A Secret Sharing-Based Key Management in Hierarchical Wireless Sensor Network

Abstract

Wireless sensor networks (WSNs) are subject to various attacks because of the vulnerable environment, limited recourse, and open communication channel. To protect WSNs, in this paper, we present a Secret sharing-based key management (SSKM). SSKM utilizes the advantages of hierarchical architecture and adopts two-level key management and authentication mechanism, which can efficiently protect the allover network communication security and survivability. Different from previous works, the SSKM distributes keys based on secret sharing mechanism by the clustered architecture, which not only localizes the key things but also keeps scalability. The SSKM provides various session keys, the network key for base station (BS) and cluster heads (CHs); the cluster key between the cluster head and member nodes. The SSKM dynamically generates different keys based on different polynomials from BS in different periods which can protect the network from the compromised nodes and reduce the high probability of the common keys. The security analysis shows that the SSKM can prevent several attacks effectively and reduce the energy consumption.

1. Introduction

Due to the development of internet of things (IoT) and cyber physical system (CPS), wireless sensors have been deployed in many applications, such as in smart grid, national security, intelligent transportation, forest detection, or chemical harmful gas monitoring [1]. However, wireless sensor networks (WSNs) usually consist of tiny sensors which have low computational capability, small storage, and limited energy; that is, the WSNs are often subject to a variety of attacks, such as eavesdropping attack and flood attack and so on. Once a sensor is compromised by adversaries, the information materials of the sensor become non secretive and intercepted by enemy, and the entire network is threatened [2].

Therefore, security mechanisms in WSN are required to provide data confidentiality, integrity, freshness, availability, and authentication [2]. Moreover, in view of the excellent performance of the clustering algorithm in WSN, the hierarchical architectures are often used in WSN applications [3]. Normally, cryptographic methods of securing a network are the key management strategy, and it has been intensively studied in the literature of WSNs [4–13]. Therefore, some literatures adopt hierarchical architecture to deploy key system on them to protect the communication in WSNs [4–10].

In [5, 6], the authors employed the secret sharing mechanism to distribute keys into nodes, which can effectively generate and assign keys. However, in these schemes, the network must exchange many messages to establish key system, which consumes lots of energy. In this paper, we present a novel secret sharing-based key management (SSKM).

In SSKM, considering that the energy efficiency is a dominant consideration problem of WSNs, we firstly employ the maximum energy cluster head (MECH) protocol to form cluster. Different from other hierarchical architectures, MECH protocol limits the size of cluster to generate uniform cluster. In each cluster, there is a sensor, called cluster head (CH), collecting information from other cluster member nodes and forwarding the processed information to the base station.

Therefore, to protect the communication channel from CH to BS, we present a network key. Firstly, the BS encrypts the network key with a secret, puts the secret as constant of the polynomial, and divides the secret into shares based on Lagrange interpolation formula. To reconstruct the polynomial of $(t-\mathrm{1})$ degree, any t or more parameters $(\text{ID},f(\text{ID}))$ combination can recover and obtain the secret. Therefore, our solution tries to avoid the adversary intercept and capture sufficient parameters.

Also, similar to network key, we design a cluster key to protect the communication between the cluster head and member nodes. Unlike the BS, CHs have no sufficient energy to broadcast messages. Thus, the BS deploys key material to sensors in advance, such as polynomials and revoked list. Then, the CH just exchanges parameters to adjust polynomials to generate/cancel keys.

Compared to previous works [5, 6], the salient advantages of our work are as follows:

• (1)

SSKM establishes a relocatable key mechanism based on the secret sharing theory, which hides keys into secret and recovers them when needed;

(2)

SSKM adopts hierarchical architecture which is suitable for the secret sharing mechanism and localizes the security and reduces energy consumption. It makes the SSKM key management feasible;

(3)

SSKM presents an authentication mechanism based on the secret sharing theory, which supports the scalability (join or leave).

The rest of this paper is organized as follows. Section 2 describes the related work, Section 3 presents the system model and assumption, Section 4 describes the secret sharing key management in detail, and Section 5 evaluates SSHM using security analysis. Finally, we end the paper with a conclusion as well as the further work in Section 6.

2. Related Work

In 1979, Shamir [14] and Blakley [15] proposed the secret sharing method based on the Lagrange interpolation formula and the nature of the vector space, respectively. Proposition: given $n+\mathrm{1}$ points $(x_i,f(x_i))$ on a polynomial $f(x)$ of degree n, one can identify a uniquely polynomial by calculating:

$$\begin{array}{cc}& f\left(x\right)={\displaystyle \sum }_{i=\mathrm{1}}^n\left(f\left(x_i\right)\coprod _{\mathrm{1}\le k\ne i\le n}\frac{x-x_k}{x_i-x_k}\right).\end{array}$$

(1)

One also defines the Lagrange coefficient ${\mathrm{\Delta }}_{i,s}$ for $i\in {{\rm Z}}_P$ and a set $S\subseteq {{\rm Z}}_P$ :

$$\begin{array}{cc}& {\mathrm{\Delta }}_{i,s}\left(x\right)=\coprod _{i\in S,j\ne i}\frac{x-j}{i-j}.\end{array}$$

(2)

A $(t,n)$ threshold secret sharing scheme is as follows: given n points $(x_i,f(x_i))$ on a polynomial $f(x)$ of degree $(t-\mathrm{1})$ , randomly picking out t points of $(x_i,f(x_i))$ from n points can construct the polynomial. When constructing the scheme, the credibility of the parties splits initial secret S into n shares (points) and assigns them to users safely. Any t or more users combining their share can reconstruct the secret S, but any $t-1$ user group or less cannot reconstruct the secret. This secret sharing method provides the security scheme in many applications, such as key distribution, secure computation, and information safe storage.

In [5], the authors present a low-cost secret-sharing scheme for sensor network. This paper provides basic building blocks to establish secure communication through exchanging secret keys between neighbor nodes without any cryptography methods. In [5], authors also design a second algorithm which extends the secret key establishment. However, due to the exchange happening among sensors, it consumes lots of energy. Moreover, the authentication between neighbor nodes also needs to exchange large messages, which makes it unsuitable for wireless sensor network.

In [6], authors presented some schemes to secure data aggregation based on secret sharing and information dispersal. In these schemes, sensor nodes split messages into subshares and forward them among several disjoint paths to defend DoS attack, eavesdropping attack, and tampering attack. They design a secret multipath aggregation (SMA) mechanism which applies secret sharing to create shares to deal with security under the contingency of node compromise. However, these schemes are not feasible for heavy energy consumption. On one hand, they want data aggregation using secret sharing; on the other hand, they have to distribute key things and messages to confuse the enemy, so that the adversary cannot find the real route, which needs a large number of messages exchange.

Comparing with previous works, our solution adopts the hierarchical network and localizes the communication and security. Also, we ingeniously use the base station to carry complicated things out, which can reduce the energy consumption.

3. System Model

3.1. Network Model

The wireless sensor network is energy sensitive. Therefore, we adopt the maximum energy cluster head (MECH) protocol for our network architecture [1]. The MECH is an LEACH-like protocol (LEACH: low energy adaptive clustering hierarchy) [2] which divides the network into clusters.

As shown in Figure 1, in the MECH architecture, the sensors self-organize into some clusters and act as two types of roles: cluster heads and member nodes. In each cluster, one node as a CH manages the cluster and deals with information from member nodes forward to the base station (BS). MECH constructs clusters based on radio range and the number of cluster members. The cluster topology in the network is distributed more equally through our cluster constructing; that is, nodes in each cluster do not exceed a certain threshold.

Figure 1

The network system.

3.2. Assumptions

In the considered network, we consumed the following.

• (i)

All sensor nodes are static.

(ii)

Each sensor has a unique ID assigned by the base station.

(iii)

Each sensor has the same capabilities in energy, computation, radio range, and so forth.

(iv)

If a node is compromised, all of the key things in the node are revealed [7].

(v)

Each sensor is in, and only in, one cluster.

(vi)

The BS can communicate with all sensors in the network.

3.3. Notations

In Table 1, we list some notations used in this paper.

Table 1

Notations.

Notation	Explains
$K_{\text{ini}}$	The initial key shared by all nodes
$\text{I}{\text{D}}_{\mathrm{i}}$	ID of sensor
BS	Base Station
$C_i$	The ith cluster
$\text{C}{\text{H}}_{\mathrm{i}}$	The ith cluster head
$K_{{}^{C_{\text{in}}}}^l$	The session key during session l
${\mathrm{S}}_{C_{\text{in}}}^{\mathrm{l}}$	The secret sharing among CHs during session l
$Z_{C_{\text{in}}}^{{}^l}$	The encrypted key $K_{{}^{C_{\text{in}}}}^l$ by the secret sharing ${\mathrm{S}}_{C_{\text{in}}}^{\mathrm{l}}$
$K_{\text{C}{\text{H}}_i}^l$	The cluster key among clusters during session l
${\mathrm{S}}_{\text{C}{\text{H}}_{\text{i}}}^{\mathrm{l}}$	The secret sharing between CH and members in session l
$Z_{\text{C}{\text{H}}_i}^{{}^l}$	The encrypted key $K_{\text{C}{\text{H}}_i}^l$ by the secret sharing ${\mathrm{S}}_{\text{C}{\text{H}}_{\mathrm{i}}}^{\mathrm{l}}$
R	Revoked set before session l
l	Session period
w	The number of nodes in WSN

4. The Secret Sharing-Based Key Management

In this section, we describe the secret sharing-based key management (SSKM) in detail. After deployment, the base station assigns each sensor an initial key $K_{\text{init}}$ similar to LEAP+ [12]. And then, the BS broadcasts the key materials to the network to build the network key and the cluster key, respectively. The key architecture is shown in Figure 2.

Figure 2

The key architecture.

4.1. Preliminaries

After deployment, the BS randomly chooses an integer, relatively primes with $p-1$ and $q-1$ (p and q are big primes); the base station assigns each sensor an initial key $K_{\text{init}}$ similar to LEAP. Since the BS is credible and has sufficient capacity and energy, it keeps all IDs and keys. Meanwhile, BS chooses polynomials and the corresponding number of polynomial values for each cluster. Assume that there are $m-\mathrm{1}$ clusters $C_i\hspace{0.17em}\hspace{0.17em}(i=\mathrm{1},\dots ,m-\mathrm{1})$ , and each cluster has a cluster head ${\text{CH}}_i$ and $k\hspace{0.17em}\hspace{0.17em}(k\ge t)$ member nodes.

Shamir's $(t,n)$ threshold scheme based on Lagrange interpolating polynomial states that there are n shareholders $U=\{U\mathrm{1},\dots ,U_n\}$ and mutually trusted dealer D. The scheme consists of two steps [16]:

(1)  share generation phase: dealer D randomly selects a polynomial $f(x)$ of $(t-\mathrm{1})$ degree:

$$\begin{array}{cc}& f\left(x\right)=S+a_{\mathrm{1}}x+\cdots +a_{t-\mathrm{1}}{x}^{t-\mathrm{1}}(\mathrm{mod}\hspace{0.17em}P),\end{array}$$

(3)

in which the secret $S=f(\mathrm{0})$ , all coefficients $S,a_{\mathrm{1}},a_{\mathrm{2}},\dots ,a_{t-\mathrm{1}}$ are in finite field $F_p=\text{GF}(P)$ with p elements, and dealer computes all shares $S_i=f{(x_i)}_{}$ for $\{i=\mathrm{1},\dots ,n\}$ ; then it distributes each share $S_i$ to corresponding shareholder $U_i$ privately;

(2)  secret reconstruct phase: any t shares $(S_{\mathrm{1}},S_{\mathrm{2}},\dots ,S_t)$ of n shares as input, and we can reconstruct the secret S as

$$\begin{array}{cc}& f\left(x\right)={\displaystyle \sum }_{i=\mathrm{1}}^t{S}_i\left({\displaystyle \prod }_{i\ne j}\frac{x-x_j}{x_i-x_j}\right)\left(\mathrm{mod}\hspace{0.17em}P\right),\\ f\left(\mathrm{0}\right)={\displaystyle \sum }_{i=\mathrm{1}}^t{S}_i\left({\displaystyle \prod }_{i\ne j}\frac{x_j}{x_j-x_i}\right)\left(\mathrm{mod}\hspace{0.17em}P\right).\end{array}$$

(4)

We find that the above scheme satisfies the basic security requirement of secret sharing scheme: any t shares or more than t shares can reconstruct the secret S; fewer than $(t-\mathrm{1})$ shares cannot reconstruct the secret S. Shamir's scheme is information theoretically secured [17]. However, there are some requirements [18] in this situation:

• (1)

there must be a secure channel for delivering shares between dealer and users;

(2)

$x_i$ and $f(x_i)$ are made publicly known. However, in key transfer protocol, for security reason, we need to keep $x_i$ and $f(x_i)$ as each user's secret. So we adopt the discrete logarithm in finite field and DDH difficulty assumption to ensure the security in the unsecure communication channel.

4.2. Initial Phase

Once wireless sensor network has been deployed and sensors self-organized into clusters, BS starts to form the key system as follows.

• (1)

Firstly, BS chooses two big primes $p_{\mathrm{1}}$ and $q_{\mathrm{1}}$ ; let $p=\mathrm{2}{p}_{\mathrm{1}}+\mathrm{1}$ and $q=\mathrm{2}{q}_{\mathrm{1}}+\mathrm{1}$ , $N=pq$ ; it is computationally intractable to solve the factor n without p, q. Meanwhile, BS selects a generator g  ( $g\in [N^{\mathrm{1}/\mathrm{2}},N]$ ) and another prime $Q\hspace{0.17em}\hspace{0.17em}(Q>N)$ . And then, BS broadcasts the three triple $(N,g,Q)$ to sensors in the network.

(2)

Assume that during each session period $l\hspace{0.17em}\hspace{0.17em}(l=\mathrm{1},\dots ,M)$ , BS randomly and uniformly chooses m polynomials $f(x)$ of $(t-1)$ -degree, where $m-\mathrm{1}\ge t$ . And one of polynomials is as follows:

$$\begin{array}{cc}& f_{C_{\text{in}}}^l\left(x\right)=S_{C_{\text{in}}}^l+a_{{\mathrm{1},C_{\text{in}}}_{}}^{l}x+\cdots +a_{t-\mathrm{1},C_{\text{in}}}^l{x}^{t-\mathrm{1}}\mathrm{mod}Q.\end{array}$$

(5)

Equation (5) is used to key distribute between BS and cluster head. And other $m-\mathrm{1}$ polynomials are utilized to key distribute among the cluster and member nodes as follows:

$$\begin{array}{cc}& f_{{\text{C}{\text{H}}_i}_{}}^l\left(x\right)=S_{{\text{CH}}_i}^l+a_{\mathrm{1},{\text{CH}}_i}^{l}x+\cdots +a_{{t-\mathrm{1},{\text{CH}}_i}_{}}^l{x}^{t-\mathrm{1}}\mathrm{mod}Q.\end{array}$$

(6)

• (3)

  BS independently selects M session keys $\{K_{C_{\text{in}}}^{l^{}}{\}}_{l=\mathrm{1},\dots ,M}$ and $\{K_{{\text{CH}}_i}^{l^{}}{\}}_{l=\mathrm{1},\dots ,M}$ from $\text{GF}(Q)$ in the finite field Q and hides the session keys with secret $S_{C_{\text{in}}}^l$ and $S_{{\text{CH}}_i}^l$ , namely, $Z_{C_{\text{in}}}^l=\{K_{C_{\text{in}}}^l+S_{C_{\text{in}}}^l\}$ in network key management and $Z_{{\text{CH}}_i}^l=\{K_{{\text{CH}}_i}^l+S_{{\text{CH}}_i}^l\}$ in cluster key management. The algorithm of initial phase is shown in Figure 3.

Figure 3

The initial phase.

4.3. Network Key Management

The network key is the session key between the BS and cluster heads to protect their communication.

The key shares distribution process is as follow.

• (1)

During the session period $\{l{\}}_{l=\mathrm{1},\dots ,M}$ , the BS counts out each cluster head's (CH's) share $f_{C_{\text{in}}}^l({\text{ID}}_{{\text{CH}}_i}^l)$ by their ID and gets the two tuples $\{{\text{ID}}_{{\text{CH}}_i}^l,f_{C_{\text{in}}}^l({\text{ID}}_i^l)\}$ , for the security between BS and CHs. Firstly, the BS randomly chooses $x_{\mathrm{0}}^l\hspace{0.17em}\hspace{0.17em}(x_{\mathrm{0}}^l\in [\mathrm{2},n])$ which relatively primes with $p-1$ and $q-1$ , and let $y_{\mathrm{0}}^l=g^{x_{\mathrm{0}}^l}\hspace{0.17em}\mathrm{mod}\hspace{0.17em}N$ ; meanwhile, CHs also chooses $x_i^l\hspace{0.17em}\hspace{0.17em}(x_i^l\in [\mathrm{2},N])$ and lets $y_i^l=g^{x_i^l}\hspace{0.17em}\mathrm{mod}\hspace{0.17em}N$ . And then, the CH sends $({\text{ID}}_{{\text{CH}}_i}^l,y_i^l)\hspace{0.17em}\hspace{0.17em}(i=\mathrm{1},\dots ,m-\mathrm{1})$ to the BS, and BS unicasts $(y_{\mathrm{0}}^l,({\text{ID}}_{{\text{CH}}_i}^l,f_{C_{\text{in}}}^l(D_{{\text{CH}}_i}^l)(y_{{\text{CH}}_i}^l{)}^{x_{\mathrm{0}}}\mathrm{mod}N$ to each ${\text{ID}}_{{\text{CH}}_i}^l$ . Note that the BS must ensure if ${\text{ID}}_i\ne {\text{ID}}_j$ then $y_i^l=y_j^l$ ; otherwise, it should regenerate until success.

(2)

Given that R indicates the set of revoked CHs during the session period l and before, let $R=R_{\mathrm{2}}\cup \cdots \cup R_{l-\mathrm{1}}\cup R_l$ , where $|R|\le t$ . In session l, the BS selects a group of users $V_l=\{{\text{ID}}_{{\text{CH}}_{\mathrm{1}}}^l,\dots ,{\text{ID}}_{{\text{CH}}_t}^l\}$ which meet ${\text{ID}}_R\subseteq V_l$ and ${\text{ID}}_{{\text{CH}}_i}\cap V_l=\varnothing$ .

(3)

BS broadcasts the information $\{Z_{C_{\text{in}}}^{\mathrm{1}},Z_{C_{\text{in}}}^{\mathrm{2}},\dots Z_{C_{\text{in}}}^l\}$ to each cluster node.

The network key process is shown in Figure 4.

Figure 4

The network in session l.

The session key recovery process is as follows.

• (1)

Having received the key materials, cluster heads calculate their individual share $f_{C_{\text{in}}}^l({\text{ID}}_{{\text{CH}}_i}^l)·(y_i^l{)}^{x_{\mathrm{0}}}/(y_{\mathrm{0}}^l{)}^{x_i}=f_{C_{\text{in}}}^l({\text{ID}}_{{\text{CH}}_i}^L)$ with the private key $x_i^l$ and public key $y_{\mathrm{0}}^l$ . According to the information $\{{\text{ID}}_i^l,f_{C_{\text{in}}}({\text{ID}}_i^l)\}$ , any t sensors or more than t sensor can recover the secret $S_{C_{\text{in}}}^l$ with (7) as follows:

$$\begin{array}{cc}& f_{C_{\text{in}}}\left(x\right)={\displaystyle \sum }_{j=\mathrm{1}}^t\left(\coprod _{l\ne j}\frac{x-{\text{ID}}_{{\text{CH}}_j}^L}{{\text{ID}}_{{\text{CH}}_l}^L-{\text{ID}}_{{\text{CH}}_j}^L}\right)f\left({\text{ID}}_{{\text{CH}}_j}^L\right)\mathrm{mod}\hspace{0.17em}Q,\\ S_{C_{\text{in}}}^l={\displaystyle \sum }_{j=\mathrm{1}}^t\left(\coprod _{l\ne j}\frac{{\text{ID}}_{{\text{CH}}_j}^L}{{\text{ID}}_{{\text{CH}}_j}^L-{\text{ID}}_{{\text{CH}}_l}^L}\right)f\left({\text{ID}}_{{\text{CH}}_j}^L\right)\mathrm{mod}Q.\end{array}$$

(7)

(2)

Using $Z_{C_{\text{in}}}^l$ and $S_{C_{\text{in}}}^l$ , users can get the secret $K^l=Z_{C_{\text{in}}}^l-S_{C_{\text{in}}}^l$ .

4.4. Cluster Key Management

In this phase, the protocol establishes the cluster key between CH and members. Similar to the network key, the cluster key can be generated as follows.

(1) Firstly, cluster head chooses $x_{{\text{ch}}_i}^l\hspace{0.17em}\hspace{0.17em}(x_{{\text{ch}}_i}^l\in [\mathrm{2},N])$ randomly which relatively primes with $p-1$ and $q-1$ , and CH sends it to BS. Then, BS counts out $y_{{\text{ch}}_i}^l=g^{x_{{\text{ch}}_i}^l}$ and sends $({\text{ID}}_{{\text{CH}}_i}^l,y_{{\text{CH}}_i}^l)$ to sensor node in cluster ${\text{CH}}_i$ ; meanwhile, sensor node picks $x_{i,r}^l$ randomly which relatively primes with $p-\mathrm{1}$ and $q-\mathrm{1}$ , computes $y_{i,r}^l=g^{x_{i,r}^l}\mathrm{mod}N$ , and then sends $({\text{ID}}_{i,r}^l,y_{i,r}^l)\hspace{0.17em}\hspace{0.17em}(i=\mathrm{1},\dots ,m-\mathrm{1},r=\mathrm{1},\dots ,k)$ to the BS. The BS ensures that if ${\text{ID}}_{i,r}^l\ne {\text{ID}}_{i,z}^l$ , there should be no $y_{i,r}^l=y_{i,z}^l$ ; otherwise it reselects until success.

Furthermore, the BS utilizes CH's ${\text{ID}}_{{\text{CH}}_i}^l$ and members' ${\text{ID}}_{i,r}^l\hspace{0.17em}\hspace{0.17em}(r=\mathrm{1},\dots ,k)$ to count out the share $f_{{\text{CH}}_i}^l({\text{ID}}_{{\text{CH}}_i}^l)$ and $f_{{\text{CH}}_i}^l({\text{ID}}_{i,r}^l)$ , respectively.

(2) Given that R indicates the set of revoked sensors during the session period l and before, let $R=R_{\mathrm{2}}\cup \cdots \cup R_{l-\mathrm{1}}\cup R_l$ , where $|R|\le t$ . During session l, the CH selects a group of users $V_l=\{{\text{ID}}_{i,\mathrm{1}}^l,\dots ,{\text{ID}}_{i,k}^l\}$ , where ${\text{ID}}_R\subseteq V_l$ and ${\text{ID}}_R\cap V_l=\varnothing$ , while BS unicasts $({\text{ID}}_{{\text{CH}}_i}^l,f_{{\text{CH}}_i}^l({\text{ID}}_{{\text{CH}}_i}^l)·(y_{{i,r}_{}}^l{)}^{x_{{\text{ch}}_i}^l}\mathrm{mod}N)$ to sensor node in ${\text{CH}}_i$ and sends $({\text{ID}}_{i,r}^l,f_{{\text{CH}}_i}^l({\text{ID}}_{i,r}^l)·(y_{{\text{CH}}_i}^l{)}^{x_{i,r}^l}\mathrm{mod}N)$ to ${\text{CH}}_i$ .

(3) Then, BS independently selects M session keys $\{K^l{\}}_{l=\mathrm{1},\dots ,M}$ from $\text{GF}(Q)$ , in finite field Q, hiding the $K^l$ : $Z_{{\text{CH}}_i}^l={\{K^l+S_{{\text{CH}}_i}^l\}}_{l=\mathrm{1},\dots ,M;\hspace{0.17em}i=\mathrm{1},\dots ,m}$ with the secret $S_{{\text{CH}}_i}^l$ . The purpose is not to leak the $K^l$ . The cluster key process is shown in Figure 5.

Figure 5

The cluster key process.

4.5. Secret Recovery

Depending on the received information from base station, public generator, node's private key $x_{i,r}^l$ , and cluster node's own key $x_{{\text{ch}}_i}^l$ , cluster head and members can obtain their share through the following formulas:

$$\begin{array}{cc}& \frac{f_{{\text{CH}}_i}^l\left({\text{ID}}_{{\text{CH}}_i}^l\right)·{\left(y_{{i,r}_{}}^l\right)}^{x_{{\text{ch}}_i}^l}}{{\left(y_{{\text{ch}}_i}^l\right)}^{x_{{i,r}_{}}^l}}=f_{{\text{CH}}_i}^l\left({\text{ID}}_{{\text{CH}}_i}^l\right),\\ \frac{f_{{\text{CH}}_i}^l\left({\text{ID}}_{i,r}^l\right)·{\left(y_{{\text{ch}}_i}^l\right)}^{x_{i,r}^l}}{{\left(y_{i,r}^l\right)}^{x_{{\text{ch}}_i}^l}}=f_{{\text{CH}}_i}^l\left({\text{ID}}_{i,r}^l\right).\end{array}$$

(8)

$f_{{\text{CH}}_i}^l({\text{ID}}_{{\text{CH}}_i}^l)·(y_{{\hspace{0.17em}\hspace{0.17em}}_{i,r}}^l{)}^{x_{{\text{ch}}_i}^l},\hspace{0.17em}\hspace{0.17em}{f}_{{\text{CH}}_i}^l({\text{ID}}_{i,r}^l)·(y_{{\text{ch}}_i}^l{)}^{x_{i,r}^l}$ is broadcast information; $y_{i,r}^l$ and $y_{{\text{ch}}_i}^l$ are public information. So cluster head and common nodes can obtain their own shares, respectively, and then members send $({\text{ID}}_{i,r}^l,f_{{\text{CH}}_i}^l({\text{ID}}_{i,r}^l))$ to CH. CH uses $({\text{ID}}_{{\text{CH}}_i}^l,f_{{\text{CH}}_i}^l(D_{{\text{CH}}_i}^l))$ and $t-\mathrm{1}$ sensors' $({\text{ID}}_{i,r}^l,f_{{\text{CH}}_i}^l({\text{ID}}_{i,r}^l))$ to recover the secret S. According to (7), we can carry $S_{{\text{CH}}_i}^l$ out. Furthermore, CH can get $Z_{{\text{CH}}_i}^l=K^l+S_{{\text{CH}}_i}^l$ , and then we can calculate $K^l$ to unicast $K^l$ to $t-\mathrm{1}$ sensors $({\text{ID}}_{i,r}^l,K^l)$ .

4.6. Scalability

In our solution, we also consider the scalability of network.

4.6.1. New Member Join

When a new member $P_u\hspace{0.17em}\hspace{0.17em}(u\ne \mathrm{1},\dots ,n)$ wants to join during session period l, $P_u$ should randomly choose an integer $x_u\hspace{0.17em}\hspace{0.17em}(x_u\in [\mathrm{2},N])$ and count out $y_u=g^{x_u}\mathrm{mod}N$ . And then, $P_u$ keeps $x_u$ secretly and chooses randomly an ${\text{ID}}_u\hspace{0.17em}\hspace{0.17em}({\text{ID}}_u>n)$ ; n is the largest node identity in network, and then sends $({\text{ID}}_u,y_u)$ to the BS. The BS will authenticate $P_u$ . If ${\text{ID}}_u>N$ and $P_i\hspace{0.17em}\hspace{0.17em}(i=\mathrm{1},\dots ,N)$ and $y_i\ne y_u$ , then $P_u$ is acceptable and can join the network.

4.6.2. Node Isolation

Once CH or neighbor nodes find a compromised node $P_h$ , the CH sends its information ${\text{ID}}_h$ to BS. Meanwhile, BS and CH add their IDs into $R:\{R\}\cup \{{\text{ID}}_h\}$ .

5. Security Analyses

Due to the unreliable wireless environment, dynamic clustering cluster key distribution scheme is subject to a variety of attacks, such as eavesdropping, tampering, and replay attacks. Compared to previous works, the salient advantage of our solution is that we addressed challenging runtime security issues using localizing key things and group key management based on secret sharing mechanism.

5.1. Robustness

In the recovery phase, for any user $P_i\in P$ , if anyone wants to recover $K^l$ , they must obtain both $Z_{{\text{CH}}_i}^l$ and $S_{{\text{CH}}_i}^l$ , which makes it very difficult to recover keys.

Furthermore, assume that any set $F\subseteq P$ and $|F|\le t-\mathrm{1}$ , if an unrevoked user $P_i\in F$ , any other user collusions in F cannot get information about the $P_i$ 's personal secret $S_i$ . Because in each session l, user $P_i$ 's secret $S_i^l=f_{{\text{CH}}_i}^l(\mathrm{0})$ or $S_i^l=f_{C_{\text{in}}}^l(\mathrm{0})$ is $t-\mathrm{1}$ degree polynomial $f_{{\text{CH}}_i}^l(x)$ or $f_{C_{\text{in}}}^l(x)$ , the users in F only know $t-1$ values about $f_{{\text{CH}}_i}^l(x)$ or $f_{C_{\text{in}}}^l(x)$ . And the difficulty to reconstruct a polynomial $f_{{\text{CH}}_i}^l(x)$ or $f_{C_{\text{in}}}^l(x)$ by $t-\mathrm{1}$ values is equivalent to breaking a Shamir's $(t,n)$ secret sharing problem, which is not feasible in computation. Therefore, user collusions in F have no ability to obtain user $P_i$ 's secret $S_i^l$ .

Moreover, because the cluster session key $K^l$ is selected from a uniform distribution, and independent of the user's personal secret, no one can obtain information about the session key $K^l$ separated from personal secret collection. Also, in each session $l=\mathrm{1},\dots ,M$ , because of $Z_{{\text{CH}}_i}^l=K^l+S_{{\text{CH}}_i}^l$ , $Z_{{\text{CH}}_i}^l$ hides session key $K^l$ with personal secret $S_{{\text{CH}}_i}^l$ , and adversary has no ability to obtain any useful information just from the collection of broadcast messages.

5.2. Tolerance

The normal user $P_i\notin R$ (unrevoked user or normal node) can utilize the broadcast messages and private secret to recover the session key $K^l$ ; however, the revoked user can only obtain $t-1$ values from the broadcasted polynomial $f^l(x)$ ; thus, they have no ability to reconstruct $t-\mathrm{1}$ degree polynomial $f^l(x)$ as mentioned above. Therefore, the user in R cannot get $f^l(\mathrm{0})$ . Moreover, because of $K^l=Z_{{\text{CH}}_i}^l-f^l(\mathrm{0})$ , it is not feasible to recover personal secret $K^l$ by $Z_{{\text{CH}}_i}^l$ and ${S_{r\{p_r\in R\}}}_{}$ .

5.3. Security

Our solution also has both $t-1$ forward secrecy and $t-1$ backward secrecy.

5.3.1. $t\mathbf{-}1$   Forward Secrecy

Let $R\subseteq P$ , $|R|\le t-\mathrm{1}$ , and each $P_i\in R$ is a revoked user before session l. Even if user collusions know all cluster keys before the session l, they cannot obtain any information of current session key $K^l$ , because they cannot recover $f^l(\mathrm{0})$ with just $t-1$ values of $f^l(x)$ . Therefore, the solution is $t-1$ forward secrecy.

5.3.2. $t\mathbf{-}1$   Backward Secrecy

Let $J\subset P$ , $|J|\le t-\mathrm{1}$ . Each user $P_i\in J$ joined the group before session l. Even if user collusions in J know all cluster keys $K^l$ before the session l, they cannot obtain any information of current session key $K^{l_{\mathrm{1}}}\hspace{0.17em}(l_{\mathrm{1}}<l)$ . Because if a user wants to get $K^{l_{\mathrm{1}}}$ , the user $P_i\in J$ at least recovers t points of $f^{l_{\mathrm{1}}}(x)$ for $f^{l_{\mathrm{1}}}(\mathrm{0})$ . However, each user $P_i$ after session J at least obtains $t-\mathrm{1}$ value from $t-1$ degree $f^{l_{\mathrm{1}}}(x)$ and has no ability to reconstruct $f^{l_{\mathrm{1}}}(x)$ ; that is, the solution is $t-1$ backward secrecy.

5.4. Complexity Analysis

In this section, we discuss the complexity of our scheme from computation complexity, communication complexity, and storage cost needed by common node and cluster.

• (1)

Computation complexity: we assume that base station has a large computation capacity, the pickout of polynomial and share distribution as well as the choice of generator. Common node only needs to compute division, and cluster head needs to reconstruct the polynomial beside division.

(2)

Communication costs include the broadcast cost: $j(\text{lo}{\text{g}}^q)$ and download the publishing information from publish board: $t*j*(\text{lo}{\text{g}}^q)$ , where t indicates a session period; j is the number of nodes in one cluster, and q is an enough secure prime.

(3)

Storage cost: in our scheme, we only need to save a private respective key, which is $\text{lo}{\text{g}}^q$ .

6. Conclusion and Future Work

In this paper, we propose a secret sharing-based key management scheme (SSKM) to enhance network security and survivability. Different from previous works, although we employ the hierarchical architecture, we limited the size of clusters to balance the overall energy consumption of the network. In contrast to other clustered architectural security solutions, the salient advantage of this work is that we addressed challenging security issues by localizing key things based on secret sharing theory. We present the network key and cluster key and generate new keys from various polynomials by Lagrange interpolation formula. Also, we present a rekey mechanism in the cluster head selection with low energy consumption. Meanwhile, SSKM has an authentication mechanism to ensure the scalability, which cannot only authenticate the new sensor but also can isolate the compromised node. The security analysis shows that our solution cannot only reduce the energy consumption effectively but also enhance the security level. In the future, we will focus on how to enhance security in mobile and scalable WSNs.