hop by-hop message authentication and source privacy in wireless sensor networks

Hop-by-Hop Message Authenticationand Source Privacy in Wireless

Sensor NetworksJian Li, Yun Li, Jian Ren, Senior Member, IEEE, and Jie Wu, Fellow, IEEE

Abstract—Message authentication is one of the most effective ways to thwart unauthorized and corrupted messages from being

forwarded in wireless sensor networks (WSNs). For this reason, many message authentication schemes have been developed, based

on either symmetric-key cryptosystems or public-key cryptosystems. Most of them, however, have the limitations of high computational

and communication overhead in addition to lack of scalability and resilience to node compromise attacks. To address these issues, a

polynomial-based scheme was recently introduced. However, this scheme and its extensions all have the weakness of a built-in

threshold determined by the degree of the polynomial: when the number of messages transmitted is larger than this threshold, the

adversary can fully recover the polynomial. In this paper, we propose a scalable authentication scheme based on elliptic curve

cryptography (ECC). While enabling intermediate nodes authentication, our proposed scheme allows any node to transmit an unlimited

number of messages without suffering the threshold problem. In addition, our scheme can also provide message source privacy. Both

theoretical analysis and simulation results demonstrate that our proposed scheme is more efficient than the polynomial-based

approach in terms of computational and communication overhead under comparable security levels while providing message source

privacy.

Index Terms—Hop-by-hop authentication, symmetric-key cryptosystem, public-key cryptosystem, source privacy, simulation, wireless

sensor networks (WSNs), distributed algorithm, decentralized control

Ç

1 INTRODUCTION

MESSAGE authentication plays a key role in thwartingunauthorized and corrupted messages from being

forwarded in networks to save the precious sensor energy.For this reason, many authentication schemes have beenproposed in literature to provide message authenticityand integrity verification for wireless sensor networks(WSNs) [1], [2], [3], [4], [5]. These schemes can largely bedivided into two categories: public-key based approachesand symmetric-key based approaches.

The symmetric-key based approach requires complexkey management, lacks of scalability, and is not resilientto large numbers of node compromise attacks since themessage sender and the receiver have to share a secretkey. The shared key is used by the sender to generate amessage authentication code (MAC) for each transmittedmessage. However, for this method, the authenticity andintegrity of the message can only be verified by the nodewith the shared secret key, which is generally shared by agroup of sensor nodes. An intruder can compromise the

key by capturing a single sensor node. In addition, thismethod does not work in multicast networks.

To solve the scalability problem, a secret polynomialbased message authentication scheme was introduced in[3]. The idea of this scheme is similar to a threshold secretsharing, where the threshold is determined by the degree ofthe polynomial. This approach offers information-theoreticsecurity of the shared secret key when the number of mes-sages transmitted is less than the threshold. The intermedi-ate nodes verify the authenticity of the message through apolynomial evaluation. However, when the number ofmessages transmitted is larger than the threshold, the poly-nomial can be fully recovered and the system is completelybroken.

An alternative solution was proposed in [4] to thwart theintruder from recovering the polynomial by computing thecoefficients of the polynomial. The idea is to add a randomnoise, also called a perturbation factor, to the polynomial sothat the coefficients of the polynomial cannot be easilysolved. However, a recent study shows that the randomnoise can be completely removed from the polynomialusing error-correcting code techniques [6].

For the public-key based approach, each message istransmitted along with the digital signature of the mes-sage generated using the sender’s private key. Everyintermediate forwarder and the final receiver can authen-ticate the message using the sender’s public key [7], [8].One of the limitations of the public-key based scheme isthe high computational overhead. The recent progress onelliptic curve cryptography (ECC) shows that the public-key schemes can be more advantageous in terms of

� J. Li and J. Ren are with the Department of Electrical & ComputerEngineering, Michigan State University, East Lansing, MI 48824-1226.E-mail: {lijian6, renjian}@egr.msu.edu.

� Y. Li is with the SPD Department, Microsoft, Redmond, WA 98052.E-mail: [email protected].

� J. Wu is with the Department of Computer & Information Sciences,Temple University, Philadelphia, PA 19122. E-mail: [email protected].

Manuscript received 17 Oct. 2012; revised 18 Feb. 2013; accepted 6 Apr. 2013;date of publication 16 Apr. 2013; date of current version 21 Mar. 2014.Recommended for acceptance by W. Lou.For information on obtaining reprints of this article, please send e-mail to:[email protected], and reference the Digital Object Identifier below.Digital Object Identifier no. 10.1109/TPDS.2013.119

IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 5, MAY 2014 1223

1045-9219 � 2013 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

computational complexity, memory usage, and securityresilience, since public-key based approaches have a sim-ple and clean key management [9].

In this paper, we propose an unconditionally secureand efficient source anonymous message authentication(SAMA) scheme based on the optimal modified ElGamalsignature (MES) scheme on elliptic curves. This MESscheme is secure against adaptive chosen-message attacksin the random oracle model [10]. Our scheme enables theintermediate nodes to authenticate the message so that allcorrupted message can be detected and dropped to con-serve the sensor power. While achieving compromise-resiliency, flexible-time authentication and source identityprotection, our scheme does not have the threshold prob-lem. Both theoretical analysis and simulation results dem-onstrate that our proposed scheme is more efficient thanthe polynomial-based algorithms under comparable secu-rity levels.

The major contributions of this paper are the following:

1. We develop a source anonymous message authenti-cation code (SAMAC) on elliptic curves that can pro-vide unconditional source anonymity.

2. We offer an efficient hop-by-hop message authenti-cation mechanism for WSNs without the thresholdlimitation.

3. We devise network implementation criteria onsource node privacy protection in WSNs.

4. We propose an efficient key management frameworkto ensure isolation of the compromised nodes.

5. We provide extensive simulation results under ns-2and TelosB on multiple security levels.

To the best of our knowledge, this is the first scheme thatprovides hop-by-hop node authentication without thethreshold limitation, and has performance better than thesymmetric-key based schemes. The distributed nature ofour algorithm makes the scheme suitable for decentralizednetworks.

The remainder of this paper is organized as follows:Section 2 presents the terminology and the preliminarythat will be used in this paper. Section 3 discusses therelated work, with a focus on polynomial-based schemes.Section 4 describes the proposed source anonymous mes-sage authentication scheme on elliptic curves. Section 5discusses the ambiguity set (AS) selection strategies forsource privacy. Section 6 describes key management andcompromised node detection. Performance analysis andsimulation results are provided in Section 7. We concludein Section 8.

2 TERMINOLOGY AND PRELIMINARY

In this section, we will briefly describe the terminology andthe cryptographic tools that will be used in this paper.

2.1 Threat Model and Assumptions

The WSNs are assumed to consist of a large number ofsensor nodes. We assume that each sensor node knows itsrelative location in the sensor domain and is capable ofcommunicating with its neighboring nodes directly usinggeographic routing. The whole network is fully connected

through multi-hop communications. We assume there is asecurity server (SS) that is responsible for generation, stor-age and distribution of the security parameters among thenetwork. This server will never be compromised. How-ever, after deployment, the sensor nodes may be capturedand compromised by attackers. Once compromised, allinformation stored in the sensor nodes can be accessed bythe attackers. The compromised nodes can be reprog-rammed and fully controlled by the attackers. However,the compromised nodes will not be able to create newpublic keys that can be accepted by the SS and othernodes.

Based on the above assumptions, this paper considerstwo types of attacks launched by the adversaries:

� Passive attacks. Through passive attacks, the adver-saries could eavesdrop on messages transmitted inthe network and perform traffic analysis.

� Active attacks. Active attacks can only be launchedfrom the compromised sensor nodes. Once the sen-sor nodes are compromised, the adversaries willobtain all the information stored in the compromisednodes, including the security parameters of the com-promised nodes. The adversaries can modify thecontents of the messages, and inject their ownmessages.

2.2 Design Goals

Our proposed authentication scheme aims at achieving thefollowing goals:

� Message authentication. The message receiver shouldbe able to verify whether a received message is sentby the node that is claimed, or by a node in a particu-lar group. In other words, the adversaries cannotpretend to be an innocent node and inject fake mes-sages into the network without being detected.

� Message integrity. The message receiver should beable to verify whether the message has been modi-fied en-route by the adversaries. In other words, theadversaries cannot modify the message contentwithout being detected.

� Hop-by-hop message authentication. Every forwarderon the routing path should be able to verify theauthenticity and integrity of the messages uponreception.

� Identity and location privacy. The adversaries cannotdetermine the message sender’s ID and location byanalyzing the message contents or the local traffic.

� Node compromise resilience. The scheme should beresilient to node compromise attacks. No matter howmany nodes are compromised, the remaining nodescan still be secure.

� Efficiency. The scheme should be efficient in terms ofboth computational and communication overhead.

2.3 Terminology

Privacy is sometimes referred to as anonymity. Commu-nication anonymity in information management has beendiscussed in a number of previous works [11], [12], [13],[14], [15], [16]. It generally refers to the state of being

1224 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 5, MAY 2014

unidentifiable within a set of subjects. This set is calledthe AS. Sender anonymity means that a particular messageis not linkable to any sender, and no message is linkableto a particular sender.

We will start with the definition of the unconditionallysecure SAMA.

Definition 1 (SAMA). A SAMA consists of the following twoalgorithms:

� Generate (m;Q1; Q2; . . . ; Qn). Given a message mand the public keys Q1; Q2; . . . ; Qn of the ASS ¼ fA1; A2; . . . ; Ang, the actual message senderAt; 1 � t � n, produces an anonymous message SðmÞusing its own private key dt.

� Verify SðmÞ. Given a message m and an anonymousmessage SðmÞ, which includes the public keys of allmembers in the AS, a verifier can determine whetherSðmÞ is generated by a member in the AS.

The security requirements for SAMA include:

� Sender ambiguity. The probability that a verifier suc-cessfully determines the real sender of the anonymousmessage is exactly 1=n, where n is the total number ofmembers in the AS.

� Unforgeability. An anonymous message scheme isunforgeable if no adversary, given the public keys of allmembers of the AS and the anonymous messagesm1;m2; . . . ;mn adaptively chosen by the adversary,can produce in polynomial time a new valid anony-mous message with non-negligible probability.

In this paper, the user ID and the user public key will beused interchangeably without making any distinctions.

2.4 Modified ElGamal Signature Scheme

Definition 2 (MES). The modified ElGamal signature scheme[17] consists of the following three algorithms:

Key generation algorithm. Let p be a large prime and g bea generator of ZZ�p: Both p and g are made public. For a randomprivate key x 2 ZZp, the public key y is computed fromy ¼ gx mod p.

Signature algorithm. The MES can also have many var-iants [18], [19]. For the purpose of efficiency, we will describethe variant, called optimal scheme. To sign a message m, onechooses a random k 2 ZZ�p�1, then computes the exponentiationr ¼ gk mod p and solves s from:

s ¼ rxhðm; rÞ þ kmod ðp� 1Þ; (1)

where h is a one-way hash function. The signature of messagem is defined as the pair ðr; sÞ.

Verification algorithm. The verifier checks whether thesignature equation gs ¼ ryrhðm;rÞ mod p: If the equality holdstrue, then the verifier Accepts the signature, and Rejects

otherwise.

3 RELATED WORK

In [1], [2], symmetric key and hash based authenticationschemes were proposed for WSNs. In these schemes,

each symmetric authentication key is shared by a groupof sensor nodes. An intruder can compromise the key bycapturing a single sensor node. Therefore, these schemesare not resilient to node compromise attacks. Anothertype of symmetric-key scheme requires synchronizationamong nodes. These schemes, including TESLA [5] andits variants, can also provide message sender authentica-tion. However, this scheme requires initial time synchro-nization, which is not easy to be implemented in largescale WSNs. In addition, they also introduce delay inmessage authentication, and the delay increases as thenetwork scales up.

A secret polynomial based message authenticationscheme was introduced in [3]. This scheme offers infor-mation-theoretic security with ideas similar to a thresh-old secret sharing, where the threshold is determined bythe degree of the polynomial. When the number of mes-sages transmitted is below the threshold, the schemeenables the intermediate node to verify the authenticityof the message through polynomial evaluation. However,when the number of messages transmitted is larger thanthe threshold, the polynomial can be fully recovered andthe system is completely broken. To increase the thresh-old and the complexity for the intruder to reconstructthe secret polynomial, a random noise, also called a per-turbation factor, was added to the polynomial in [4] tothwart the adversary from computing the coefficient ofthe polynomial. However, the added perturbation factorcan be completely removed using error-correcting codetechniques [6].

For the public-key based approach, each message istransmitted along with the digital signature of the mes-sage generated using the sender’s private key. Everyintermediate forwarder and the final receiver can authen-ticate the message using the sender’s public key. Therecent progress on ECC shows that the public-keyschemes can be more advantageous in terms of memoryusage, message complexity, and security resilience, sincepublic-key based approaches have a simple and clean keymanagement [9].

The existing anonymous communication protocols arelargely stemmed from either mixnet [11] or DC-net [12].A mixnet provides anonymity via packet re-shufflingthrough a set of mix servers (with at least one beingtrusted). In a mixnet, a sender encrypts an outgoing mes-sage, and the ID of the recipient, using the public key ofthe mix. The mix accumulates a batch of encrypted mes-sages, decrypts and reorders these messages, and for-wards them to the recipients. Since mixnet-like protocolsrely on the statistical properties of the background traffic,they cannot provide provable anonymity. DC-net [12],[16] is an anonymous multi-party computation scheme.Some pairs of the participants are required to sharesecret keys. DC-net provides perfect (information-theo-retic) sender anonymity without requiring trusted serv-ers. However, in DC-net, only one user can send at atime, so it takes additional bandwidth to handle collisionand contention.

Recently, message sender anonymity based on ring sig-natures was introduced [20]. This approach enables themessage sender to generate a source anonymous message

LI ET AL.: HOP-BY-HOP MESSAGE AUTHENTICATION AND SOURCE PRIVACY IN WIRELESS SENSOR NETWORKS 1225

signature with content authenticity assurance. To gener-ate a ring signature, a ring member randomly selects anAS and forges a message signature for all other members.Then he uses his trap-door information to glue the ringtogether. The original scheme has very limited flexibilityand very high complexity. Moreover, the original paperonly focused on the cryptographic algorithm, and the rel-evant network issues were left unaddressed.

4 PROPOSED SOURCE ANONYMOUS MESSAGE

AUTHENTICATION ON ELLIPTIC CURVES

In this section, we propose an unconditionally secure andefficient SAMA. The main idea is that for each message mto be released, the message sender, or the sending node,generates a source anonymous message authenticator forthe message m. The generation is based on the MESscheme on elliptic curves. For a ring signature, each ringmember is required to compute a forgery signature for allother members in the AS. In our scheme, the entireSAMA generation requires only three steps, which linkall non-senders and the message sender to the SAMAalike. In addition, our design enables the SAMA to be ver-ified through a single equation without individually veri-fying the signatures.

4.1 Proposed MES Scheme on Elliptic Curves

Let p > 3 be an odd prime. An elliptic curve E is defined byan equation of the form:

E : y2 ¼ x3 þ axþ bmod p;

where a; b 2 IFp, and 4a3 þ 27b2 6� 0 mod p. The set EðIFpÞconsists of all points ðx; yÞ 2 IFp on the curve, together witha special point O, called the point at infinity.

Let G ¼ ðxG; yGÞ be a base point on EðIFpÞ whose order isa very large value N . User A selects a random integerdA 2 ½1; N � 1� as his private key. Then, he can compute hispublic key QA from QA ¼ dA �G.

Signature generation algorithm. For Alice to sign a messagem, she follows these steps:

1. Select a random integer kA, 1 � kA � N � 1.2. Calculate r ¼ xA modN , where ðxA; yAÞ ¼ kAG. If

r ¼ 0, go back to step 1.3. Calculate hA �

lhðm; rÞ, where h is a cryptographic

hash function, such as SHA-1, and �l denotes the lleftmost bits of the hash.

4. Calculate s ¼ rdAhA þ kA modN . If s ¼ 0, go back tostep 2.

5. The signature is the pair ðr; sÞ.Signature verification algorithm. For Bob to authenticate

Alice’s signature, he must have a copy of her public key QA,then he:

1. Checks that QA 6¼ O, otherwise invalid2. Checks that QA lies on the curve3. Checks that nQA ¼ OAfter that, Bob follows these steps to verify the signature:

1. Verify that r and s are integers in ½1; N � 1�. If not,the signature is invalid.

2. Calculate hA �lhðm; rÞ, where h is the same func-

tion used in the signature generation.3. Calculate ðx1; x2Þ ¼ sG� rhAQA modN .4. The signature is valid if r ¼ x1 modN , invalid

otherwise.In fact, if the signature is correctly generated, then:

ðx1; x2Þ ¼ sG� rhAQA

¼ ðrdAhA þ kAÞG� rhAQA

¼ kAGþ rhAQA � rhAQA

¼ kAG:

Therefore, we have x1 ¼ r, and the verifier should Acceptthe signature.

4.2 Proposed SAMA on Elliptic Curves

Suppose that the message sender (say Alice) wishes totransmit a message m anonymously from her network nodeto any other nodes. The AS includes n members,A1; A2; . . . ; An, for example, S ¼ fA1; A2; . . . ; Ang, where theactual message sender Alice is At, for some valuet; 1 � t � n. In this paper, we will not distinguish betweenthe node Ai and its public key Qi. Therefore, we also haveS ¼ fQ1; Q2; . . . ; Qng.

Authentication generation algorithm. Suppose m is a mes-sage to be transmitted. The private key of the messagesender Alice is dt; 1 � t � N . To generate an efficient SAMAfor message m, Alice performs the following three steps:

1. Select a random and pairwise different ki for each1 � i � n� 1; i 6¼ t and compute ri from ðri; yiÞ ¼kiG.

2. Choose a random ki 2 ZZp and compute rt fromðrt; ytÞ ¼ ktG�

Pi6¼t rihiQi such that rt 6¼ 0 and

rt 6¼ ri for any i 6¼ t; where hi �lhðm; riÞ:

3. Compute s ¼ kt þP

i6¼t ki þ rtdtht modN .The SAMA of the message m is defined as:

SðmÞ ¼ ðm;S; r1; y1; . . . ; rn; yn; sÞ:

4.3 Verification of SAMA

Verification algorithm. For Bob to verify an alleged SAMAðm;S; r1; y1; . . . ; rn; yn; sÞ, he must have a copy of the publickeys Q1; . . . ; Qn. Then he:

1. Checks that Qi 6¼ O; i ¼ 1; . . . ; n, otherwise invalid2. Checks that Qi; i ¼ 1; . . . ; n lies on the curve3. Checks that nQi ¼ O; i ¼ 1; . . . ; nAfter that, Bob follows these steps:

1. Verify that ri; yi; i ¼ 1; . . . ; n and s are integers in½1; N � 1�. If not, the signature is invalid.

2. Calculate hi �lhðm; riÞ, where h is the same func-

tion used in the signature generation.3. Calculate ðx0; y0Þ ¼ sG�

Pni¼1 rihiQi

4. The signature is valid if the first coordinate ofPiðri; yiÞ equals x0, invalid otherwise.

In fact, if the SAMA has been correctly generated withoutbeing modified, then we compute:


ðx0; y0Þ ¼ sG�Xn

i¼1

rihiQi

¼�

kt þX

i6¼tki þ rtdtht

�

G�X

i

rihiQi

¼X

i6¼tkiGþ

�

ktG�X

i6¼trihiQi

�

¼X

i6¼tðri; yiÞ þ ðrt; ytÞ

¼X

i

ðri; yiÞ:

Therefore, the verifier should always Accept the SAMA.

Remark 1. It is apparent that when n ¼ 1, SAMA becomes asimple signature algorithm.

4.4 Security Analysis

In this section, we will prove that the proposed SAMAscheme can provide unconditional source anonymity andprovable unforgeability against adaptive chosen-messageattacks.

4.4.1 Anonymity

In order to prove that the proposed SAMA can ensureunconditional source anonymity, we have to prove that:1) for anybody other than the members of S, the probabilityto successfully identify the real sender is 1=n, and 2) any-body from S can generate SAMAs.

Theorem 1. The proposed SAMA can provide unconditionalmessage sender anonymity.

Proof. The identity of the message sender is uncondition-ally protected with the proposed SAMA scheme. Thisis because, regardless of the sender’s identity, there areexactly ðN � 1ÞðN � 2Þ . . . ðN � nÞ different options togenerate the SAMA. All of them can be chosen by anymembers in the AS during the SAMA generation proce-dure with equal probability without depending on anycomplexity-theoretic assumptions. The proof for thesecond part, that anybody from S can generate theSAMA, is straightforward. This finishes the proof ofthis theorem. tu

4.4.2 Unforgeability

The design of the proposed SAMA relies on the ElGamalsignature scheme. Signature schemes can achieve differ-ent levels of security. Security against existential forgeryunder adaptive-chosen message attacks is the maximumlevel of security.

In this section, we will prove that the proposedSAMA is secure against existential forgery under adap-tive-chosen message attacks in the random oracle model[21]. The security of our result is based on ECC, whichassumes that the computation of discrete logarithms onelliptic curves is computationally infeasible. In otherwords, no efficient algorithms are known for non-quan-tum computers.

We will introduce two lemmas. Lemma 1 is the SplittingLemma, which is a well-known probabilistic lemma from

reference [10]. The basic idea of the Splitting Lemma is thatwhen a subset Z is “large” in a product space X � Y , it willhave many “large” sections. Lemma 2 is a slight modifica-tion of the Forking Lemma presented in [10]. The proofs ofthe two lemmas are mainly probability theory related. Wewill skip the proofs of these two lemmas here.

Lemma 1 (The Splitting Lemma). Let Z X � Y such thatPr½ðx; yÞ 2 Z� ". For any a < ", define W ¼ fðx; yÞ 2X � Y jPry02Y ½ðx; y0Þ 2 Z� "� ag, and W ¼ ðX � Y ÞnW ,then the following statements hold:

1. Pr½W � a.2. 8ðx; yÞ 2W;Pry02Y ½ðx; y0Þ 2 Z� "� a.3. Pr½W jZ� a=".

Lemma 2 (The Forking Lemma). Let A be a Probabilistic Poly-nomial Time (PPT) Turing machine. Given only the publicdata as input, if A can find, with non-negligible probability, avalid SAMA ðm;S; r1; y1; . . . ; rn; yn; h1; . . . ; hn; sÞ within abounded polynomial time T , then with non-negligible probabil-ity, a replay of this machine, which has control over A and adifferent oracle, outputs another valid SAMA ðm;S; r1;y1; . . . ; rn; yn; h

01; . . . ; h0n; sÞ, such that hi ¼ h0i, for all

1 � i � v; i 6¼ j for some fixed j.

Theorem 2. The proposed SAMA is secure against adaptive cho-sen-message attacks in the random oracle model.

Proof. (Sketch) If an adversary can forge a valid SAMA withnon-negligible probability, then according to the ForkingLemma, the adversary can obtain two valid SAMAsSðmÞ ¼ ðm;S; r1; y1; . . . ; rn; yn; h1; . . . ; hn; sÞ, and SðmÞ ¼ðm;S; r1; y1; . . . ; rn; yn; h

01; . . . ; h0n; sÞ, such that for 1 � i �

n; i 6¼ j; hi¼ h0i; hj 6¼ h0j and sG�Pn

i¼1 rihiQi ¼P

iðri; yiÞ;s0G�

Pni¼1 rih

0iQi ¼

Piðri; yiÞ:

Subtracting these two equations, we obtain ðs� s0ÞG ¼ rjðhj � h0jÞQj: Equivalently, we have:

Qj ¼s� s0

rjðhj � h0jÞG:

Therefore, we can compute the elliptic curve discretelogarithm of Qj in base G with non-negligible probabil-ity, which contradicts the assumption that it is compu-tationally infeasible to compute the elliptic discretelogarithm of Qj in base G. Therefore, it is computation-ally infeasible for any adversary to forge a validSAMA. tu

5 AS SELECTION AND SOURCE PRIVACY

The appropriate selection of an AS plays a key role in mes-sage source privacy, since the actual message source nodewill be hidden in the AS. In this section, we will discusstechniques that can prevent the adversaries from trackingthe message source through the AS analysis in combinationwith local traffic analysis.

Before a message is transmitted, the message source nodeselects an AS from the public key list in the SS as its choice.This set should include itself, together with some othernodes. When an adversary receives a message, he can possi-bly find the direction of the previous hop, or even the real


node of the previous hop. However, the adversary is unableto distinguish whether the previous node is the actualsource node or simply a forwarder node if the adversary isunable to monitor the traffic of the previous hop. Therefore,the selection of the AS should create sufficient diversity sothat it is infeasible for the adversary to find the messagesource based on the selection of the AS itself.

Some basic criteria for the selection of the AS can bedescribed as follows:

� To provide message source privacy, the messagesource needs to select the AS to include nodes fromall directions of the source node. In particular, theAS should include nodes from the opposite directionof the successor node. In this way, even the immedi-ate successor node will not be able to distinguish themessage source node from the forwarder based onthe message that it receives.

� Though the message source node can select any nodein the AS, some nodes in the AS may not be able toadd any ambiguity to the message source node. Forinstance, the nodes that are apparently impossible orvery unlikely to be included in the AS based on thegeographic routing. Therefore, these nodes are notappropriate candidates for the AS. They should beexcluded from the AS for energy efficiency.

� To balance the source privacy and efficiency, weshould try to select the nodes to be within a prede-fined distance range from the routing path. We rec-ommend selecting an AS from the nodes in a bandthat covers the active routing path. However, the ASdoes not have to include all the nodes in the routingpath.

� The AS does not have to include all nodes in thatrange, nor does it have to include all the nodes in theactive routing path. In fact, if all nodes are includedin the AS, then this may help the adversary to iden-tity the possible routing path and find the sourcenode.

As an example, suppose we want to transmit a packetfrom source node S to destination node D in Fig. 1. Weselect the AS to include only nodes marked with �, whilenodes marked as � will not be included in the AS. Of allthese � nodes, some of them are on the active routing path,while others are not. However, all these nodes are locatedwithin the shaded band area surrounding the active routingpath. Suppose node A is compromised, unless node A col-laborates with other nodes and can fully monitor the trafficof the source node S, it will not be able to determinewhether S is the source node, or simply a forwarder. Similaranalysis is also true for other nodes.

Any node in the active routing path can verify the con-tents’ authenticity and integrity. However, anybody whoreceives a packet in the transmission can possibly excludesome of the nodes in the WSNs as the possible sourcenode. Inclusion of these nodes in the AS will not increasethe source privacy. Nevertheless, the more the nodesincluded in the AS are, the higher the energy cost will be.Therefore, the selection of the AS has to be done with careso that the energy cost and the source privacy can both beoptimized.

In addition, to balance the power consumption betweenauthenticity and integrity verification, and the possibilitythat corrupted messages are being forwarded, the verifica-tion service may not have to take place in every hop;instead, it may be configured to take place in every otherhop, for instance.

6 KEY MANAGEMENT AND COMPROMISED NODE

DETECTION

In our scheme, we assume that there is an SS whose respon-sibilities include public-key storage and distribution in theWSNs. We assume that the SS will never be compromised.However, after deployment, the sensor node may be cap-tured and compromised by the attackers. Once compro-mised, all information stored in the sensor node will beaccessible to the attackers. We further assume that the com-promised node will not be able to create new public keysthat can be accepted by the SS.

For efficiency, each public key will have a short identity.The length of the identity is based on the scale of the WSNs.

6.1 Compromised Node Detection

As a special scenario, we assume that all sensor informa-tion will be delivered to a sink node, which can be co-located with the SS. As described in Section 5, when a mes-sage is received by the sink node, the message source ishidden in an AS. Since the SAMA scheme guarantees thatthe message integrity is untampered, when a bad or mean-ingless message is received by the sink node, the sourcenode is viewed as compromised. If the compromisedsource node only transmits one message, it would be verydifficult for the node to be identified without additionalnetwork traffic information. However, when a compro-mised node transmits more than one message, the sinknode can narrow the possible compromised nodes downto a very small set.

As shown in Fig. 2, we use the circle to represent an AS.When only one message is transmitted, the sink node canonly obtain the information that the source node will be ina set, say AS1. When the compromised source node trans-mits two messages, the sink node will be able to narrowthe source node down to the set with both vertical linesand horizontal lines. When the compromised source nodetransmits three messages, the source node will be furthernarrowed down to the shaded area. Therefore, if the sinknode keeps tracking the compromised message, there is ahigh probability that the compromised node can beisolated.

If the compromised nodes repeatedly use the same AS, itmakes traffic analysis of the compromised nodes feasible,

Fig. 1. Anonymous set selection in active routing.


which will increase the likelihood for the compromisednodes to be identified and captured.

When a node has been identified as compromised, the SScan remove its public key from its public key list. It can alsobroadcast the node’s short identity to the entire sensordomain so that any sensor node that uses the stored publickey for an AS selection can update its key list. Once the pub-lic key of a node has been removed from the public key list,and/or broadcasted, any message with the AS containingthe compromised node should be dropped without any pro-cess in order to save the precious sensor power.

7 PERFORMANCE ANALYSIS

In this section, we will evaluate our proposed authentica-tion scheme through both theoretical analysis and simula-tion demonstrations. We will compare our proposedscheme with the bivariate polynomial-based symmetric-keyscheme described in [3], [4]. A fair comparison between ourproposed scheme and the scheme proposed in [4] should be per-formed with n ¼ 1.

7.1 Theoretical Analysis

Key management is one of the major issues for secret-keybased authentication schemes. This is especially true forlarge scale WSNs. While many of these schemes aredesigned to provide node authentication, they can only pro-vide end-to-end node authentication using the secret keyshared between the two nodes, which implies that only thereceiver can verify the authenticity of the messages en-route. This means that no intermediate node can authenti-cate the message in general. The intermediate nodes mayhave to forward a manipulated message for many hopsbefore the message can finally be authenticated anddropped by the receiving node. This not only consumesextra sensor power, but also increases the network collisionand decreases the message delivery ratio. In addition to per-formance improvement, enabling intermediate nodeauthentication will thwart adversaries from performingdenial-of-service attacks through message manipulation todeplete the energy and communication resources of thewireless network. Therefore, developing a protocol that canprovide hop-by-hop intermediate node authentication is animportant research task.

Most of the authentication schemes are based on sym-metric-key schemes, including the polynomial evaluationbased threshold authentication scheme [4]. The secret bivar-iate polynomial is defined as [3]:

fðx; yÞ ¼Xdx

i¼0

Xdy

j¼0

Ai;jxiyj;

where each coefficient Ax;y is an element of a finite field IFp,and dx and dy are the degrees of this polynomial. dx and dyare also related to the message length and the computa-tional complexity of this scheme. From the performanceaspect, dx and dy should be as short as possible.

On the other hand, it is easy to see that when eithermore than dy þ 1 messages transmitted from the base sta-tion are received and recorded by the intruders, or morethan dx þ 1 sensor nodes have been compromised, theintruders can recover the polynomial fðx; yÞ via Lagrangeinterpolation. In this case, the security of the system istotally broken and the system cannot be used anymore.This property requires that both dx and dy be very large forthe scheme to be resilient to node compromise attacks.

An alternative approach based on perturbation of thepolynomial was also explored. The main idea is to add asmall amount of random noise to the polynomial in the orig-inal scheme so that the adversaries will no longer be able tosolve the coefficients using Lagrange interpolation. How-ever, this technique is proved to be vulnerable to securityattacks [6], since the random noise can be removed from thepolynomial using error-correcting techniques.

While hop-by-hop authentication can be achievedthrough a public-key encryption system, the public-keybased schemes were generally considered as not preferred,mainly due to their high computational overhead. How-ever, our research demonstrates that it is not always true,especially for elliptic curve public-key cryptosystems.

In our scheme, each SAMA contains an AS of n randomlyselected nodes that dynamically changes for each message.For n ¼ 1, our scheme can provide at least the same securityas the bivariate polynomial-based scheme. For n > 1, wecan provide extra source privacy benefits. Even if one mes-sage is corrupted, other messages transmitted in the net-work can still be secure. Therefore, n can be much smallerthan the parameters dx and dy. In fact, even a small n mayprovide adequate source privacy, while ensuring high sys-tem performance.

In addition, in the bivariate polynomial-based scheme,there is only one base station that can send messages. Allthe other nodes can only act as intermediate nodes orreceivers. This property makes the base station easy toattack, and severely narrows the applicability of thisscheme. In fact, the major traffic in WSNs is packet deliveryfrom the sensor nodes to the sink node. In this case, ourscheme enables every node to transmit the message to thesink node as a message initiator.

The recent progress on ECC has demonstrated that thepublic-key based schemes have more advantages in termsof memory usage, message complexity, and security resil-ience, since public-key based approaches have a simple andclean key management [9].

Fig. 2. Compromised node detection.


7.2 Experimental Results

In this section, we implement the bivariate polynomial-based scheme and our proposed scheme in a real worldcomparison. The comparison is based on comparable secu-rity levels.

The implementation in [4] was carried out on Mica2 plat-form, which is 8 MHz, while our implementation is carriedout on Telosb platform, which is 4 MHz. We first providesimulation in Table 1 to compare and justify our parameterselections. From the table, we can see that our results iscomparable with the original paper. This justifies that theperformance comparisons between our scheme and thealgorithm proposed in [4] using different parameters areconsistent and reasonable.

7.2.1 Simulation Parameter Setup

The bivariate polynomial-based scheme is a symmetric-key based implementation, while our scheme is based onECC. This requires us to determine the comparable keysizes. If we choose the key size to be l for the symmetric-key cryptosystem, then the key size for our proposed ECCshould be 2l according to [22], which is much shorter thanthe traditional public-key cryptosystem. This progressfacilitates the implementation of the authentication schemeusing ECC.

In our simulation setting, we choose five security levels,which are indicated by the symmetric-key sizes l: 24, 32, 40,64, and 80 bits, respectively. The comparable key sizes ofour scheme are 48, 64, 80, 128, and 160 bits, respectively.

We also need to determine dx and dy for the bivariatepolynomial-based scheme, and the n for our scheme. In oursimulation, we select dx equal to dy and choose three valuesfor them: 80, 100, and 150. We assume that WSNs do not

contain more than 216 nodes in our simulation, which is rea-sonably large. For size n of the AS, we choose three valuesin the simulation: 10, 15 and 20.

We will compare the computational overhead, communica-tion overhead, delivery ratio, energy consumption, transmissiondelay, and memory consumption of our proposed scheme withthe bivariate polynomial-based scheme.

7.2.2 Computational Overhead

For a public-key based authentication scheme, computa-tional overhead is one of the most important performancemeasurements. So we first performed simulation to measurethe process time. The simulations were carried out in 16-bit,4 MHz TelosB mote.

Table 2 shows the process time of our scheme and thebivariate polynomial-based scheme for both authenticationgeneration and verification. In the simulations, we assumethat the key length of our scheme is 2l.

From the table, we have the following findings:

� For the bivariate polynomial-based scheme, theauthentication generation time is much longer thanthe verifying time; while for our proposed scheme,the verifying time is about half of the authenticationgeneration time, except when n ¼ 1, the generationtime is shorter than the verification time.

� Comparing bivariate polynomial-based scheme withour proposed scheme for n ¼ 1, we find that the gen-eration time of our scheme is less than 5 percent ofthe bivariate polynomial-based scheme for all dx; dy,but the verifying time is slightly longer when dx; dyis less than 100. When dx; dy is longer than 150, theverifying times of the two schemes are comparable.

� The memory consumption of our proposed schemeis slightly less than the bivariate polynomial-basedscheme in all scenarios.

� For our proposed scheme, to provide source pri-vacy, the cost of generation time and verifying timeincrease linearly with n.

7.2.3 Communication Overhead and Message

Transmission Delay

The communication overhead is determined by the mes-sage length. For the bivariate polynomial-based scheme,each message is transmitted in the form of <m;MAFmðyÞ> , where MAFmðyÞ is defined as: MAFmðyÞ ¼fðhðmÞ; yÞ ¼

Pdyj¼0 Mjy

j: MAFmðyÞ is represented by its

TABLE 2Process Time (s) for the Two Schemes (16-bit, 4 MHz TelosB Mote)

TABLE 1Performance Comparison of the Bivariate Polynomial-Based

Scheme in Two Different Scenarios: (a) The OriginalImplementation under 8 MHz Mica2 Platform, and

(b) Our Implementation under 4 MHz Telosb


dy þ 1 coefficients Mi 2 ZZp; 0 � i � dy, where p 2 ð2l�1; 2lÞ isa large prime number. The total length of the message islðdy þ 1Þ.

For our scheme, the message format is: ðm;S; r1; y1; . . . ;rn; yn; sÞ, where m; s; ri; yi are all numbers with lengthL ¼ 2l. S is the ID list for all the nodes included in the AS.Assuming the network is composed of � nodes in total, eachID will be of the length: dlog2�e. When n nodes are includedin the AS, the length of S is ndlog2�e. Therefore, the totallength of one message for our scheme is: 4lðnþ 1Þþ ndlog2�e:

The large communication overhead of the polynomial-based scheme will increase the energy consumption andmessage delay. The simulation results in Figs. 3a and 3bdemonstrate that our proposed scheme has a much lowerenergy consumption and message transmission delay.These simulations were carried out in ns-2 on RedHat Linuxsystem. The security levels 1, 2, 3, 4 correspond to symmet-ric key sizes 24, 32, 40, and 64 bits, and elliptic curves keysize 48, 64, 80, and 128 bits, respectively.

We also conduct simulations to compare the deliveryratios using ns-2 on RedHat Linux system. The resultsshow that our scheme is slightly better than the bivariatepolynomial-based scheme in delivery ratio. The results aregiven in Fig. 3c.

Our simulation on memory consumption derived inTelosB, see Table 3, shows the overall memory consumptionfor bivariate polynomial-based scheme is at least five timeslarger than our proposed scheme.

8 CONCLUSION

In this paper, we first proposed a novel and efficientSAMA based on ECC. While ensuring message sender

privacy, SAMA can be applied to any message to providemessage content authenticity. To provide hop-by-hopmessage authentication without the weakness of the built-in threshold of the polynomial-based scheme, we thenproposed a hop-by-hop message authentication schemebased on the SAMA. When applied to WSNs with fixedsink nodes, we also discussed possible techniques for com-promised node identification. We compared our proposedscheme with the bivariate polynomial-based schemethrough simulations using ns-2 and TelosB. Both theoreti-cal and simulation results show that, in comparable sce-narios, our proposed scheme is more efficient than thebivariate polynomial-based scheme in terms of computa-tional overhead, energy consumption, delivery ratio, mes-sage delay, and memory consumption.

ACKNOWLEDGMENTS

This research was supported in part by NSF grants CNS-0845812, CNS-1117831, CNS-1217206, ECCS-1232109.

REFERENCES

[1] F. Ye, H. Lou, S. Lu, and L. Zhang, “Statistical En-Route Filteringof Injected False Data in Sensor Networks,” Proc. IEEE INFOCOM,Mar. 2004.

[2] S. Zhu, S. Setia, S. Jajodia, and P. Ning, “An Interleaved Hop-By-Hop Authentication Scheme for Filtering False Data in SensorNetworks,” Proc. IEEE Symp. Security and Privacy, 2004.

[3] C. Blundo, A. De Santis, A. Herzberg, S. Kutten, U. Vaccaro, andM. Yung, “Perfectly-Secure Key Distribution for Dynamic Confer-ences,” Proc. Advances in Cryptology (Crypto ’92), pp. 471-486, Apr.1992.

[4] W. Zhang, N. Subramanian, and G. Wang, “Lightweight andCompromise-Resilient Message Authentication in SensorNetworks,” Proc. IEEE INFOCOM, Apr. 2008.

TABLE 3Memory (KB) for the Two Schemes (TelosB) (F Stands for Flash Memory)

Fig. 3. Performance comparison of our proposed scheme and bivariate polynomial-based scheme.


[5] A. Perrig, R. Canetti, J. Tygar, and D. Song, “Efficient Authentica-tion and Signing of Multicast Streams over Lossy Channels,” Proc.IEEE Symp. Security and Privacy, May 2000.

[6] M. Albrecht, C. Gentry, S. Halevi, and J. Katz, “Attacking Crypto-graphic Schemes Based on ‘Perturbation Polynomials’,” Report2009/098, http://eprint.iacr.org/, 2009.

[7] R. Rivest, A. Shamir, and L. Adleman, “A Method for ObtainingDigital Signatures and Public-Key Cryptosystems,” Comm. ACM,vol. 21, no. 2, pp. 120-126, 1978.

[8] T.A. ElGamal, “A Public-Key Cryptosystem and a SignatureScheme Based on Discrete Logarithms,” IEEE Trans. InformationTheory, vol. IT-31, no. 4, pp. 469-472, July 1985.

[9] H. Wang, S. Sheng, C. Tan, and Q. Li, “Comparing Symmetric-Keyand Public-Key Based Security Schemes in Sensor Networks: ACase Study of User Access Control,” Proc. IEEE 28th Int’l Conf. Dis-tributed Computing Systems (ICDCS), pp. 11-18, 2008.

[10] D. Pointcheval and J. Stern, “Security Proofs for SignatureSchemes,” Proc. Advances in Cryptology (EUROCRYPT), pp. 387-398, 1996.

[11] D. Chaum, “Untraceable Electronic Mail, Return Addresses, andDigital Pseudonyms,” Comm. ACM, vol. 24, no. 2, pp. 84-88, Feb.1981.

[12] D. Chaum, “The Dinning Cryptographer Problem: UnconditionalSender and Recipient Untraceability,” J. Cryptology, vol. 1, no. 1,pp. 65-75, 1988.

[13] A. Pfitzmann and M. Hansen, “Anonymity, Unlinkability,Unobservability, Pseudonymity, and Identity Managementa Proposal for Terminology,” http://dud.inf.tu-dresden.de/literatur/Anon_Terminology_v0.31.pdf, Feb. 2008.

[14] A. Pfitzmann and M. Waidner, “Networks without User Observ-ability—Design Options.,” Proc. Advances in Cryptology (EURO-CRYPT), vol. 219, pp. 245-253, 1985.

[15] M. Reiter and A. Rubin, “Crowds: Anonymity for Web Trans-action,” ACM Trans. Information and System Security, vol. 1, no. 1,pp. 66-92, 1998.

[16] M. Waidner, “Unconditional Sender and Recipient Untraceabilityin Spite of Active Attacks,” Proc. Advances in Cryptology (EURO-CRYPT), pp. 302-319, 1989.

[17] D. Pointcheval and J. Stern, “Security Arguments for Digital Sig-natures and Blind Signatures,” J. Cryptology, vol. 13, no. 3, pp. 361-396, 2000.

[18] L. Harn and Y. Xu, “Design of Generalized ElGamal Type DigitalSignature Schemes Based on Discrete Logarithm,” Electronics Let-ters, vol. 30, no. 24, pp. 2025-2026, 1994.

[19] K. Nyberg and R.A. Rueppel, “Message Recovery for SignatureSchemes Based on the Discrete Logarithm Problem,” Proc. Advan-ces in Cryptology (EUROCRYPT), vol. 950, pp. 182-193, 1995.

[20] R. Rivest, A. Shamir, and Y. Tauman, “How to Leak a Secret,”Proc. Advances in Cryptology (ASIACRYPT), 2001.

[21] M. Bellare and P. Rogaway, “Random Oracles are Practical: A Par-adigm for Designing Efficient Protocols,” Proc. ACM First Conf.Computer and Comm. Security (CCS ’93), pp. 62-73, 1993.

[22] “Cryptographic Key Length Recommendation,” http://www.keylength.com/en/3/, 2013.

Jian Li received the BE and MA degrees in elec-trical engineering both from Tsinghua University,Beijing, China, in 2005 and 2008, respectively.He is currently working toward the PhD degree inelectrical and computer engineering at MichiganState University, East Lansing. His researchinterests include cyber security, network codingand distributed storage.

Yun Li received the BE degree from Xidian Uni-versity, Xi’an, China, in 2005, and the PhDdegree in electrical and computer engineeringfrom Michigan State University, East Lansing, inMay 2010. He joined the Network Operating Sys-tem Technology Group of Cisco System in 2010.He also joined the Server & Tools Division ofMicrosoft in 2012. His current research interestsinclude wireless sensor networks, network secu-rity and cloud based data services.

Jian Ren received the BS and MS degrees bothin mathematics from Shaanxi Normal University,China, and the PhD degree in electrical engineer-ing from Xidian University, China. He is an asso-ciate professor in the Department of ElectricalCommunication Engineering at Michigan StateUniversity, East Lansing. His current researchinterests include cryptography, network security,energy efficient sensor network security protocoldesign, privacy-preserving communications, andcognitive networks. He received the US National

Science Foundation Faculty Early Career Development (CAREER)Award in 2009. He is a senior member of the IEEE.

Jie Wu is the chair and a professor in the Depart-ment of Computer and Information Sciences,Temple University, Philadelphia, Pennsylvania.Prior to joining Temple University, he was a pro-gram director at National Science Foundation.His research interests include wireless networksand mobile computing, routing protocols, fault-tolerant computing, and interconnection net-works. He serves in the editorial board of theIEEE Transactions on Computers and Journal ofParallel and Distributed Computing. He is a pro-

gram cochair for IEEE INFOCOM 2011. He was also the general cochairfor IEEE MASS 2006, IEEE IPDPS 2008, and DCOSS 2009. He cur-rently serves as an ACM distinguished speaker and is the chairman ofthe IEEE Technical Committee on Distributed Processing. He is a fellowof the IEEE.

" For more information on this or any other computing topic,please visit our Digital Library at www.computer.org/publications/dlib.


hop by-hop message authentication and source privacy in wireless sensor networks

Education