An Efficient Confidentiality and Integrity Preserving Aggregation Protocol in Wireless Sensor Networks

Abstract

Wireless sensor networks (WSNs) are composed of sensor nodes with limited energy which is difficult to replenish. In-network data aggregation is the main solution to minimize energy consumption and maximize network lifetime by reducing communication overhead. However, performing data aggregation while preserving data confidentiality and integrity is challenging, because adversaries can eavesdrop and modify the aggregation results easily by compromised aggregation nodes. In this paper, we propose an efficient confidentiality and integrity preserving aggregation protocol (ECIPAP) based on homomorphic encryption and result-checking mechanism. We also implement ECIPAP on SimpleWSN nodes running TinyOS. Security and performance analysis show that our protocol is quite efficient while persevering both aggregation confidentiality and integrity.

1. Introduction

Wireless sensor networks consist of a large number of sensor nodes which can be deployed to sense, transmit, and process the data collected from the environment in many applications such as battlefield surveillance, health care monitoring, and traffic regulation. The environment data will be transmitted to the base station (BS) hop by hop. Sensor nodes have limited energy storage and their computational ability is not so powerful as base station. We cannot supply energy to the nodes at all times because they are usually deployed in the areas humans hardly reach. If some key nodes cannot work as we supposed, the whole network will break down. The energy of the node is mainly spent on data transmission. On TelosB nodes, sending and receiving one bit data cost 0.72 μJ and 0.81 μJ which are more than 600 times than 1.2 nJ cost on processing one instruction by processor [1]. Therefore, how to reduce communication overhead is the key issue to prolong the life of wireless sensor networks [2, 3].

Other than transmitting data directly to the base station, wireless sensor nodes can perform aggregation operations, such as SUM and AVERAGE, on aggregation nodes. Through this approach, the communication overhead will be reduced largely. An aggregation tree should be built before data aggregation. The topology can be tree-based or cluster-based depending on the applications. Then the sensors need to collect environment data from the monitoring area and transmit the data to the bases station hop by hop. When the intermediate nodes receive the data from their child nodes, they aggregate them using aggregation functions.

Sensor nodes should be deployed in the hostile areas in some applications, such as battlefield surveillance and target tracking. If these data was leaked to the enemies, it would bring heavy losses. The adversaries can contact the physical nodes easily and they can tamper the original sensing data so that the base station will receive the false aggregation results. If the base station cannot receive the true data, it will make wrong decisions. Some other attacks also affect the aggregation process like denial of service (DoS) or data selective forwarding. General data aggregation protocols do not consider these attacks, so they are useless in military applications. Designing a data aggregation protocol should take security into consideration. All above, secure data aggregation mandates three security factors.

1.1. Data Confidentiality

The original sensing data and the intermediate aggregation results should not be disclosed to the unauthorized parties during the transmission process.

1.2. Data Integrity

If the original sensing data or the intermediate aggregation results were tampered by the adversaries or modified due to the poor quality of communications, the base station can detect the changes from final aggregation results.

1.3. Data Freshness

Sensing data received by the base station should represent the very recent state of the environment. If the aggregation values are too old, base station should discard such results.

Researchers have proposed many data aggregation protocols which can provide some secure protections. Most protocols can only provide confidentiality protection [4, 5] or integrity protection [6, 7]. Some protocols claim that they can protect both data confidentiality and data integrity, but some problems still exist. Data must be transmitted in some special forms if data integrity needs to be protected. But data form may be changed when some encryption algorithms are used to protect data confidentiality. They are contradictory in a way. Designing a data aggregation protocol which can provide both data confidentiality and data integrity is a challenge.

In this paper, we propose an efficient confidentiality and integrity preserving aggregation protocol (ECIPAP) in wireless sensor networks motivated by protocols SIES [8] and SHIA [9]. Our scheme is based on a lightweight homomorphic encryption which is energy efficient. Through the result-checking phase, every node in the wireless sensor network can verify if its data was added to the final aggregation results. We use a random number dissemination mechanism to update the keys stored in sensor nodes so as to guarantee the data freshness against replay attacks. This protocol also uses μTESLA [10] to broadcast authenticated queries along with the random numbers. We implement our protocol on TelosB physical nodes. Through the results of the experiment and the theoretic analysis, we will show the practicability and high efficiency of our protocol.

The paper is organized as follows. In Section 2, we introduce the related work in this research area. Section 3 explains the system model in our protocol. Section 4 describes our protocol in detail. Section 5 analyses the security, experiment, and performance of ECIPAP. We conclude this paper in Section 6.

2. Related Work

Hu and Evan proposed the first integrity-preserving hierarchy data aggregation protocol in 2003 [11]. The main idea of this protocol is delayed aggregation and delayed authentication. Girao et al. proposed an aggregation scheme that can guarantee the end-to-end data confidentiality using symmetric key based homomorphic encryption [12]. After that, a series of secure data aggregation protocols have been proposed. Existing protocols, which claim that they can protect both data confidentiality and data integrity, have some potential risks. Generally, we can think that both confidentiality and integrity preserving protocols should satisfy the following conditions.

• (i)

The encrypted sensing data should only be decrypted at the base station but not on the intermediate nodes thus to implement end-to-end confidentiality.

(ii)

If the adversaries tamper the sensing data, base station can verify the data integrity through checking the final aggregation results.

(iii)

The energy consumption should be reasonable because of the limited energy in each node.

The protocols proposed in [13–16] use pair keys to encrypt the data transmitted between two nodes based on the existing integrity-preserving data aggregation protocols. These protocols achieve hop by hop confidentiality but not end-to-end confidentiality. Based on a confidentiality protection mechanism, paper [17] provides data integrity protection through using a global key $k^{(r)}$ and a key $k^{(r)\prime }$ shared with the base station to compute the authenticated message $m_i{k}^{(r)}+k^{(r)\prime }$ of message $m_i$ . This protocol is not secure if an adversary compromises a node and gets the global key $k^{(r)}$ , using which the adversary can forge message as wished. Protocol in [18] uses EC-ElGamal to achieve confidentiality protection. It also uses a global key k and the node's private key $z_i$ to compute the signature of message $m_i$ . However, through compromising a sensor node the adversary can get k which can be used to tamper the cipher and compute the corresponding signature. Paper [19] proposed a protocol that can protect the data confidentiality. Meanwhile, this protocol also can protect the aggregation data sent by cluster header from being tampered. But adversary can compromise a node and get the public key of the cluster; then the aggregation data can be tampered freely.

Chan et al. presented a provable secure tree-based in-network data aggregation protocol named SHIA [9]. Without assuming a particular data structure, SHIA can detect any manipulation of the in-network aggregation. SHIA has three phases: query dissemination phase, aggregation-commit phase, and result-checking phase. After the queries were broadcast to the whole network, sensor nodes send their environment data and commitment upward. In the result-checking phase, associated off-path values would be passed down to the aggregation tree. Through this way, sensor nodes can verify if their data was indeed added to the final aggregation results. After node i is convinced, it will send an authentication message $\text{MAC}(K_i,N\hspace{0.17em}\parallel \hspace{0.17em}\text{OK})$ , where $\text{OK}$ is a unique identifier and $K_i$ is the key shared with base station, to base station hop by hop. The intermediate nodes perform XOR on these authentication messages and the final result received by base station is $\text{MAC}(K_{\mathrm{1}},N\hspace{0.17em}\parallel \hspace{0.17em}\text{OK})\oplus \cdots \oplus \text{MAC}(K_n,N\hspace{0.17em}\parallel \hspace{0.17em}\text{OK})$ . Base station computes this message itself and compares it with the authentication message received. If two messages match, base station accepts the aggregation result. Otherwise, the result will be ignored. Although this protocol can protect data integrity, the data confidentiality is not guaranteed.

Combining homomorphic encryption and secret sharing, Papadopoulos et al. proposed a secure data aggregation protocol SIES which can protect both data confidentiality and data integrity [8]. In this protocol, each sensor node has a secret message ${\text{ss}}_i$ , a global key K, and a private key $k_i$ shared with base station. After the environment data $v_i$ was sensed from monitoring area, each sensor node generates a message $m_i=v_i\hspace{0.17em}\parallel \hspace{0.17em}{\text{ss}}_i$ . Sensor nodes use homomorphic encryption to encrypt $m_i$ and send them to their parent nodes. The parent nodes can perform aggregation functions on the encrypted data directly. When the final aggregation result is received by the base station, it will be decrypted and divided into two parts: environment data V and secret $\text{SS}$ . Base station computes the $\text{SS}$ itself and compares it with the secret received. This protocol also has a problem that if the data $v_i$ of the message $m_i$ was tampered by adversaries, base station cannot detect such changes.

Our protocol improves SIES [8] by using result-checking mechanism motivated by SHIA [9] to protect data integrity instead of secret sharing. We also use homomorphic encryption to allow intermediate nodes perform aggregation directly so as to achieve end-to-end data confidentiality. When the final aggregating result was sent to the base station, the result-checking process will detect whether all the data is added to the final aggregation result.

3. System Model

Different secure data aggregation protocols support different aggregation functions. The security protection abilities are also various and the adversaries can launch a variety of attacks. This section gives the general problem definition, network assumption, and attack model in detail.

3.1. Network Assumption

We assume that an aggregation tree is already set up in the deployment phase. If not ready, TAG [20] can be used to build such tree-based networks. In our protocol, base station BS has unlimited energy and computing ability. BS can broadcast query messages to the whole network using authenticated method μTESLA [10]. In the aggregation tree, there are two types of nodes, leaf nodes and the intermediate nodes. Leaf nodes only sense environment data and encrypt them, while intermediate nodes not only sense environment data but also aggregate their child nodes' data. The distance between two nodes is about 10 m and nodes can only communicate with its child nodes or parent nodes.

Each sensor node has a unique ID and an initial key $k_i$ . We further assume that sensor nodes can perform symmetric additively homomorphic encryption and collision-resistant hash function.

3.2. Problem Definition

In our protocol, we use an efficient symmetric additively homomorphic encryption algorithm. A key distribution mechanism is also used to generate the keys in each sensor node.

3.2.1. Homomorphic Encryption

As shown in Algorithm 1, M is a large integer. Let $m(m\in [\mathrm{0},M])$ be the message that needs to be encrypted, and $k(k\in [\mathrm{0},M])$ is the initial key stored in every node before deployment. Parameter r is the random number sent by base station and H is the hash function.

Algorithm 1: Homomorphic encryption algorithm.

(i) Key Generation:

  Round key $k_r=H(k,r)$ mod M

(ii) Encryption:

  Ciphertext $c=\text{Enc}(m,k_r,M)$

         $=(m+k_r)$ mod M

(iii) Decryption:

   $m=$ $\text{Dec}(c,k_r,M)=(c-k_r)$ mod M

(iv) Addition:

   $c_i=\text{Enc}(m_i,k_{i,r},M)$

   $c_j=\text{Enc}(m_j,k_{j,r},M)$

   $c=(c_i+c_j)$ mod M

   $m_i+m_j=\text{Dec}(c_i+c_j,k_{i,r}+k_{j,r},M)$

3.2.2. Message Format

The message m sent by sensor node has a fixed format which is a data tuple:

$$\begin{array}{cc}& 〈\text{count},\text{value},\overline{\text{value}},\text{MAC}〉,\end{array}$$

(1)

where count is the number of the sensor nodes in the subtree. If a sensor node is the leaf node, then $\text{count}=\mathrm{1}$ . Parament value is the environment data and it has lower bound $V_{\min }$ and upper bound $V_{\max }$ . We also add $\overline{\text{value}}=V_{\max }-\text{value}$ to this data tuple. $\text{MAC}$ can be computed as follows:

$$\begin{array}{cc}& \text{MAC}=H\left(\text{count}\hspace{0.17em}\parallel \hspace{0.17em}\text{value}\hspace{0.17em}\parallel \hspace{0.17em}\overline{\text{value}}\hspace{0.17em}\parallel \hspace{0.17em}{\text{ID}}_i\right),\end{array}$$

(2)

where ${\text{ID}}_i$ is node's unique ID.

3.2.3. Aggregation Function

An intermediate node i has n child nodes $s_{\mathrm{1}},s_{\mathrm{2}},\dots ,s_n$ . Let $v_{\mathrm{1}},v_{\mathrm{2}},\dots ,v_n$ be the data sensed by these child nodes from the monitory area. We define aggregation function $F_{\text{agg}}$ that can be performed on intermediate nodes as shown in Algorithm 2.

Algorithm 2: Aggregation functions.

(i) Count Function:

   $F_{\text{count}}={{\displaystyle \sum }}_{i=\mathrm{1}}^n\mathrm{‍}{m}_i·\text{count}$

(ii) Sum Function:

   $F_{\text{sum}}=〈{{\displaystyle \sum }}_{i=\mathrm{1}}^n\mathrm{‍}{m}_i·\text{value},{{\displaystyle \sum }}_{i=\mathrm{1}}^n\mathrm{‍}{m}_i·\overline{\text{value}}〉$

(iii) Average Function:

   $F_{\text{average}}=〈\frac{{{\displaystyle \sum }}_{i=\mathrm{1}}^n\mathrm{‍}{m}_i·\text{value}}{{{\displaystyle \sum }}_{i=\mathrm{1}}^n\mathrm{‍}{m}_i·\text{count}},\frac{{{\displaystyle \sum }}_{i=\mathrm{1}}^n\mathrm{‍}{m}_i·\overline{\text{value}}}{{{\displaystyle \sum }}_{i=\mathrm{1}}^n\mathrm{‍}{m}_i·\text{count}}〉$

(iv) MAC Aggregation:

   $F_{\text{MAC}}={⨁}_{i=\mathrm{1}}^n{m}_i·\text{MAC}$

3.3. Attack Model

The most threatening attack against data aggregation in wireless sensor networks is node compromising launched by the adversaries. Through this attack, adversaries can obtain the keys of the nodes. After that, they can use fake messages to disturb the final aggregation results. Such stealthy attacks [12] can make base station accept the false aggregation results without being detected. We assume that the adversaries can compromise a fraction of sensor nodes in the network.

Denial-of-service attack is out of our consideration, because this type of attack can be detected easily by the base station when the network works improperly.

4. ECIPAP

We improve SIES [8] by using result-checking mechanism instead of secret sharing. Then we propose an efficient confidentiality and integrity preserving aggregation protocol (ECIPAP). The homomorphic encryption used in our protocol can guarantee end-to-end data confidentiality. Our protocol has three phases: query dissemination phase, data aggregation phase, and result-checking phase.

4.1. Network Deployment

Before the sensor nodes were deployed in the monitory area, each sensor node shared a private key $k_i$ , a large integer M, and a unique ${\text{ID}}_i$ with the base station. The symmetric additively homomorphic encryption algorithm and hash function SHA-1 are also preset. When the aggregation process begins, we assume that the aggregation tree is already set up. We can use TAG [20] to form an aggregation tree.

4.2. Query Dissemination Phase

In each aggregation round, base station $\text{BS}$ chooses a random number r and the query message such as COUNT, SUM, and AVERAGE. Due to its powerful communication ability, it can broadcast this query message to the whole network along with the random number r. When the nodes receive the query messages, they store them in the RAMs and start the data aggregation phase.

4.3. Data Aggregation Phase

Sensor node collects environment data $\text{value}\in [V_{\min },V_{\max }]$ such as temperature and sets $\overline{\text{value}}=V_{\max }-v$ , $\text{count}=\mathrm{1}$ . Next it generates the temporary keys $k_{i,r}$ , $k_{i,r}^{\prime }$ , and $k_{i,r}^{\mathrm{\prime \prime }}$ :

$$\begin{array}{cc}& k_{i,r}=H\left(k_i,r\right)\mathrm{mod}M,\\ k_{i,r}^{\prime }=H\left(k_i,r+\mathrm{1}\right)\mathrm{mod}M,\\ k_{i,r}^{\mathrm{\prime \prime }}=H\left(k_i,r+\mathrm{2}\right)\mathrm{mod}M.\end{array}$$

(3)

Then it encrypts these data as follows:

$$\begin{array}{cc}& c_{\text{count},i}=\text{Enc}\left(\text{count},k_{i,r},M\right),\\ c_{\text{value},i}=\text{Enc}\left(\text{value},k_{i,r}^{\prime },M\right),\\ c_{\overline{\text{value}},i}=\text{Enc}\left(\overline{\text{value}},k_{i,r}^{\mathrm{\prime \prime }},M\right).\end{array}$$

(4)

The reason why we use different keys to encrypt count, value, and $\overline{\text{value}}$ will be shown latter. Sensor nodes can compute message authentication code as follows:

$$\begin{array}{cc}& {\text{MAC}}_i=H\left(c_{\text{count},i}\hspace{0.17em}\parallel \hspace{0.17em}{c}_{\text{value},i}\hspace{0.17em}\parallel \hspace{0.17em}{c}_{\overline{\text{value}},i}\hspace{0.17em}\parallel \hspace{0.17em}{\text{ID}}_i\right).\end{array}$$

(5)

The data tuple can be created now as

$$\begin{array}{cc}& u_i=〈c_{\text{count},i},c_{\text{value},i},c_{\overline{\text{value}},i},{\text{MAC}}_i〉.\end{array}$$

(6)

When the nodes prepare the data tuples ready, they send them to their parent nodes. We show the aggregation process in Figure 1. There are $N=\mathrm{10}$ nodes in the network and node F has two child nodes I and J. When node F receives the data tuples $u_i$ and $u_j$ sent by node I and node J, it aggregates them with the data tuple $u_f$ created by itself: $U_f=F_{\text{agg}}(u_i,u_j,u_f)$ . Node F sends this intermediate aggregation result to its parent node C. The final aggregation result will be transmitted to the base station BS at last. BS can decrypt this aggregation result as follows:

$$\begin{array}{cc}& {\text{count}}_{\text{agg}}=\text{Dec}\left(U_a·\text{count},{\displaystyle \sum }_{i=\mathrm{1}}^n{k}_{i,r},M\right),\\ {\text{value}}_{\text{agg}}=\text{Dec}\left(U_a·\text{value},{\displaystyle \sum }_{i=\mathrm{1}}^n{k}_{i,r}^{\prime },M\right),\\ {\overline{\text{value}}}_{\text{agg}}=\text{Dec}\left(U_a·\overline{\text{value}},{\displaystyle \sum }_{i=\mathrm{1}}^n{k}_{i,r}^{\mathrm{\prime \prime }},M\right).\end{array}$$

(7)

The base station BS can also get the MAC_agg:

$$\begin{array}{cc}& {\text{MAC}}_{\text{agg}}={{\displaystyle ⨁}}_{i=\mathrm{1}}^n{m}_i·\text{MAC}.\end{array}$$

(8)

Figure 1

Data aggregation phase in ECIPAP.

4.4. Result-Checking Phase

When the final aggregation result is received, base station broadcasts the aggregated data tuple down to the whole network using authenticated method. To enable result checking, each sensor node will send a checking message to its child node. We can regard the result checking as a reverse process of data aggregation. We show this in Figure 2. Base station sends the final data tuple $U_a^{\prime }$ to node A. Then node A can remove the data sent by nodes B, C, and D from $U_a^{\prime }$ . We define the reverse computational operation as ⊖. For example, we can get data tuple created by node A as $u_a^{\prime }=U_a^{\prime }\ominus u_b\ominus U_c\ominus u_d$ . Through comparing $u_a^{\prime }$ with the data tuple $u_a$ created by node A, node A can verify if its data was added to the final aggregation result.

Figure 2

Result-checking phase in ECIPAP.

Every sensor node can verify if its own data was added to the aggregation data by comparing its own data to the data sent by parent nodes. If the result passes the verification, then every sensor node prepares an authentication message $\text{MAC}(k_i\hspace{0.17em}\parallel \hspace{0.17em}r\parallel \hspace{0.17em}\text{OK})$ and sends it to the base station hop by hop. If verification is failed, $\text{MAC}(k_i\hspace{0.17em}\parallel \hspace{0.17em}r\parallel \hspace{0.17em}\text{NO})$ will be sent. When the intermediate sensor nodes receive these authentication messages, they aggregate them using MAC Aggregation Function. The base station also can calculate this authentication message with its own data stored before network deployment. So comparing these two authentication messages can verify if all the sensing data is added to the final aggregation result. If the authentication message passes the verification, then base station accepts this aggregation result. Otherwise, base station just ignores it.

5. Analysis

5.1. Security Analysis

Adversaries can compromise a fraction of sensor nodes in the wireless sensor network. When a sensor node is compromised, its private information such as encryption keys will be leaked. Adversaries can sniff confidential data sent by the sensor nodes. They can launch stealthy attack to make the base station accept false data without being detected.

We assume the adversaries can eavesdrop messages sent between sensor nodes and they already know the range of sensing data. If we use the same key to encrypt both value and $\overline{\text{value}}$ , the adversaries can get the original sensing data through algebraic operation, such as ${\text{value}}_i=(c_{\text{value},i}-c_{\overline{\text{value}},i}+V_{\max })/\mathrm{2}$ . Because we use different keys $k_{i,r}$ , $k_{i,r}^{\prime }$ , and $k_{i,r}^{\mathrm{\prime \prime }}$ to encrypt count, value, and $\overline{\text{value}}$ in ECIPAP, data confidentiality can be protected.

Authors in [9] define the direct data injection and optimally secure as follows.

5.1.1. Direct Data Injection

A direct data injection attack occurs when an adversary modifies the data readings reported by the nodes under its direct control, under the constraint that only legal readings in [ $V_{\min }$ , $V_{\max }$ ] are reported.

5.1.2. Optimally Secure

An aggregation algorithm is optimally secure if, by tampering with the aggregation process, an adversary is unable to induce the base station to accept any aggregation result which is not already achievable by direct data injection.

The message format in our protocol is the same as the message format $〈$ vount, value, complement, commitment $〉$ used in SHIA [9]. Adversaries can compromise some nodes and set all their readings to $V_{\min }$ or $V_{\max }$ so that the final aggregation result is in the range [ $\mu V_{\min }$ , $\mu V_{\max }$ ] where μ is the number of malicious nodes. Obviously, any aggregation result between these two bounds can be achieved by direct data injection. Hence, our ECIPAP is optimally secure.

5.2. Experiment Analysis

We have implemented ECIPAP using SimpleWSN experimental platform to sense average temperature in lab. Characteristics of SimpleWSN nodes are shown in Table 1.

Table 1

Characteristics of simpleWSN nodes.

CPU 8-bit	8 MHz
Storage	10 Kbytes RAM
	48 Kbytes FLASH
Communication	2.4 GHz
Bandwidth	250 Kbps
Operating system	TinyOS 2.1

The temperature data DataNum sensed by SimpleWSN nodes are 16-bit hexadecimal integers. We can use the following formula to transform such data to readable Celsius degree:

$$\begin{array}{cc}& \text{Temperature}\left(\text{C}\right)=\frac{\left(\left(\text{DataNum}/\mathrm{4096}\right)*\mathrm{1.5}-\mathrm{0.98}\right)}{\mathrm{0.00355}}.\end{array}$$

(9)

Table 2 describes the parameters used in our experiment. We use sensor nodes to form an aggregation tree whose root is a powerful PC.

Table 2

Parameters used in experiment.

N	5	Total node number
r	$[\mathrm{1},{\mathrm{2}}^{\mathrm{16}}-\mathrm{1}]$	Random number
$k_{i,r},k_{i,r}^{\prime },k_{i,r}^{\prime \prime }$	$[\mathrm{0},{\mathrm{2}}^{\mathrm{32}}-\mathrm{1}]$	Encryption keys
count	$[\mathrm{0},{\mathrm{2}}^{\mathrm{8}}-\mathrm{1}]$	Aggregating count
value	$[\mathrm{0},{\mathrm{2}}^{\mathrm{16}}-\mathrm{1}]$	Aggregating value
$\overline{\text{value}}$	$[\mathrm{0},{\mathrm{2}}^{\mathrm{16}}-\mathrm{1}]$	$V_{\max }$ − $\text{value}$
${\text{MAC}}_i$	160 bit	SHA-1 output
M	${\mathrm{2}}^{\mathrm{32}}$	Large integer
$V_{\min }$	1000	Lower bound
$V_{\max }$	4000	Upper bound
$\text{OK/NO}$	1/0	Identifaction
t	1000 ms	Query period

Table 3 shows the data received by base station before decryption. The data in $\text{count}$ , $\text{value}$ , and $\overline{\text{value}}$ columns are encrypted. We know this environment data is larger than the upper bound $V_{\max }$ , so we cannot get any useful information from such messages.

Table 3

Encrypted aggregation results received by $\text{BS}$ .

count	value	$\overline{\text{value}}$	MAC
8A 9D A4 86	20 25 79 BE	16 09 0C C5	21 B9 95 E0 86 36 3D 1E F5 9C 06 12 70 BE B1 53 05 AE 81 D4
08 EF 90 17	04 98 E7 85	61 03 3E 1B	76 4A 9B 43 A9 74 5D CB 70 30 D5 D9 43 6E E9 93 29 1D 1B 2C
B9 84 48 53	25 0E 1A AE	6E AD 98 D8	DA 31 9E CA F6 04 A5 1F 21 4C 80 77 CF 75 E7 2B 9C 5A EB 65
A1 1E 78 01	02 A8 59 FD	AA 50 50 0E	35 E2 76 0A 08 EE DB 1E 80 D5 44 77 4A 78 8A 59 CE D9 A8 2F
E0 B1 ED 95	1F 13 C7 A4	B8 53 B3 3E	1B 49 94 BE B3 A0 0F B3 7D 27 56 33 77 11 B8 BE 48 87 34 4F
0D 15 51 8D	04 16 05 14	C8 66 EF C8	1E A4 2C 8B 99 1B 70 E2 BD C1 4C 6F 1B A5 84 34 0C 50 31 7A
36 A5 79 3F	0C CF 54 28	A4 21 21 74	EC 51 67 47 9E CA 90 FA 64 DF 80 25 19 C1 10 01 45 F7 9A 14

Then, we use the keys shared between sensor nodes and base station to decrypt the aggregation results and show them in Table 4. The total number of nodes used is 5 and the average temperature is about 23.2 degrees Celsius. Base station broadcasts query messages every 1000 million seconds. Our experiment shows the practicability and high efficiency of ECIPAP.

Table 4

The original environment data received by $\text{BS}$ after decryption.

count	value	$\overline{\text{value}}$	MAC
00 00 00 05	00 00 0B 55	00 00 15 77	74 21 49 83 DA ED D4 83 97 21 FA E7 AD 88 9F 58 FC C9 78 AA
00 00 00 05	00 00 0B 54	00 00 15 79	9C A6 75 EF 33 0C 88 9A 90 93 57 C4 73 12 F0 D0 52 6D 39 CE
00 00 00 05	00 00 0B 55	00 00 15 77	F1 37 76 9A 0F 43 66 CA 86 B0 92 34 CC 9A 75 50 25 E4 93 1C
00 00 00 05	00 00 0B 56	00 00 15 72	86 37 5C B3 CB EB C3 B6 2C 92 72 56 B7 46 A9 7C CD 76 6E 00
00 00 00 05	00 00 0B 55	00 00 15 75	DE B3 93 F6 98 E6 D1 E8 D9 D6 35 73 DD D1 34 B5 62 D7 8A A8
00 00 00 05	00 00 0B 55	00 00 15 76	5C AF 15 67 B6 28 5E F6 2F 5A A1 06 89 09 E3 D2 B6 CC C5 06
00 00 00 05	00 00 0B 55	00 00 15 75	98 1D 7E 47 B2 49 B0 96 DE B7 F1 BD EA 00 E0 39 6B AE CB E5

5.3. Performance Analysis

We give a theoretical analysis of the performance in this section. Through comparing the communication overhead between ECIPAP, SHIA, and SIES, we show that ECIPAP not only protect both data integrity and data confidentiality but also reduce the communication overhead in result-checking phase.

We assume every intermediate node in the network has d child nodes and the height of the aggregation tree is h. The length of the data tuple sent by sensor nodes in ECIPAP, SHIA, and SIES are $\left|m\right|$ , $\left|m^{\prime }\right|$ and $\left|m^{\mathrm{\prime \prime }}\right|$ . The length of the authentication messages, sent by sensor nodes in result-checking phase, are $\left|\text{MAC}\right|$ and $\left|{\text{MAC}}^{\prime }\right|$ in ECIPAP and SHIA. The number of nodes in the whole network is ${\sum }_{i=\mathrm{1}}^h‍d^i$ . So we can get the communication overhead of ECIPAP, SHIA, and SIES in Table 5.

Table 5

Communication overhead of ECIPAP, SHIA, and SIES.

	ECIPAP	SHIA	SIES
Edge congestion	$\left|m\right|$	$h\times (d-\mathrm{1})\times \left|m^{\prime }\right|$	$\left|m^{\prime \prime }\right|$
Node congestion	$d\times \left|m\right|$	$d\times h\times (d-\mathrm{1})\times \left|m^{\prime }\right|$	$d\times \left|m^{\prime \prime }\right|$
Data aggregation	${{\displaystyle \sum }}_{i=\mathrm{1}}^h\mathrm{‍}{d}^i\times \left|m\right|$	${{\displaystyle \sum }}_{i=\mathrm{1}}^h\mathrm{‍}{d}^i\times \left|m^{\prime }\right|$	${{\displaystyle \sum }}_{i=\mathrm{1}}^h\mathrm{‍}{d}^i\times \left|m^{\prime \prime }\right|$
Authentication	${{\displaystyle \sum }}_{i=\mathrm{1}}^h\mathrm{‍}{d}^i\times \left|m\right|$	${{\displaystyle \sum }}_{i=\mathrm{1}}^h\mathrm{‍}{d}^i\times (d-\mathrm{1})\times i\times \left|m^{\prime }\right|$	—
MAC transmission	${{\displaystyle \sum }}_{i=\mathrm{1}}^h\mathrm{‍}{d}^i\times \left|\text{MAC}\right|$	${{\displaystyle \sum }}_{i=\mathrm{1}}^h\mathrm{‍}{d}^i\times \left|{\text{MAC}}^{\prime }\right|$	—

In ECIPAP, we use 4-byte integers to present encrypted count, value, and $\overline{\text{value}}$ . Hash function SHA-1 outputs a 160-bit value. So we know $\left|m\right|=\mathrm{256}\hspace{0.17em}\text{bit}$ and $\left|\text{MAC}\right|=\mathrm{160}\hspace{0.17em}\text{bit}$ . Message length and MAC length in SHIA are the same as ECIPAP, so we can set $\left|m^{\prime }\right|=\mathrm{256}\hspace{0.17em}\text{bit}$ and $\left|{\text{MAC}}^{\prime }\right|=\mathrm{160}\hspace{0.17em}\text{bit}$ . The length of message in SIES is also $\mathrm{256}\hspace{0.17em}\text{bit}$ . The communication overhead in SHIA is mostly spent in authentication process. Our protocol can reduce such overhead largely as we present in Figure 3.

Figure 3

Communication overhead in authentication process when node degree $d=\mathrm{3}$ .

The total communication overhead reduces by 79% comparing with SHIA when $h=\mathrm{6}$ and $d=\mathrm{3}$ , shown in Figure 4. As the height of aggregation tree increases, the advantages of ECIPAP are more obvious. ECIPAP improves the secure ability of SIES with small communication overhead increase. Our protocol can work more efficiently in the applications where data should be transmitted along multihops.

Figure 4

Total communication overhead in ECIPAP, SHIA, and SIES when node degree $d=\mathrm{3}$ .

6. Conclusion

It is difficult to design an aggregation protocol to protect both data confidentiality and data integrity in wireless sensor networks. Existing protocols which claim to achieve this goal still have some problems. In this paper, we improve SIES by using result-checking mechanism instead of secret sharing. We also use homomorphic encryption algorithm to protect data end-to-end confidentiality. We concentrate on the communication overhead cost in the result-checking phase and propose an efficient confidentiality and integrity preserving aggregation protocol (ECIPAP). We implement our protocol on physical nodes running TinyOS. Through this experiment and theoretical analysis, we show the practicability and high efficiency of ECIPAP.