A New Design of Access Control in Wireless Sensor Networks

Abstract

Nodes in a sensor network may be lost because of power exhaustion or malicious attacks. To extend the span of sensor network, new nodes deployment is necessary. To prevent malicious nodes from joining the sensor networks, access control is a designed requirement for controlling sensor node deployment. Based on elliptic curve cryptography (ECC), this paper presents a new access control protocol for secure wireless sensor networks. The proposed scheme not only prevents malicious nodes from joining sensor networks, but also key establishment is included in the authentication procedure. Compared to the previously proposed schemes, the authentication procedure and common key generation of the proposed method are very simple and efficient. It could offer computational efficiency, energy, and bandwidth savings. In addition, it can be easily implemented as a dynamic access control, because all the old secret keys and information in existing nodes should not be updated once a new node is added or an old node is lost.

1. Introduction

Wireless sensor networks applied to the monitoring of physical environments have recently emerged as an important infrastructure. It usually consists of one or more base stations and lots of sensor nodes, which are densely deployed either inside the phenomenon or very close to it. To save manufacturing, a sensor node is usually built as a small device, which has limited memory, a low-end processor, and is powered by a battery [1]. The position of sensor nodes need not to be engineered or predetermined. This allows random deployment in inaccessible terrain or disaster relief operations. Therefore, sensor networks are being deployed for a wide variety of applications, including military sensing and tracking, patient monitoring, and environmental monitoring, and airport and home security [1, 2]. Owing to the property of sensor devices, sensor networks may easily be compromised by adversaries who modify messages or provide misleading information to other sensor nodes. To prevent information and communication systems from illegal delivery and modification, the receiver must authenticate messages transmitted from the sensor nodes over a wireless sensor network.

Because of the sensor devices, after several days or weeks of operation, some nodes in the network may exhaust their power or lost. That is, nodes in a sensor network may exhaust their battery or be stolen by malicious attacks. In addition, some nodes may be destroyed by adversaries so that the entire network may become useless. To extend the lifetime of the sensor network, new node deployment is necessary. However, an adversary can also deploy malicious nodes into the network for eavesdropping purposes or insert false reports. Hence, a new node should prove that it is a legitimate node through the authentication.

Today, the practical option for the distribution of keys to the sensor nodes of wireless sensor networks rely on key predistribution. That is, keys are preinstalled in the sensor nodes, and the nodes having a common key are provided with a secure connection between them. One solution is all the nodes carrying a master secret key. Any pair of nodes can use this master key to achieve key agreement and obtain a new common key [3]. This procedure does not exhibit network resiliency: if the master secret key is compromised by one node, the security of the entire sensor network will be compromised. Recently, many key predistribution schemes were proposed to protect sensor networks [4–8]. They provide that any pair of sensor nodes can find a common shared key between them with simple calculations, and this common key is pairwise. Then, it could reduce the risk of the entire sensor network. However, the above-mentioned key predistribution schemes cannot be easily implemented as a dynamic access control, because all the old secret keys and information of existing nodes should be updated once a new node is added.

To prevent malicious nodes from joining the sensor networks, access control is required in the design for controlling new nodes deployment. Some approaches [9, 10] try to detect malicious nodes after they join the sensor networks, but adversaries can still attack the networks [11]. Besides, the authors in [12, 13] proposed key management protocols called LEAP and LEAP+ for sensor networks. They assumed that each sensor node can sustain a tolerance time interval before it is compromised. That is, the adversary cannot compromise a sensor node within a time interval. Their scheme can establish a pairwise key shared between any two neighboring sensor nodes by exchanging their identities. Later, Wang et al. proposed an access control for sensor networks [14]. In their scheme, they assume an offline certification authority (CA) that deploys an ECC cryptosystem and maintains a secret polynomial function f() of degree t. The basic idea of Wang et al.'s scheme is that usershave to be authenticated and endorsed by t local sensors before they can send the remote query. They develop a threshold endorsement scheme (inspired by the Shamir's secret sharing [15]) to perform the remote access control. Then, the secret polynomial function f() of degree t may not be flexibly updated for applications. To the best of our knowledge, recently, Zhou et al. [11] proposed an access control protocol based on ECC for sensor networks that are more efficient than those public key-based schemes. Their scheme can prevent malicious nodes from joining sensor networks at the very beginning, and key establishment is also included in their access control protocol. In their scheme [11], two sensor nodes may have the same bootstrapping time if deployed simultaneously. Besides, they also suppose that the adversary cannot compromise a sensor node within a time interval. It is the same assumption in [12, 13]. However, it is required to send twenty one transmissions in Zhou et al.'s authentication protocol [11]. The bandwidth consumption rates are quite demanding and likely to bottleneck in many applications.

Compared to RSA [16], it has been shown that 160-bit ECC provides comparable security to 1024-bit RSA, and 224-bit ECC provides comparable security to 2048-bit RSA [17–19]. Hence, under the same security level, smaller key sizes of ECC offer merits of computational efficiency, as well as memory, and bandwidth saving. Sensor nodes adopt 802.15.4 standard which allows a variable payload of up to 102 bytes [20]. Such a packet provides enough space to include digital signature for broadcast authentication [20]. Moreover, in Wang et al.'s experiment [14], they show that the public key-based protocol is more advantageous than the symmetric key in terms of the memory usage, message complexity, and security resilience. Therefore, based on ECC and the concept of Schnorr signature [21], this paper designs a simple access control protocol to prevent malicious nodes joining sensor networks, and key establishment is also included in the authentication protocol.

The new access control protocol uses the concept of timebound in which once time period has elapsed the sensor node in wireless network cannot access any data for future time period. It means that each node has its own expiration time of w, then the node can achieve authentication and communication to other nodes in the z time period if and only if the time period $z\le w$ . Once the time period $z>w$ elapses, this node cannot achieve authentication and communication to other nodes for any useful messages. So, our access control in wireless sensor networks is constrained by the time period. Our purpose is to protect future messages. That is, the impact of the node compromises attack to be decreased or minimized. In the proposed scheme, it actually divides the total time into t time periods, starting with l. The time is not necessarily a real time. Compared with Zhou et al.'s scheme, the authentication procedure and common key generation of the proposed scheme are very simple and efficient for each sensor node. And it does not suppose that each sensor node can sustain a tolerance time interval before it is compromised. In addition, the proposed scheme can be easily implemented as a dynamic access control, because the old secret keys and information of existing nodes should not be changed once a new node is added. Comparing to Zhou et al.'s scheme, the proposed scheme could significantly reduce the overhead of communications for sensor nodes to achieve secure connectivity. It could offer more energy and bandwidth savings than Zhou et al.'s scheme.

The rest of this paper is organized as follows. In Section 2, this paper will introduce a new access control in sensor networks. The security analyses and the performance of the proposed scheme are discussed in Section 3. Some conclusions are given in Section 4.

2. The Proposed Scheme

At the very beginning of a network, a lot of sensor nodes are deployed in a designated area. New node deployment is inevitable, because nodes in a sensor network may be lost or destroyed. We assume that all sensor nodes have the same transmission range and communication with each other. And, the time during the wireless network is divided into t periods, numbered $\mathrm{1,2},\dots ,t$ . For simplicity, we let t be an integer; that is, the system ends at time t. This maximum number of (expired) time period t should not be considered as a limitation of the system. For example, if each time period represents twenty minutes, then $t=360$ denotes roughly five days. Using the concepts of Schnorr signature [21] and based on ECC, we will develop an access control method to prevent malicious nodes from joining sensor networks. Without loss of generality, the proposed method would accomplish two tasks.

• (1)

Node Authentication. a deployed node establishes its identity with its neighboring nodes and shows that it has the right to access the sensor network through authentication.

(2)

Key Establishment. through authentication, shared keys should be created between a deployed node and its neighboring nodes to provide secure communication. This guarantees that any two sensor nodes can find a common shared key between themselves. This shared key is pairwise. A shared key refers to the relationship between the node and one of its direct neighbors.

The proposed method consists of an initialization phase and an authentication and key establishment phase. The basic idea is stated as follows.

Initialization Phase

(1) Before a sensor network is deployed, the system (trusted center or base station) chooses a large prime number $q\hspace{0.17em}\hspace{0.17em}(q\approx 2^{160})$ and an elliptic curve ${\hspace{0.17em}\hspace{0.17em}E}_q$ (the elliptic curve E is over the finite field $F_q$ ); a cyclic group $G=〈P〉$ of points over the elliptic curve $E_q$ , where P is the generator of the group and has an order n of at least 160 bits [17–19, 22]. It provides $P=O$ , and its point at infinity is O. Then, the system selects a secret key $x\in Z_q$ and computes the system's public key $Q=xP$ of the point over the elliptic curve $E_q$ . Next, the system (or base station) chooses a secure one-way hash function $h(\hspace{0.17em}\hspace{0.17em})$ .

(2) Suppose that there are a number of v neighborhood nodes with identities $\{N_1,N_2,\dots ,N_v\}$ in a designated area. For each node $N_i$ , the system (or base station) first generates a random number $r_i$ and the expiration time $w_i<t$ then computes the point $R_i=r_{i}P=(R{x}_i,R{y}_i)$ and the value $s_i=r_i+c_{i}x\text{mod\hspace{0.17em}}q$ , where $c_i=h(N_i\parallel R{x}_i\parallel R{y}_i\parallel w_i)$ . Next, the system preloads the elliptic curve $E_q$ , the system's public key Q, the generator P of the group $G=〈P〉$ over the elliptic curve $E_q$ , one-way hash function $h(\hspace{0.17em}\hspace{0.17em})$ , its expiration time $w_i$ , and the secret pair $(R_i,s_i)$ to node $N_i$ , for $i=\mathrm{1,2},\dots ,v$ . Here, “ $\parallel$ ” is the concatenation of operation; $R{x}_i$ and $R{y}_i$ are the x-component and y-component of point $R_i$ , respectively.

Authentication and Key Establishment Phase

Suppose that the time period is T now. The processes of authentication and key establishment for two nodes $N_i$ and $N_j$ are described in the following steps.

Step 1.

The node $N_i$ generates a random number $t_i$ and computes the point $A_i=t_{i}P$ over the elliptic curve $E_q$ , then it sends $A_i$ and its identity $N_i$ to the node $N_j$ . Similarly, node $N_j$ generates a random number $t_j$ and computes the point $A_j=t_{j}P$ over elliptic curve $E_q$ then it sends $A_j$ and its identity $N_j$ to node $N_i$ . For security, the random numbers $t_i$ and $t_j$ cannot be reused.

Step 2.

After receiving $A_j$ , node $N_i$ computes a shared session key $K_{ij}=t_i^{}{A}_j=t_i{t}_{j}P=(K{x}_{ij},K{y}_{ij})$ and $z_i=t_i+e_i{s}_{i}modq$ , where $e_i=h(N_i\parallel K{x}_{ij}\parallel K{y}_{ij})$ . Then, it delivers the signature $z_i$ , the expiration time $w_i$ of $N_i$ , and its point $R_i=(R{x}_i,R{y}_i)$ to node $N_j$ . Here, $K{x}_{ij}$ and $K{y}_{ij}$ are the x-component and y-component of point $K_{ij}$ , respectively. Similarly, after receiving $A_i$ , node $N_j$ computes a shared session key $K_{ij}=t_j^{}{A}_i=t_j{t}_{i}P=(K{x}_{ij},K{y}_{ij})$ and $z_j=t_j+e_j{s}_j\text{mod\hspace{0.17em}}q$ , where $e_j=h(N_j\parallel K{x}_{ij}\parallel K{y}_{ij})$ . Then, it also delivers the signature $z_j$ , the expiration time $w_j$ , and its point $R_j=(R{x}_j,R{y}_j)$ to node $N_i$ .

To make sure that node $N_i$ is a legitimate node and confirms their shared session key $K_{ij}$ , node $N_j$ carries out the following steps.

• (1)

Node $N_j$ first compares $N_i$ 's expiration time $w_i$ with the broadcasted time period T from the system. If the expiration time $w_i<T$ then node $N_i$ is rejected and continued otherwise.

(2)

It computes $c_i=h(N_i\parallel R{x}_i\parallel R{y}_i\parallel w_i)$ and $e_i=h(N_i\parallel K{x}_{ij}\parallel K{y}_{ij})$ .

(3)

It checks whether the equality $z_{i}P=A_i+e_i(R_i+c_{i}Q)$ holds, where Q is the public point of the system.

The signature is accepted if the answer is yes and rejected otherwise. In the same way, from the signature $z_j$ , the expiration time $w_j$ , and its point $R_j=(R{x}_j,R{y}_j)$ of node $N_j$ ; if $w_j>T$ and $z_{j}P=A_j+e_j(R_j+c_{j}Q)$ hold, then node $N_i$ can verify the identity of node $N_j$ , where $c_j=h(N_j\parallel R{x}_j\parallel R{y}_j\parallel w_j)$ and $e_j=h(N_j\parallel K{x}_{ij}\parallel K{y}_{ij})$ . Thus, two nodes, $N_i$ and $N_j$ , could achieve mutual authentication and generate a common session key $K_{ij}$ . The above authentication and key establishment are briefly illustrated in Figure 1.

Figure 1

The proposed authentication and key establishment protocol.

According to the Diffie-Hellman algorithm over elliptic curve [23], it provides that $K_{ij}=t_j{A_i}^{}=t_i{A}_j=t_i{t}_{j}P$ over elliptic curve $E_q$ . Hence, two nodes, $N_i$ and $N_j$ , can obtain their common shared key $K_{ij}$ by using their secret parameter $t_i$ and $t_j$ , respectively. This common shared key $K_{ij}$ is pairwise. Therefore, by means of the signature verification, any pair of nodes $N_i$ and $N_j$ can mutually authenticate each other and construct a shared session key for securing communications. For security and creating a different session key for nodes $N_i$ and $N_j$ , the random numbers $t_i$ and $t_j$ should be used only once. In the following, we state the correctness of the signature verification.

To make sure the validity of node $N_i$ and their shared key $K_{ij}$ for node $N_j$ , the equality $z_{i}P=A_i+e_i(R_i+c_{i}Q)$ always holds, while the signature $z_i$ , the expiration time $w_i$ , and the point $R_i=(R{x}_i,R{y}_i)$ of node $N_i$ are correct, where Q is the public point of the system. According to the authentication and key establishment phase, the node $N_j$ can compute a shared session key $K_{ij}=t_j^{}{A}_i=(K{x}_{ij},K{y}_{ij})$ , $c_i=h(N_i\parallel R{x}_i\parallel R{y}_i\parallel w_i)$ , and $e_i=h(N_i\parallel K{x}_{ij}\parallel K{y}_{ij})$ . Since $z_i=t_i+e_i{s}_i$ and $s_i=r_i+c_{i}x\hspace{0.17em}\text{mod}q$ , then it has $z_{i}P=(t_i+e_i{s}_i)P=t_{i}P+e_i(r_i+c_{i}x)P=A_i+e_i(R_i+c_{i}Q)$ , where $t_{i}P=A_i$ , $r_{i}P=R_i$ , and $xP=Q$ . Therefore, node $N_j$ can confirm the legality of node $N_i$ and generate a common session key $K_{ij}$ .

Adding a New Node

During the network operation phase, if some sensor nodes are lost or destroyed, new sensor nodes need to be deployed. When a new node with identity $N_{v+1}$ is added, the system (or base station) first generates a random number $r_{v+1}$ and its expiration time $w_{v+1}$ , and then computes the point $R_{v+1}=r_{v+1}P=(R{x}_{v+1},R{y}_{v+1})$ and the secret key $s_{v+1}=r_{v+1}+c_{v+1}x\text{mod\hspace{0.17em}}q$ , where $c_{v+1}=h(N_{v+1}\parallel R{x}_{v+1}\parallel R{y}_{v+1}\parallel w_{v+1})$ . Next, the system preloads the elliptic curve $E_q$ , the system's public key Q, the generator P of the group $G=〈P〉$ over the elliptic curve $E_q$ , the one-way hash function $h(\hspace{0.17em}\hspace{0.17em})$ , its expiration time of $w_{v+1}<t$ , and the secret pair $(R_{v+1},s_{v+1})$ to the new node $N_{v+1}$ . The authentication and key establishment for any old node with the new node $N_{v+1}$ is the same as the above authentication and key establishment phase. In addition, the other information in existing nodes is not updated. Hence, the proposed scheme can be easily implemented as a dynamic access control, because all the old secret keys and messages of existing nodes need not be changed once a new node is added or an old node is lost.

3. Discussions

The proposed scheme is based on the ECC. Thus, the security of our scheme is founded in the difficulty of solving the discrete logarithm problem in $E_q$ . We will review some security terms needed for security analysis [17–19, 22, 23].

Definition 1.

A secure hash function, $h(\hspace{0.17em}\hspace{0.17em}):x\to y$ , is one-way; if given x, it is easy to compute $h(x)=y$ ; however, given y, it is hard to compute $h^{-1}(y)=x$ .

Definition 2.

The elliptic curve discrete logarithm problem (ECDLP) in $E_q$ is as follows: given $P\in E_q$ with order n (that is $nP=O$ ) and Q is a point in the cyclic group $G=〈P〉$ . It is intractable to find r such that $Q=rP$ .

Definition 3.

The elliptic curve computational Diffie-Hellman problem (ECDHP) is as follows: given $t_{1}P$ and $t_{2}P$ over elliptic curve $E_q$ , it is hard to compute $t_1{t}_{2}P$ for any positive integers $t_1$ and $t_2$ .

Next, we will discuss the security and performance of our scheme as follows.

3.1. Security Analysis

The security of the proposed scheme can be showed as follows.

3.1.1. Sensor Node Replication Attack

In this attack [10], an adversary can deploy malicious nodes which are clones of a compromised node into the sensor network. In the proposed scheme, for each node $N_i$ , the system (or base station) first gives the expiration time $w_i$ and generates a random number $r_i$ for the node $N_i$ then computes the point $R_i=r_{i}P=(R{x}_i,R{y}_i)$ and the value $s_i=r_i+c_{i}x\text{mod\hspace{0.17em}}q$ , where $c_i=h(N_i\parallel R{x}_i\parallel R{y}_i\parallel w_i)$ . Next, the system preloads the elliptic curve $E_q$ , the system's public key Q, the generator P of the group $G=〈P〉$ over the elliptic curve $E_q$ , the one-way hash function $h(\hspace{0.17em}\hspace{0.17em})$ , and the secret pair $(R_i,s_i)$ to node $N_i$ . Thus, based on the timebounded $w_i$ , the secret key $s_i$ of node $N_i$ is computed by $s_i=r_i+c_{i}x$ , where $c_i=h(N_i\parallel R{x}_i\parallel R{y}_i\parallel w_i)$ . Therefore, once the time period $T>w_i$ elapses, the clones of a compromised node $N_i$ cannot impersonate the real node of $N_i$ to achieve authentication and communication to other nodes for any future messages. Hence, the proposed method can withstand the sensor node replication attack. On the other hand, the public key $Q=xP$ and x is the private key of the system. Based on the elliptic curve discrete logarithm problem (ECDLP), with points $R_i=r_{i}P$ and Q, it is very difficult for anyone to obtain the secret number $r_i$ and x. Then, even if knowing $s_i$ , an attacker cannot easily derive the private key x of the system. Without the private key x, it is extremely hard for the attacker to achieve the sensor node replication attack.

3.1.2. Sybil Attack

In this attack, a malicious sensor claims multiple IDs (identities) or locations [24]. In the proposed scheme, the secret key $s_i$ of node $N_i$ is to use the timebounded and the identity $N_i$ for computing $s_i=r_i+c_{i}x$ and $c_i=h(N_i\parallel R{x}_i\parallel R{y}_i\parallel w_i)$ . Therefore, a compromised node $N_i$ cannot claim a new identity ${N_i\prime }_{}$ in the vicinity of node $N_j$ . It can withstand the Sybil attack [24]. Therefore, without knowing x, it is very difficult for an adversary to update the expiration time $w_i$ and the identity $N_i$ so that the node $N_i$ might construct communication with other nodes through authentication. On the other hand, if node $N_i$ is compromised within its lifetime $w_i$ , then the adversary can impersonate $N_i$ and even mount a Sybil attack for the time $T<w_i$ . However, once the time period $T>w_i$ elapses, the adversary cannot impersonate $N_i$ to achieve authentication and communication to other nodes for any useful messages. Thus, without the knowledge of x, the malicious sensor node cannot successfully impersonate other nodes to inject forged data into the sensor network. To reduce the Sybil attack for this case, the lifetime for each node may be shorter. That is the impact of the node compromise attack to be decreased or minimized. It could be dependent on the applications and its area for a node.

3.1.3. Wormhole Attack

In this attack, an adversary tries to tunnel normal messages between a new node and other distant old nodes so that these nodes might construct communication through handshakes. This attack does not compromise any sensor node, but it may lead to many serious threats, for example, the chaos of the routing operations [9, 25]. However, in our authentication, the secret key $s_i$ of node $N_i$ is based on the timebounded. Once the time period has elapsed, an adversary could not use the Wormhole attack to establish a tunnel between a new node and other distant old nodes. Thus, for each node $N_i$ , using x and the expiration time $w_i$ , only the system can generate the secret key $s_i=r_i+c_{i}x$ for the node $N_i$ such that the signature verification $z_{i}P=A_i+e_i(R_i+c_{i}Q)$ holds, where $z_i=t_i+e_i{s}_i\text{mod\hspace{0.17em}}q$ , $c_i=h(N_i\parallel R{x}_i\parallel R{y}_i\parallel w_i)$ , and $e_i=h(N_i\parallel K{x}_{ij}\parallel K{y}_{ij})$ . Without knowing the private key x of the system, an attacker cannot easily forge the system to deploy new nodes in the sensor networks.

3.1.4. Key Establishment

Based on the ECDLP, even if attackers can obtain $A_i=t_{i}P$ and $A_j=t_{j}P$ , it is very hard for them to derive the random numbers $t_i$ and $t_j$ from $A_i$ and $A_j$ . Without knowing $t_i$ and $t_j$ , an attacker obtains nothing about the shared key $K_{ij}=t_j{A}_i=t_i{A}_j=t_i{t}_{j}P$ for nodes $N_i$ and $N_j$ . It is based on the elliptic curve computational Diffie-Hellman problem (ECDHP) [23]. Hence, the proposed method can generate a shared key for secure communications. Moreover, a common key between two nodes is pairwise. If the common key $K_{ij}$ of nodes $N_i$ and $N_j$ is compromised, without knowing any other nodes' session keys $w_i$ , it would not be helpful for the attacker to obtain other nodes' messages.

3.1.5. Mutual Authentication

In the proposed authentication and key establishment phase, after receiving information $A_i=t_{i}P$ and $A_j=t_{j}P$ , only the legal nodes $N_i$ and $N_j$ can derive their signatures $z_i=t_i+e_i{s}_i$ and $z_j=t_j+e_j{s}_j\text{mod\hspace{0.17em}}q$ with their secret key $s_i$ and   $s_j$ , respectively. Here, $e_i=h(N_i\parallel K{x}_{ij}\parallel K{y}_{ij})$ , $e_j=h(N_j\parallel K{x}_{ij}\parallel K{y}_{ij})$ , and $K_{ij}=t_j{A_i}^{}=t_i{A}_j=t_i{t}_{j}P=(K{x}_{ij},K{y}_{ij})$ . Through signature verification, if two equations $z_{i}P=A_i+e_i(R_i+c_{i}Q)$ and $z_{j}P=A_j+e_j(R_j+c_{j}Q)$ hold, then two nodes $N_i$ and $N_j$ could achieve mutual authentication and generate a common session key $K_{ij}$ . Moreover, based on the ECC public key infrastructure, each sensor node does not know the secret keys of other nodes, and each shared common key is only known to neighboring nodes that created it. Hence, based on the security of Schnorr signature [21], without knowing the private key x or the secret key $s_i$ of node $N_i$ , no one can easily masquerade as the system or the node $N_i$ to compute the actuality signature of $z_i$ for cheating other nodes. Therefore, it can withstand a forgery attack. On the other hand, the random numbers $t_i$ and $t_j$ are used only once. It can resist the reply attack.

3.1.6. No Entire Secret Exposure

If the secret key $s_i$ of node $N_i$ is compromised, an attacker can only forge node $N_i$ to construct the new pairwise key $K_{ij}^{\prime }$ between nodes $N_i$ and $N_j$ in the z time period if and only if the time period $z\le w_i$ . Once the time period $z>w_i$ elapses, this node cannot achieve authentication to other nodes for future time. These nodes are constrained by the time period. It could decrease the risk of the entire sensor network. The proposed method could protect all future secret information and the security of the entire sensor network will not be revealed. Thus, it could provide more secure connectivity for sensor networks.

3.1.7. Perfect Forward Secrecy

According to the Diffie-Hellman algorithm over elliptic curve, it provides that $K_{ij}=t_j{A_i}^{}=t_i{A}_j=t_i{t}_{j}P$ over elliptic curve $E_q$ . Hence, only two nodes $N_i$ and $N_j$ can obtain their common shared key $K_{ij}$ by using their secret parameter $t_i$ and $t_j$ , respectively. This common shared key $K_{ij}$ is pairwise. Therefore, by means of the signature verification, any pair of nodes $N_i$ and $N_j$ can mutually authenticate each other and construct a shared session key for securing communications. Thus, the proposed scheme can prevent external adversaries from eavesdropping normal messages or injecting bogus data into the sensor network. For security and creating a different session key for nodes $N_i$ and $N_j$ , the random numbers $t_i$ and $t_j$ should be used only once. Then, even if an intruder obtains the current session key $K_{ij}$ , it is difficult for him to obtain private messages from the past. The new scheme can provide perfect forward security even if the current secret key $K_{ij}$ has been compromised.

3.2. Performance

To the best of our knowledge, most previous key predistribution schemes cannot be easily implemented as a dynamic access control, because all the old secret messages of existing nodes have to be changed once a new sensor node is added [4–8, 15]. Therefore, with regard to efficiency and communications, we compare the proposed protocol with Zhou et al.'s [11] which is an access control scheme based on ECC. For convenience, we define related notations to analyze the computational complexity. The notation $T{e}_m$ means the time for one multiplication computation over an elliptic curve, $T_i$ denotes the time for one modular inverse computation, and $T_h$ denotes the time for executing the adopted one-way hash function in one's scheme. Note that the times for computing modular addition is ignored, since they are much smaller than $T{e}_m$ , $T_i$ , and $T_h$ .

In the proposed method and Zhou et al.'s protocol, the most expensive operation is the point multiplication of the form $kP$ for $k\in {\text{Z}}_n^{*}$ and P is a cyclic group of points over an elliptic curve [17–19]. Zhou et al. [11] and Gura et al. [26] evaluated the assembly language implementations of ECC and RSA on the Atmel ATmega128 processor [26, 27], which is popular for sensor platform such as crossbow MICA motes. In their implementation, a 160-bit point multiplication of ECC requires only 0.81 s (second), while 1024-bit RSA public key operation and private key operation require about 0.43 s (second) and 10.99 s (second), respectively. Besides, an inverse computation in ${\text{z}}_{\text{q}}^{*}$ takes about the same time as that of a modular exponentiation computation in $z_q^{}$ [28, 29]. And a hashing computation is more efficient than $T{e}_m$ and $T_i$ [28, 29]. Therefore, under the same security level, smaller key sizes of ECC could offer faster computation, as well as memory, energy, and bandwidth savings.

We summarize the comparisons of the proposed scheme with Zhou et al.'s scheme in Table 1. As shown in Table 1, in Zhou et al.'s scheme [11], each node needs to perform two hash function computations ( $2T_h$ ), two inverse modular computations ( $2T_i$ ), and four-point multiplications ( $4T{e}_m$ ) over an elliptic curve for authentication. In the proposed method, each node requires two hash function computations ( $2T_h$ ) and five-point multiplications ( $5T{e}_m$ ) over an elliptic curve for authentication. In the implementation of [9, 27] for sensor platform, a 160-bit point multiplication of ECC requires only 0.81 s. Under their implementation [9, 27], the time to perform the proposed scheme is 4.05 s ( $5\times 0.81$ ) for the five-point multiplications ( $5T{e}_m$ ) over an elliptic curve. The time for Zhou et al.'s scheme is 3.24 s ( $4\times 0.81$ ) for the four-point multiplications ( $4T{e}_m$ ). Moreover, in Zhou et al.'s scheme, each node needs to use two inverse modular computations ( $2T_i$ ). However, the proposed method need not to use inverse modular computations. As reported in [28, 29], an inverse computation in $z_q^{*}$ takes about the same time as that of a modular exponentiation computation in $z_q^{}$ . Therefore, the computational time of the Zhou et al.'s scheme is not significantly less than that of the proposed scheme.

Table 1

Comparisons of computation and transmission for two schemes.

Schemes	Zhou et al.'s scheme	The proposed scheme
Computations for each node to achieve authentication and compute a common key	$4T{e}_m+2T_i+2T_h$	$5T{e}_m+2T_h$
Total number of transmissions for the protocol	21	10

With regard to the communications, in the proposed authentication and key establishment phase, for the node $N_i$ , it requires to send five messages, $A_i,\hspace{0.17em}\hspace{0.17em}{N}_i,\hspace{0.17em}\hspace{0.17em}{z}_i,\hspace{0.17em}\hspace{0.17em}{R}_i$ , and $w_i$ , to the node $N_j$ ; similarly, the node $N_j$ needs to deliver five messages, $A_j,\hspace{0.17em}\hspace{0.17em}{N}_j,\hspace{0.17em}\hspace{0.17em}{z}_j,\hspace{0.17em}\hspace{0.17em}{R}_j$ , and $w_j$ , to the node $N_i$ . The total number of transmissions for the proposed protocol only needs ten transmissions. However, it is required to send twenty-one transmissions in Zhou et al.'s protocol [11]. Compared to Zhou et al.'s scheme, the proposed method could significantly reduce the overhead of communications for sensor nodes to achieve secure connectivity. Therefore, under the same security level, the proposed method could offer more energy and bandwidth savings than Zhou et al.'s scheme.

4. Conclusions

Based on ECC, this paper presents a simple dynamic access control protocol to prevent malicious nodes from joining sensor networks. Compared to the previously proposed schemes, the authentication procedure and common key generation of the proposed method are very simple and efficient. The proposed method could significantly reduce the overhead by avoiding modular exponentiation and inverse computations for any pair of nodes to establish a common key in the authentication procedure. It could offer computational efficiency, energy, and bandwidth savings.