Abstract
Wireless sensor network (WSN) has become one of the most promising network technologies for many useful applications. However, for the lack of resources, it is different but important to ensure the security of the WSNs. Key management is a corner stone on which to build secure WSNs for it has a fundamental role in confidentiality, authentication, and so on. Combinatorial design theory has been used to generate good-designed key rings for each sensor node in WSNs. A large number of combinatorial design based key management schemes have been proposed but none of them have taken key updating into consideration. In this paper, we point out the essence of key updating for the unital design based key management scheme and propose two key updating methods; then, we conduct performance analysis on the two methods from three aspects; at last, we generalize the two methods to other combinatorial design based key management schemes and enhance the second method.
1. Introduction
Wireless sensor network (WSN) is a kind of large wireless network. Generally speaking, WSNs consist of resource-limited sensor nodes with a large number of functions, such as sensing, collecting, and processing, which leads to their ability to fulfill special missions [1]. WSNs have become one of the most promising network technologies, which can be widely used in different applications. Because of the sensitivity of these applications and many issues involved in WSNs, sophisticated security services are required [2]. Key management is a corner stone on which to build secure WSNs, because it is able to protect many services, such as confidentiality and authentication, which are required for secure communication in WSNs. However, the sensor nodes in WSNs are all resource-limited devices. Therefore, key management schemes like Diffie-Hellman based or public-key based schemes, which are widely used in other networks, are not very suitable for the direct application in WSNs [3]. The key management scheme, which uses symmetric encryption technology, is still a hot research topic. Over the last decade, a lot of research works dealt with symmetric key predistribution issue for WSNs and many solutions have been proposed [4–6]. Nevertheless, in most existing solutions, the design of key rings (blocks of keys) strongly depends on the size of the WSNs, which results in either suffering from low scalability or degrading other performance metrics [7].
Combinatorial design theory is an important part of combinatorial mathematics. Combinatorial design theory deals with the existence, construction, and properties of systems of finite sets whose arrangements satisfy generalized concepts of balance and/or symmetry. Combinatorial design theory has been used in many different applications, such as cryptography and secret sharing in literatures [8–10], network design in literatures [11, 12], and key management for WSNs in literatures [7, 13–16]. Since Mitchell and Piper [13] firstly applied combinatorial designs to key distribution, a lot of other combinatorial design based key management schemes have been proposed.
Key updating is very important in key management because the more often a key is used, the less secure it will be. To the best of our knowledge, there exists no updating method for combinatorial design based key management scheme. Therefore, we propose two key updating methods to resolve the problem mentioned above.
The main contributions of this paper are as follows:(1)we point out the essence of key updating for combinatorial design based key management schemes which is a multigroup key distribution;(2)we propose two key updating methods for the unital design based key management scheme. The two key updating methods can be generalized to other kinds of combinatorial design based key management schemes. The first proposed method is distributed where each sensor node is devoted to key updating and the second one is traditional group key distribution;(3)we conduct the performance analysis on our proposed two methods and show their advantages and disadvantages;(4)we enrich the application of combinatorial design in key management for WSNs and also point out some future research directions.
The remainder of this paper is organized as follows: Section 2 presents the related works on combinatorial design based key management scheme for WSNs and shows the importance of key updating. We propose our two methods in Section 3. In Section 4, we conduct the performance analysis on the two methods from three aspects and make some comparison. In Section 5, we discuss our two proposed methods and improve them. Finally, we draw conclusions and point out our future research directions in Section 6.
2. Related Work
Mitchell and Piper [13] firstly used combinatorial designs into key distribution. They introduced a number of new concepts and showed how the theory of incidence structures with special properties, called key distribution patterns, may be applied to key management problems. The proposed method is shown to generalize earlier work in the area.
Çamtepe and Yener [14] proposed novel deterministic and hybrid schemes based on symmetric balanced incomplete block design (SBIBD) for key predistribution in WSNs. The SBIBD decides how many and what keys are assigned into each key-chain before the WSNs are deployed. After mapping from SBIBD to key predistribution, there are key rings, which contain keys selected from a key pool with the size . And each pair of two key rings shares exactly one common key. SBIBD which produces better connectivity with smaller key-chain size can make key distribution schemes more efficient. The main strength of the proposed scheme is that each pair of two nodes shares exactly one common key which can obtain total secure connectivity. However, the SBIBD schemes do not have a good scalability for large WSNs because they only generate key rings to obtain a key ring with keys, while the former are determined by the properties of SBIBD.
Ruj and Roy [15] also used SBIBD to guarantee intraregion secure communications in grid group WSNs. In grid group WSNs, all nodes within a particular region can link to each other directly. While sensor nodes in different regions can make use of more special resource nodes to communicate with each other. Taking the Lee distance into account, they consider the resiliency not only in terms of fraction of links broken, but also in terms of the number of nodes and regions disconnected when some sensors are compromised. But the deterministic key predistribution schemes will lead to constant-time computation cost for shared key discovery and path key establishment.
Basic schemes like [17] have perfect network resilience but their network scalability is only where is the key ring size. The SBIBD [15] and the trade [16] based ones obtain a network scalability of . The solutions proposed in [13] elevate the network scalability up to without losing secure connectivity coverage and overall performances. The researchers apply the unital design into predistribution. They propose two schemes, a basic one and an enhanced one, which achieve a good tradeoff between scalability and connectivity.
Combinatorial design based key management schemes obtain a lot of attentions. However, to the best of our knowledge, none of the related works have taken key updating into consideration. Without key updating, the key management schemes will be less secure as time passes. In this paper, we point out the essence of key updating for combinatorial design based key management scheme and then put up our two different kinds of key updating methods.
3. The Proposed Schemes
In this section, first we briefly introduce the unital design based key management scheme [7]. The brief introduction consists of unital design and its mapping to key predistribution. Then, we point out the essence of the key updating for the unital design based key management scheme. At last, we propose two key updating methods.
3.1. Unital Based Key Management Scheme
3.1.1. Background: Unital Design
Combinatorial design theory is a part of combinatorial mathematics dealing with the existence, construction, and properties of the systems which consist of finite sets whose arrangements satisfy generalized concepts of balance and/or symmetry. A -design is defined as follows: given a finite set of points (elements), we construct a family of subsets from the finite set , called blocks, such that each block has a certain number of points, which is , each point is contained in blocks, and points are contained together in exactly blocks [13]. A unital design is a Steiner 2-design, where , = , and . We call the unital design 2−design , or in short form.
Here is an example of a 2-(9,3,1) unital design with shown in Table 1.
We can see from Table 1 that there are 12 blocks, , in the above example, and 9 elements are , respectively. In addition, we can find that every block has 3 elements; for example, has 3 elements, , , and ; each element is contained in 4 blocks; for example, is contained in , , , and , and each pair of 2 elements together is contained in exactly 1 block; for example, and together are contained only in .
3.1.2. A Basic Mapping from Unital to Key Predistribution for WSNs
Each block which has points can be mapped into a sensor node in WSNs while each point can be mapped to a key. Note that point can also be called element in combinatorial design. The following table, Table 2, shows the basic mapping from unital design to key predistribution for WSNs.
The key distribution center (KDC) generates the unital blocks (key rings) and loads them to the memory of sensor nodes before these sensor nodes are deployed. Each distinct key ring will be preloaded in only one node, along with the corresponding key identifiers. When two nodes want to communicate with each other, they will exchange their key identifiers. According to their key identifiers, they can decide the communication key or they need to establish a secure path for communication. In the basic unital design mapping, each pair of two nodes shares at most one common key. Therefore, if two nodes have a common key, after exchanging the key identifiers, they will be able to determine this common key, or if two nodes do not have a common key, they need the help of other nodes to establish secure paths.
3.2. System Model for WSNs and Updating Model for Each Sensor
We can see from the generalized definition of the unital design (a 2-design , that there are keys and sensor nodes. In addition, the definition of the unital design shows that each key is contained in sensor nodes and each sensor node has keys. We can regard all the sensor nodes which have the same key as a group; therefore, there will be group, and in each group there will be sensor nodes. Furthermore, each sensor node belongs to groups because it has keys.
Therefore, the system model can be described in the following two formulas:
The first formula shows that the system model consists of groups. Each group corresponds to a key and there are sensor nodes in each group which is marked by the key ID. Note that because, in a unital design, each pair of 2 elements is contained together in exactly 1 block.
The second formula points out that the system model is made up of sensor nodes and each sensor node has keys. The keys can be defined as a key ring or a key block, . Note that two nodes have one common key or not because in one unital design, each pair of and has the relationship that or 1.
According to the above system model, we can obtain the key updating model as each sensor node updates all its keys. For each of sensor nodes, the updating model can be described as in Figure 1.
Figure 1 shows the key updating model for each sensor. We can see, from it, sensor node has keys . If it wants to update , it will need to communicate with the other sensor nodes in that share the same key with it, and by some methods, the new updated key can be obtained by all the sensor nodes in the . As each sensor node has keys, it needs to communicate with other groups like what it does with to update all its other keys.
We can see from the updating model for each of sensor nodes that the essence of key updating for the unital design based key management scheme is multigroup key management.
In the following subsection, we propose two key updating methods for the unital design based key management scheme, the first one is distributed which means each sensor node in the group is devoted to updating the group key, while in the second one, there is a group manager in each group distributing the broadcast to update the group key.
3.3. The First Key Updating Method
In this method, each sensor node is predistributed with a device ID, that is, , keys, and corresponding key ID. In addition, each sensor node also stores the corresponding ID of sensor nodes in each group which is made up of the corresponding key. Table 3 shows the detail of the content which each sensor node should store in the first method.
In this method, to update one key, each sensor node will send a random number which is encrypted by the group key to other sensor nodes in the same group. And then, it will receive a certain number of messages which also contain random numbers from other sensor nodes. The number of the messages is determined by the number of legal sensor nodes in the group. For the sensor , it updates one of its keys, , as the following steps.
Step 1. Consider : || ().
In this step, sensor node broadcasts the message || () to other sensor nodes which have the same group key . Here, is the id of the key which needs to be updated; is the ID of the sensor node and () which is the decrypted .
Step 2. Sensor receives broadcast message from other senor nodes. If the first part of the broadcast message, , is also contained in the content of sensor , and the ID of that sensor node (the sender of the broadcast message), , is in the same key group, then it begins to receive the whole broadcast message. In order to compute the new updating key, it needs to receive a certain number (the number of other legal sensor nodes in the same key group). Note that after one node has used up its energy, it will inform other nodes in the same key group to delete its id. Therefore, the number of the broadcast messages which a sensor node needs to receive for computing the group key will decrease when the time goes. Note that these messages contain other RN generated by other sensor nodes in the same key group.
Step 3. After it receives messages for updating the key, it computes the new updated key as the following equation:
Here is the number of legal nodes. The order of each is decided by the ID of the sender which is set before deployment.
As each senor node has keys, it needs to do the above steps times to update all its keys. When a sensor node is about to use up its energy, it will send a revocation message to other sensor nodes to inform them to delete the corresponding information about it in the key groups. In addition, if a node is detected as a promised sensor node, the detector will inform other nodes to delete the corresponding information about the promised node. The detector will ask other sensor nodes to update the corresponding keys the promised node has.
3.4. The Second Key Updating Method
In the first method, all the sensor nodes are distributed and are all responsible for the generation of the new key, while in the second key updating method, only one sensor node which is defined as group manager (GM) is responsible for the generation of a new key.
In this key updating method, the GM stores the same content as the content each sensor node stores in the first method. Each member sensor node is predistributed with a device ID , keys, and corresponding key ID. Note that in this scheme, each sensor node does not store the identifiers of other senor nodes. Table 4 shows the detail of the content which the group member sensor nodes store.
We can see from Table 4 that this method is more efficient in storage overhead because each member sensor node stores less content than that of the first method. The second method is based on the group key distribution. Therefore, there are two kinds of sensor nodes in the system: the GM and the member sensor nodes. In this method, to update one key, the GM needs to generate the broadcast and each member sensor node can compute the group key after receiving the whole broadcast.
The GM generates and sends the broadcast as the following steps.
Step 1. The GM generates the authentication polynomial as the following equation: is the number of legal member sensor nodes (except the GM and revoked sensor nodes), and .
Step 2. The GM generates the key updating polynomial as follows: is the key updating material.
Step 3. The GM generates the broadcast and sends it. The construction of the broadcast is as follows:
We can see from (5) that the broadcast consists of two parts. The first part is , the ID of the key which needs to be updated. And the second part is the key updating polynomial which is generated in the second step.
Each sensor node (except for the GM) receives the first part of the broadcast and decides whether it needs to receive the whole broadcast according to theID of the key, . If it has this key (also has this key ID), then it receives the whole broadcast and computes the corresponding key updating information according to the broadcast; otherwise, it waits for the next broadcast. The key updating information can be computed as the following equation:
Each legal member node will get the computation result of 0 when computing the authentication polynomial . Therefore, all the legal member nodes will get the same key update information from the above equation while other revoked sensor nodes will obtain value of . The different value will lead to different key updating information . And then each legal member sensor node uses the key update information to update the group key as the following equation:
Note that all the legal member nodes can compute the same updated key because these legal member nodes have the same group key and use the same key updating information to update the group key.
4. Performance Analysis
In this section, we conduct the performance analysis on the two different kinds of key updating methods. As the sensor nodes in WSNs are all resource-limited devices, we take the following three aspects into consideration: storage, computation, and communication overhead.
4.1. Storage Overhead
Table 5 shows the storage overhead of the sensor devices in the proposed two methods.
In the first method, each sensor node stores its own device ID, and group information which contains one key, one key ID, and other IDs of other sensor nodes is in the same group. Therefore, the total ID number which each sensor node stores is and the total number of keys is .
In the second method, the GM has the same storage overhead as the first method; however, each member sensor node only needs to store its device ID and group information. The group information consists of one key and one key ID. Therefore, the total ID number which each member sensor node stores is , and the total number of keys is also , the same as the first method.
We can see from Table 5 that the second method is more efficient in storage overhead than the first method. Therefore, when the sensor nodes in WSNs are more limited in memory, the second method would be preferable.
4.2. Computation Overhead
Table 6 shows the computation overhead of the sensor devices in the proposed two methods.
In the first method, each sensor node needs to generate a random number RN and do hash to update its keys.
In the second method, the GM needs to generate a random number, that is, the updating information, and a -degree polynomial while other sensor nodes need to do polynomial evaluation operations to obtain updating information. Both the GM and the member sensor nodes need to operate hash to update its keys.
As all the sensor nodes in both methods have hash operations (when lengths of the content and are small, the time required for hash operations, for example, md5 and sha1, is not obviously different compared with that of polynomial operations which need a large number of loops. For example, the time required for hashing 64-bit data by md5 in java is 1 ms while hashing 64000 bits is about 19 ms); we can compare them from the previous three items: Generate RN, Poly generation, and Poly evaluation. The first method is much more efficient in computation overhead because the Generate RN operation is much more efficient in computation than that of the Poly operation in the second method. Therefore, when the sensor nodes in WSNs are more limited in computation ability, the first method would be preferable.
4.3. Communication Overhead
Table 7 shows the communication overhead of the sensor devices in the proposed two methods.
Table 7 shows the communication overhead of the devices in two methods. In the first key updating method, in order to update one key, a sensor node needs to send a message which contains two IDs and one encrypted random number and will receive messages from other nodes in the same key group. The communication overhead for updating one key is IDs and random numbers. Therefore, for each of sensor nodes to update all its keys, the total communication overhead is ID and ()() random numbers.
In the second method, the GM needs to send (while the other sensor nodes need to receive) the broadcast which contains the ID of the key and a -degree polynomial (). Therefore, the total communication overhead of the GM and each member sensor node are both keys and -degree polynomials. Here, we take into consideration the largest communication overhead of each sensor node; therefore, the number of legal sensor nodes or the degree of the authentication polynomial, , is set as ( member sensor nodes except the GM itself). Because each sensor node needs to update all its keys, the total communication overhead is ID and -degree polynomials.
Here, we define all the IDs, RNs, and coefficients of the polynomial AS belonging to Fp. Therefore, the communication overhead of the two methods can be concluded in Table 8.
Table 8 shows that the second method is more efficient than the first method in communication overhead. Therefore, when the sensor nodes in WSNs are more limited in energy, the second method is preferred.
4.4. Comparison between the Two Methods
We can draw a conclusion from the above three subsections that the first method is better in computation while the second method is more efficient in storage and communication. In addition, the second method is more energy saving because the energy cost is linked to communication overhead (communication needs more energy than the calculation) [18]. However, the first method is more secure because in the first second the capture of one sensor node will not affect the whole WSNs with the help of other security technologies such as IDS (intrusion detect system), while in the second method, the capture of the GM will affect the whole WSNs. Note that the capture of the member sensor nodes will not affect the WSNs. In conclusion, as each proposed method has its own strong points and weak points, we should choose different key updating method for different applications.
5. Discussion
5.1. Generalization
When a combinatorial design is constructed, the number of elements and the number of blocks are both determined which will load to the determination of the number of groups and sensor nodes. As our methods are designed for the case that there exist a certain number of groups which contain some sensor nodes and sensor nodes which have some keys, they can be generalized to other combinatorial design based key management schemes.
For example, the symmetric balanced incomplete block design (SBIBD) is a design, where ,, and . There are sensor nodes and keys in the WSNs. In addition, each key is contained in sensor nodes and each sensor node has keys, which means, for a sensor node , it needs to update keys among key groups. The sensor node can use the proposed two methods to update its keys.
5.2. The Improvement of the Second Method
The second method can be improved in two factors: less communication overhead and self-healing.
As we can see from predistribution rule, each sensor node has keys. Note that the construction of the unital design makes it possible for blocks having all elements. For example, in the example of the 2-(9,3,1) unital in Table 1, there are blocks and keys, and , , and have all the 9 different keys, and so do , , and . Taking advantage of this good feature, we set that a node manages groups, so the number of group managers and the corresponding broadcasts will drop to . The first part KID of the broadcast contains all the key IDs which the GM has. Therefore, the broadcast can be described as in the following equation:
The disadvantage is that the degree of the will increase to as the authentication polynomial contains all IDs of the legal sensor nodes the GM knows. To reduce the degree of the, we can replace the authentication polynomial with the revocation polynomial and masking polynomial which will lead to only (the degree of the masking polynomial) revocation ability. The masking polynomial is used in [19], and the construction of is as follows: where is the revocation polynomial, is the masking polynomial, and is the session ID.
The modification increases the storage overhead that each sensor node needs to store the masking polynomial and the session ID but can decrease the degree of the to which can be much less than .
Self-healing is a desirable feature for group key distribution scheme as the wireless environment and resource-limited features make the WSNs sometime an unreliable network. In unreliable networks, the member in the group may lose a message from the GM. The member can ask the GM to resend the broadcast. However, it will become a large communication cost for the GM when the resend requirement increases. To overcome the above problem, in 2002, group key distribution with the feature of self-healing is proposed, and soon self-healing group key distribution scheme becomes a hot research topic [20].
Our second method can be easily modified to a self-healing one with some more communication overhead. The construction of the broadcast can also refer to that in [19] which can be described as the following equation:
Here, is the number of all the sessions and is the number of which each broadcast owns to ensure the ability of self-healing the group key within sessions. Note that the number of in the second part of increases from 1 to . Figure 2 shows the relationship between and healing rate in the case that there are 1001 sensor nodes (a GM controls 1000 member sensor nodes) in the WSNs where the loss probability is 10%.
As we can see from Figure 2, the broadcast which contains less can still have a good healing rate which means that we can set a small number for self-healing of the second method.
6. Conclusion
In this paper, we focus on how to update the key used in combinatorial design based key management schemes for WSNs. In order to better introduce combinatorial design, we give an example of unital design and its mapping to key predistribution for WSNs. Then, we propose two key updating methods for the unital design based key management scheme; one is distributed and the other is group based. The key updating methods can be generalized to other combinatorial design based key management schemes, and the group based key updating method can be modified to a self-healing version easily. We conduct the performance analysis on the two proposed methods from three aspects: storage, computation, and communication overhead. As the essence of updating keys for combinatorial design based key management schemes is the same as that of the unital design based key management scheme, our two key updating methods can be generalized into other combinatorial design based key management schemes. Referring to the construction of in [19], we can modify the second method to a less communication overhead version. In addition, the second method also can be modified to a self-healing one. The best contribution of this paper is that with the key updating feature, combinatorial design based key management scheme will be more secure and, thus, enriches the application of combinatorial design in key management for WSNs.
Regarding future work, we will research in the following two aspects:(1)how to reduce the communication overhead of the first method by the construction of the combinatorial design;(2)looking for or coming up with another combinatorial design holding better features for key management in WSNs.
Conflict of Interests
The authors declare that there is no conflict of interests regarding the publication of this paper.
Acknowledgments
This research was supported by Ministry of Education, Humanities and Social Sciences Project (13YJCZH216), Natural Science Foundation of Zhejiang Province (LQ12G01007), Foundation of Department of Education of Zhejiang Province (Y201329545), Key Laboratory of Electronic Commerce and Logistics Information Technology of Zhejiang Province (2011E10005), Innovative Group of e-Business Technology of Zhejiang Province (2010R50041), and Postgraduate Technology Innovation Project of Zhejiang Gongshang University (1120XJ1513176).