Privacy-preserving and Secure Top-k Query in Two-tier Wireless Sensor Network

Transcription

1 Privacy-preservig ad Secure Top-k Query i Two-tier Wireless Sesor Network Xiaojig Liao, Jiazhog Li School of Computer Sciece ad Techology, Harbi Istitute of Techology, Heilogjiag, Chia {xiaojigliao,lijzh}@hit.edu.c Abstract I two-tier wireless sesor etworks, resource-rich storage odes at the upper tier collect sesig data from resourcepoor sesor odes at the low tier, ad the aswer queries from the user. Sesor odes perform sesig task ad submit sesig data i oe time-slot to the earest storage ode while storage odes aswer ad process the query from the etwork ower. However the storage odes cofrot serious security cocers. Storage odes may be compromised ad leak the sesitive data as well as returig fake query result. Therefore, it is importat to protect the privacy ad verify the query results. I this paper, we defie ad solve the practical ad challegig problem of privacypreservig ad verifiable top-k query processig performed o the time-slot sesig data set i two-tier sesor etwork, ad establish a set of privacy ad correctess requiremets for such a secure top-k query scheme to become a reality. We propose the basic PriSecTopk scheme by usig order-preservig ecryptio, ad the improve it step by step to achieve various privacy requiremets as well as the correctess requiremets i three levels of threat models. Theoretical aalysis ad experimet o the real-world data set successfully validate the efficacy ad efficiecy of the proposed schemes. I. Itroductio Wireless sesor etworks[1] become prevalet for pervasive computig ad widely deployed for various applicatios such as itrusio detectio, earthquake predictio ad eviromet sesig, etc.. It usually cosists of resource limited odes i terms of storage capacity ad computig capacity. Various iheret limitatios of it appear especially resource costraits which limit the storage capacity of sesig data ad the computig capacity of processig query. These limitatios deserve special attetio especially i the remote ad extreme eviromet where a high-speed ad always-o coectio is ifeasible[2][3]. Extesive research has bee coducted to address these limitatios by developig a two-tier wireless sesor etwork where the storage ode[4] is itroduced. Several commercial storage odes have appeared, such as StarGate[5]. A two-tier wireless sesor etwork cosists of large amout of resource-limited sesor odes at the lower-tier which sese the eviromet iformatio ad plety of resourcerich relatively storage odes at the upper-tier which gather data from the earby sesor odes ad aswer queries from the user. While storage odes brig several beefits such as prologig etwork lifetime, savig the memory of sesor odes ad processig queries efficietly, the storage ode faces serious security cocers i hostile eviromet. First, whe the storage ode is compromised, the sesig data from the sesor odes, the history of query requests ad the correspodig query results are exposed. Secod, it may cause heavy loss whe the compromised sesor odes retur fake, forged or icomplete data for a query especially i military ad commercial applicatio. Therefore, developig a privacypreservig ad result-verifiable mechaism is of paramout importace such that the autheticity ad completeess of the query results ca be verified as well as the privacy of the sesitive data is protected. Recetly various secure query schemes have bee proposed i two-tier sesor etwork aimig at the rage query[6], [7], [8] ad top-k query[9]. However they did t address the privacy problem of top-k query i two-tier wireless sesor etwork. I additio, all the secure query schemes are performed o the data set which cosists of sesig data sampled from several successive time slots by all sesor odes, referred to as a time iterval. Sesor odes submit to the earest storage ode all the data sesig durig the time iterval that the storage odes process query i the time iterval data set. As show i the aalysis, it is a geeral case i may real-world applicatio where the query is performed o the data set i which each data items are from the sesor odes samplig ad submittig at oe sigle time slot, referred to as a time slot data set such as Itel Lab[10]. The schemes they proposed are iefficiet ad itroduce large amout of commuicatio cosumptio whe performed o the time slot data set. I this paper, for the first time, we propose a privacypreservig ad query-verifiable top-k query mechaism o the time slot data set i two-tier wireless sesor etwork while achievig eergy efficiecy. Amog various top-k query sematics, we choose the sigle score fuctio model that each data ca be scored by the scorig fuctio ad raked based o its score. I cosideratio of three levels of threat models, we propose the basic PriSecTopk scheme by usig orderpreservig ecryptio, ad the improve it step by step to achieve various privacy requiremets as well as the correctess requiremets. The rest of the paper is orgaized as follows. I Sectio II we preset related work. Sectio III itroduces the system, ad threat models, ad our desig goals. I Sectio IV we describe the PriSecTopk framework ad security requiremets. The followig Sectio V presets the details ad performace aalysis of the three PriSecTopk schemes correspodig to three threat models. Sectio VI presets the performace evaluatio ad the experimets of our schemes. Fially, the coclusio is draw i Sectio VII.

2 II. Related Work A. Secure Query i Two-tier Sesor Networks Sheg et al. proposed a scheme[6] to protect the privacy ad itegrity of rage query i two-tier sesor etwork which utilized the idea of bucket partitio to preserve privacy. However, the iherited limitatio of bucket partitio techique allows compromised storage odes to achieve the estimatio o the actual value of data items ad the query request. Extedig the work from oe-dimesioal data to multidimesioal data, Shi et al.[7] optimized the scheme to reduce the commuicatio cosumptio betwee the sesor odes ad the storage ode. Nevertheless, both of the schemes itroduce great eergy cosumptio ad storage cosumptio whe the data dimesio icreases. To solve this problem, SafeQ was proposed[8] i cosideratio of eighborhood chais that allows a sik to verify the correctess of data items. With regards to the top-k query, Zhag et al. proposed VFTop-k scheme[9] to verify the correctess of the query result through addig the order-related verificatio iformatio i the sesig data. B. Order-preservig Symmetric Ecryptio The order-preservig symmetric ecryptio scheme (OPE) is a determiistic ecryptio scheme where the umerical orderig of the plaitexts gets preserved by the ecryptio fuctio. OPE was proposed i the database commuity by Agrawal et al. [11]to support efficiet rage queries o ecrypted data. The Boldyreva et al. [12] proposed the first formal cryptographic treatmet of OPE which was a efficiet blockcipher-based scheme provably meetig their security defiitio. Boldyreva et al. proved that the orderpreservig fuctio g(x) for a give poit x {1,..., M} has a NHG distributio over a radom choice of g. However, this ecryptio scheme leaks approximate value of ay plaitext ad approximate distace betwee ay two plaitexts, each to a accuracy of about square root of the domai size. I the revised order-preservig symmetric ecryptio proposed by Boldyreva et al.[13], a more efficiet ad stroger rage queries appeared which however was ot order-preservig. A. System Model III. Problem Formulatio We cosider a two-tier sesor etwork ivolvig the sesor odes at the lower tier ad the storage ode at the upper tier. The sesor odes which collect eviromet iformatio as sesig data has a limited storage resource ad computig power while the storage odes are equipped with much stroger storage capacity ad computig power tha sesor odes. Sesor odes periodically sed their collected data to the earest storage odes. The storage odes serve as a itermediate tier betwee the user ad the sesors for storig data ad processig queries. For the above etwork architecture, without loss of geerality, we assume that the lower-tier sesor etwork with N static sesors radomly distributed i a large-scale area. Each sesor has a uique sesor ID ad similar storage capacity ad computig power. Meawhile, each storage ode is powerful ad resourceful eough to store sesig data ad process query. All sesor odes ad storage odes are loosely sychroized through the secure sychroized scheme[14]. B. Threat Model At first, the storage ode is cosidered as hoest-butcurious i our model. Specifically, storage ode acts i a hoest fashio ad correctly follows the desigated protocol specificatio. However, it is curious to ifer ad aalyze data i its storage ad query messages received durig the protocol so as to lear additioal iformatio. I particular, the storage odes aalyze the sesig data from the lower-tier sesor odes to gai the eviromet iformatio or mie the query request from the users to kow the query preferece. The, we exted the threat model ito a more geeral oe where the compromised storage ode do ot follow the desigated protocol but retur fake ad/or icomplete data i respose to top-k queries from the user. Based o the itesity of the attack, we cosider three levels of the threat models as follows. Plaitext attack model - I this model, storage odes ited to gai the plaitext of the sesig data ad the query request. Backgroud attack model - Storage ode is supposed to possess some backgroud from the collected data ad the query result, such as the statistical iformatio, i additio to what ca be accessed i plaitext attack model. Compromised attack model - The compromised storage odes are istructed to retur fake ad/or icomplete data i additio to what ca be accessed i backgroud attack model. C. Desig Goals To eable privacy-preservig ad result-verifiable top-k query performed o the time slot sesig data uder the aforemetioed model, our scheme should achieve security ad performace guaratees as follows. Privacy: To prevet the storage ode from learig additioal iformatio over the sesig data ad query request, ad to meet the data privacy, query privacy ad result privacy. Autheticity/Completeess: All data i query results are ideed geerated by the lower-tier sesor odes ad the query result ideed cotai the top k sesig data items as the top-k query requests. Efficiecy: Above goals o privacy ad autheticity/completeess should be achieved with low commuicatio ad computatio overheads. IV. Framework ad Security requiremet for PriSecTopk I this sectio, we defie the framework of top-k query over ecrypted sesig data ad establish various strict security requiremets for such a two-tier wireless sesor etwork.

3 A. PriSecTopk Framework Iitializatio() Besides collectig sesig data, the sesor ode geerates the secret key used i the scheme ad calculates the scores for sesig data. MsgEc() Performed o the time slot data set, sesor ode ecrypts the sesig score ad the time stamp by the symmetric key ad the outsources them to storage ode alog with Message Autheticatio Codes. ItitQuery() Before sedig the query request, the user ecrypts the query request. Query() Whe the storage ode receives a query request, it performs the top-k query o the set of ecrypted sesig scores ad the returs the top-k ecrypted sesig records as query result. MsgDec() The user geerates the secret key to decrypt the sesig records ad the achieves the top-k sesig scores. B. Security Requiremet for PriSecTopk 1) Privacy: We explore ad establish a set of strict privacy requiremets specifically for the PriSecTopk Framework. As for the data privacy o the time-slot data set, the sesor odes should utilize a stateless ecryptio scheme to ecrypt the data before outsourcig. I this scheme he ecryptio algorithm is processed o the sigle plaitexts, ad prevet the storage odes from pryig ito outsourced data. With respect to the query privacy, the users prefer to keep their query request from beig exposed to the third party i.e., the time stamp ad the k value. Traditioal symmetric key cryptography should be resorted to guaratee the query efficiecy of the scheme o the ecrypted data set. The query results retured by the storage odes cotai much iformatio such as the order-relatio ad the distace-relatio i topk query, therefore we cosider the result privacy to prevet from the backgroud attack. Withi the top-k query, the orderrelatio exposes the value order of the sesig scores i the top-k query result while the distace-relatio exposes the value distace of the sesig scores i the top-k query result. 2) Autheticity/Completeess: Extedig the attack model from the hoest-but-curious to a more geeral oe, the storage odes may be compromised i hostile eviromets ad the istructed to retur fake ad/or icomplete data i respose to the top-k query. Therefore, the user should verify the autheticity ad completeess of the query results which forces the compromised storage odes to retur both authetic ad complete top-k query results to avoid beig caught. I particular, autheticity guaratees the sesig records ideed geerated by the sesor ode ot by the compromised storage odes, ad completeess meas that the query results ideed cotais the top k sesig data amog all the cadidates. V. Privacy-preservig ad Secure PriSecTopk Before givig our itact result, we start with a straightforward yet ideal scheme where the storage odes follow the desigate protocol to better illustrate the privacy problem i the two-tier wireless sesor etwork. The, we assume Algorithm 1 ecopse(d,r,m) 1: M D ; N R ; 2: d mi(d)-1;r mi(r)-1; y r+ N/2 3: if D =1 the 4: cc TapeGe(K,1 l R,(D,R,1 m)); c Rad(cc,R);retur c 5: ed if 6: cc TapeGe(K,1 l R,(D,R,0 y)); x HGD(D,R,y;cc) 7: if m x the 8: D {d+1,...,x}; R {r+1,...,y} 9: else 10: D {x+1,...,d+m}; R {y+1,...,r+n} 11: ed if 12: retur ecopse(d,r,m) a more geeral attack model that the compromised storage odes do ot follow the desigate protocol but retur the fake/icomplete query result i additio to lear additioal iformatio over the sesig data ad query request. A. PriSecTopk I: Basic Scheme With respect to the plaitext attack model, PriSecTopk I eables the privacy of sesig data ad query request by ecryptig the data items with revised order-preservig ad traditioal symmetric ecryptio respectively. 1) PriSecTopk I: To provide a privacy guaratee agaist the attack o the plaitext of sesig data ad query request as well as the efficiecy requiremet, we utilize revised order-preservig ecryptio scheme ad traditioal symmetric ecryptio to ecrypt the sesig data ad query request. The order-preservig symmetric ecryptio scheme (OPS E) is based o the observatio that ay order-preservig fuctio g from {1,..., M} to {1,..., N} ca be uiquely represeted by a combiatio of M out of N order items. The whole scheme to achieve top-k query over ecrypted data i two-tier wireless sesor etwork is as follows. Before deployed, each sesor ode u shares with the user a uique secret key k u which we call the ode s idividual key. Also the user ad the sesor odes have the same pseudo-radom fuctio f (), correspodig seed ad collisio resistat hash fuctio π. The sesor iitiates the scheme by geeratig radom keys x, y from the pseudo-radom fuctio f (). After gaiig the sesig data d u at the time-slot t, the sesor ode u calculates the score s u for the sesig data. Let E be a sematically secure symmetric ecryptio algorithm. Each sesor ode u ecrypts the score s u by orderpreservig symmetric ecryptio as show i Algorithm 1 to gai the ciphertext of the score OPS E(s u ) ad the ecrypt ode ID usig key f x (t), compute the keyed-hash for time stamp t. Sesor ode u seds the ecrypted data alog with Message Autheticatio Code to the closest storage ode S. u S : E fx (t)ops E(s u ), E fy (t)(id u ), π x (y), MAC(k u, m) where m = E fx (t)ops E(s u ) E fy (t)(id u ) π x (y) To ecrypt the query request Q q =< q, t > where q is the query code ad t is the time stamp to query. With the pseudo-radom fuctio f () ad the correspodig seed, user

4 geerates the secret key x to ecrypt the query time stamp with the oe-way hash fuctio π ad the seds the secret key f x (t) alog with the ciphertext of the query time stamp to the storage ode. user S : q, π x (t), f x (t) With the ciphertext of the query time stamp, storage ode locates the matchig list of the sesig data via π x (t), uses f x (t) to achieve the OPS E sesig scores ad the sorts the OPS E sesig scores to fetch the top k sesig data records. Storage odes sed back the top-k ecrypted sesig records i.e. E fx (t)ops E(s u ),E fy (t)(id u ),π x (y),mac(k u, m) to the user. Upo receivig the query respose from the storage ode, the user first utilizes the pseudo-radom fuctio ad the correspodig seed shared with sesor ode to geerate the secret key y ad gai f y (t) to decrypt sesor ode ID, the locates the key for the each sesor ode with which it ca verify the MACs retured alog with every sesig data record. After decryptig the OPS E(s u ) by order-preservig decryptio scheme, the user fially obtais the top-k sesig scores as the query result. 2) Aalysis: We aalyze the basic scheme from two aspects. Privacy: As for query privacy, traditioal symmetric key ecryptio techiques could be properly utilized by the user whe issuig query request which are ot withi the scope of this paper. The data privacy is well protected ot oly by the symmetric key ecryptio but also the order-preservig ecryptio scheme to guaratee the top-k query. The essece of order-preservig ecryptio ca be see as a combiatio of the size of domai M out of the size of rage N ordered items. A adversary ca oly break the ecryptio scheme by performig a brute force search over all the possible combiatio of M out of N. If the security level is chose to be 80 bits, the it is suggested to choose M= N/2>80 so that the total umber of combiatio will be greater tha Therefore, the data privacy ad query privacy are well protected i our basic scheme, while it is a usolved privacy leakage problem of result privacy. Efficiecy: With the help of order-preservig ecryptio scheme, the storage ode ca process the top-k query as efficietly as for the uecrypted sesig scores. I the ecryptio ad decryptio process, the umber of recursive calls is at most log N + 1 i the worst-case ad at most 5 log M + 12 o average. As for memory additio, PriSecTopk I do ot ask for additioal memory except for the MACs. B. PriSecTopk II The basic scheme performs outstadig from the efficiecy perspective ad also provides privacy guaratee by usig order-preservig ecryptio scheme, but it will icur orderrelatio privacy leakage amog the plaitexts oce the storage ode processes query o the order-preservig ecrypted data. To guaratee the order-relatio privacy, we improve the basic scheme with the idea of secret perturbatio. Namely, whe a sesor ode has a sesig data to report, it does ot report the origial data, but the sum of the origial data ad the secret shared with the sik. I the scheme we proposed, the sesor odes whose sesig score is perturbed are implicitly selected through radom selectio mechaism which guaratees the order-relatio privacy. 1) PriSecTopk II: The order-relatio ad distace-relatio privacy leakage stem from the simply usage of the sesig score as the plaitext of the order-preservig ecryptio scheme. Therefore, the idea of secret perturbatio is utilized to protect the order-relatio ad distace-relatio privacy. I this sectio, we propose a improved PriSecTopk scheme preservig result privacy as well as data ad query privacy. Namely, we will show how to perturb the origial sesig data while guaratee the correctess of the top-k query result i two-tier sesor etworks. I the Iitializatio step, except for the similar deployig process to the basic scheme, each sesor ode u also shares a threshold P used i the radom selectio processig. After geeratig the radom key x, y, z ad calculatig the score s u for the sesig data, the sesor odes start the score perturbed processig. Each sesor ode u computes h(z, k u, id u ) to implicitly decide whether to add the perturbatio where h() is a radom fuctio. I particular, whe satisfyig the followig formulas, sesor ode u uses the perturbatio versio of the sesig score s u to ecryptio by order-preservig ecryptio scheme. The, the ecrypted sesig records are set to the storage ode with the same ecryptio method but usig the perturbed versio of the data istead of the origial oe. i f h(z, k u, id u ) < P, the s u = s u + s max i f h(z, k u, id u ) P, the s u = s u where s max is the maximum umber of the sesig score. I the ItitQuery step, user obtais the umber of sesor odes that uses the perturbatio versio of the sesig score ad the correspodig ode ID by computig the followig formula. i f h(z, k u, id u ) < P, the r = r + 1, list = list id u Where r is the umber of sesor odes that uses the perturbatio versio of the sesig score ad list is the perturbatio ID list. To ecrypt the query request Q q =< q, t, k > where k = r + k. With the secret key x ad the oe-way hash fuctio π, the user ecrypts the query request ad the seds it to the storage ode. user S : q, π x (t), f x (t), k The storage ode processes the query as the query request received from the user, i.e. fetchig the k sesig data records whose OPS E sesig scores are k highest. Fially, i the MsgDec step, except for decryptig the OPS E(s u) which is the reversig process of the ecryptio, the user should also reduce to achieve the origial sesig score by subtractig s max from s u with the perturbatio ID list. The sort the k origial sesig score to get the top-k query result. 2) Aalysis: Similar to the basic scheme, we aalyze the PriSecTopk II from two aspects. Privacy: I PriSecTopk II, we itroduce the secret perturbatio to guaratee the result privacy. By implicitly choosig the sesor odes that perturbs the origial sesig score, the

5 order ad distace of the sesig score chages radomly. The compromised storage ode ca oly gai the right order of query result with the probability 1 k!. I additio, the query privacy is protected that the compromised storage odes do ot kow the real umber of query result to retur. Efficiecy: Compared with the PriSecTopk I, the PriSec- Topk II itroduces additioal commuicatio cost for the redudacy query result ad additioal computig cost for the user to select the real query result. There exists tradeoff betwee privacy ad efficiecy. If the security level is chose to be 80 bits, the umber of sesor odes is deoted as N, ad N odes have the perturbed sesig scores. The the threshold P should meet the formula Pro( f () > P) > N N > 25 k N. With the distributio of the radom fuctio, the threshold P ca be determied. C. PriSecTopk III I this sectio, we cosider a more geeral attack model istead of the hoest but curious oe which the compromised storage ode may retur fake ad/or icomplete data i additio to what ca be accessed i the backgroud attack model. Now we further propose PriSecTopk III with stroger the security requiremet of the top-k query i two-tier wireless sesor etworks. 1) PriSecTopk III: To guaratee the autheticity ad completeess of the top-k query i two-tier sesor etworks, we require the storage ode to retur some computig commitmet iformatio durig the query process. Through hypothesis testig method combied with computig commitmet, the compromised storage odes are forced to retur both authetic ad complete top-k query results to the etwork ower. Also these methods icrease the detectio rate ad reduce the additioal commuicatio cost while eablig verifiable top-k queries. Iitializatio() ad MsgEc() i PriSecTopk III are similar to those i PriSecTopk II. Cosiderig the ItitQuery step, the user ecrypts the query request Q q =< q, t, k, m > where m is the sample times used i query process, i.e. m = N k s k, where s is the umber of chose sesor ode i query process. With the secret key x ad the oe-way hash fuctio π, the user ecrypts the query request ad the seds it to the storage ode. user S : q, π x (t), f x (t), k, m I the query process, storage ode is required to sed back the computig commitmet iformatio key[ ] = {id, data, sampledtimes} alog with the query results. I particular, storage odes geerate the computig commitmet iformatio from the ecrypted sesig scores query process as follows. - select s sesig scores from {OPS E(s u)} ad put the correspodig records ito set C i.e. C {OPS E(s u)}, C = s. Sort the sesig score i set C. C = {C i } s i=1 - key = {E fy (t)(id k ), C k, 1}, f ilter = {C i } s i=k +1, R t = {OPS E(s u)}\ f ilter. - i every selectio, select s sesig scores from R t ad put the correspodig records ito set C i.e. C R t, C = s; Sort the sesig score i set C. C={C i } s i=1, f ilter={c i} s i=k +1, R t = R t \ f ilter. if C k > key.c key the key = key {E fy (t)(id k ), C k, 1} else key.st key = key.st key + 1 The storage ode the fetches the sesig records of query results ad seds back them orderly associated with the computig commitmet iformatio. After decryptig to get the OPS E(s u), the user verifies the autheticity ad completeess of the query result retured from the storage ode through sample-based hypothesis testig method combied with computig commitmet. The whole process is show as follows. - verify if Q k = k, Q k ad key is sorted, Q k.ops E(s k ) = key.c key ad Σst = m, the f lag = 1. else f lag = 0. retur. - radomly sample sesig records from the storage ode. The verify the sesig records through MACs. Fially, calculates the umber h of sesor odes whose sesig score is larger tha OPS E(s k ) - if k (N N t k )k < h N < k (N N + t k )k the f lag = 1 else f lag = 0 With the perturbatio ID list, the user computes the origial sesig scores by subtractig s max from s u. The sort the k origial sesig score to get the top-k query result. 2) Aalysis: We aalyze the PriSecTopk III from three aspects. Privacy: Similar to the PriSecTopk II, the data privacy, query privacy ad result privacy are all well protected by the PriSecTopk III. Efficiecy: Except for the commuicatio ad computatio overheads cosumed i the PriSecTopk II, the strategy for autheticity/completeess verificatio itroduces additioal commuicatio ad computig cosumptio. As for the additioal commuicatio cosumptio, the storage ode is asked to retur computig commitmet iformatio alog with the query result. Also, durig the samplig verificatio process the user ad storage odes should commuicate to exchage the verificatio iformatio. The computig overhead of the verified step based o hypothesis testig method is O(N). Autheticity/Completeess: Usig the idividual ode key k u as the hash key of the MACs set with the sesig records, the compromised storage odes ca ot maipulate or apped the sesig record because the ode key of every sesor ode is oly kow by the user ad the sesor ode respectively. Therefore, the autheticity of the query result the storage ode set back guaratees. Before provig the completeess of the scheme, we illustrate k satis f actio rate follows the ormal distributio which is related with the computig commitmet iformatio, ad prove the correctess of the hypothesis testig method to verify the completeess. DEFINITION 1: k satis f actio rate is the rate of the umber of sesor ode whose sesig score larger tha the k th highest sesig score i the query results amog all the sesor odes sampled THEOREM 2: k satis f actio rate follows the ormal distributio N(E(p), )

6 Proof: For k satis f actio rate p = m, suppose that the sesig score of the sesor ode i is larger tha the k th highest sesig score i the query results, the x i = 1, else x i = 0. I that way, m = Σ i=1 x i. E(p) = E( m ) = P, D(p) = D( m ) = Let t = ( m P)/ = (m/ P) For the momet geeratig f uctio o f t M t () = M (m/ P) = e P M Σ i x i () = e P M m/ = e p(1 p) The l M t () = P + l M xi ( = P + l [1 + Let Z = µ 1 + () = e P [M xi ) µ 1 + 2! µ 2 + P M m ] 2! µ ] 2! 3/2 µ The l M t () = P + Z 2 Z2 + 3 Z lim l M t() = ( P + µ )+( µ 2 (µ 1 )2 p(1 p) p(1 p) p(1 p) )2 2 Each x i f ollows 0 1 distributio, µ 1 = µ = P, µ 2 = 12 P = P, µ 2 = µ 2 µ 1 2 = P(1 P) The lim l M t() = ( P + p(1 p) P ) + ( p (p)2 p(1 p) p(1 p) )2 2 = 2 2 Hece, the momet geeratig fuctio of t is similar to that of the ormal distributio. Based o the uiqueess theorem of the momet geeratig fuctio[15], k satis f actio rate follows the ormal distributio N(E(p), ). THEOREM 3: For k satis f actio rate p, k (N N t k )k < p < k (N N + t k )k The the k th sesig score the storage ode retured is ideed the k th largest sesig score amog the time-slot data set. Proof: Use k satis f actio rate p to test the hypothesis H 0 : P = k /N. By T HEOREM2, k satis f actio rate follows the ormal distributio N(E(p), ) ad the sigificace level of the test to calculate the k th largest sesig score = 1 t , where t is the acceptace level to calculate the k th largest sesig score. Hece, Pro( p] k N / k (N k ) < t ) = Pro( p] k N < t Therefore, k N t THEOREM 4: If the k th k (N k ) ) = 1 (N k )k < p < k N + t (N k )k sesig score the storage ode retured is ideed the k th largest sesig score amog the time-slot data set, the the query result the storage ode set back is complete. Proof: With the guaratee of the autheticity, if the query result the storage ode set back is ot complete, the compromised storage ode ca oly retur a smaller sesig record to the user which offeds the verificatio that the k th sesig score the storage ode retured is ideed the k th largest sesig score as T HEOREM3. VI. Performace Evaluatio I this sectio, we coduct a thorough experimetal evaluatio of the PriSecTopk scheme o a real-world dataset: Itel Berkeley Research Lab Data [10]which icludes a log of about 2.3 millio readigs. We radomly select differet data records to build the dataset. Ad the record schema we used is as follows. Date: 8B Time: 8B MoteId: 4B Temperature: 4B The whole experimet system is implemeted by C laguage o a Liux machie with Itel CPU ruig at 3.0GHz. Algorithms use MATLAB libraries. The performace of the PriSecTopk scheme is evaluated regardig the tradeoff betwee privacy ad efficiecy as well as the autheticity/completeess. Without loss of geerality, suppose the size of MACs is 20B ad the sampled times i the commitmet iformatio is 4B. I our experimet, we assume a cell with 400 sesor odes ad a storage ode. the select times is 20, k = 30 ad the radom fuctio follows the ormal distributio. The scheme we proposed does ot itroduce additioal ietwork commuicatio cosumptio betwee sesor odes ad storage ode which is far more efficiet ad practical tha the secure approaches i [6][7][8][9]. Therefore, we focus o the commuicatio cosumptio betwee the storage ode ad the user as well as the computig cosumptio of the sesor odes ad the user. A. Privacy As show i Sectio V-B2, the commuicatio overheads betwee the storage ode ad the user i PriSecTopk II is determied by both of the security level ad the k value i the top-k query. Figure. 1i gives the commuicatio cost measuremet to the fixed security level of our proposed. The result represets the mea of 50 trials. Note that eve for a larger k value give a fix security level, the commuicatio cost does ot icrease too much which is because the threshold of the radom selectio fuctio adjusts adaptively. Specially, i the 80 bits security level, the commuicatio cost betwee a storage ode ad the user of the proposed scheme is B for top-10 query which is B for top- 20 query. However, from the Figure. 1ii, we ca fid a step chage of the commuicatio cost whe the k value is large. The reaso is that the mai effect factor of commuicatio factor chages from the threshold to the k value. Eve though the step chage, the additioal commuicatio cosumptio decreases, which idicates that the scheme we proposed is more efficiet for the top-k query whose k value is larger. B. Autheticity/Completeess To guaratee the autheticity ad completeess of the query result the storage ode returs, we itroduce the verificatio method based o hypothesis testig method with computig

7 verificatio method adapts a large-scale sesor etwork with the reaso that the larger umber of sesor odes icreases the detectio rate while it also brig larger commuicatio cosumptio as show above. (i) commuicatio cosumptio vs (ii) commuicatio cosumptio vs the security level k Fig. 1. (i) commuicatio cosumptio vs the k Performace Evaluatio of Privacy (ii) commuicatio cosumptio vs the umber of sesor odes (iii) detectio rate vs the the k (iv) detectio rate vs the umber of sesor odes Fig. 2. Performace Evaluatio of Autheticity/Completeess commitmet iformatio which icreases the commuicatio cosumptio derived from the computig commitmet iformatio, the sampled sesor ode IDs ad their correspodig sesig records. Figure. 2i ad 2ii idicate the efficiecy of our scheme with differet k value ad the umber of sesor odes. Compared to the VFTop-k proposed i [9] which brigs large amout of commuicatio cosumptio performed o time-slot dataset, amely, more tha 10 4 B i our experimet eviromet, the scheme we proposed oly itroduces oly 1 3 commuicatio cosumptio tha that of the VFTop-k as well as protectig the privacy which is ot guarateed i the VFTop-k. Figure.2i shows the impact of k o the commuicatio cost which icreases smoothly whe k goes up, ad the higher security level asks for more commuicatio cosumptio. The similar result ca be foud i Figure. 2ii but the icremet is smoother with the larger umber of sesor odes, which is because that with the umber of sesor odes rises up the legth of the computig commitmet iformatio does ot icrease that much. Cosiderig the detectio rate of the verificatio method we proposed, Figure. 2iii shows that the detectio rate always larger tha 90% i the experimet eviromet ad the icremet of the k value ad the security level brigs a slimly higher detectio rate. Also, i the Figure. 2iv, we determie that the VII. Coclusio We explore the problem of top-k query o time slot data set i two-tier wireless sesor etwork, ad establish a set of privacy ad correctess requiremets for such a secure top-k scheme to become practical. We propose three PriSecTopk schemes meetig differet privacy ad correctess requiremets i cosideratio of three levels of threat models. Thorough aalysis ivestigatig privacy, detectio rate ad efficiecy guaratee of proposed scheme is give, ad experimets o the real-world dataset further show the efficiecy of proposed schemes. Ackowledgmet This work is partially supported by the Natioal Sciece Foudatio uder grats , Refereces [1] I. Akyildiz, W. Su, Y. Sakarasubramaiam, ad E. Cayirci. Wireless Sesor Networks: A Survey. Computer Networks, vol.38, o.4, March 2002 [2] W. Zhag, H. Sog, S. Zhu, ad G. Cao. Least privilege ad privilege deprivatio: towards toleratig mobile sik compromises i wireless sesor etworks. i MobiHoc05, pp. 378C389. ACM,2005 [3] M. Shao, S. Zhu, W. Zhag, ad G. Cao.pDCS: Security ad privacy support for data-cetric sesor etworks. i INFOCOM07, pp. 1298C1306. IEEE, 2007 [4] S. Ratasamy, B. Karp, S. Sheker. Data-cetric storage i sesorets with GHT, a geographic hash table. Mobile Networks ad Applicatios, 2003,8(4): [5] Willow Techologies: SPB400-STARGATE GATEWAY. stargate gateway.html [6] Sheg B, Li Q. Verifiable privacy-preservig rage query i two tiered sesor etworks. I INFOCOM 08, pp IEEE 2008 [7] Shi J, Zhag R, Zhag Y. Secure rage queries i tiered sesor etworks. I INFOCOM 09. pp IEEE, 2009 [8] Fei C, Alex L. SafeQ: Secure ad Efficiet query processig i sesor etworks. I NFOCOM 10. IEEE, 2010 [9] Rui Z, Jig S, Yuzhog L, et al. Verifiable fie-graied top-k queries i tiered sesor etworks. I INFOCOM 10. IEEE, 2010 [10] Samuel Madde. Itel Lab Data: sesor readigs. [11] R. Agrawal, J. Kiera, R. Srikat, ad Y. Xu. Order-preservig ecryptio for umeric data. I S IGMODE 04, pp ACM,2004 [12] A. Boldyreva, N. Cheette, Y. Lee ad A. O Neill. Order-preservig symmetric ecryptio. I Eurocrypt 09, PP Spriger,2009 [13] A. Boldyreva, N. Cheette, A. O Neill. Order-preservig Ecryptio Revisited: Improved Security Aalysis ad Alterative Solutios. I ACC 11, PP Spriger,2011 [14] Su K, Nig P, Wag C. TiySeRSyc: secure ad resiliet time sychroizatio i wireless sesor etworks. I CCS 06, pp ACM 2006 [15] W. Feller. A Itroductio to Probability Theory ad Its Applicatios, 3rd Editio. Wiley, 1968