Iteratioal Joural of Digital Cotet Techology ad its Applicatios Vol. 2 No 1, March 2008 A Key Distributio method for Reducig Storage ad Supportig High Level Security i the Large-scale WSN Yoo-Su Jeog *1, Yog-Tae Kim *2, Gil-Cheol Park *3, Sag-Ho Lee *4 *1 Departmet of Computer Sciece, Chugbuk Natioal Uiversity, 410 Sugbog-Ro, Heugduk-Gu, Cheogju 361-763 Korea *2, Correspodig author,*3 School of Iformatio & Multimedia, Haam Uiversity, 133 Ojug-Dog, Daeduk-Gu Daejeo 306-791 Korea *4 School of Electrical ad Computer Egieerig, Chugbuk Natioal Uiversity, 410 Sugbog-Ro, Heugduk-Gu, Cheogju 361-763 Korea bukmuro@gmail.com, ky7762@haam.ac.kr, gcpark@haam.ac.kr, shlee@chugbuk.ac.kr Abstract I WSNs, sice the attacks, such as jammig or eavesdroppig without physical access, easily occur, security is oe of the importat requiremets for WSNs. The key pre-distributio scheme, recetly beig researched for advaces of security i WSNs, distributes keys with probability with the use of q- composite radom key pre-distributio method, but there is a high probability that there is o key shared betwee sesor odes, ad it takes lots of time ad eergy to fid out the shared key, therefore it is ot suitable for WSNs. I order to ehace stability of a ode that plays a role of gateway without depedig o probabilistic key, this paper proposes a key predistributio scheme combied with radom key predistributio scheme ad double hash chai. Sice the proposed scheme ca maitai small storage space ad strog security stregth, it is more efficiet tha the existig schemes with the same security stregths. I additio, sice it uses a small size of key geeratio key set, it ca reduce a great deal of storage overhead. Keyword WSN, Security, Key Pre Distributio, Hash Chai 1. Itroductio Recet developmet of computer ad telecommuicatio techology has facilitated expasio of WSNs [3, 8]. WSN(Wireless Sesor Networks) meas a eviromet composed of largescale micro devices which are called sesor odes [2]. These sesor odes are characteristic of power supplied by battery, structure with itegrated sesor devices ad data processig ad short distace wireless commuicatio capabilities. SmartDust ad WINS are typical examples for applicatio of sesor etwork [1]. Applicatio of WSNs icludes military sesig ad trackig, evirometal moitorig, patiet moitorig ad smart eviromet, etc. Whe sesor odes are istalled i a dagerous area, security is very importat. For example, attackers ca easily peep ito traffic, ad imitate a etwork sesor ode by givig false iformatio to its eighbor ode. For providig WSNs with security, commuicatio should be ecrypted ad autheticated. This problem ca i part be solved by settig a secret key for stable commuicatio betwee sesor odes [4]. I the researches coducted till ow, sesor ode egotiatio schemes were proposed, i which key iformatio, which ca be used to form a sessio key, is distributed to all sesor odes before arragemet, ad usig this, two sesor odes geerate shared secret keys by themselves after arragemet [1, 2, 3]. As the simplest scheme amog them, BROSK (BROadcast Sessio Key Negotiatio Protocol) was proposed, i which a shared secret key (master key) is give to all sesor odes i a sesor etwork, improvig security vulerability i a sessio key commo to sesor etworks, ad each sesor ode broadcasts a key egotiatio message ecrypted with the master key, settig a sessio key with its eighbor odes [5]. However, the sessio key formig scheme usig a master key has a security problem that exposure of the master key leads to that of all sessio keys, sice the master key is commo to all sesors. Therefore, a radom key pre-distributio scheme was proposed to solve the problem. The radom key pre-distributio scheme has a problem that exposure of a sessio key may give a ifluece o security betwee other odes 61
A Key Distributio method for Reducig Storage ad Supportig High Level Security i the Large-scale WSN Yoo-Su Jeog, Yog-Tae Kim, Gil-Cheol Park, Sag-Ho Lee ad a vulerability that there may be o sessio key shared betwee two odes, sice the two odes form a sessio key through the distributio key commo to them ad the same sessio key may be used as the sessio key of phases of umerous odes. For improvig these vulerabilities, various schemes were proposed to geerate a sessio key by combiig several shared keys [9]. However, these schemes have limits that iformatio o locatio of sesor odes is required. OKS (Overlap Key-sharig) was also proposed, i which bit sequece, istead of key, is used to distribute iformatio to each sesor ode before arragemet. This paper proposes a key pre-distributio scheme combiig radom key pre-distributio techology with double hash chai to ehace eergy efficiecy ad stability of a ode that plays a role of key storage space ad gateway suitable for WSN eviromet. The proposed scheme aims at performig radom key predistributio i which a itermediate ode, playig a role of gateway without iformatio o prearragemet of etwork, prevets attacks such as jammig ad eavesdroppig, usig double hash chai. I the proposed scheme, by desigig a key pool, the keys are expressed as a key set that geerates very small size of keys ad are stored ito it. The proposed scheme is suitable for a sesor etwork that uses small amouts of eergy, sice it requires smaller size of key rig tha the existig schemes that require resiliece for ode capture. The remaider of this paper is orgaized as follows: Sectio 2 presets some works relatig to key predistributio method i WSNs. Sectio 3 proposes a key pre-distributio scheme, based o double hash chai for much better resiliece property agaist ode capture i WSNs. Sectio 4 presets performace ad security aalyses i the proposed scheme. Fially, Sectio 5 draws coclusios. 2. Related Works BROSK[5] has advatages that it has small amouts of commuicatio ad ca form the sessio key oly for each sesor ode-pair. It, however, also has disadvatages that the sessio key of the whole etwork may be exposed i case of exposure of the master key, sice the master key is commo to all sesor odes. Eschehaur ad Gligor proposed a radom key pre-distributio protocol that may ot heighte security dager, while decreasig storage burde of the sesor odes geerated from the method of the secret key shared betwee odes [6]. This protocol is composed of key pre-distributio step before arragemet ad commo key discovery step after arragemet. A radom key pre-distributio scheme has problems that a sessio key ca be formed oly whe there exists a key shared betwee two odes, ad that the same sessio key ca be formed as the sessio key betwee lots of odes. I OKS (Overlap-Key-Sharig) protocol, a sessio key is geerated by the bit sequece shard by two sesor odes, usig very log bit sequece, istead of a set (P) of a large umber of keys [5]. Therefore, it allows the sesor odes to radomly assig ad store bit sequeces which are part of log bit sequeces i etwork. Each sesor ode broadcasts iformatio o its ow stored bit sequeces ad receives iformatio o the bit sequeces broadcast by its eighbor ode, thereby comparig it with its ow stored bit sequeces. Through a hash fuctio, it the forms a certai size of sessio key with the bit sequeces of a overlapped iterval shared by its eighbor ode. This eables it possible to save the amouts of storage ad commuicatio, compared with a radom predistributio scheme, but there exists a disadvatage of decrease i the possibility to coect a sessio key betwee two sesors. Q complex key scheme, where a sessio key is geerated oly whe there exists more tha a certai umber (q) of sessio keys shared by two odes, is composed of key pre-distributio step ad shared key developmet step [7]. I the key pre-distributio step, its ow ode ID is broadcast, like i a radom key predistributio protocol, ad its eighbor (withi the rage of commuicatio) ode ID is checked. I the shared key developmet step, each sesor ode trasmits its eighbor odes the puzzle (cliet Merkle puzzle) for m keys withi its ow key rig. Whe the eighbor ode receives the puzzle, it fids out the key that ca provide the right aswer for the puzzle (that is, the key shared by the two sesor odes) withi its ow key rig, ad trasmits the right aswer to the trasmittig sesor. Whe there is more tha a certai umber (q) of keys shared with its eighbor ode, a sessio key betwee the two ode is formed from the shared key through hash. Q complex key scheme ehaced stability by lowerig the possibility that differet sesor ode-pairs have the same sessio key, ad prepared for eavesdroppig attack, usig a puzzle. However, sice it trasmits each puzzle as a separate message, preparig for replay attack, it has the problem that the amouts of trasmissio, which ca give a great ifluece o the most vulerable electric power of a sesor ode, is excessively icreased, ad that mutual cofirmatio process for the formed key is omitted. 62
Iteratioal Joural of Digital Cotet Techology ad its Applicatios Vol. 2 No 1, March 2008 3. The Key Pre-distributio Usig Double Hash Chai i WSN This sessio describes a radom key predistributio scheme based o double hash chai to explai the system model ad provide resiliece for ode capture i a sesor etwork. 3.1 Notatios This sessio describes otatio used i the proposed scheme like Table 1 below. Table 1. Notatio ad assumptio Notatio Descriptio x, y Two geeric sesors i the WSN N Number of sesors i the WSN S Size of the pool from which the keys are draw th K i i key pool assiged to each sesor C Radom umber of x,y x, y g Uique geeratig key i E() Ecryptio fuctio H() Hash fuctio XOR operatio 3.2 The Key Pre-distributio Scheme This sectio describes a radom key pre-distributio scheme for stable commuicatio of a itermediate ode that plays a role of gateway. The key predistributio scheme is largely composed of key predistributio, shared key restoratio ad path key establishmet sytaxes. I the key pre-distributio sytax, a large key pool ad ID of a ode is geerated before arragemet of etwork. Each ode assigs m key rigs ad radomly take them out of the pool. I the shared key restoratio sytax that is used durig etwork setup, all odes broadcast ID of the key existig i its key rig. A ode ca fid out its eighbor ode sharig a key through such broadcastig process. Fially, i the path key establishmet sytax, the path key is cofigured with ID ad key-pair of a ode for secure commuicatio with its eighbor ode. I this sectio, our scheme cosists of key predistributio, lik key setup withi each cluster ad path key establishmet. 3.2.1 Key Pre-distributio I the key pre-distributio sytax, all odes are divided ito may groups, ad at least odes are cofigured i each group. All sesor odes, icluded i the same group G i, perform prior loadig of bootstrappig program that cotrols role divisio ad ode cofiguratio. The sesors, composig group Gi, have key pool Ki of group Gi. Key pool Ki is composed of size of key pool S ad umber of key chai. The sesor ode performs legitimate autheticatio, usig a sigature key, istead of cluster. A malicious ode caot fake a key of sesor ode, resultig i the advatage that it ca be used i various eviromet services through this process. Key pool K is composed of differet key chai L. K i is composed of K = (i=-1,-2,...0, j=1,2,...,) ad C C j, i j, i + 1 C = i C i+1 φ (i j). Each key chai K i is geerated through g i, the oly geeratio key, ad seed is obtaied through repeated applicatio of the keyed th hash algorithm. The l key of the key chai L is computed with the use of radom umber. of c h j,, g j, c j, g j, is secret iformatio values strictly maitaied with other odes i WSN. Geerates sigature key S( ( c j, 0 ) CH S, SKS ), usig the key shared betwee cluster head ad sesor ode. 3.2.2 Lik Key Setup withi Each Cluster The key establishmet sytax is operated, based o th double hash chai. The key of j hash chai has j 1 value K. Whe autheticatio is required by a sesor ode, the cluster head checks the key of the sesor ode. Whe double hash chai is geerated, oe chai is geerated by a sesor ode, ad the other chai is geerated by the cluster head. The chai geerated by oe chai of the double hash chai is composed of pairs of hash fuctio value c j, i+1 i mutual exchage order of umbers. A sesor ode radomly selects seed value ad apply it to the, c j hash fuctio, geeratig other chai. Figure 1 shows the iitial step geeratig double hash chai, more detailed operatio process of which are as follows: Step 1: Whe autheticatio is required by a sesor ode, the cluster head checks iformatio of the sesor ode. If the iformatio is correct, a key is give to the sesor ode; if ot, the process fiishes. Step 2: The sesor ode geerates double hash chai so that the omial amouts may be differetiated by umber of hash chais j. I order to geerate oe hash chai, the sesor ode selects radom umber. c j, 63
A Key Distributio method for Reducig Storage ad Supportig High Level Security i the Large-scale WSN Yoo-Su Jeog, Yog-Tae Kim, Gil-Cheol Park, Sag-Ho Lee The sesor ode apply the selected c j, to the hash fuctio, geeratig oe chai of double hash chai like h(, g ), (=-1,-2,...,0). Root value c j, +1 j, + 1 c j,0 = h ( c j, ) is geerated whe the hash fuctio is applied to for times. c j, Step 3: I order to geerate the other chai of double hash chai, the cluster head selects radom umber c, usig h c, g ). I order to apply, j ( j, j,, c j selected for times, c j,0 = h ( c j, ) is computed. Seed value of the geerated hash chai is ecrypted Kode cluster with key of the sesor ode ad give to the sesor ode. Step 4: The cluster head seds R j =S( Root j, SKC ) to sesor odes. The value marked o is give Root j by the sesor odes. Whe keys are divided i the cluster, the proxy sigature key-pairs of BS (Base Statio), istead of the BS, are set to the cluster head. Whe the cluster head uses the proxy sigature keypairs, fairess of the cluster head for the keys is verified. 3.2.3 Path Key Establishmet I etwork bootstrappig sytax, each sesor ode broadcasts key idex iformatio of key rig R j to obtai key iformatio of its eighbor ode. This eables each ode to kow the key of its eighbor ode. The each ode surveys key idex iformatio of its ow key rig to compute or fid out a key shared with its eighbor ode. The sesor ode selects = c j 1,0 c j, s BS ad radom umber, apply them to the hash fuctio for times. The sesor ode agrees o idicatio for a ew key, usig proxy key sigature of BS. Sesor ode A seds S ( c j 1, 0, c c 1,0, j-1,, R j 1, rbs, SKS ) ad CertS to sesor ode B icluded i other cluster. Sesor ode B checks Cert S ad verifies V( Root j 1, R j 1, rbs ), usig the shared key of BS. After verificatio of V( Root j 1, R j 1, rbs ), sesor ode B delivers the geerated key to sesor ode A, resultig i mutual commuicatio. 4. Aalysis This sessio evaluates the relatio betwee key rig size ad security stregth of a sesor ode i a give key sharig probability $P_{m}$. This sessio assumes that each sesor ode made security egotiatio with its eighbor ode i iitial step. 4.1 Performace Aalysis Numerical evaluatio of performace aalysis was preformed with the use of Mathlab. For simplicity of the proposed scheme, we assume that examples of all group key pre-distributios have the same property of fuctios. This assumptio is as same as that of all key pre-distributio scheme of give [4] i the same storage space, group size ad keyig material size. We evaluate the proposed scheme with the storage space required for a sesor ode i a give key sharig probability P m. It is assumed that two specific ode i ad j share at least oe key ad q keys. For key pre-distributio scheme, P m is computed like 1 m 1 (1 s ). Here s is the size of key rig, ad m is the size of key pool. d couts the umber of sets assiged to the key pool. Probability is as same as j that obtais m from the key pool ad satisfies 1 j d. The umber of sets i the key pool is expected as 1+ ( d 1). Whe the key rig is assiged to other p m d ode, probability is as same as j that obtais m from the key pool ad satisfies 0 j d. O the basis of above equatios, the expected umber of key pool setup ca be cosidered as d. Performace aalysis of the proposed scheme ca be expressed as various values of K, L ad ( r0, r 1 ) pairs. I a give large umber of K ad L, we ca observe better property of ode capture. For example, i compariso of security legth, that of 210 keys i the proposed scheme is shorter tha that of 100 keys with K=100,000 i Escheauer scheme. Although the proposed scheme is worse tha Escheauer scheme due to shorter security legth, its R value is over 30 less tha that of Escheauer scheme. Whe security legth is guarateed like this, the key rig size, required i the proposed scheme, is about 20% less tha that of Escheauer scheme. This meas that the proposed scheme has more ehaced performace tha other schemes whe etwork size icreases byth of the proposed scheme with =10,000, p m =0.5 ad key rig=256. The results of Figure 1 show that the proposed scheme has 28% lower values tha Escheauer scheme i the same eviromet whe 100% of egotiated commuicatio fractio is performed. As a result, this eables to obtai more efficiet storage space i the d 64
Iteratioal Joural of Digital Cotet Techology ad its Applicatios Vol. 2 No 1, March 2008 same security stregth, sice it is possible to obtai lower values i icrease of etwork size. we ca kow that probability of radomly selected keys adversely icreases with area size. This result ca be obtaied from the value lie draw through value aalysis of differet K, L ad ( r0, r 1 ) pairs. I Figure 3, probability of radomly selected keys is i proportio 2 to. 4.2 Security Aalysis Figure 1. p vs. r0 ad r1 uder differet values of K={50,000, 10,000, 250,000, 500,000} I the proposed scheme, the hash fuctio, which geerates a key, is satisfied oly o the aspect of key geeratio. This is because it is possible to geerate a key from seed value or verify it, but is impossible to compute it. If ( ci, c 1 ),...,( c i + k,..., c i k ) is used for autheticatio, a third perso caot geerate hash value of c i for j > i+k. This makes it impossible to perform key fake. Moreover, the proposed scheme, which proposes use of double hash fuctio, is more secure i key cofiguratio tha the existig schemes which use oe hash fuctio. If validity of sesor is to be proved, the divided key should be autheticated after it is geerated as computatio of c j 1 = c j,, the seed value of chai. If a sesor ode did ot setup seed value of the key i order to be divided ito c j, sbs, the cluster head ca determie validity of the sesor by checkig seed value of the sesor or verifyig validity of divisio. BS, which has iformatio of sesor ode for autheticatio, ca track sesor odes geeratio of faked key. Whe a sesor ode makes double use of ( c j, j+1, c j, i ), BS searches for the sesor ode that geerated a key after computig root value of the key. The, for oe key chai used for key divisio, it is possible to compute seed value of the key used before, usig the root value of BS, thereby searchig for the sesor ode that geerated the key. If the sesor ode divided the key ad reused the divided key, BS makes seed value of the geerated key, usig the divided ad geerated key, ad tracks the sesor ode, usig sesor ode iformatio stored whe proxy sigature was give. Figure 2. Probability p m of radomly selected keys i areas of various sizes Figure 2 shows probability p m of radomly selected keys i areas of various sizes of etwork. Here 65
A Key Distributio method for Reducig Storage ad Supportig High Level Security i the Large-scale WSN Yoo-Su Jeog, Yog-Tae Kim, Gil-Cheol Park, Sag-Ho Lee 6. Refereces [1] J. D. Richard ad S. Mishra, Security Support for I- Network Processig i Wireless Sesor Network, Proc. of ACM Workshop o SASN, pp. 83-93, 2003. [2] S. Doshi ad A. Eswara, A Hierarchical Security Architecture for Group Commuicatio i Sesor Network, Project Report, 2003. [3] S. Slijepcevic, M. Potkojak, V. Tsiatsis, S. Zimbeck ad M. B. Srivastava, O Commuicatio Security i Wireless Ad-Hoc Sesor Network, Proc. of WETICE, pp. 139-144, 2002. Figure 3. Security stregth of the proposed scheme with =10,000, p m =0.5, roud=256 Figure 3 shows security stregth of the proposed scheme with =10000, p m =0.5 ad key rig size R=256. Figure 4 shows that the proposed scheme has 38% more efficiecy tha Escheauer scheme i the same fractio of commuicatio compromised i 100% performace of Escheauer scheme. I additio, results of Figure 4 show that the proposed scheme is more efficiet tha the scheme of Cha et. al that has good security stregth oly for small size of attack, sice the proposed scheme has good security stregth, irrespective of etwork size. 5. Coclusio Sice jammig or eavesdroppig ca more easily occur i wireless etwork tha wire etwork, security is oe of the most importat factors i WSNs. Sice lots of keys have to be loaded for operatio of each ode i the existig key pre-distributio schemes, they are ot suitable for large-scale sesor etworks. This paper proposed a radom key pre-distributio scheme that does ot give a ifluece o etwork size. I order to decrease storage space, while maitaiig the same security legth, istead of assigmet of all keys to the sesor odes, the proposed scheme maximized efficiecy by savig importat key values ito key geeratio set, usig key pool. I particular, the proposed scheme showed average 13% ehacemet of security stregth legth, compared with the schemes of Escheauer ad Cha et. al. Further study i the future is plaig to evaluate security stregth, accordig to the kids of active attacks i case of radom ode capture i a optimized size. [4] H. Cha ad A. Perrig, PIKE: Peer itermediaries for key establishmet i sesor etworks, Proc. of IEEE INFOCOM, 2005. [5] B. Lai, D. Hwag, S. Kim ad I. Verbauwhede, Reducig Radio Eergy Cosumptio of Key Maagemet protocols for Wireless Sesor Networks, Proc. of ISLPED04, pp. 351~356, 2004. [6] L. Eschehaur ad V. Gligor, A Key-Maagemet Scheme for Distributed Sesor Networks, Proc. of CCS02, pp.41~47, 2002. [7] H. Cha, A. Perrig ad D. Sog, Radom Key Predistributio Schemes for Sesor Networks, Proc. of 2003 IEEE Symposium o Security ad Privacy(SP03), p. 197~213, 2003. [8] R. Pietro, L. Macii ad A. Mei, Radom Key Assigmet for Secure Wireless Sesor Networks, Proc of 1st Workshop Security of Ad Hoc ad Sesor Networks, pp. 62~71, 2003. [9] R. Blom, A Optimal class of symmetric key geeratio systems, Proc. of EUROCRYPT84, Lecture Notes i Computer Sciece, Spriger-Verlag 209, pp. 335~338, 1984. 66