Secure Access Control Method for Wireless Sensor Networks

Abstract

Wireless sensor networks (WSNs) contain a large number of resource-constrained and energy-limited sensor nodes that are generally deployed in an open environment. Those sensor nodes communicate with each other or with a base station via wireless channels. Therefore, secure access control is an important issue in WSNs because sensor nodes are susceptible to various malicious attacks during the authentication and key establishment phase and the new node addition phase. In this study, we propose a new access control method based on elliptic curve cryptography and the chameleon hash function. This method addresses the security problems in the existing research. It also has additional advantages since it does not require time synchronization between communication nodes, nor does it require node verification tables. In addition to our proposal, the correctness, security, resistance to possible attacks, and the performance of the proposed method are analyzed and evaluated. The results of our study demonstrate that the proposed method has an outstanding performance and fulfills all the requirements for secure communication in WSNs.

1. Introduction

Wireless sensor networks (WSNs) consist of base stations and a large number of resource-constrained and energy-limited sensor nodes that are typically deployed in various environments. Since the base stations and sensor nodes communicate with each other via wireless channels [1], the WSN system is threatened by malicious security attacks.

In WSNs, after a prolonged period of operation, the power of some of the sensor nodes gets exhausted. This occurs due to uneven distribution of radio transmission load or damage caused by unpredictable events. The base station must dynamically add new nodes to the WSN to ensure the coverage and connectivity of sensor nodes. Following the addition of a node, the new node is authenticated by the neighboring nodes, and it establishes shared session keys with them for secure communication.

In order to attack or access communication information, malicious nodes may modify received messages, eavesdrop on transmission messages, insert false messages, or provide misleading information to legitimate sensor nodes. Therefore, access control security is a major concern in WSNs.

Zhou et al. [2] proposed an access control protocol to improve the performance of traditional public-key-based encryption protocols. This protocol was based on the elliptic curve. Each sensor node could sustain for a tolerable time interval before it was compromised, rendering the scheme unsuitable for certain practical applications. Huang [3] proposed an efficient access control protocol based on the elliptic curve and hash chains. This scheme could easily add new nodes and resist various attacks. Kim and Lee [4] proposed an enhanced access control protocol based on the scheme proposed by Huang. Their research indicated that the method proposed by Huang could not resist replay as well as active attacks. Further, it lacked hash chain renewability after the authentication and key establishment phase. In 2010, Shen et al. [5] and Zeng et al. [6] demonstrated that the scheme presented by Kim and Lee was vulnerable to masquerade attacks executed by new as well as legal nodes because it lacked hash chain renewability. In 2012, Lee et al. [7] proposed a practical access control scheme, still based on elliptic curve and hash chain. However, such a large number of key distribution schemes [2–7] are vulnerable to various adversary attacks and had huge storage overhead at the sensors node.

In 2013, Molavi et al. [8] use ECDLP method to solve security problem but still need time synchronization and had more compute time.

Our goal is to solve the problems mentioned above, and we propose a secure and flexible access control protocol. The idea of proposed scheme based on the chameleon hash function [9–12] and Diffie-Hellman key agreement. This proposed method can dynamically and securely add new nodes to the existing networks. Moreover, it overcomes the existing security problems and had a fewer number of transmissions and does not require time synchronization or the verification table.

The remainder of this paper is organized as follows. Section 2 describes the preliminary information relevant to our scheme, that is, the chameleon hash function based on the elliptic curve. In Section 3, the proposed scheme is introduced, followed by the correctness and performance analysis in Section 4. Finally, we draw our conclusions in Section 5.

2. Preliminaries

This section introduces the properties of chameleon hash functions based on elliptic curves [7, 8]. The base station initially chooses a large prime number q, an elliptic curve $E_q$ , a point P of order n over $E_q$ , a subgroup G with order P, and a cryptographically secure hash function f: $Z_q\times G\to Z_q$ . Here, M is a message space, and R is a finite space. Two random elements are chosen $k,x{\in }_R{Z}_q^{\ast }$ , and then $K=kP$ and $Y=xP$ are computed. The public hash key is $\mathrm{H}\mathrm{K}=(K,Y)$ , and the private trapdoor key is $\mathrm{T}\mathrm{K}=(k,x)$ .

The proposed chameleon hash function is as follows.

Given the hash key $\mathrm{H}\mathrm{K}$ , $\mathrm{C}\mathrm{H}(m,r)$ : $Z_q\times Z_q\to G$ is defind as

$$\begin{array}{cc}& \mathrm{C}\mathrm{H}\left(m,r\right)=f\left(m,kP\right)kP+rY.\end{array}$$

(1)

According to [10], the chameleon hash function has the following properties.

• (1)

Anyone that knows the public key $\mathrm{H}\mathrm{K}=(K,Y)$ can compute the associated hash function $\mathrm{C}\mathrm{H}(m,r)$ in polynomial time.

(2)

If the private trapdoor key is not known, it is not possible to find two inputs ( $m_{\mathrm{1}},m_{\mathrm{2}}$ ) that are mapped to the same output, such that $\mathrm{C}\mathrm{H}\left(m_{\mathrm{1}},r_{\mathrm{1}}\right)=\mathrm{C}\mathrm{H}\left(m_{\mathrm{2}},r_{\mathrm{2}}\right)$ .

(3)

The holder of the secret key information can easily find collisions for a given input, that is, two messages $m_{\mathrm{1}}$ and $m_{\mathrm{2}}$ , where $\mathrm{C}\mathrm{H}\left(m_{\mathrm{1}},r_{\mathrm{1}}\right)=\mathrm{C}\mathrm{H}\left(m_{\mathrm{2}},r_{\mathrm{2}}\right)$ .

Note that in signature schemes that use the chameleon hash function, there is a signer and a recipient, and two phases of execution. In the off-line phase, the signer precomputes the chameleon hash values $\mathrm{C}\mathrm{H}$ and the corresponding signatures σ on the hash values. In the online phase, the signer computes a random number r of the chameleon hash function for the given message m such that $\mathrm{C}\mathrm{H}\left(m,r\right)=\mathrm{C}\mathrm{H}$ . The signature for the message m is r, σ. When the recipient receives m, r, σ, it decrypts σ and verifies $\mathrm{C}\mathrm{H}\left(m,r\right)=\mathrm{C}\mathrm{H}$ .

3. The Proposed Scheme

This section presents the proposed access control method based on the chameleon hash function [9–12] and used twice Diffie-Hellman key exchange. This study used signature parameter to archive robust authentication and key exchange. This method consists of two phases: the initialization phase and the node authentication and key establishment phase. The basic concepts and operations are as follows:

• (1)

initialization phase: the base station sets the necessary values of the sensor nodes before they are deployed;

(2)

node authentication and key establishment phase: a deployed node engages in mutual authentication with one of its neighboring nodes and then establishes a common session key with the neighboring node for secure communication.

In order to depict the proposed method more clearly, the notations used in this paper are listed in Notations Section.

3.1. Initialization Phase

To set up the network system parameters, the base station initially chooses a large prime number q, an elliptic curve $E_q$ , a point P of order n over $E_q$ , a subgroup G with order P, and a cryptographically secure hash function f: $Z_q\times G\to Z_q$ . It then completes the initialization phase by carrying out the following steps.

Step 1.

Choose random elements $x,\alpha {\in }_R{Z}_q^{\ast }$ as the secret key and then compute the public key $Y=xP$ as well as the chameleon hash value of the base station $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}=\alpha Y$ .

Step 2.

Select random numbers $k_i{\in }_R{Z}_q^{\ast }$ as the secret key, where $i=\mathrm{1,2},3,\dots ,n$ , compute the trapdoor/hash key pair ( $k_i{x}^{-\mathrm{1}},k_{i}P$ ), and load $k_{i}P$ to node $N_i$ .

Step 3.

Compute a security key $r_i$ of $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ for the given m, where $m=N_i\parallel k_i{P}^X$ of node $N_i$ , such that $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}=f(m,k_{i}P)·k_{i}P+r_{i}Y$ . Here, $r_i=\alpha -f(m,k_{i}P)k_i{x}^{-\mathrm{1}}\mathrm{m}\mathrm{o}\mathrm{d}q$ . Load ( $N_i,k_{i}P,r_i,\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ ) to node $N_i$ and publish $E_q,q,n,P,Y$ to all the sensor nodes.

These three steps of the initialization phase are shown in Algorithm 1.

Algorithm 1: Steps of the initialization phase.

  The node   $$N_i$$      The base station

Preloads         Choose secret key   $$x,\alpha {\in }_R{Z}_q^{\ast }$$

  $$N_i,k_{i}P,r_i,\text{C}{\text{H}}_{\text{BS}}$$     Computes public key   $$Y=xP$$

          and chameleon hash value

           $$\text{C}{\text{H}}_{\text{BS}}=\alpha P$$

          Generates   $$k_i{\in }_R{Z}_q^{\ast }$$

          Computes   $$k_i{x}^{-\mathit{1}},k_{i}P$$

          and $$r_i=\alpha -f\left(m,k_{i}P\right)k_i{x}^{-\mathit{1}}\mathrm{mod}q$$

               $$m=N_i\parallel k_i{P}^X$$

3.2. Authentication and Key Establishment Phase

After all the sensor nodes have been deployed, if node $N_i$ wants to communicate with another node $N_j$ , they must implement the following steps to authenticate each other. Subsequently, they must establish a shared session key for securing their communication.

Step 1.

Node $N_i$ chooses a random integer $a{\in }_R{Z}_q^{\ast }$ to compute the public key $aP$ and $r_{i}Y$ and then sends ( $N_i,aP,r_{i}Y,k_{i}P$ ) to the node $N_j$ .

Step 2.

Node $N_j$ computes the chameleon hash value ${\mathrm{C}\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }$ of node $N_i$ based on the received message ( $N_i,aP,r_{i_i}Y,k_{i}P$ ). $m=N_i\parallel k_i{P}^X$ , according to (1), where

$$\begin{array}{cc}& \mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }=f\left(m,k_{i}P\right)k_{i}P+r_{i}Y.\end{array}$$

(2)

Then, $N_j$ compares ${\mathrm{C}\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }$ with the chameleon hash value of the base station $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ .

If $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }=\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ , then node $N_j$ chooses a random number $b{\in }_R{Z}_q^{\ast }$ to compute the public key $bP$ and the shared session key $baP(abP)$ between $N_i$ and $N_j$ .

Then, $N_j$ uses $r_j$ to compute the mutual authentication value $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ for the given values of $r_j$ and $ab{P}^X$ , where $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}=f((ab{P}^X\parallel r_j{r}_i{Y}^X),k_{j}P)$ . It subsequently delivers the message ( $N_j,bP,r_{j}Y,k_{j}P,\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ ) to node $N_i$ .

Step 3.

When node $N_i$ receives the message from $N_j$ , it also computes the chameleon hash value $m=N_j\parallel k_j{P}^X$ and ${\mathrm{C}\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }=f(m,k_{j}P)k_{j}P+r_{j}Y$ of node $N_j$ , according to the received message ( $N_j,bP,r_{j}Y,k_{j}P,\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ ) from $N_j$ . It then compares $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }$ with the chameleon hash value of the base station $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ . If $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }=\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ , then node $N_i$ computes the shared session key $abP$ , the mutual authentication value ${\mathrm{M}\mathrm{a}\mathrm{v}}_{N_j}^{\prime }$ for the given $r_i$ , and $ab{P}^X$ , where

$$\begin{array}{cc}& {\mathrm{M}\mathrm{a}\mathrm{v}}_{N_j}^{\prime }=f\left(\left(ab{P}^X\parallel r_i{r}_j{Y}^X\right),k_{j}P\right).\end{array}$$

(3)

If ${\mathrm{M}\mathrm{a}\mathrm{v}}_{N_j}^{\prime }=\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ , then the node $N_j$ is legitimized, and node $N_i$ sends back a mutual authentication value $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_i}$ for the given $r_i$ and $ab{P}^X$ , where

$$\begin{array}{cc}& \mathrm{M}\mathrm{a}{\mathrm{v}}_{N_i}=f\left(\left(ab{P}^X\parallel r_i{r}_j{Y}^X\right),k_{i}P\right).\end{array}$$

(4)

Step 4.

When $N_j$ receives $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_i}$ , it also computes the value for ${\mathrm{M}\mathrm{a}\mathrm{v}}_{N_i}^{\prime }=f((ab{P}^X\parallel r_j{r}_i{Y}^X),k_{i}P)$ . If ${\mathrm{M}\mathrm{a}\mathrm{v}}_{N_i}^{\prime }=\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_i}$ , then node $N_i$ is authenticated. Otherwise, the value $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_i}$ is discarded.

The steps of the authentication and the key establishment phase are shown in Algorithm 2.

Algorithm 2: Authentication and key establishment phase.

  The Node   $$N_i$$            The Node   $$N_j$$

Generates    $$a\hspace{1em}\stackrel{\hspace{1em}\hspace{1em}{\mathrm{N}}_{\mathrm{i}},aP,r_{i}Y,k_{i}P\hspace{1em}\hspace{1em}}{\to }$$    Check CH_BS ?= $${\text{C}{\text{H}}_{\text{BS}}}^{\prime }$$

Compute    $$aP,r_{i}Y$$             Generates   b

                    Compute   $$bP,baP,r_{j}Y$$

Check               $$\text{Ma}{\text{v}}_{N_j}=f((ab{P}^X\parallel r_j{r}_i{Y}^X),k_{j}P)$$

CH_BS ?= $${\text{C}{\text{H}}_{\text{BS}}}^{\prime }$$   $$\stackrel{\hspace{1em}\hspace{1em}{\mathrm{N}}_{\mathrm{j}},bP,r_{j}Y,k_{j}P,\text{Ma}{\text{v}}_{N_j}\hspace{1em}\hspace{1em}}{\leftarrow }$$

Compute   $$abP$$

$${\text{Ma}{\text{v}}^{\prime }}_{N_j}?=f((ab{P}^X\parallel r_i{r}_j{Y}^X),k_{j}P)$$

$${\text{Mav}}_{N_i}=f((ab{P}^X\parallel r_i{r}_j{Y}^X),k_{i}P)$$

        $$\stackrel{\hspace{1em}\hspace{1em}\hspace{1em}{\text{Mav}}_{{\mathrm{N}}_{\mathrm{i}}}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}}{\to }$$   Check

               $${\text{Ma}{\text{v}}^{\prime }}_{N_i}?=f((ab{P}^X\parallel r_j{r}_i{Y}^X),k_{i}P)$$

Note that after the sensor network has operated for a certain period of time, new nodes must be deployed in the network to extend its life. For example, for the deployment of a new node $N_{i+\mathrm{1}}$ , the base station adds the new node by following Steps 2 and 3 of the initialization phase outlined in Section 3.1.

4. Analysis of the Proposed Scheme

In this section, we analyze the correctness, the security, and the performance of the proposed access control protocol. The security analysis also shows how the proposed method can resist known security attacks.

4.1. Correctness

In the authentication and key establishment phase, node $N_j$ authenticates node $N_i$ based on the chameleon hash value of the node $N_i$ ; that is, the computed result of $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }=f(m,k_{i}P)·k_{i}P+r_{i}Y$ .

Based on the received message ( $N_i,aP,r_{i}Y,k_{i}P$ ) from node $N_i$ and the published message of the base station $〈P,Y〉$ , (2) can be rewritten as

$$\begin{array}{l}\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }=f((N_i\parallel k_i{P}^X),k_{i}P)·k_{i}P\hfill \\ \hspace{1em}+(\alpha -f((N_i\parallel k_i{P}^X),k_{i}P)k_i{x}^{-\mathrm{1}})·xP\hfill \\ =f((N_i\parallel k_i{P}^X),k_{i}P)·k_{i}P\hfill \\ \hspace{1em}-f((N_i\parallel k_i{P}^X),k_{i}P)k_{i}P+\alpha xP\hfill \\ =\alpha Y.\hfill \end{array}$$

(5)

All nodes of the WSN have the same chameleon hash value as the base station; that is, $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}=\alpha Y$ . This is preloaded by the base station. Therefore, node $N_j$ can verify the received identification and the hash key $k_{i}P$ of node $N_i$ based on the result of comparison of $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }$ with $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ . Moreover, node $N_i$ also can ensure whether node $N_j$ is valid by applying the same method that is used by node $N_j$ . In this case, the received message is from node $N_j$ .

If node $N_i$ confirms that node $N_j$ is valid, a shared session key $abP$ can be established by using the mutual authentication value ( $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ ) of the received message from node $N_j$ . Subsequently, $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}^{\prime }$ can be computed, where

$$\begin{array}{cc}& {\mathrm{M}\mathrm{a}\mathrm{v}}_{N_j}^{\prime }=f((ab{P}^X\parallel r_i{r}_j{Y}^X),k_{j}P).\end{array}$$

(6)

Equation (3) can be rewritten as

$$\begin{array}{l}{\mathrm{M}\mathrm{a}\mathrm{v}}_{N_j}^{\prime }=f((ab{P}^X\parallel r_i{r}_j{Y}^X),k_{j}P)\hfill \\ =f((ba{P}^X\parallel r_j{r}_i{Y}^X),k_{j}P)\hfill \\ =\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}.\hfill \end{array}$$

(7)

On the other hand, the random values a and b are chosen by nodes $N_i$ and $N_j$ , respectively. The point P of the Elliptic curve and the public key Y are initially published by the base station. Therefore, node $N_i$ can obtain the value of $ab{P}^X$ using the aforementioned parameters. $r_i$ is $N_i$ 's security key. Node $N_i$ then compares ${\mathrm{M}\mathrm{a}\mathrm{v}}_{N_j}^{\prime }$ with $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ , which are obtained by Diffie-Hellman key exchange. If they are equal, the shared session key has been established. In a similar manner, node $N_j$ can apply the method used by node $N_i$ to confirm the mutual authentication value.

4.2. Security Analysis

The proposed scheme utilizes the chameleon hash function and twice Diffie-Hellman key exchange produces the mutual authentication value to establish mutual authentication between communication nodes. This study is constructed of security chameleon hash function, and further proof is in [10, 11]. For example, if nodes $N_i$ and $N_j$ require mutual authentication, $N_j$ will first compare the preloaded chameleon hash value of the base station, $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ , with the chameleon hash value of node $N_i,\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }$ , obtained by using (1). However, the calculation of $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }$ requires the ID, the hash key $k_{i}P$ , and the value $r_{i}Y$ of node $N_i$ . Thus, the process can authenticate the ID and hash key because computing $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}^{\prime }$ is an elliptic curve discrete logarithm problem (ECDLP) if the attacker does not have any information about the ID and hash key. Furthermore, $r_i$ is protected by the secret keys α and $k_i{x}^{-\mathrm{1}}$ .

After node $N_i$ has been authenticated, node $N_j$ applies (1) and (2) to compute the $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ . Then, $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_j}$ is compared with $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_i}$ . $\mathrm{M}\mathrm{a}{\mathrm{v}}_{N_i}$ is obtained by using the shared session key $abP$ and security key $r_i$ . However, only the communication nodes recognize the session key $abP$ , and only node $N_i$ and the base station can have the secret key $r_i$ .

In addition to security analysis, the following paragraphs explain how the proposed method can resist attacks such as legal node masquerading attacks, forgery attacks, new node masquerading attacks, replay attacks, and man-in-the-middle attacks.

(A) Legal Node Masquerading Attack. In this study, the authentication of node $N_j$ depends on the comparison of chameleon hash values in the authentication and key establishment phase.

First, the node to be authentication node $N_j$ checks $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ . $N_j$ can provide a legitimate value of $r_{j}Y$ only if it is legitimate, and only the base station knows the secret keys α and $k_j{x}^{-\mathrm{1}}$ can provide corresponding $r_j$ for given message.

Secondly, only a legitimate node $N_j$ can use $r_j$ to compute the mutual authentication value and get authenticated successfully.

An attacker may obtain the commutation values by eavesdropping on the communication between nodes $N_i$ and $N_j$ . However, even if the attacker obtains the values of $aP$ and $bP$ from the authentication and key establishment phase, deriving the legalized session key $abP$ is extremely difficult because of the ECDLP. Therefore, the proposed scheme can prevent a legal node masquerading attack.

(B) Forgery Attack. Consider the case where an adversary has obtained the commutation values by eavesdropping on the communication channel.

The adversary may attempt to create a legitimate authentication message using the following equation:

$$\begin{array}{cc}& r_i^{\prime }=r_i+k_i{x}^{-\mathrm{1}}\left(f\left(m^{\prime },k_{i}P\right)-f\left(m,k_{i}P\right)\right)\mathrm{m}\mathrm{o}\mathrm{d}q.\end{array}$$

(8)

However, it is not possible for the adversary to create a forged message because the value of $r_i^{\prime }$ cannot be computed without secret key $k_i{x}^{-\mathrm{1}}$ .

(C) New Node Masquerading Attack. When some of the sensor nodes in the wireless sensor network are damaged or have exhausted their power, new sensor nodes must be added to the network to extend its life. In the new node addition phase, the base station preloads the $k_{i+\mathrm{1}}P$ , $\mathrm{C}{\mathrm{H}}_{\mathrm{B}\mathrm{S}}$ , $N_{i+\mathrm{1}}$ , and $r_{i+\mathrm{1}}$ values to a new node. Owing to the nonavailability of the secret keys x and α, the attacker cannot compute the value of $r_{i+\mathrm{1}}$ ; hence, it cannot use $r_{i+\mathrm{1}}$ to verify the ID and the hash key of the new node. Therefore, the proposed scheme can prevent new node masquerading attacks.

(D) Replay Attack. A replay attack is the one in which an attacker captures the transmitted messages of a legitimate node and later replays them on the network in an attempt to imitate legitimate authentication messages. For example, if an attacker transmits the captured message ( $N_i,aP,r_{i}Y,k_{i}P$ ) to another node $N_j$ , the attacker must then provide $r_i$ for establishing a mutual authentication value Mav. The Mav is required for a shared session key with the node to be connected. However, it is not possible for the attacker to obtain $r_i$ without the secret key $k_i{x}^{-\mathrm{1}}$ .

In addition, if the attacker sends the value $\mathrm{M}\mathrm{a}{\mathrm{v}}_{}$ to connect node $N_j$ , node $N_j$ can use the shared session key to authenticate whether the connecting node is legitimate or not. Another point that must be noted is that every connection between the two nodes uses the up-to-date session key values a and b. By means of these different strategies, the proposed method can resist replay attacks.

(E) The Man-in-the-Middle Attack. In the proposed scheme, the communication nodes can mutually authenticate and establish session keys between users and servers. Although an attacker may launch a man-in-the-middle attack, the attacker can only know the values of $aP$ and $bP$ . It still has to resolve the ECDLP. Moreover, even if the attacker obtains user information (such as $N_i,k_{i}P,r_{i}Y$ ), the attacker still cannot pass the authentication and key establishment phase because it cannot compute the mutual authentication value $\mathrm{M}\mathrm{a}\mathrm{v}$ of the session key. Therefore, the proposed scheme can resist man-in-middle attacks.

4.2.1. Session Key Security

The proposed scheme uses a session key. Only the communicating parties know the session key $abP$ when the user verifies the message from receiving party. The session key $\mathrm{S}\mathrm{K}=abP$ is not known by anyone other than the communicating parties because the random values $aP$ and $bP$ are protected by the ECDLP. Therefore, the proposed scheme provides session key security.

4.3. Performance Analysis

Table 1 shows the proposed scheme compared with related works Huang [3], Kim and Lee [4], Zeng et al. [6], and Molavi et al. [8] in terms of the function of access control method. The computation cost and the transmission cost are two popular benchmarks for evaluation of the efficiency of the WSNs. Table 2 shows the computation costs of the proposed method during different phases. When compared to the computation cost of the hash chain and the elliptic curve-based schemes, the computation cost of the proposed method is slightly higher. However, our proposed method does not require time synchronization or the verification table for authentication. Hence, it is more efficient than the hash chain and elliptic curve-based methods.

Table 1

Compared function of access control method.

Function	Method
	[3]	[4]	[7]	[8]	Proposed method
Resist various attacks	No	No	Yes	Yes	Yes
Easily add new node	Yes	Yes	Yes	Yes	Yes
Do not need time synchronization	No	No	No	No	Yes
After authentication, no need for broadcast	No	No	No	Yes	Yes
Do not have to verify table	No	No	No	Yes	Yes
After adding new node, no need for broadcast	No	No	No	Yes	Yes

Table 2

The computation costs of the proposed method during different phases.

Phase	Computation cost
	Base station	Node $N_i$
Initialization	$$\mathit{2}T{e}_m+n(\mathit{2}T{e}_m+\mathit{1}{T}_{\text{mul}})$$	N/A
Authentication and key establishment	N/A	$$\mathit{5}T{e}_m+\mathit{1}{T}_h$$
New node adding	$$\mathit{2}T{e}_m+\mathit{1}{T}_{\text{mul}}$$	N/A

$$T{e}_m$$ : time cost for one multiplication computation over an elliptic curve.

$$T_h$$ : time for cryptographic secure hash function.

$$T_{\text{mul}}$$ : time cost of performing the modulus multiplication operation.

The energy cost of communication and cryptography in wireless sensor networks is an important consideration. In [13] indicated, the energy cost of cryptographic protocols, both from a communication energy cost and computation energy cost. According to [13] measure practical costs of computation and communication in WSN, it used TelosB sensors run Elliptic Curve Diffie-Hellman key exchange with authentication energy costs total is 130 (mJ), communication costs is 58.3 (mJ), and computation cost is 77 (mJ). As a result, we can realize that communication cost is an important consideration same as the computation cost. Table 3 presents the computation and the transmission costs incurred by using the methods put forward by Zhou et al. [2], Huang [3], Kim and Lee [4], and Lee et al. [7]. It also displays the costs incurred by using our proposed method. The protocol proposed by Huang requires seven transmissions and updates the broadcast hash chain after each authentication, key establishment, and new node addition phase. Our method requires only five transmissions. Consequently, it needs less bandwidth than the schemes proposed by Zhou et al. and Huang.

Table 3

The comparison of computation costs and number of transmissions.

Scheme	Each node achieves authentication and establishes shared session key	Total number of transmissions to establish shared session key
Zhou et al. [2]	$$\mathit{3}T{e}_m+T_{\text{mul}}+T_h$$	21
Kim and Lee [4]	$$\mathit{2}T{e}_m+\mathit{8}{T}_h$$	14
Huang [3]	$$\mathit{2}T{e}_m+\mathit{5}{T}_h$$	10
Lee et al. [7]	$$\mathit{2}T{e}_m+\mathit{5}{T}_h$$	8
Our proposed scheme	$$\mathit{5}T{e}_m+\mathit{1}{T}_h$$	5

$$T{e}_m$$ : point multiplication computation over an elliptic curve.

$$T_h$$ : time for cryptographic secure hash function.

$$T_{\text{mul}}$$ : time cost of performing the modulus multiplication operation.

Therefore, the proposed scheme can be applied to applications from the WSNs criteria that had less number of transmissions and had lower data rate of communication. However, every broadcast has resulted in poor throughput of WSNs. Our proposed method does not need broadcast to update node list and verify table. Furthermore, it can be implemented by using any elliptic curve and cryptographic secure hash function.

5. Conclusion

This study demonstrated a new access control scheme for WSNs that has three characteristics. First, the proposed scheme can establish mutual authentication between two communication nodes and resist possible attacks when the base station adds a new node to the WSN. Second, the proposed scheme can establish a common session key between two nodes in an efficient manner. Moreover, it does not require time synchronization or the verification table. Third, the proposed scheme requires fewer transmissions and less bandwidth than existing schemes.