A Complete Hierarchical Key Management Scheme for Heterogeneous Wireless Sensor Networks

Abstract

Heterogeneous cluster-based wireless sensor networks (WSN) attracted increasing attention recently. Obviously, the clustering makes the entire networks hierarchical; thus, several kinds of keys are required for hierarchical network topology. However, most existing key management schemes for it place more emphasis on pairwise key management schemes or key predistribution schemes and neglect the property of hierarchy. In this paper, we propose a complete hierarchical key management scheme which only utilizes symmetric cryptographic algorithms and low cost operations for heterogeneous cluster-based WSN. Our scheme considers four kinds of keys, which are an individual key, a cluster key, a master key, and pairwise keys, for each sensor node. Finally, the analysis and experiments demonstrate that the proposed scheme is secure and efficient; thus, it is suitable for heterogeneous cluster-based WSN.

1. Introduction

Recently, wireless sensor networks (WSN) become more and more popular since they have been deployed in various applications, such as military, environmental monitor, industry automation, and smart space. A WSN is composed of a large number of sensor nodes which work together by collaborating with each other. In fact, sensor nodes are constrained in computing, communication, and energy capability; therefore, energy saving and hardware complexity are necessary to be considered carefully when constructing a WSN. For example, asymmetric cryptographic algorithms such as RSA or high cost operations like modular exponentiation operations are not appropriate for designing security mechanisms for a WSN.

Generally, all sensor nodes in a WSN may be divided into several small groups which are known as clusters [1–3]. Each cluster would have a cluster head responsible for collecting and aggregating sensing data from its cluster members. A cluster-based WSN can be implemented in both homogeneous WSN and heterogeneous WSN. We first consider the case that implementing a cluster-based WSN in homogeneous WSN. Note that all sensor nodes in homogeneous WSN have the same capabilities. After being deployed, every sensor node within the same cluster elects one as a cluster head. Obviously, the workload of acting a cluster head is heavier than a sensor node; as a result, the sensor node which acts as a cluster head would run out of its battery before other sensor nodes. Although it can be solved by rotating the role of the cluster head periodically over all cluster members, the workload of being a cluster head is still heavy for a sensor node. Actually, several studies [4, 5] have demonstrated that a homogeneous ad hoc network has poor performance and scalability.

Hence, several researches have concentrated on a heterogeneous WSN which incorporate different types of sensor nodes with different capabilities. For example, a WSN may contain a small number of powerful high-end sensor nodes (𝐻-Sensors) and a large number of low-end sensor nodes (𝐿-Sensors). If implementing a cluster-based WSN in heterogeneous WSN, 𝐻-Sensors organize 𝐿-Sensors around them into clusters, and 𝐿-Sensors forward sensing reports to the corresponding 𝐻-Sensor. It is commonly referred to as the heterogeneous cluster-based WSN. The advantage of it is the overall hardware cost of the entire WSN that can be reduced. This is because 𝐿-Sensors, which only perform the basic functions, can be manufactured very cheap and simple.

In another aspect, security is a vital issue in various WSN applications. Thus, an efficient key management scheme is necessary. Depending on different applications and security requirements, a variety of key management schemes have been proposed for a heterogeneous WSN [6–10]. In fact, most of these schemes place more emphasis on pairwise key establishment and key predistribution. However, due to the property of a heterogeneous cluster-based WSN that makes the topology hierarchical, a hierarchical key management scheme for cluster-based heterogeneous WSN is essential. Except for an pairwise key, which is shared between two sensor nodes, an individual key, which is shared between each sensor node and the base station, a common cluster key for each cluster, and a master key for all sensor nodes are also required.

Moreover, key updating is also required to be considered for the following reasons. First, sensor nodes may be compromised. The affected keys must be updated or revoked. Second, the network topology may be dynamic. For example, sensor nodes are deployed into the sea for aquatic application. If a sensor node moves to another neighboring cluster, some keys may need to be updated. Third, the base station may desire to update the master key periodically for better security level. For the best of our knowledge, no hierarchical key management scheme with key updating functionality for a heterogeneous cluster-based WSN has been proposed.

In this paper, we propose a complete and efficient hierarchical key management system for a heterogeneous cluster-based WSN. Our design only utilizes symmetric cryptographic algorithms and low cost operations such as bitwise XOR operation and modular multiplication. This construction contains two schemes, key generating scheme and key updating scheme. In the key generating scheme, four kinds of keys, which are an individual key, pairwise keys, a cluster key, and a master key, are generated for each 𝐿-Sensor. In the key updating scheme, we place the emphasis on updating cluster keys and the master key. In order to improve better efficiency, our design reduces the usage of unicasting. In the performance evaluation, we demonstrate that the storage requirement, communication, and computation cost are reasonable. Besides, in the security analysis, we show that the proposed construction is secure and influence of compromising can be confined to the affected cluster. Finally, the experimental results demonstrate that the operations used in our design are practical.

The remainder of this paper is organized as follows. In Section 2, some preliminaries are introduced. We describe the related work, network model, attack model, and our design goals. In Section 3, we propose our key generating scheme. In Section 4, the proposed key updating scheme is introduced. Then, Sections 5 and 6 describe the security analysis and performance evaluation of our design, respectively. We further provide experiments in Section 7. Finally, Section 8 concludes.

2. Preliminaries

In this section, the related work is introduced firstly. Then we describe the network model of heterogeneous cluster-based WSN and the attack model. We also list our design goals.

2.1. Related Work

Since several studies [4, 5] demonstrated that a homogeneous WSN has poor performance and scalability; several recent works investigate a heterogeneous WSN. Duarte-Melo and Liu [11] analyzed the energy consumption and lifetime of a heterogeneous WSN. Girod et al. [12] developed tools to support a heterogeneous WSN and measurement and visualization of operational systems. Du and Lin [13] proposed a differentiated coverage algorithm which can provide different coverage degrees for different areas. Lazos and Poovendran [14] studied the problem of coverage in planar heterogeneous WSNs. Lin et al. [15] proposed an ant colony optimization-based approach to maximize the lifetime of a heterogeneous WSN. Chen et al. [16] proposed a recoverable data aggregation scheme for a heterogeneous cluster-based WSN. As shown above, heterogeneous WSN indeed received lots of attention.

In the view of key management or key distribution schemes, several researches have been proposed [6–9, 17, 18]. Most of these schemes focus on probabilistic key predistribution method. Du et al. [6] presented an asymmetric key management scheme which preloads a large number of keys in each 𝐻-Sensor while preloading a small number of keys in 𝐿-Sensors. Later, Hussain et al. [8] also proposed key predistribution scheme, which reduces the storage requirements while maintaining the same security strength. Durresi et al. [7] proposed key predistribution schemes between stationary nodes and nonstationary nodes. Traynor et al. [9] described three keying and trust models for the heterogeneous WSN. Khan et al. [17] presented a key management scheme supporting mobility in a heterogeneous WSN that consists of mobile sensor nodes with few fixed sensor nodes. Shi et al. [18] proposed a resource-efficient authentic key establishment scheme for a heterogeneous WSN.

The above schemes for heterogeneous WSNs put more emphasis on pairwise key distribution and ignore the property of hierarchy. Thus, in this paper, we propose a hierarchical key management construction with the functionality of key updating.

2.2. The Network Model of Heterogeneous Cluster-Based WSN

The network model of a heterogeneous cluster-based WSN contains three components, a base station, a small number of powerful high-end sensor nodes (𝐻-Sensors), and a large number of low-end sensor nodes (𝐿-Sensors). 𝐻-Sensors are expected to have more energy than 𝐿-Sensors. They organize 𝐿-Sensors into clusters, collect and aggregate sensing data from their cluster members (𝐿-Sensors), and send the results to the base station. Besides, an 𝐻-Sensor is equipped with a tamper-resistant hardware.

On the other hand, 𝐿-Sensors, which have sensing capability with limited computation, memory, and communication, are small and low-cost devices. Each 𝐿-Sensor detects a target within its detection range, uses its processing power to locally perform simple computations, and then sends the required data to the corresponding 𝐻-Sensor. Besides, an 𝐿-Sensor is not equipped with tamper-resistant hardware; therefore, an adversary can obtain the information stored in an 𝐿-Sensor after compromising it.

Figure 1 illustrates a simple example of a heterogeneous clustered-based WSN. Note that 𝐻_𝑖 denotes the 𝐻-Sensor 𝑖 and 𝐿^𝑗_𝑖 denotes the 𝐿-Sensor; 𝑖 belongs to 𝐻_𝑗. Depending on different environments, there might be more than one level of 𝐻-Sensors between the base station and 𝐿-Sensors. In Figure 1, cluster 3 contains 𝐿³₀, 𝐿³₁, 𝐿³₂, 𝐿³₃, and 𝐻₃. 𝐻₁, an upper level 𝐻-Sensor of 𝐻₃, forwards the data sent from 𝐻₃ to the base station.

Figure 1 

An example of a heterogeneous clustered-based WSN.

Due to the properties of a heterogeneous WSN, the communication capacity of the base station, 𝐻-Sensors and 𝐿-Sensors are different. The communication can be classified into the following categories.(1)Within a cluster: an 𝐻-Sensor can broadcast/unicast messages to its cluster member through single hop, whereas messages sent to the 𝐻-Sensor may require multihop or still single hop depending on the distance between them.(2)Between two neighboring 𝐻-Sensors: an 𝐻-Sensor can communicate to neighboring 𝐻-Sensors through single hop.(3)Between the base station and 𝐻-Sensors: no doubt, messages sent to the base station require hop by hop. For example, in Figure 1, messages which are sent by 𝐻₃ to the base station would pass through 𝐻₁. On the other hand, the base station can broadcast/unicast to all 𝐻-Sensors through single hop or multihops.

2.3. Attack Models

Here we discuss the attack model for key management schemes in a WSN. Depending on the abilities of adversary, attacks can be categorized into two situations.(1)Without compromising sensor nodes: an adversary can only eavesdrop packets or send false messages to legal sensor nodes without any knowledge.(2)Compromising sensor nodes: after compromising a sensor node, an adversary can obtain the information stored in this sensor node. He may calculate other keys or secrets through the compromised information.

Note that detecting compromised sensor nodes which still act as normal sensor nodes is infeasible in all existing detection mechanisms in WSN. However, if an adversary compromises a sensor node and performs abnormal behavior or attacks, it will be detected [19–23]. Besides, in a heterogeneous WSN, it is assumed that every 𝐻-Sensor is equipped with a temper-resistant hardware; thus, considering the case that he compromises an 𝐻-Sensor is not required.

Based on the above attack models, a key management scheme for a WSN must satisfy the following security requirements. Requirement 1: all messages, including sensing data and control messages, must be encrypted. Requirement 2: an adversary cannot compromise the entire WSN with the compromised secrets. More specifically, he cannot derive the secrets that belong to other clusters. Furthermore, if he compromises two sensor nodes which belong to different clusters, he cannot obtain the secrets with other clusters either. Requirement 3: if compromised sensor nodes are detected, the affected keys must be updated or revoked.

2.4. Design Goals

Four kinds of keys, individual key, master key, cluster key, and pairwise key, are generated in the proposed construction.(1)Individual key: every 𝐿-Sensor and 𝐻-Sensor share an individual key with the base station. The base station can encrypt the secret information with the individual key if required.(2)Cluster key: every cluster has one cluster key which is shared with all cluster members including one 𝐻-Sensor and several 𝐿-Sensors. The cluster key is utilized for encrypting the cluster traffic. An 𝐻-Sensor can securely transfer control messages to its cluster members with this key. For example, an 𝐻-Sensor may turn some cluster members into sleep mode; it can encrypt this control message with the cluster key. On the other hand, all 𝐿-Sensors within the same cluster may encrypt the sensing reports with the same cluster key. The importance of cluster key is also discussed in [24].(3)Master key: this master key is shared between all 𝐿-Sensors and the base station within the entire network. The base station can securely broadcast the information to all 𝐿-Sensors with the master key.(4)Pairwise key: the pairwise key is shared with two neighboring 𝐿-Sensors. In some applications, two neighboring 𝐿-Sensors may require secure channel to protect their communication. For example, if the cluster key is compromised, 𝐿-Sensors in this cluster may encrypt the data with pairwise keys. In this paper, we also consider how to update some of the above keys efficiently. Sensor nodes may be compromised or move to another neighboring cluster; consequently, the master key and the corresponding cluster keys must be updated. Besides, the master key may be updated periodically for security considerations.

3. The Proposed Key Generating Scheme

In this section, we propose a key generating scheme for a heterogeneous cluster-based WSN. As mentioned above, this scheme generates four kinds of keys, individual key, master key, cluster key, and pairwise key. Notations used in this paper are summarized as shown in Notation section.

3.1. Generating Each Individual Key

Actually, individual keys of each 𝐿-Sensor and 𝐻-Sensor are preloaded before being deployed. More specifically, an individual key 𝐾_𝐿^𝑗_𝑖,BS is preloaded to 𝐿^𝑗_𝑖 and 𝐾_𝐻𝑗,BS is preloaded to 𝐻_𝑗.

After deployment, 𝐻-Sensors partition all 𝐿-Sensors into several clusters. Each 𝐻-Sensor can realize which 𝐿-Sensors are organized in its cluster. Then every 𝐻-Sensor reports its cluster information to BS.

Before generating other keys, BS requires to securely assign each 𝐿-Sensor a key which is shared with the attached 𝐻-Sensor. For example, 𝐾_𝐿^𝑗_{𝑖,𝐻𝑗} which is assigned to 𝐿^𝑗_𝑖 is shared between 𝐿^𝑗_𝑖 and 𝐻_𝑗. Since BS realizes the cluster information of each cluster, it can securely send the key 𝐾_𝐿^𝑗_{𝑖,𝐻𝑗} encrypted with 𝐾_𝐻𝑗,BS or 𝐾_𝐿^𝑗_𝑖,BS to every 𝐻-Sensor and 𝐿-Sensor. Hence, all 𝐿-Sensors would share the keys with their attached 𝐻-Sensors. Note that the key 𝐾_𝐿^𝑗_{𝑖,𝐻𝑗} is transmitted only once before the stages of generating other kinds of keys.

3.2. Generating Cluster Keys

The procedure of generating cluster keys is modified from [25, 26]. To generate the cluster key, each 𝐻-Sensor constructs a binary tree and assigns its cluster members to leaf nodes. The root of the binary tree is the cluster key and intermediate nodes are key encryption keys. Note that the key encryption keys are used for updating the cluster key. Each 𝐿-Sensor knows all the keys from the parent of its corresponding leaf node up to the root. This set of keys is called the key path. The procedure of generating the cluster key is described as follows.

If there are 𝑛_𝑗𝐿-Sensors in cluster 𝑗, the 𝐻-Sensor 𝐻_𝑗 will generate random elements 𝑅₀,𝑅₁,…,𝑅_{⌈log2(𝑛𝑗)⌉−1} and 𝐾₀,𝐾₁,…,𝐾_{⌈𝑛𝑗/2⌉−1} to calculate key encryption keys and the cluster key. Both key encryption keys and the cluster key are composed of one random element 𝑅_𝑋 and several random elements 𝐾_𝑌, where 0≤𝑋≤⌈log₂(𝑛_𝑗)⌉−1 and 0≤𝑌≤⌈𝑛_𝑗/2⌉−1. 𝑅_𝑋 means that this key is at level 𝑋 in the key tree and 𝐾_𝑌 means that this key belongs to the key path 𝑌. All keys on the same key path 𝑌 have the same random elements 𝐾_𝑌.

The example in Figure 2 shows 8 𝐿-Sensors in cluster 0. 𝐻₀ constructs a key tree with 8 leaves and generates random elements 𝑅₀, 𝑅₁, 𝑅₂, 𝐾₀, 𝐾₁, 𝐾₂, and 𝐾₃. In Figure 2, KEK⁰₃ (=𝑅₂×𝐾₀mod𝑝), KEK⁰₁ (=𝑅₂×𝐾₀×𝐾₁mod𝑝), and CK₀ (=𝑅₀×𝐾₁×𝐾₂×𝐾₃mod𝑝) are on the key path 0, KEK⁰₄, KEK⁰₁, and CK₀ are on the key path 1, and so on. KEK⁰₅, KEK⁰₂, and CK₀ belong to key path of 𝐿⁰₄ and 𝐿⁰₅. Note that 𝑝 is a 128-bit prime number. Since CK₀ is at level 0 in the key tree and belongs to the key path 0, 1, 2, and 3, it is composed of 𝑅₀, 𝐾₀, 𝐾₁, 𝐾₂, and 𝐾₃. After the key tree is constructed, 𝐻₀ assigns each cluster member 𝐿⁰_𝑖 to a leaf node and securely sends the cluster key CK₀ and key encryption keys on the key path to 𝐿⁰_𝑖 using the key 𝐾_𝐿⁰_𝑖,𝐻0.

Figure 2 

An example of a key tree.

3.3. Generating the Master Key

Assume that there are 𝑚𝐻-Sensors which are denoted as {𝐻₀,𝐻₁,…,𝐻_𝑚−1} in a WSN. Before generating the master key, BS needs to deliver the secure information SI_𝐻𝑗,BS and SI_𝐿^𝑗_𝑖,BS to each 𝐻-Sensor and 𝐿-Sensor. Note that this secure information is used when generating and updating other keys (see Section 4.2).

BS first chooses a 128-bit prime number 𝑝, where 𝑝 is public, and two secret random numbers 𝑆, 𝑊∈𝑍^∗_𝑝. It also selects 𝑚 distinct numbers which are denoted as {𝑒₀,𝑒₁,…,𝑒_𝑚−1} from 𝑍^∗_𝑝. BS then securely sends the following message to all 𝐻-Sensors: ∀0≤𝑗<𝑚,BS⟶𝐻_𝑗∶𝐸_{𝐾𝐻𝑗,BS}SI_𝐻𝑗,BS,SI_𝐿^𝑗_𝑖,BS, (1) where SI_𝐻𝑗,BS=𝑒_𝑗×𝑊⁻¹mod𝑝 and SI_𝐿^𝑗_𝑖,BS=𝑆×𝑒_𝑗⁻¹mod𝑝. After receiving it, each 𝐻-Sensor, for example, 𝐻_𝑗, broadcasts 𝐸_CK𝑗(SI_𝐿^𝑗_𝑖,BS) to all its cluster members. Note that CK_𝑗 is the cluster key of cluster 𝑗. As a result, all its cluster members can obtain SI_𝐿^𝑗_𝑖,BS. Note that 𝐿-Sensors attached to the same 𝐻-Sensor will have the same secure information SI_𝐿^𝑗_𝑖,BS. Figure 3 shows an example of a WSN with secure information.

Figure 3 

An example of the WSN with secure information.

After that, BS starts to generate the master key. The procedure of master key generation is described as follows.

Step 1. BS first selects a random number 𝑟∈𝑍^∗_𝑝 and computes a master key 𝐾_Master=𝑆×𝑟mod𝑝.

Step 2. BS broadcasts 𝑟×𝑊mod𝑝 to all 𝐻-Sensors.

Step 3. When each 𝐻-Sensor receives 𝑟×𝑊mod𝑝 from BS, it calculates the following equations and broadcasts the result to all its cluster members.
For all 0≤𝑗≤𝑚−1, 𝐻_𝑗 calculates SI_𝐻𝑗,BS×𝑟×𝑊mod𝑝mod𝑝⊕CK_𝑗=𝑒_𝑗×𝑊⁻¹×𝑟×𝑊mod𝑝mod𝑝⊕CK_𝑗=𝑟×𝑒_𝑗mod𝑝⊕CK_𝑗. (2) We use bitewise XOR operation ⊕ to guarantee that messages can be securely sent to legitimate 𝐿-Sensors.

Step 4. When 𝐿^𝑗_𝑖 receives (𝑟×𝑒_𝑗mod𝑝)⊕CK_𝑗 from 𝐻_𝑗, it computes the master key 𝐾_Master, where 𝐾_Master=SI_𝐿^𝑗_𝑖,BS×𝑟×𝑒_𝑗=mod𝑝𝑆×𝑒_𝑗⁻¹mod𝑝×𝑟×𝑒_𝑗mod𝑝=𝑆×𝑟mod𝑝. (3) By the above steps, all 𝐿-Sensors have the same master key 𝐾_Master.

3.4. Generating Pairwise Keys

The pairwise key shared with two neighboring 𝐿-Sensors can be generated through their corresponding 𝐻-Sensor. For example, if 𝐿¹₀ desires to share a pairwise key with 𝐿¹₁, 𝐻₁ will generate this pairwise key and send 𝐸_{𝐾𝐿101,𝐻}(pairwise_key) and 𝐸_{𝐾𝐿111,𝐻}(pairwise_key) to 𝐿¹₀ and 𝐿¹₁, respectively; consequently, both 𝐿¹₀ and 𝐿¹₁ can obtain this pairwise key.

4. The Proposed Key Updating Scheme

In this section, we propose the key updating scheme to update some of the generated keys. We discuss these kinds of keys separately as follows.(1)Individual key: since it is only shared between BS and each 𝐿-Sensor, this key is revoked automatically if an 𝐿-Sensor is compromised.(2)Cluster key: obviously, if an 𝐿-Sensor is compromised, the corresponding cluster requires updating the cluster key. Besides, 𝐿-Sensors may move to another neighboring clusters if the deployment of 𝐿-Sensors is nonstationary; consequently, both clusters (the original cluster and the target cluster) require updating their cluster key, respectively.(3)Master key: similarly, if 𝐿-Sensors are compromised, the master key must be updated. Besides, BS may desire to update the master key periodically for better security considerations.(4)Pairwise key: for example, assume that two 𝐿-Sensors, 𝐿^𝑛_𝑖 and 𝐿^𝑛_𝑗, have shared a pairwise key. If 𝐿^𝑛_𝑖 is compromised, 𝐿^𝑛_𝑗 would revoke the shared pairwise key automatically. Besides, these two 𝐿-Sensors can also update this key periodically.

4.1. Updating the Cluster Key

Here we discuss how to update cluster keys. First, we consider that an 𝐿-Sensor leaves a cluster. It is because this 𝐿-Sensor is compromised or moves to other neighboring cluster. Second, we consider an 𝐿-Sensor joins a cluster.

4.1.1. An 𝐿-Sensor Leaves a Cluster

In Figure 2, if 𝐿⁰₆ leaves cluster 0, the keys CK₀, KEK⁰₂, and KEK⁰₆ must be updated. The detailed procedure is described in the following.

Step 1. 𝐻₀ selects a random number 𝐾^′₃ from 𝑍^∗_𝑝 and sends the following key update messages: (i)𝐻₀→{𝐿⁰₀,…,𝐿⁰₃}∶KEK⁰₁⊕((KEK⁰₁)×(𝐾₃⁻¹×𝐾^′₃mod𝑝)mod𝑝),(ii)𝐻₀→{𝐿⁰₄,𝐿⁰₅}∶KEK⁰₅⊕((KEK⁰₅)×(𝐾₃⁻¹×𝐾^′₃mod𝑝)mod𝑝),(iii)𝐻₀→{𝑆⁰₇}∶𝐾_𝐿⁰_7,𝐻0⊕((𝐾_𝐿⁰_7,𝐻0)×(𝐾₃⁻¹×𝐾^′₃mod𝑝)mod𝑝).

Step 2. 𝑆⁰₀, 𝑆⁰₁, 𝑆⁰₂, and 𝑆⁰₃ can obtain 𝐾₃⁻¹×𝐾^′₃mod𝑝 with KEK⁰₁ and then compute the new cluster key CK^′₀ where CK^′₀=CK₀×𝐾₃⁻¹×𝐾^′₃mod𝑝mod𝑝=𝑅₀×𝐾₀×𝐾₁×𝐾₂×𝐾^′₃mod𝑝. (4)

Step 3. 𝑆⁰₄ and 𝑆⁰₅ can obtain 𝐾₃⁻¹×𝐾^′₃mod𝑝 with KEK⁰₅ and then compute the new keys CK^′₀ and KEK₂^0′ where KEK₂^0′=KEK⁰₂×𝐾₃⁻¹×𝐾^′₃mod𝑝mod𝑝=𝑅₁×𝐾₂×𝐾^′₃mod𝑝. (5)

Step 4. 𝑆⁰₇ can obtain 𝐾₃⁻¹×𝐾^′₃mod𝑝 with 𝐾_𝐿⁰_7,𝐻0 and then compute the new keys CK^′₀, KEK₂^0′, and KEK₆^0′ where KEK₆^0′=KEK⁰₆×𝐾₃⁻¹×𝐾^′₃mod𝑝mod𝑝=𝑅₂×𝐾^′₃mod𝑝. (6)

Obviously, it only requires updating the value 𝐾₃ in this example. Since 𝐿⁰₆ has no keys to obtain 𝐾₃⁻¹×𝐾^′₃mod𝑝, it cannot compute the new cluster key and key encryption keys.

4.1.2. An 𝐿-Sensor Joins a Cluster

When an 𝐿-Sensor joins a new cluster, the target 𝐻-Sensor authenticates this joined 𝐿-Sensor. This can be accomplished by coordinating with the original 𝐻-Sensor. Then BS would deliver a key which will be shared between the target 𝐻-Sensor and this 𝐿-Sensor. After receiving this key, the 𝐻-Sensor would assign this new 𝐿-Sensor a leaf node of the key tree. To prevent this new 𝐿-Sensor from decrypting the past traffic, all the keys on this key path need to be updated.

Let us take Figure 2 as an illustration. Assume that 𝐿⁰₆ joins this cluster and has received an individual key 𝐾_𝐿⁰_6,𝐻0. The procedure of updating the cluster key is described as follows.

Step 1. 𝐻₀ assigns 𝐿⁰₆ a leaf node of the key tree. 𝐻₀ then selects a random number 𝐾^′₃ from 𝑍^∗_𝑝 to compute the new keys, CK^′₀, KEK₂^0′, and KEK₆^0′, where CK^′₀=CK₀×𝐾₃⁻¹×𝐾^′₃mod𝑝=𝑅₀×𝐾₀×𝐾₁×𝐾₂×𝐾^′₃mod𝑝,KEK₂^0′=KEK⁰₂×𝐾₃⁻¹×𝐾^′₃mod𝑝=𝑅₁×𝐾₂×𝐾^′₃mod𝑝,KEK₆^0′=KEK⁰₆×𝐾₃⁻¹×𝐾^′₃mod𝑝=𝑅₂×𝐾^′₃mod𝑝. (7)(8)(9)

Step 2. 𝐻₀ needs to send the following two messages; one is broadcasted to all 𝐿-Sensors within this cluster for updating the key path; one is additionally unicasted to the new 𝐿-Sensor 𝐿⁰₆: (i)𝐻₀→{𝐿⁰₀,…,𝐿⁰₇}∶CK₀⊕(𝐾₃⁻¹×𝐾^′₃mod𝑝),(ii)𝐻₀→𝐿⁰₆: 𝐾_𝐿⁰_6,𝐻0⊕𝐾_𝐿⁰_6,𝐻0×CK^′₀‖𝐾mod𝑝_𝐿06,𝐻0⊕𝐾_𝐿⁰_6,𝐻0×KEK₂^0′‖𝐾mod𝑝_𝐿06,𝐻0⊕𝐾_𝐿⁰_6,𝐻0×KEK^0′₆mod𝑝. (10)Since 𝐿⁰₆ does not have CK₀, it cannot obtain 𝐾₃⁻¹×𝐾^′₃mod𝑝 to compute the previous keys. On the contrary, all other 𝐿-Sensors in this cluster will obtain 𝐾₃⁻¹×𝐾^′₃mod𝑝.

Step 3. 𝐿⁰₆ computes the new keys CK^′₀, KEK₂^0′, and KEK₆^0′ with 𝐾_𝐿⁰_6,𝐻0.

Step 4. 𝐿⁰₀, 𝐿⁰₁, 𝐿⁰₂, and 𝐿⁰₃ can compute the new key CK^′₀ from (7) with the obtained 𝐾₃⁻¹×𝐾^′₃mod𝑝.

Step 5. 𝐿⁰₄ and 𝐿⁰₅ can compute the new keys CK^′₀ and KEK₂^0′ from (7) and (8) with the obtained 𝐾₃⁻¹×𝐾^′₃mod𝑝.

Step 6. 𝐿⁰₇ can compute the new keys CK^′₀, KEK₂^0′, and KEK₆^0′ from (7), (8), and (9) with the obtained 𝐾₃⁻¹×𝐾^′₃mod𝑝.

Similarly, only the value 𝐾₃ is required to be updated.

4.1.3. Further Discussion

Notice that in Step 1 of Section 4.1.1, for example, 𝐿⁰₀ will receive 𝐾₃⁻¹×𝐾^′₃mod𝑝 protected by KEK⁰₁. The reason that we use the equation KEK⁰₁⊕KEK⁰₁×𝐾₃⁻¹×𝐾^′₃mod𝑝mod𝑝 (11) rather than KEK⁰₁×𝐾₃⁻¹×𝐾^′₃mod𝑝mod𝑝 (12) is to protect KEK⁰₁. More specifically, if we only use (12), 𝐿⁰₄, 𝐿⁹₅, and 𝐿⁰₇ can utilize the obtained 𝐾₃⁻¹×𝐾^′₃mod𝑝 to further obtain KEK⁰₁. In fact, KEK⁰₁ is not revealed to 𝐿⁰₄, 𝐿⁰₅, and 𝐿⁰₇; therefore, an additional bitewise XOR operation ⊕ is required.

Similarly, in Step 2 of Section 4.1.2, the reason we use (10) rather than 𝐾_𝐿⁰_6,𝐻0×CK^′₀mod𝑝‖𝐾_𝐿⁰_6,𝐻0×KEK₂^0′‖𝐾mod𝑝_𝐿06,𝐻0×KEK₆^0′mod𝑝 (13) is to protect 𝐾_𝐿⁰_6,𝐻0; otherwise, other cluster members can obtain 𝐾_𝐿⁰_6,𝐻0 with CK^′₀, KEK₂^0′, or KEK₆^0′.

4.2. Updating the Master Key

Here we discuss how to update the master key in the following situations. First, BS may update the master key periodically to improve the security level. Second, the master key is required to be updated if 𝐿-Sensors are compromised.

4.2.1. Updating the Master Key Periodically

The master key may be updated periodically, for example, monthly. The procedure of updating master key is described as follows.

Step 1. BS selects a new random number 𝑟^′∈𝑍^∗_𝑝 and calculates a new master key 𝐾_{Master_new}=𝑆×𝑟^′mod𝑝. BS broadcasts 𝑟^′×𝑊mod𝑝 to all 𝐻-Sensors.

Step 2. While 𝐻_𝑗 receives 𝑟^′×𝑊mod𝑝, it calculates SI_𝐻𝑗,BS×𝑟^′×𝑊mod𝑝mod𝑝⊕CK_𝑗=𝑟^′×𝑒_𝑗mod𝑝⊕CK_𝑗. (14)
𝐻_𝑗 then broadcasts the result to all its cluster members.

Step 3. 𝐿^𝑗_𝑖 can calculate the new master key 𝐾_{Master_new} where 𝐾_{Master_new}=SI_𝐿^𝑗_𝑖,BS×𝑟^′×𝑒_𝑗=mod𝑝𝑆×𝑒_𝑗⁻¹mod𝑝×𝑟^′×𝑒_𝑗mod𝑝=𝑆×𝑟^′mod𝑝. (15)

In conclusion, all 𝐿-Sensors can obtain the new master key 𝐾_{Master_new}.

4.2.2. Updating the Master Key If 𝐿-Sensors Are Compromised

Assume that 𝐿-Sensor 𝐿^𝑛_𝑚 which is attached to 𝐻_𝑛 is compromised and 𝐿^𝑛_𝑘 denotes the 𝐿-Sensor 𝑘 which is also attached to 𝐻_𝑛, where 𝑘≠𝑚. Besides, there are 𝑚𝐻-Sensors which are denoted as {𝐻₀,𝐻₁,…,𝐻_𝑚−1} in the entire WSN. The procedure of updating the master key is described as follows.

Step 1. BS selects a new random number 𝑟^′∈𝑍^∗_𝑝 and calculates a new master key 𝐾_{Master_new}=𝑆×𝑟^′mod𝑝. BS also selects a random number 𝑒^′_𝑛∈𝑍^∗_𝑝 to compute 𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝 and broadcasts ((𝑟^′×𝑊mod𝑝)‖(𝐸_{𝐾𝐻𝑛,BS}(𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝))) to all 𝐻-Sensors.

Step 2. Except for 𝐻_𝑛, each 𝐻-Sensor calculates the following equations and broadcasts the result to its cluster members.
For all 0≤𝑗≤𝑚−1, 𝑗≠𝑛, 𝐻_𝑗 calculates SI_𝐻𝑗,BS×𝑟^′×𝑊mod𝑝mod𝑝⊕CK_𝑗=𝑒_𝑗×𝑊⁻¹×𝑟^′×𝑊mod𝑝mod𝑝⊕CK_𝑗=𝑟^′×𝑒_𝑗mod𝑝⊕CK_𝑗. (16)
Then, all their cluster members can obtain the new master key 𝐾_{Master_new}, where 𝐾_{Master_new}=SI_𝐿^𝑗_𝑖,BS×𝑟^′×𝑒_𝑗mod𝑝=𝑆×𝑟^′mod𝑝. (17)

Step 3. (a) 𝐻_𝑛 obtains 𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝 from 𝐸_{𝐾𝐻𝑛,BS}(𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝) and further computes the new secure information SI^′_𝐻𝑛,BS where SI^′_𝐻𝑛,BS=SI_𝐻𝑛,BS×𝑒_𝑛⁻¹×𝑒^′_𝑛=𝑒mod𝑝mod𝑝_𝑛×𝑊⁻¹mod𝑝×𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝=𝑒^′_𝑛×𝑊⁻¹mod𝑝. (18)
(b) 𝐻_𝑛 obtains (𝑟^′×𝑒^′_𝑛mod𝑝)⊕CK_𝑛 from 𝑟^′×𝑊mod𝑝 and new secure information SI^′_𝐻𝑛,BS. Then 𝐻_𝑛 broadcasts ((𝑟^′×𝑒^′_𝑛mod𝑝)‖(𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝))⊕CK_𝑛⊕CK^′_𝑛. Note that CK^′_𝑛 is the new cluster key of cluster 𝑛.
(c) Except for 𝐿^𝑛_𝑚, all the other 𝐿-Sensors which are also attached to 𝐻_𝑛 can derive 𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝 and 𝑟^′×𝑒^′_𝑛mod𝑝 from the obtained message ((𝑟^′×𝑒^′_𝑛mod𝑝)‖(𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝))⊕CK_𝑛⊕CK^′_𝑛 and then compute SI^′_𝐿^𝑛_𝑘,BS, where SI^′_𝐿^𝑛_𝑘,BS=SI_𝐿^𝑛_𝑘,BS×𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝⁻¹=𝑆×𝑒_𝑛⁻¹mod𝑝×𝑒_𝑛×𝑒_𝑛^′−1mod𝑝=𝑆×𝑒_𝑛^′−1mod𝑝. (19)
(d) After updating SI^′_𝐿^𝑛_𝑘,BS, all the other 𝐿-Sensors except 𝐿^𝑛_𝑚 within cluster 𝑛 can compute new master key 𝐾_{Master_new}=𝑟^′×𝑊mod𝑝 where 𝐾_{Master_new}=SI^′_𝐿^𝑛_𝑘,BS×𝑟^′×𝑒^′_𝑛=mod𝑝𝑆×𝑒_𝑛^′−1mod𝑝×𝑟^′×𝑒^′_𝑛mod𝑝=𝑆×𝑟^′mod𝑝. (20)

Only 𝐻_𝑛 can obtain 𝑒_𝑛⁻¹×𝑒^′_𝑛 by decrypting 𝐸_{𝐾𝐻𝑛,𝐵𝑆}(𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝). Besides, the compromised 𝐿-Sensor 𝐿^𝑛_𝑚 cannot obtain 𝑟^′×𝑒^′_𝑛mod𝑝 and 𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝 to compute the new secure information SI^′_𝐿^𝑛_𝑘,BS without CK^′_𝑛; therefore, it is unable to obtain the new master key.

Obviously, only the 𝐿-Sensors within the affected cluster require updating the secure information before updating the master key; as a result, the influence can be confined locally.

4.2.3. Further Discussion

We have already discussed how to update the master key. It may be questioned why we need to do it in this way. A trivial idea is to let BS generate a random master key (either for master key generation or master key updating). Then BS encrypts it using each cluster key and transmits it to every 𝐻-Sensor. This method seems simpler and more straightforward.

The reason is that the proposed scheme attempts to reduce the usage of unicasting. More precisely, in the above method, BS requires to unicast each encrypted master key to corresponding 𝐻-Sensor. However, BS only needs to broadcast the same message (𝑟^′×𝑊mod𝑝) to every 𝐻-Sensor in our design. Actually, using broadcast is more efficient than using unicasting. We will demonstrate it through experiments in Section 7.

4.3. Updating the Pairwise Key

Assume that two 𝐿-Sensors, 𝐿^𝑛_𝑖 and 𝐿^𝑛_𝑗, have shared a pairwise key. If these two 𝐿-Sensors decide to update their shared pairwise key, 𝐻_𝑛 generates a new pairwise key and sends 𝐸_{𝐾𝐿𝑛𝑖𝑛,𝐻}(new_pairwise_key) and 𝐸_{𝐾𝐿𝑛𝑗𝑛,𝐻}(new_pairwise_key) to 𝐿^𝑛_𝑖 and 𝐿^𝑛_𝑗, respectively.

5. Security Analysis

In this section, we demonstrate that the proposed construction is secure through the following analyses. We first explain that our design satisfies the following security requirements mentioned in Section 2.3. Requirement 1: indeed, this requirement is satisfied. All kinds of messages (sensing reports and control messages) will be encrypted with the generated keys. An adversary cannot realize any information without keys. Requirement 2: if an adversary compromises an 𝐿-Sensor which is denoted as 𝐿^𝑗_𝑖, he can obtain 𝐾_master=𝑆×𝑟mod𝑝, SI_𝐿^𝑗_𝑖,BS=𝑆×𝑒_𝑗⁻¹mod𝑝, CK_𝑗, and several key encryption keys KEK. However, he is not capable of calculating cluster key and secure information belonging to other clusters. Moreover, the secrets belonging to other clusters cannot be derived even if he compromises two 𝐿-Sensors belonging to different clusters. Requirement 3: actually, the purpose of our key updating scheme can achieve Requirement 3.

Here we analyze the proposed construction in the following aspects.

5.1. The Influence of Compromised 𝐿-Sensors

Actually, an adversary can obtain all information which is stored in an 𝐿-Sensor after compromising it. Fortunately, the adversary cannot calculate the information (cluster key and secure information) of other clusters in our design; as a result, the proposed construction ensures that the compromise of 𝐿-Sensors does not cause the compromise of the entire network.

To prevent the adversary from decrypting future traffic, the compromised individual key and the pairwise keys are revoked automatically. Besides, BS updates the affected cluster key and the master key. In our design, the adversary cannot obtain this updated information. Moreover, as an example showed in Section 4, only the affected cluster needs to update the secure information before updating the master key. Obviously, the influence of compromising can be confined to be affected cluster.

Besides, if an 𝐿-Sensor moves to another cluster, both clusters (original and targeting clusters) would update the cluster keys. It can prevent the 𝐿-Sensor from decrypting the traffic of both clusters after it leaves or before it joins. In fact, it can also effectually reduce the influence of compromising. An adversary may eavesdrop and record all packets before compromising 𝐿-Sensors. Let us consider the following situations if an 𝐿-Sensor 𝐿⁰₁ moves from cluster 0 to cluster 1. Note that CK₀ and CK₁ are the cluster keys of cluster 0 and cluster 1, respectively.(1)CK₀ and CK₁ are updated: CK₀ and CK₁ are updated to CK^′₀ and CK^′₁, separately. If 𝐿⁰₁ which already has moved to cluster 1 is compromised, an adversary would obtain CK^′₁. Hence, he cannot decrypt the messages encrypted with CK₁. Similarly, if the adversary compromises an 𝐿-Sensor within cluster 0 after 𝐿⁰₁ leaves, he can only decrypt the messages encrypted with CK^′₀.(2)CK₀ and CK₁ are not updated: 𝐿⁰₁ receives CK₁ after arriving to cluster 1. If 𝐿⁰₁ is compromised, an adversary can decrypt the messages encrypted with CK₁. More specifically, after compromising 𝐿¹₀, he can retrieve the messages which are sent before 𝐿⁰₁ joins. Similarly, the same condition happened if he compromises an 𝐿-Sensor within cluster 0. Obviously, the influence of compromising is effectually reduced.

5.2. Confidentiality

An outsider cannot obtain the current cluster keys or master key because the cluster keys and the secure information 𝑆×𝑒_𝑛⁻¹mod𝑝 which is used for computing the master key are securely distributed to all legitimate 𝐿-Sensors. Although a leaving 𝐿-Sensor has the old secure information or the old cluster key, this 𝐿-Sensor cannot derive the new master key or the new cluster key. To prevent a leaving 𝐿-Sensor from obtaining the parameter 𝑆 or 𝑒_𝑛, we choose the length of the prime number 𝑝 as 128-bit. It is large enough to ensure that deriving correct (𝑥,𝑦) pair from 𝑥×𝑦mod𝑝 is infeasible. Although a leaving 𝐿-Sensor knows the messages 𝑟×𝑊mod𝑝 and 𝑆×𝑒_𝑛⁻¹mod𝑝, it cannot compute the current master key 𝑆×𝑟mod𝑝.

5.3. Integrity

To achieve message authentication and integrity, we can utilize hash algorithms, for example, SHA-1 or MD5, to compute message authentication code (MAC) for a message. For example, in the master key generation phase of the key generating scheme, BS computes the MAC of 𝑟×𝑊mod𝑝 with 𝐾_Master, appends it to 𝑟×𝑊mod𝑝, and then broadcasts it to all 𝐻-Sensors. Each 𝐻-Sensor 𝐻_𝑗 broadcasts 𝑟×𝑒_𝑗mod𝑝 and the received message (𝑟×𝑊mod𝑝 and its MAC) to its cluster members. Eventually, each 𝐿-Sensor uses the computed master key to recompute the MAC and compares it with the received MAC value. This implies that if an adversary masquerades as BS to send a message, he does not have the master key to compute the corresponding MAC value, and 𝐿-Sensors will reject this message.

6. Performance Evaluation

In this section, we show that the proposed construction is efficient in storage, communication, and computation. Besides, it is scalable because the additional overhead of increasing 𝐿-Sensors is confined to log₂(𝑠).

6.1. The Storage Requirement

In the key generating scheme, each 𝐿-Sensor requires storing some keys and necessary information. For example, an 𝐿-Sensor 𝐿^𝑗_𝑖, would store 𝐾_𝐿^𝑗_𝑖,BS, 𝐾_𝐿^𝑗_{𝑖,𝐻𝑗}, SI_𝐿^𝑗_𝑖,BS, a cluster key CK_𝑗, and a common master key 𝐾_Master. Also, several key encryption keys KEK must be stored to update the cluster key. The number of key encryption keys of 𝐿^𝑗_𝑖 is about ⌈log₂(𝑠)⌉−1 where 𝑠 is the number of 𝐿-Sensors in cluster 𝑗. The total storage of these secrets is 128-bit × (5 + (⌈log₂(𝑠)⌉−1)). Since usually there are at most one hundred 𝐿-Sensors within a cluster, total storage is about 176 bytes. Comparing with the current generation of sensor nodes (128 Kbytes in programmable flash memory in MICAz), the storage of the proposed scheme is much less. Besides, as the cluster size grows, the number of keys stored in an 𝐿-Sensor increases proportional to the number of 𝐿-Sensors within the cluster in an order of log₂(𝑠). Note that each 𝐿-Sensor may also require to store the pairwise keys shared with its neighbors if necessary, but the total storage requirement is still reasonable.

6.2. The Communication Cost

Here we discuss the communication cost of the proposed construction. The communication cost is closely related to two factors. The first one is the message size. Obviously, the number of bits of every message is less than 128-bit. It is reasonable in a WSN. The second one is the transmission types. In fact, using broadcasting is more efficient than using unicasting in a WSN (we will show it in the next section). The majority of transmission in the key generating scheme is using broadcasting. For example, in the master key generation phase, BS broadcasts 𝑟×𝑊mod𝑝 to all 𝐻-Sensors. Similarly, 𝐻-Sensors also broadcast the calculating results to its cluster members. The use of unicasting in the proposed scheme is normally involved in the initial stage of some phases. For example, BS unicasts 𝐸_{𝐾𝐻𝑗,BS}(SI_𝐻𝑗,BS) to all 𝐻-Sensors at the initial stage of master key generation phase; thus, this transmission would be executed only once; even the master key must be updated. Similarly, transmitting 𝐾_𝐿^𝑗_{𝑖,𝐻𝑗} is still executed only once before generating cluster keys and the master key.

In the key updating scheme, every 𝐿-Sensor in the affected clusters only receives one message to update the cluster key. In order to avoid using unicasting, we aim to reduce the number of kinds of messages transmitted on the air. As the example shown in Section 4.1, only three kinds of messages are transmitted on the air. Similarly, only two kinds of messages are transmitted in Section 4.1. In the view of updating the master key, it only requires two broadcasts. More specifically, BS broadcasts same information to all 𝐻-Sensors, then each 𝐻-Sensor broadcasts the calculating result to all cluster members. Only the 𝐿-Sensors within the affected cluster require updating the secure information; consequently, the impact can be confined locally. As a result, updating keys incurs less communication overhead and is beneficial for the limited energy of 𝐿-Sensors.

6.3. The Computation Cost

The proposed construction utilizes symmetric cryptosystem, such as AES, and modular multiplication. AES is practical and efficient based on previous experimental studies. Another operation, modular multiplication, is always considered as an inefficient operation where the modulus is large, for example, 1024-bit moduli. However, the length of the modulus we adopted is only 128 bits. To demonstrate high effect of the modular multiplication with a 128-bit modulus, we implement it on MICAz sensor nodes. Computation results are given in Section 7.2.

7. Experiments

In our experiments, we choose MICAz sensor nodes. MICAz is capable of ATmega128L microcontroller. The architecture is 8-bit with 8 MHz computation speed. Total programmable memory storage of MICAz sensor is 128 Kbytes. For communication interface, MICAz uses ZigBee (802.15.4) to communicate with other MICAz sensors. Figure 4(a) shows one MICAz sensor. Another device is the base station. Figure 4(b) shows one MICAz sensor plugged on a MIB510 hardware interface, which is the interface of the base station. The MIB510 broad is connected to the desktop computer.

(a) MICAz sensor

(b) MICAz with MIB510 broad

Figure 4 

(a) Deployed sensor device and (b) base station device.

7.1. Experiment Assumptions and Design

After deployment, routing paths will be constructed. Normally, a routing path is constructed as a tree structure. In order to simplify this experiment, we assume that all 𝐻-Sensors in the routing path have the same degree. Figure 5 illustrates a constructed routing path with degree 𝑑=2 and height ℎ=4.

Figure 5 

Example of a routing path where 𝑑=2 and ℎ=4.

Some researches assume that BS is capable of transmitting data to all 𝐻-Sensors through one hop. However, this assumption is not reasonable. In our experiments, we assume that data transmitted to all 𝐻-Sensors require multihops. For example, in Figure 5, the message sent to 𝐻₆ by BS would pass through 𝐻₀ and 𝐻₂. Therefore, if BS desires to update the master key, the following two scenarios may happen using the example shown in Figure 5.(1)Using unicasting: BS encrypts the new master key 𝐾 with each cluster key (CK₀,CK₁,…,CK₁₃), respectively. BS then sends these encrypted master keys to all 𝐻-Sensors. Therefore, 𝐻₀ receives seven messages which are 𝐸_CK0(𝐾), 𝐸_CK2(𝐾), 𝐸_CK3(𝐾), 𝐸_CK6(𝐾), 𝐸_CK7(𝐾), 𝐸_CK8(𝐾), and 𝐸_CK9(𝐾). 𝐻₀ obtains 𝐸_CK0(𝐾) and then transmits three messages (𝐸_CK2(𝐾), 𝐸_CK6(𝐾), and 𝐸_CK7(𝐾)) to 𝐻₂ and transmits the remainder three messages to 𝐻₃. Similarly, 𝐻₄ will receive three messages and then transmit two messages. Note that the size of the encrypted master key is 128 bits.(2)Using broadcasting: the proposed master key updating method actually uses broadcasting. BS broadcasts a common message to all 𝐻-Sensors. Every 𝐻-Sensor receives only one message from the upper level 𝐻-Sensor and then broadcasts it to lower level 𝐻-Sensors. For example, 𝐻₂ receives a message from 𝐻₀ and then broadcasts it to 𝐻₆ and 𝐻₇. Note that the size of the broadcasted message depends on two situations. First, if BS desires to update the master key periodically, the size of the broadcasted message is 128 bits (𝑟^′×𝑊mod𝑝). Second, BS updates the master key if 𝐿-Sensors are compromised. The size of broadcasted message is 256 bits (((𝑟^′×𝑊mod𝑝)‖(𝐸_{𝐾𝐻𝑛,BS}(𝑒_𝑛⁻¹×𝑒^′_𝑛mod𝑝)))).

Three experiments are performed in this paper.(1)Experiment 1: we evaluate the energy consumption of an MICAz sensor node while transmitting or receiving messages with different sizes.(2)Experiment 2: we calculate the communication overhead of the entire network. We consider the above two scenarios.(3)Experiment 3: we evaluate the cost of AES and modulus multiplication.

In our experiments, we use MICAz sensor nodes to act as 𝐻-Sensors and calculate their energy consumption. If fact, energy consumed on powerful devices is the same as one on weak devices, such as MICAz. Besides, energy consumption measurement depends on the number of clock cycles spent [27]. Energy consumption for executing 2090 clock cycles on the ATmega128L microcontroller is equivalent to 7.4 μJ (Joule).

7.2. Experiment Results

Experiment 1. To measure energy consumed on transmitting and receiving data, the number of clock cycles is recorded when a data packet is received and sent. Broadcasting and unicasting executed 10 rounds for different length of data packets. The average results are showed in Table 1. Obviously, the values of broadcast 128-bit and unicast 128-bit are almost equal. Besides, the value of broadcasting 256-bit is larger but twice smaller than broadcasting 128-bit. It is because transmitting a 256-bit message still requires one package.

Table 1 

Energy consumption of a MICAz sensor node.

Experiment 2. According to the results in Experiment 1, total energy consumed for a WSN is simulated and evaluated. Table 2 lists the result of communication overhead of the above two scenarios. We consider several routing paths with different degree 𝑑 and height ℎ. For example, if a routing path is generated as a tree with degree 𝑑=2 and height ℎ=3, the total energy consumption of all 𝐻-Sensors when broadcasting 128-bit/broadcasting 256-bit/unicasting 128-bit is 0.0149/0.0174/0.3551 mJ, respectively. The number of 𝐻-Sensors in this tree is 6. While performing unicasting 128-bit, the maximum energy consumption among all 𝐻-Sensors is 0.0923 mJ. Besides, the average energy consumption of all 𝐻-Sensors is 0.0592 mJ when performing unicasting 128-bit.
Since senor nodes may be deployed in a large scale environment, the number of clusters may be up to thousands. Thus, we consider several candidates with different 𝑑 and ℎ. Obviously, the communication overhead is closely related to the number of 𝐻-Sensors. If it grows to hundreds or thousands of nodes, it causes huge energy consumption.
In the view of average energy consumption of an 𝐻-Sensor, we can consider the following cases. (1)Broadcast 128-bit: in this condition, every node receives one 128-bit message and broadcasts it. The total energy consumption of every node is 21.3 μJ (=14.2+7.1).(2)Broadcast 256-bit: similarly, the total energy consumption of every node is 24.84 μJ (=16.56+8.28).(3)Unicast 128-bit: the average energy consumption is listed in Table 2. Obviously, the values are quite larger.

Table 2 

Communication overheads, unit is mJ.

Experiment 3. The goal of this experiment is to evaluate the costs of AES and modulus multiplication. Execution time and energy consumed by them are recorded. For AES, we choose an AES library based on TinyOS-2.x for comparison. We also implemented modulus multiplication by ourselves. These two operations were executed on MICAz physical sensors for 100 rounds. The average results are given in Table 3. In Table 3, one multiplication over 128-bit modulus is equivalent to 1.75 AES encryptions. As a result, modulus multiplication is feasible on physical sensors.

Table 3 

Time and energy consumption for different operations.

7.3. Discussion

Through these experiments, we can demonstrate that the proposed key updating scheme is efficient. This is because we utilize broadcasting instead of unicasting. Actually, we must take something into consideration. First, every 𝐻-Sensor in the routing path may not have the same degree. Second, BS may have more powerful transmission capability. Let us use Figure 5 as an example. The transmission range of BS may reach the second level 𝐻-Sensors. Therefore, the total energy consumption would not equal the result shown in Table 2. However, the overall energy consumption is still high if using unicasting.

8. Conclusion

In this paper, we proposed a complete hierarchical key management construction for heterogeneous cluster-based WSN which only utilizes simple operations. It considered several kinds of keys which are necessary for WSN. Besides, some kinds of keys may require updating; an efficient key updating scheme is also proposed. In order to provide better efficiency, the majority of transmission in our design is using broadcasting. In fact, using unicasting is inevitable in designing security mechanisms for WSN. Fortunately, the usage of unicasting in our design is normally involved at the initial stage of some phases. In the security analysis, we showed that the influence of compromising is effectually reduced and confined locally. We also showed that the proposed construction is efficient in storage, communication, and computation. Finally, we gave some experiments to further demonstrate two things. First, the operations we used are simple and practical. Second, using unicasting will cause uncontrollable overhead. In conclusion, the proposed construction is appropriate for heterogeneous cluster-based WSN.

Notation

BS∶	The base station
𝐻𝑗:	The 𝐻-Sensor 𝑗
𝐿𝑗𝑖:	The 𝐿-Sensor 𝑖 belongs to 𝐻𝑗
𝐸𝐾(𝑀):	A message 𝑀 encrypted with the key 𝐾
𝐾𝐿𝑗𝑖,BS:	The predeployed key shared between 𝐿𝑗𝑖 and BS
𝐾𝐻𝑗,BS:	The predeployed key shared between 𝐻𝑗 and BS
𝐾𝐿𝑗𝑖,𝐻𝑗:	The key shared between 𝐿𝑗𝑖 and 𝐻𝑗
SI𝐻𝑗,BS:	The secure information shared between 𝐻𝑗 and BS
SI𝐿𝑗𝑖,BS:	The secure information shared between 𝐿𝑗𝑖 and BS
CK𝑗:	The cluster key for the cluster 𝑗
KEK𝑗𝑙:	The key encryption key 𝑙 in the cluster 𝑗
𝐾Master:	The master key
⊕:	Bitewise XOR operation
‖:	Concatenation.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

The work was supported in part by the Project HIT.NSRIF.2014098 by Natural Scientific Research Innovation Foundation in Harbin Institute of Technology, in part by Shenzhen Peacock Project, China, under Contract KQC201109020055A, and in part by Shenzhen Strategic Emerging Industries Program under Grant ZDSY20120613125016389.