rffiffiffiffiffiffi πn ¼ round 2d ð12þ ð13þ where l denotes the side length of the wireless sensor network, R is the counication range of a node, round ( ) is a function that rounds the inut to the nearest integer; d is the average nuber of a node's neighbors; and n is the nuber of sensor nodes in the network. When there are soe areas not covered in the broadcast range, the unicast ode is adoted. Suose l cell is the side length of a cell when the location clai acket is roagated along the horizontal or vertical direction, the axiu forwarding distance does not exceed l cell ho. The TTL contained in the acket is set as follows: TTL ¼ l cell ¼ ffiffiffiffiffiffiffiffi n=, and the collision robability of conflicting location clais in the sae cell is 100%. Every node randoly selects and as its own location clai to q verification cells. If q is in the order of Oð ffiffiffiffi Þ, the robability of collision when conflicting location clais are aed to the sae cell exceeds 63%. According to the coutation of Equation 10, as is shown in Figure 3, when q ¼ 3 ffiffiffiffi holds, the robability of collision when conflicting location clais are aed to the sae cell is over 99%. When q ¼ 4 ffiffiffiffi holds, then the robability of collision when conflicting location clais are aed to the sae cell is 100%. Accordingly, the counication overhead and the storage overhead also increase. Siulation results show that when the size of cell s decreases to 1, then the nuber of aing cells q increases to n; that is, q = n, s =1, then the RMC Figure 3 Collision robability of cell aing.

10 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 10 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 Figure 4 Success rate of detecting relicas in RMC, P-MPC, and LSM. rotocol becoes the RM rotocol roosed by Parno et al., and the counication cost increases to the order of O(n 2 ). When the size of cell s increases to n, then the nuber of aing cells q decreases to 1; that is, q =1, s = n, then the RMC rotocol becoes the GDL rotocol. The difference between the RMC and the GDL is that the rando verification is used in the RMC schee and the deterinistic verification is used in the GDL schee. The LSM and P-MPC schees are also siulated in this exerient. The araeter settings of the two schees are the sae as the setting in aers of Parno [3] and Zhu et al. [15]. Every node has 40 neighbors in the LSM schee; the robability that a neighbor of node L decides to forward L's location clai is 6/d. In the P-MPC schee, s = 0.2, f =3/d, andv=3, which eans that the robability that every node in the cell decides to store the location clai acket is 0.2 and the robability that a neighbor forwards the acket is 3/d. The robability of detecting node relication attacks when an adversary akes a single relica (there are two nodes with the sae ID but in a different location) is the ain easure to analyze the security of a wireless sensor network. Figure 4 shows the success rates of detecting relicas using the LSM rotocol, the RMC rotocol, and the P-MPC rotocol within networks of different sizes. On average, the success rate of the RMC is 24.4% higher than that of the LSM. The ain reason for this is that the LSM utilizes a line intersection detection echanis, so the detection fails when there is no sensor node deloyed on the oint where the lines intersect, while the RMC utilizes a surface intersection detection echanis, in which the node on both lines of the horizontal axis and the vertical axis is taken as the center and works with its one-ho distance neighbors to constitute the detection surface, which akes the detection rate 100%. Meanwhile, the success rate of the RMC is, on average, 5.1% higher than that of the P-MPC. In order to evaluate the energy consution of the RMC schee, the counication overheads of the different schees are coared. The counication overhead is the easure of the average nuber of ackets sent and Figure 5 Counication overhead of RM, RMC, LSM, and P-MPC.

11 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 11 of 12 htt://jwcn.eurasijournals.co/content/2014/1/163 Figure 6 The ercentage of energy deletion node varies with the nuber of rotocol running rounds. received while roagating the location clais. As is shown in Figure 5, when coared with the RM rotocol that uses rando verification, the counication overhead of the RMC rotocol is significantly reduced. Coared with that of the other two rotocols, the counication overhead of RMC is lower at the beginning. When the caacity of the network is ore than 2,000 nodes, then the counication overhead of the RMC is larger than that of the LSM and the P-MPC rotocols. The ga in the counication overhead is bigger as the caacity of network is larger. The ain reason for this is that the RMC rotocol alies the rando verification echanis. In order to aintain its high success rate, the nuber of aing cells reains in the order of Oð ffiffiffiffi Þ. The larger network size results in a larger nuber of aing cells, so the counication overhead is larger. On the other hand, the P-MPC is a variant of the deterinistic verification schee. Its aing cells are selected fro deterinistic cells and the nuber of cells is fixed. So, the nuber of aing cells does not increase as the size of the network increases, thus its counication cost is relatively stable. The ercentage of the energy-exhausted nodes, which can be used to evaluate the lifetie of the overall network, is couted as the roortion of the energy-exhausted nodes to all of the nodes. Figure 6 shows that the ercentage of the nodes that are exhausted of energy varies with the nuber of the rotocol running rounds. As is shown in Figure 6, the energy consution of the sensor nodes in the RMC rotocol is aarently lower than that of the P-MPC and the LSM rotocols. After running 300 rounds, 46% of the sensor nodes survive in the LSM rotocol, 22% of the sensor nodes survive in the P-MPC rotocol, and 54% of the sensor nodes survive in the RMC rotocol. The reason for this is that the RMC rotocol uses the rando verification echanis. The witness nodes are selected randoly and the energy consution is aroxiately equal. At the sae tie, the counication overhead of the RMC is relative lower. 7 Conclusions In this aer, two distributed detection schees that are designed to detect node relication attacks in wireless sensor networks have been roosed. The reliinary schee is the GDL aroach. The iroved version of the GDL schee is the RMC aroach. In our aroach, randoly selected cells to which location clais are aed and randoly linear-selected node verification within cells are cobined to realize true randoization. This ethod is efficiently resilient to a sart attack of node relication. Our theoretical analysis and the eirical results show that when coared with Parno et al.'s schees and Zhu et al.'s schees, the success rate of detecting node relication attacks is higher in our aroach. In ters of counication and eory costs, our schee is ore efficient than that of Parno et al. The siulation exerient is coleted in a unifor toology environent. In our future work, a non-unifor toology environent should be used to create a siulation environent that is as close to the real alication environent as ossible. Coeting interests The authors declare that they have no coeting interests. Acknowledgents This work was suorted by Fujian Province Education Deartent of China (No. JA11170, No. JA14202), the Natural Science Foundation of Fujian Province of China (No. 2012J01295) and the National Natural Science Foundation of China (No ). Author details 1 College of Couter Science, Minnan Noral University, Zhangzhou , China. 2 College of Electrical and Inforation Engineering, Jiangsu University of Technology, Changzhou , China. Received: 23 Deceber 2013 Acceted: 11 Seteber 2014 Published: 7 October 2014 References 1. W Khan, M Aalsale, Detection and itigation of node relication attacks in wireless sensor networks: a survey. Int. J. Distribute Sens. Netw. 2013, 1 22 (2013)

12 Zhou et al. EURASIP Journal on Wireless Counications and Networking 2014, 2014:163 Page 12 of 12 htt://jwcn.eurasijournals.co/content/2014/1/ DQ Zhang, RB Zhu, SQ Men, V Raychoudhury, Query reresentation with global consistency on user click grah. J. Internet Technol. 14(5), (2013) 3. B Parno, A Perrig, V Gligr, Distributed detection of node relication attacks sensor networks, in Proceedings of IEEE Syosiu on Security and Privacy (S & P) (Washington D.C, 2005), H Choi, S Zhu, TF LA, SET Porta, Detecting node clones in sensor networks, in Proceedings of the Third International Conference on Security and Privacy in Counication Networks (Nice, 2007), CM Yu, CS Lu, SY Kuo, CSI: coressed sensing-based clone identification in sensor networks, in Proceedings of the IEEE International Conference on Pervasive Couting and Counications Workshos (Lugano, 2012), M Conti, RD Pietro, LV Mancini, A Mei, Requireents and oen issues in distributed detection of node identity relicas in WSN, in Proceedings of the 2006 IEEE International Conference on Systes (Man and Cybernetics SMC 2006) (Taiei Taiwan, 2006), K Xing, X Cheng, F Liu, DH Du, Real-tie detection of clone attacks in wireless sensor networks. Paer resented at the 28th international conference on distributed couting systes (Beijing, 2008), W Znaidi, M Minier, S Ubeda, Hierarchical node relication attacks detection in wireless sensors networks, in Proceedings of the 20th IEEE international syosiu on ersonal, indoor and obile radio counications (PIMRC 09, Tokyo Jaan, 2009), M Zhang, V Khanaure, S Chen, X Xiao, Meory efficient rotocols for detecting node relication attacks in wireless sensor networks, in Proceedings of the 17th IEEE International Conference on Network Protocols ICNP 2009 (Princeton, 2009), K Zeng, K Govindan, P Mohaatra, Non-crytograhic authentication and identification in wireless networks. IEEE Wirel. Coun. 17(10), (2010) 11. M Conti, R Di Pietro, LV Mancini, A Mei, A randoized, efficient, distributed rotocol for the detection of node relication attacks in wireless sensor network, in Proceedings of the 8th ACM International Syosiu on Mobile (Ad Hoc Networking and Couting MobiHoc 2007) (Montréal, 2007), B Zhu, VGK Addada, S Setia, S Jajodia, S Roy, Efficient distributed detection of node relication attacks in sensor networks, in Proceedings of the 23rd Annual Couter Security Alications Conference ACSAC 2007 (Miai, 2007), WN Shu, L Cheng, A novel load balancing otiization algorith based on eer-to-eer technology in streaing edia. J. Convergence Infor. Technol. 7(21), (2012) 14. R Brooks, PY Govindaraju, M Pirretti, N Vijaykrishnan, MT Kandeir, On the detection of clones in sensor networks using rando key redistribution. IEEE Trans. Syst. Man Cybern. Part C Al. Rev. 37(11), (2007) 15. B Zhu, S Setia, S Jajodia, S Roy, L Wang, Localized ulticast: efficient and distributed relica detection in large-scale sensor networks. IEEE Trans. Mob. Cout. 9(7), (2010) 16. JW Ho, M Wright, SK Das, Fast detection of obile relica node attacks in wireless sensor networks using sequential hyothesis testing. IEEE Trans. Mob. Cout. 10(6), (2011) 17. JW Ho, M Wright, SK Das, Fast detection of relica node attacks in obile sensor networks using sequential analysis, in Proceedings of the IEEE INFOCOM (Rio de Janeiro, 2009), XM Deng, Y Xiong, A new rotocol for the detection of node relication attacks in obile wireless sensor networks. J. Cout. Sci. Technol. 26(4), (2011) 19. CM Yu, CS Lu, SY Kuo, Mobile sensor network resilient against node relication attacks, in Proceedings of the 5th Annual IEEE Counications Society Conference on Sensor (Mesh and Ad Hoc Counications and Networks SECON 2008 (California, 2008), YJ Wang, TY Yang, YG Ma, GV Halade, JQ Zhang, ML Lindsey, YF Jin, Matheatical odeling and stability analysis of acrohage activation in left ventricular reodeling ost-yocardial infarction. BMC Genoics 13,1 8 (2012) 21. LM Wang, Y Shi, Patrol detection for relica attacks on wireless sensor networks. Sensors 11(3), (2011) 22. Y Lou, Y Zhang, S Liu, Single ho detection of node clone attacks in obile wireless sensor networks, in Proceedings of the International Worksho on Inforation and Electronics Engineering (IWIEE) (Harbin, 2012), WT Zhu, J Zhou, R Deng, F Bao, Detecting node relication attacks in obile sensor networks: theory and aroaches. Secur. Coun. Netw. 5(5), (2012) 24. RB Zhu, YY Qin, CF Lai, Adative acket scheduling schee to suort real-tie traffic in WLAN esh networks. KSII Transac. Internet Infor. Syst. 5(9), (2011) 25. F Hess, Efficient identity based signature schees based on airings, in Proceedings of the Ninth Annual International Worksho on Selected Areas in Crytograhy, SAC 2002 (Newfoundland, 2002), H Chan, A Perrig, D Song, Rando key redistribution schees for sensor networks, in Proceedings of IEEE Syosiu on Security and Privacy (Berkeley, 2003), WR Heinzelan, A Chandrakasan, Energy-efficient counication rotocol for wireless icrosensor networks. Paer resented at the 33rd Hawaii international conference on syste sciences (Hawaii, 2000), YJ Wang, P Chen, YF Jin, Trajectory lanning for an unanned ground vehicle grou using augented article swar otiization in a dynaic environent, in Proceedings of IEEE International Conference on Systes (Man and Cybernetics) (San Antonio, 2009), doi: / Cite this article as: Zhou et al.: An energy-efficient rando verification rotocol for the detection of node clone attacks in wireless sensor networks. EURASIP Journal on Wireless Counications and Networking :163. Subit your anuscrit to a journal and benefit fro: 7 Convenient online subission 7 Rigorous eer review 7 Iediate ublication on accetance 7 Oen access: articles freely available online 7 High visibility within the field 7 Retaining the coyright to your article Subit your next anuscrit at 7 sringeroen.co