A Mutual Broadcast Authentication Protocol for Wireless Sensor Networks Based on Fourier Series

Abstract

This thesis presents a mural broadcast authentication protocol (MBAP) for wireless sensor networks based on Fourier series according to the issues of the main broadcast authentication protocol µTESLA being limited in authentication delay, more initial parameters, limited time, large key chain, and network congestion. Firstly, achieving the forward authentication work for common sensor nodes to base station is based on the characteristic of continuous-integrability function $f(x)$ in $[-\pi ,\pi ]$ which could be expanded into Fourier series, including entity authentication and source attestation. Secondly, assume that $f(x)$ is the quadratic form function, and achieve the reverse authentication work for base station to common sensor nodes by detecting the security of $f(x)$ . The analysis results of safety performance in MBAP show that the captured nodes in WSN will not affect the security of broadcast authentication protocol and have low computation and communication cost, the base station can make broadcast randomly, and common sensor nodes can authenticate messages instantly, which solves the problem of network congestion well. The most important thing of MBAP is the mutual broadcast authentication method which ensures the security of the network greatly.

1. Introduction

In wireless sensor networks (WSN), in order to save the network bandwidth and the communication time, the base station and the cluster heads generally send messages to the common sensor nodes by broadcasting. And broadcast communication plays a very important role in WSN, and its security has a direct impact on the security of the entire network [1–5]. Therefore, it must be able to authenticate the source, the accuracy, and the integrity of the broadcast packets when the receiving nodes get the broadcast packets; it is also known as broadcast authentication.

The broadcast authentication includes two parts: entity authentication and source attestation. Entity authentication is the process for confirming the identity of the sending nodes based on some authentication protocol, which insures the security for network access. And source attestation is mainly to ensure the integrity of the messages and prevent unauthorized nodes sending, forging, and tampering messages. These two parts’ authentication can be achieved by the generation and verification of message authentication code (MAC). If the broadcast authentication takes the symmetric encryption mechanism, each captured node can modify or forge the messages and threaten the whole network security. So, it is necessary to use asymmetric encryption technique for broadcast authentication.

There are many efficient broadcast protocols that have been proposed, such as broadcast transmission capacity (BTC) of heterogeneous wireless ad hoc networks with secrecy outage constraints [6], a qos-based broadcast protocol (QBBP) for multihop cognitive radio ad hoc networks under blind information [7], and a reliable and total order tree-based (RTOT) broadcast in wireless sensor network [8]. But it is hard to design broadcast authentication protocols for WSN because of the limitations of WSN. There are two kinds of WSN broadcast authentication protocols: one is the signature authentication [9–11], but it is hard to be applied because of the disadvantage of using public key cryptography and large cost, and the other one is the message authentication code (MAC) [12–15], such as the μTESLA which is proposed as the broadcast authentication protocol by Perrig based on the security protocols for sensor networks in [15], which realizes the asymmetry of broadcast authentication by using the symmetric encryption mechanism, and including three key parts: key establishment, disclosing authentication key, and authenticating broadcast data. In addition, multilevel LTESLA, a broadcast authentication system for distributed sensor networks, is proposed in [16], which divides authentication into multiple levels, where the high level key chain authenticates the low level key chain, and the low layer key chain authenticates the broadcast data packets, but it is suitable for the single base station network.

This thesis presents a mutual broadcast authentication protocol (MBAP) for wireless sensor networks based on Fourier series according to the problems of the main broadcast authentication protocol μTESLA being limited in authentication delay, more initial parameters, limited time, large key chain, and network congestion. And the mutual authentication between nodes and base station is achieved according to the characteristic of continuous-integrability function $f(x)$ in $[-\pi ,\pi ]$ which could be expanded into Fourier series. Firstly one has pre-distributing $f(x)$ for each node upon network initializing, calculating the current Fourier series coefficients, establishing authentication key $K^{\prime }$ , verifying the correctness of the broadcast authentication information, achieving entity authentication and source attestation. Secondly, assuming that $f(x)$ is the quadratic form function and achieving the reverse authentication work for base station to common sensor nodes by detecting the security of $f(x)$ , it also means that the MBAP protocol can achieve mutual security authentication. The analysis results of safety performance in MBAP show that the captured nodes in WSN will not affect the security of broadcast authentication protocol and have low computation and communication cost, the base station can make broadcast randomly, and common sensor nodes can authenticate messages instantly, which solves the problem of network congestion well. The most important thing of MBAP is the mutual broadcast authentication method which ensures the security of the network greatly.

The paper is organized as follows. In Section 2, we analyze the related work, such as μTESLA protocol principle and its issues. In Section 3, we discuss the specific principle of MBAP, including network model assumptions, Fourier series’ characteristics analysis and MBAP authentication principle. Section 4 analyzes the security of MBAP compared with MBAP. And summary is made in Section 5.

2. Related Work

2.1. μTESLA Protocol

In μTESLA, the asymmetric characteristic of broadcast authentication is realized by using the symmetric encryption mechanism on condition of the loose time synchronization of sending nodes and receiving nodes. The key points of μTESLA protocol are using hash key chain and publishing key delayed, as showed in Figure 1, a one-way function key chain is established by the sending node, where the length of key chain is $n+\mathrm{1}$ , and the first key $K_n$ of the key chain is generated randomly by the sending node, but the next keys are all generated by the one-way function $hash$ acting on the last key repeatedly, such as $K_j=H(K_{j+\mathrm{1}})$ . The sending node divides the communication time into equal time slices, where the length of each time slice is D, and each time slice is assigned a key in order, but the order of the assigned keys is the opposite order of the key chain, and each message $P_i$ of time slice j is encrypted by $K_j$ , such as $\mathrm{M}\mathrm{A}{\mathrm{C}}_{K_j}\left(P_i\right)$ . The sending node determines the key delay time δ based on the time slice length, and the key $K_j$ on time slice j will be published after δ, such as $\delta =\mathrm{2}$ in Figure 1.

Figure 1

μTESLA protocol.

To avoid the additional communication cost, the published key is sent to the receiving nodes by being attached with the data packet. If there is no data packet on some time slice, the key attached with the data packet will not be published, and this key can be calculated by the next keys in one-way function $hash$ . More importantly, the initial parameters $K_{\mathrm{0}}$ , δ, and D and starting time $T_{\mathrm{0}}$ should be sent to receiving nodes before authentication.

2.2. μTESLA Protocol Issues

2.2.1. Computation Cost

The μTESLA protocol has higher authentication efficiency in the case of sending data packets frequently, but it has a very low sending frequency in some applications, such as fire alarm and other event-driven applications, where the transmission interval of the adjacent data packets may be far greater than the time slice D of μTESLA and causes lots of keys not to be used for the data packets authentication, and the distance between adjacent keys on the key chain is also increased and causes a large computation cost and authentication delay.

Increasing D can alleviate this problem, but it also causes a lot of authentication delay, and the receiving nodes also need more memory space for buffering packets.

2.2.2. Delay

In μTESLA, the time interval of sending message $\left\{\mathrm{M}\mathrm{A}{\mathrm{C}}_{K_i}\left(P_i\right)\parallel K_{i-\mathrm{2}}\parallel P_i\parallel i\left(t\right)\right\}$ will be increased gradually, and the time for buffering data packets is also increased because of the authentication delay, which also makes the protocol more vulnerable to be attacked by DoS. Therefore, the authentication mechanism of μTESLA is not suitable for the situation of large sending time interval.

2.2.3. Problem of Initialization Parameters

The most important problem of μTESLA is the distribution of initialization parameters. Each sending node has an independent authentication key chain for encrypting its own data packets, and each receiving node makes authentication for $\left\{\mathrm{M}\mathrm{A}{\mathrm{C}}_{K_i}\left(P_i\right)\parallel K_{i-\mathrm{2}}\parallel P_i\parallel i\left(t\right)\right\}$ after receiving the initialization parameters $K_{\mathrm{0}}$ , δ, and D and starting time $T_{\mathrm{0}}$ . If the nodes send the initialization parameters $\left\{K_{\mathrm{0}},\delta ,D,T_{\mathrm{0}}\right\}$ in unicast way, it will cause much resource consumption, because the sending node needs to encrypt the $\left\{K_{\mathrm{0}},\delta ,D,T_{\mathrm{0}}\right\}$ in different keys shared with the receiving node, which will cause the delay for data packet transmission and authentication, and the delay may lead to DoS attacks.

2.2.4. Authentication Aging Problem

There are some applications that require real-time authentication for broadcasting, such as real-time audio frequency, video stream, and alarm information. Obviously, μTESLA is not suitable for high ageing applications because of the authentication delay.

2.2.5. Fixed Key Chain Length

In μTESLA, the authentication key of each time slice is predistributed upon network initialization. On the one hand, if the work time is too long, it means that the length of key chain is too large, which will cause a large computation cost and storage cost. On the other hand, if the work time is too short, it cannot meet the requirement of frequent data exchange and long-term work.

Therefore, in order to meet the characteristics of lower delay, better aging, less key storage, computing fast, and better flexibility for the general broadcast authentication in WSN, this paper introduces the mathematical theory of Fourier series, which simplifies the practical issues based on characteristic of Fourier series coefficients and makes a simple and efficient broadcast authentication.

3. MBAP

3.1. Network Model Assumptions

In WSN, either the base station or the sensor node is the broadcaster (as shown in Figure 2).

Figure 2

Broadcasting communication in centralized network.

According to the topology of the network, it can broadcast directly when the base station is the broadcaster which can send the information to the prerecipient without intermediate nodes or can send the information to the prerecipient layer by layer, such that the base station will send the information to each cluster head first of all, and the cluster head will send the information to each common sensor node after authentication.

When the sensor nodes are the broadcasters, they can only send the information to their neighbor nodes directly without intermediate nodes.

In order to facilitate the description of MBAP, the network is assumed as follows:

• (1)

Assume that the network is isomorphic and static and each of the sensor nodes has been uniformly deployed in the target area and has same configuration in software and hardware and will not move any more once they are deployed, where the network size is N, including 2 types of nodes, base station (BS) and sensor node (SN), as shown in Figure 2.

(2)

Assume that base station (BS) is equipped with abundant software and hardware resources and can cover the entire network deployment area by means of a high power radio signal, and it is responsible for storing the basic information of all the nodes in network and has the ability to detect compromised or captured nodes.

(3)

Common sensor node is responsible for collecting environmental data. The ability to process data of sensor node is limited by storage space, energy reserves, and communication distance. Since the communication radius of the common sensor node is limited, the communication between nodes which are not in the communication radius should be transferred by neighbor node.

The main symbols in the text are shown as follows:

•  

$\mathrm{B}\mathrm{S}$ : base station,

 

$\mathrm{S}\mathrm{N}$ : sensor node,

 

$h(x)$ : $hash$ function,

 

K: authentication key,

 

$\mathrm{I}{\mathrm{D}}_i$ : identity symbol of node i,

 

$f(x)$ : continuous-integrability function,

 

D: time slice length,

 

P: plaintext,

 

$L\left(i\right)$ : authentication message of time slice i.

3.2. Analyzing Characteristics of Fourier Series

Definition 1.

If the function $f(x)$ period is T, it is satisfied on the following conditions:

$$\begin{array}{cc}& f\left(x\right)=A_{\mathrm{0}}+{\displaystyle \sum }_{n=\mathrm{1}}^{\infty }{A}_n\sin \left(n\omega x+{\phi }_n\right)=A_{\mathrm{0}}+{\displaystyle \sum }_{n=\mathrm{1}}^{\infty }\left(a_n\cos n\omega x+b_n\sin n\omega x\right).\end{array}$$

(1)

And claim that formula (1) is the Fourier series determined by $f(x)$ .

3.2.1. Orthogonal Analysis of Trigonometric Function

Assume that c is a real number and $\cos kx$ and $\sin kx$ are the periodic function in $\left[c,c+\mathrm{2}\pi \right]$ , where the period is $\mathrm{2}\pi$ , and then

$$\begin{array}{cc}& {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }\cos kx\hspace{0.17em}dx={{\displaystyle \int }}_{\mathrm{0}}^{\mathrm{2}\pi }\cos kx\hspace{0.17em}dx=\mathrm{0},\\ {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }\sin kx\hspace{0.17em}dx={{\displaystyle \int }}_{\mathrm{0}}^{\mathrm{2}\pi }\sin kx\hspace{0.17em}dx=\mathrm{0},\\ \hspace{1em}\left(k=\mathrm{1,2},\dots \right).\end{array}$$

(2)

And it is easy to prove with product and difference

$$\begin{array}{cc}& {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }\sin kx\cos lx\hspace{0.17em}dx=\mathrm{0},\\ {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }\sin kx\sin lx\hspace{0.17em}dx=\mathrm{0},\\ {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }\cos kx\cos lx\hspace{0.17em}dx=\mathrm{0}\\ \hspace{1em}\left(k\ne l;\hspace{0.17em}\hspace{0.17em}k,l=\mathrm{1,2},\dots \right)\end{array}$$

(3)

$$\begin{array}{cc}& {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }{\cos }^{2}kx\hspace{0.17em}dx={{\displaystyle \int }}_{\mathrm{0}}^{\mathrm{2}\pi }{\cos }^{2}kx\hspace{0.17em}dx={{\displaystyle \int }}_{\mathrm{0}}^{\mathrm{2}\pi }\frac{\mathrm{1}+\cos \mathrm{2}kx}{\mathrm{2}}dx=\pi ,\\ {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }{\sin }^{\mathrm{2}}kx\hspace{0.17em}dx=\pi ,\\ \hspace{1em}\left(k=\mathrm{1,2},\dots \right)\\ {{\displaystyle \int }}_c^{c+\mathrm{2}\pi }{\mathrm{1}}^{\mathrm{2}}dx=\mathrm{2}\pi .\end{array}$$

(4)

3.2.2. Fourier Series Coefficient Analysis

Deduction 1.

Assume that function $f(x)$ has been expanded to a uniformly convergent trigonometric series:

$$\begin{array}{cc}& f\left(x\right)=\frac{a_{\mathrm{0}}}{\mathrm{2}}+{\displaystyle \sum }_{k=\mathrm{1}}^{\infty }\left(a_k\cos kx+b_k\sin kx\right).\end{array}$$

(5)

Then

$$\begin{array}{cc}& a_{\mathrm{0}}=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)dx,\\ a_k=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)\cos kx\hspace{0.17em}dx,\hspace{1em}\left(k=\mathrm{0,1},\mathrm{2},\dots \right),\\ b_k=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)\sin kx\hspace{0.17em}dx,\hspace{1em}\left(k=\mathrm{0,1},\mathrm{2},\dots \right).\end{array}$$

(6)

Proof.

Assume that $f(x)$ is an integrable function in $[-\pi ,\pi ]$ , where the right side of (5) can be integrable term by term. So we can get (7) by (2). Consider

$$\begin{array}{cc}& {{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)dx=\frac{a_{\mathrm{0}}}{\mathrm{2}}·\mathrm{2}\pi =a_{\mathrm{0}}\pi ,\\ a_{\mathrm{0}}=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)dx.\end{array}$$

(7)

Set that n is a positive integer and multiplying by both sides with $\cos nx$ for $f(x)$ and integration in $[-\pi ,\pi ]$ then we can get (8) by (2), (3), and (4):

$$\begin{array}{cc}& {{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)\cos nx\hspace{0.17em}dx=\frac{a_{\mathrm{0}}}{\mathrm{2}}{{\displaystyle \int }}_{-\pi }^{\pi }\cos nx\hspace{0.17em}dx+{\displaystyle \sum }_{k=\mathrm{1}}^{\infty }\left(a_k{{\displaystyle \int }}_{-\pi }^{\pi }\cos kx\cos nx\hspace{0.17em}dx+b_k{{\displaystyle \int }}_{-\pi }^{\pi }\sin kx\cos nx\hspace{0.17em}dx\right)={{\displaystyle \int }}_{-\pi }^{\pi }{a}_n{\cos }^{2}nx\hspace{0.17em}dx=a_n\pi .\end{array}$$

(8)

Therefore

$$\begin{array}{cc}& a_n=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)\cos nx\hspace{0.17em}dx.\end{array}$$

(9)

Similarly

$$\begin{array}{cc}& b_n=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)\sin nx\hspace{0.17em}dx.\end{array}$$

(10)

Thus Deduction 1 is proved.

3.3. MBAP Authentication Principle

We assume that $f(x)$ is a continuous-integrability function in $[-\pi ,\pi ]$ which is predistributed for each node upon initializing. So, the MBAP authentication principle is as follows.

Step  1 (establishing authentication key). The base station divides the communication time into equal time slices, where the length of each time slice is D, and each time slice is assigned a key in order. Set $K\left(i\right)$ to be the authentication key distributed for the time slice i, and set

$$\begin{array}{cc}& K\left(i\right)=\frac{a_{\mathrm{0}}}{\mathrm{2}}+{\displaystyle \sum }_{k=\mathrm{1}}^i\left(a_k\cos kx+b_k\sin kx\right).\end{array}$$

(11)

It is obvious that the keys for each time slice are different based on Deduction 1, and

$$\begin{array}{cc}& K\left(i+\mathrm{1}\right)=\frac{a_{\mathrm{0}}}{\mathrm{2}}+{\displaystyle \sum }_{k=\mathrm{1}}^{i+\mathrm{1}}\left(a_k\cos kx+b_k\sin kx\right)=K\left(i\right)+\left(a_{i+\mathrm{1}}\cos \left(i+\mathrm{1}\right)x+b_{i+\mathrm{1}}\sin \left(i+\mathrm{1}\right)x\right).\end{array}$$

(12)

It is showed in (12) that the authentication key $K\left(i+\mathrm{1}\right)$ on time slice $i+\mathrm{1}$ can be calculated by $K\left(i\right)$ and Fourier series coefficients $a_{i+\mathrm{1}}$ and $b_{i+\mathrm{1}}$ .

Step  2 (building broadcast authentication information). We assume that $L\left(i\right)$ is the broadcast authentication information of the time $i\left(t\right)$ on time slice i, where t is a certain time on time slice i, and set

$$\begin{array}{cc}& L\left(i\right)=\left\{P_{i\left(t\right)}\parallel h\left(a_i\right)\parallel h\left(b_i\right)\parallel \mathrm{M}\mathrm{A}\mathrm{C}=h\left(K\left(i\right),P_{i\left(t\right)},i\left(t\right)\right)\parallel i\left(t\right)\right\},\end{array}$$

(13)

where $a_i=\left(\mathrm{1}/\pi \right){\int }_{-\pi }^{\pi }f\left(x\right)\cos ix\hspace{0.17em}dx$ and $b_i=(\mathrm{1}/\pi ){\int }_{-\pi }^{\pi }f\left(x\right)\sin ix\hspace{0.17em}dx$ are last two Fourier series coefficients of $K\left(i\right)$ , $P_{i\left(t\right)}$ is the plaintext message of time $i\left(t\right)$ , and $\mathrm{M}\mathrm{A}\mathrm{C}=h(K(i),P_{i\left(t\right)},i\left(t\right))$ makes sure that $K(i)$ is undisclosed which ensures the security of the key in the process of message communication.

Then there are base station broadcasts $L\left(i\right)$ .

Step  3 (application verification). The common sensor node gets the authentication information $L\left(i\right)$ and time $i\left(t\right)$ .

If the common sensor node has received the authentication information $L\left(i\right)$ on time $i\left(t+\mathrm{1}\right)$ , it is showed that the authentication information $L\left(i\right)$ is outdated, and it is likely to be caused by network congestion or may be an enemy in disguise after being captured. For this unusual situation, the first step is to abandon $L\left(i\right)$ on time $i\left(t\right)$ , and the second step is to verify the legitimacy of $L\left(i\right)$ on time $i\left(t\right)$ by BS.

Conversely, if $i\left(t\right)$ is the latest time, it is showed that $L\left(i\right)$ is the authentication information which needs to be authenticated currently, and go to Step  4.

Step  4 (entity authentication). Because $f(x)$ is predistributed for each sensor node, according to the Definition 1 and Deduction 1, set

$$\begin{array}{cc}& a_i^{\prime }=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)\cos ix\hspace{0.17em}dx\\ b_i^{\prime }=\frac{\mathrm{1}}{\pi }{{\displaystyle \int }}_{-\pi }^{\pi }f\left(x\right)\sin ix\hspace{0.17em}dx.\end{array}$$

(14)

If $h\left(a_i^{\prime }\right)=h\left(a_i\right)$ and $h\left(b_i^{\prime }\right)=h\left(b_i\right)$ , it is showed that $L\left(i\right)$ is the authentication information sent by BS on the time slice i, and entity authentication is completed by now.

Conversely, if $h\left(a_i^{\prime }\right)\ne h\left(a_i\right)$ or $h\left(b_i^{\prime }\right)\ne h\left(b_i\right)$ , abandon $\hspace{0.17em}\hspace{0.17em}L\left(i\right)$ and check the legitimacy of $L\left(i\right)$ by BS.

Step  5 (source attestation). After the completion of entity authentication, it is necessary to determine whether the plaintext message $P_{i\left(t\right)}$ has been tampered by enemy, and set

$$\begin{array}{cc}& K^{\prime }\left(i\right)=\frac{a_{\mathrm{0}}^{\prime }}{\mathrm{2}}+{\displaystyle \sum }_{k=\mathrm{1}}^i\left(a_k^{\prime }\cos kx+b_k^{\prime }\sin kx\right)\end{array}$$

(15)

$$\begin{array}{cc}& \text{Or\hspace{0.17em}\hspace{0.17em}}{K}^{\prime }\left(i\right)=K\left(i-\mathrm{1}\right)+\left(a_i^{\prime }\cos ix+b_i^{\prime }\sin ix\right),\end{array}$$

(16)

where $K(i-\mathrm{1})$ is the authentication key on time slice $i-\mathrm{1}$ which has been authenticated on last time slice and $h\left(a_i^{\prime }\right)=h\left(a_i\right)$ and $h\left(b_i^{\prime }\right)=h\left(b_i\right)$ have been authenticated in Step  4, so $K^{\prime }\left(i\right)=K(i)$ based on (12), where $K(i)$ encrypted by hash function cannot be got by enemy.

It is showed in (16) that the calculation of $K^{\prime }\left(i\right)$ avoids amounts of the calculation of Fourier series coefficients each time and reduces the computation cost greatly.

And if

$$\begin{array}{cc}& h\left(K^{\prime }\left(i\right),P_{i\left(t\right)},i\left(t\right)\right)=h\left(K\left(i\right),P_{i\left(t\right)},i\left(t\right)\right)=\mathrm{M}\mathrm{A}\mathrm{C},\end{array}$$

(17)

it is showed that the plaintext message $P_{i\left(t\right)}$ is integrity and not tampered by enemy, and source attestation is completed by now.

Conversely, if $h(K^{\prime }(i),P_{i\left(t\right)},i\left(t\right))\ne h(K(i),P_{i\left(t\right)},i\left(t\right))$ , it is showed that the plaintext message $P_{i\left(t\right)}$ is captured by enemy and checking the legitimacy of $L\left(i\right)$ by BS.

The forward authentication work for common sensor nodes to base station is completed from now on, and the forward flow chart of MBAP protocol is showed in Figure 3.

Figure 3

Forward flow chart of MBAP protocol.

Step  6 (reverse authentication)

Deduction 2.

In order to detect the security of $f(x)$ , assume that $f(x)$ is a quadratic polynomial and a continuous-integrability function for some variable in $[-\pi ,\pi ]$ . And the reverse authentication work for the base station to the common sensor nodes can be completed by detecting the security of $f(x)$ , and it also means that the MBAP protocol can achieve mutual security authentication.

Proof.

Assume that $f(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n)$ is a multiple asymmetric quadratic form polynomial in field P:

$$\begin{array}{cc}& f\left(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n\right)=a_{\mathrm{11}}{x}_{\mathrm{1}}^{\mathrm{2}}+a_{\mathrm{12}}{x}_{\mathrm{1}}{x}_{\mathrm{2}}+\cdots +a_{\mathrm{1}n}{x}_{\mathrm{1}}{x}_n+a_{\mathrm{21}}{x}_{\mathrm{2}}{x}_{\mathrm{1}}+a_{\mathrm{22}}{x}_{\mathrm{2}}^{\mathrm{2}}+\cdots +a_{\mathrm{2}n}{x}_{\mathrm{2}}{x}_n+\cdots +a_{n\mathrm{1}}{x}_n{x}_{\mathrm{1}}+a_{n\mathrm{2}}{x}_n{x}_{\mathrm{2}}+\cdots +a_{nn}{x}_n^{\mathrm{2}}=\left(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n\right)\left[\begin{array}{cccc}{a}_{\mathrm{11}}& a_{\mathrm{12}}& \cdots & a_{\mathrm{1}n}\\ a_{\mathrm{21}}& a_{\mathrm{22}}& \cdots & a_{\mathrm{2}n}\\ ⋮& ⋮& ⋮& ⋮\\ a_{n\mathrm{1}}& a_{n\mathrm{2}}& \cdots & a_{nn}\end{array}\right]\left[\begin{array}{c}{x}_{\mathrm{1}}\\ x_{\mathrm{2}}\\ ⋮\\ x_n\end{array}\right]=X^{T}AX,\end{array}$$

(18)

where A is the quadratic matrix of $f(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n),\hspace{0.17em}\hspace{0.17em}{a}_{ij}=a_{ji}$ , $i,j=\mathrm{1},\dots ,n,\hspace{0.17em}\hspace{0.17em}A=A^T$ .

A key management scheme based on quadratic for WSN is proposed in [17] by the author Xiaogang Wang, where, assuming $\hspace{0.17em}\hspace{0.17em}{f}_{w_i}(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n)$ is the quadratic polynomial of node i, ${\lambda }_{i\mathrm{1}},{\lambda }_{i\mathrm{2}},\dots ,{\lambda }_{in}$ are the eigenvalues of $f_{w_i}(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n)$ , $\left\{{\xi }_{i\mathrm{1}},{\xi }_{i\mathrm{2}},\dots ,{\xi }_{in}\right\}$ are the eigenvectors of $f_{w_i}(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n)$ , and assume that

$$\begin{array}{cc}& {\mathbf{C}}_i=\left[\begin{array}{cccc}{\lambda }_{i\mathrm{1}}& \mathrm{0}& \cdots & \mathrm{0}\\ \mathrm{0}& {\lambda }_{i\mathrm{2}}& \cdots & \mathrm{0}\\ ⋮& ⋮& ⋮& ⋮\\ \mathrm{0}& \mathrm{0}& \cdots & {\lambda }_{in}\end{array}\right],\\ {\mathbf{D}}_i=\left[{\xi }_{i\mathrm{1}},{\xi }_{i\mathrm{2}},\dots ,{\xi }_{in}\right].\end{array}$$

(19)

We can assume that node $n_i$ has achieved forward authentication work for base station and responded to the base station with a message $M=\left\{f(x)\parallel h({\mathbf{C}}_i)\parallel h({\mathbf{D}}_i)\parallel \mathrm{I}{\mathrm{D}}_i\right\}$ and the base station will make reverse authentication upon receiving the message $M=\left\{f(x)\parallel h({\mathbf{C}}_i)\parallel h({\mathbf{D}}_i)\parallel \mathrm{I}{\mathrm{D}}_i\right\}$ .

Based on [17], we can get that the eigenvalues ${\lambda }_{i\mathrm{1}},{\lambda }_{i\mathrm{2}},\dots ,{\lambda }_{in}$ of quadratic polynomial $f_{w_i}(x_{\mathrm{1}},x_{\mathrm{2}},\dots ,x_n)$ in different sequence or incorrectness will affect the accuracy of eigenvectors $\left\{{\xi }_{i\mathrm{1}},{\xi }_{i\mathrm{2}},\dots ,{\xi }_{in}\right\}$ or ${\mathbf{D}}_i$ , and the eigenvectors in different sequence that belonged to the same eigenvalue also can affect the accuracy of ${\mathbf{D}}_i$ . For this reason, we can assume that the sequence of eigenvalues and eigenvectors of each sensor node are predistributed by base station, which can avoid the same response information by different nodes and ensure the independence of the reverse authentication work. For example, $M=\left\{f(x)\parallel h({\mathbf{C}}_i)\parallel h({\mathbf{D}}_i)\parallel \mathrm{I}{\mathrm{D}}_i\right\}$ is the response information of node $n_i$ , and the base station can get ${\mathbf{C}}_i^{\prime }$ and ${\mathbf{D}}_i^{\prime }$ based on the sequence of eigenvalues and eigenvectors of node $n_i$ . If $h({\mathbf{C}}_i)\ne h({\mathbf{C}}_i^{\prime })$ or $h({\mathbf{D}}_i)\ne h({\mathbf{D}}_i^{\prime })$ , it is showed that node $n_i$ is captured by enemy and removed by base station. If $h({\mathbf{C}}_i)=h({\mathbf{C}}_i^{\prime })$ and $h({\mathbf{D}}_i)=h({\mathbf{D}}_i^{\prime })$ , it is showed that identity of node $n_i$ is authenticated base station.

Therefore, a mutual broadcasting authentication work is achieved by now and Deduction 2 is proved.

Step  7 (update $f(x)$ ). For the network security, $f(x)$ should be updated periodically, so we modify the broadcast authentication information $L\left(i\right)$ by the base station and set

$$\begin{array}{cc}& L{\left(i\right)}^{\prime }=\left\{P_{i\left(t\right)}\parallel h\left(a_i\right)\parallel h\left(b_i\right)\parallel \mathrm{M}\mathrm{A}\mathrm{C}=h\left(K\left(i\right),P_{i\left(t\right)},i\left(t\right)\right)\parallel K_i\left(f{\left(x\right)}_{\mathrm{n}\mathrm{e}\mathrm{w}}\right)\parallel h\left(f{\left(x\right)}_{\mathrm{n}\mathrm{e}\mathrm{w}}\right)\parallel i\left(t\right)\right\},\end{array}$$

(20)

where the first part $\left\{P_{i\left(t\right)}\parallel h\left(a_i\right)\parallel h\left(b_i\right)\parallel \mathrm{M}\mathrm{A}\mathrm{C}=h(K(i),P_{i\left(t\right)},i\left(t\right))\right\}$ of $L(i{)}^{\prime }$ is still the broadcast authentication information $L\left(i\right)$ , so the common sensor nodes can still make forward authentication work. After forward authentication, each sensor node can get $f{\left(x\right)}_{\mathrm{n}\mathrm{e}\mathrm{w}}$ by $K_i$ and verify $f{\left(x\right)}_{\mathrm{n}\mathrm{e}\mathrm{w}}$ by $h\left(f{\left(x\right)}_{\mathrm{n}\mathrm{e}\mathrm{w}}\right)$ , removing the old $f(x)$ at last.

And the updating for $f(x)$ is completed by now.

4. Security Analysis

Because of the limited resource in WSN, it should meet 3 basic requirements for designing efficient broadcast authentication protocol: Firstly, insure the lower computation and communication cost. Secondly, the base station can make authentication randomly. Thirdly, the sensor nodes can make a real-time authentication. In this paper, the TWBAP protocol has some own security features besides the above the 3 conditions.

4.1. Anticapture

In MBAP, we know that $f(x)$ is the key point of authentication, and the network will not be safe once $f(x)$ leaked, so the selection of $f(x)$ is very important. On the basis of [17], we assume that $f(x)$ is n-variate quadratic polynomial in field P, which has a high anticapture. For example, a key management scheme for distributed sensor networks is proposed by Eschenauer and Gligor in [18], and the main idea of this scheme is based on the binary tth symmetric polynomials, if the enemy captures some nodes which all include the same binary tth symmetric polynomial, and the nodes’ number is more than t, such that the communication key will be decrypted by enemy, it is also called t-collusion attack. In MBAP, if the enemy wants to get the communication keys, it should decrypt the binary tth symmetric polynomial $f(x)$ or the matrix A in formula (18), but A is a symmetric matrix, it means that there are $n(n+\mathrm{1})/\mathrm{2}$ different elements in matrix A needed to be decrypted, and the difficulty of decrypting A will be multiplied when the dimension n of matrix A is slightly changed (as shown in Figure 4). So it shows that it is very difficult to capture the binary tth symmetric polynomial $f(x)$ .

Figure 4

Anticapture performance of MBAP.

In addition to this, we assume that the size of the network in WSN is N, and if $N<n(n+\mathrm{1})/\mathrm{2}$ , it shows that the enemy is unable to decrypt matrix A and also unable to decrypt $f(x)$ . Therefore, for the small or middle size network, the network is absolutely safe as long as $N<n(n+\mathrm{1})/\mathrm{2}$ . And, for the large network, it also can guarantee the network security as long as there is reasonable network structure, such as increasing the number of clusters space and limiting the number of cluster members. It shows that MBAP in this paper has good anticapture performance.

4.2. Low Cost

In this paper, the computation cost and communication cost of MBAP protocol are relatively low, which can meet the requirements of low cost. Firstly, the broadcast authentication information $L\left(i\right)=\left\{P_{i\left(t\right)}\parallel h\left(a_i\right)\parallel h\left(b_i\right)\parallel \mathrm{M}\mathrm{A}\mathrm{C}=h(K(i),P_{i\left(t\right)},i\left(t\right))\parallel i\left(t\right)\right\}$ is verified by single hash operation, while the μTESLA is operated by key chain. Secondly, we can get $K^{\prime }\left(i\right)=K(i-\mathrm{1})+\left(a_i^{\prime }\cos ix+b_i^{\prime }\sin ix\right)$ in (16), where $K(i-\mathrm{1})$ is the authentication key on time slice $i-\mathrm{1}$ which has been authenticated on last time slice, so we can get $K^{\prime }\left(i\right)=K(i)$ by verifying $h\left(a_i^{\prime }\right)=h\left(a_i\right)$ and $h\left(b_i^{\prime }\right)=h\left(b_i\right)$ in Step  4 of Section 3.3, which shows that the calculation of $K(i)$ avoids amounts of the calculation for Fourier series coefficients each time and reduces the computation cost greatly.

4.3. Instant Authentication

In MBAP, we can make authentication immediately based on the characteristics of Fourier series coefficients when the authentication information $L(i)$ is broadcasted by the base station. But the μTESLA protocol needs to make the authentication after the delay time δ, which may cause a communication blocking.

4.4. Delay

In μTESLA, we know that the time interval of sending message $\left\{\mathrm{M}\mathrm{A}{\mathrm{C}}_{K_i}\left(P_i\right)\parallel K_{i-\mathrm{2}}\parallel P_i\parallel i\left(t\right)\right\}$ will be increased gradually, and the time for buffering data packets is also increased because of the authentication delay, which also makes the protocol more vulnerable to be attacked by DoS.

In MBAP, the authentication information $L\left(i\right)=\left\{P_{i\left(t\right)}\parallel h\left(a_i\right)\parallel h\left(b_i\right)\parallel \mathrm{M}\mathrm{A}\mathrm{C}=h(K(i),P_{i\left(t\right)},i\left(t\right))\parallel i\left(t\right)\right\}$ and we get that the plaintext message $P_{i\left(t\right)}$ and authentication key $K(i)$ are sent together in $L(i)$ , and there is no such problem that the time interval of sending message is increased gradually.

We know that authentication delay includes the transmission cost and the computation cost, where the transmission cost is the necessary cost which cannot be avoided. For μTESLA, the authentication delay should also include delay time δ.

In order to analyze the delay problems between MBAP and μTESLA by simulation, we assume that T is the authentication delay and D is the length of time slice, which can be set to 1 in here, and assume delay time $\delta =\mathrm{2}$ , $K_0$ is the initial key, and t is the computation time of a hash calculation.

In μTESLA, $\left\{\mathrm{M}\mathrm{A}{\mathrm{C}}_{K_i}\left(P_i\right)\parallel K_{i-\mathrm{2}}\parallel P_i\parallel i\left(t\right)\right\}$ is the message authentication code on time slice i, we can judge the correctness of $K_{i-\mathrm{2}}$ by $K_{\mathrm{0}}=H^{i-\mathrm{2}}\left(K_{i-\mathrm{2}}\right)$ , it shows that the entity authentication is completed by $i-\mathrm{2}$ times hash calculation, and we can verify the integrity of $P_{i-\mathrm{2}}$ by $\mathrm{M}\mathrm{A}{\mathrm{C}}_{K_{i-\mathrm{2}}}\left(P_{i-\mathrm{2}}\right)$ , and it shows that the source attestation is completed by a hash calculation. So, we assume that $T_{\mathrm{1}}$ is the authentication cost on time slice i in μTESLA, and

$$\begin{array}{cc}& T_{\mathrm{1}}=\left(i-\mathrm{2}\right)t+t+\delta =\left(i-\mathrm{1}\right)t+\delta =\left(i-\mathrm{1}\right)t+\mathrm{2}.\end{array}$$

(21)

In MBAP, $L\left(i\right)=\left\{P_{i\left(t\right)}\parallel h\left(a_i\right)\parallel h\left(b_i\right)\parallel \mathrm{M}\mathrm{A}\mathrm{C}=h(K(i),P_{i\left(t\right)},i\left(t\right))\parallel i\left(t\right)\right\}$ is the message authentication code on time slice i, for the entity authentication, we should calculate $a_i^{\prime }=\left(\mathrm{1}/\pi \right){\int }_{-\pi }^{\pi }f\left(x\right)\cos ix\hspace{0.17em}dx$ and $b_i^{\prime }=(\mathrm{1}/\pi ){\int }_{-\pi }^{\pi }f\left(x\right)\sin ix\hspace{0.17em}dx$ by two conventional operation and calculate $h\left(a_i^{\prime }\right)=h\left(a_i\right)$ and $h\left(b_i^{\prime }\right)=h\left(b_i\right)$ by two times hash calculation, for the source attestation, and we should calculate $K_i^{\prime }=a_0^{\prime }/\mathrm{2}+{\sum }_{k=\mathrm{1}}^i\left(a_k^{\prime }\cos kx+b_k^{\prime }\sin kx\right)$ by a conventional operation and calculate $h(K^{\prime }(i),P_{i\left(t\right)},i\left(t\right))=h(K(i),P_{i\left(t\right)},i\left(t\right))$ by a hash calculation. For ease of calculation, we assume that a conventional operation cost also is t and $T_{\mathrm{2}}$ is the authentication cost on time slice i in MBAP, and

$$\begin{array}{cc}& T_{\mathrm{2}}=\mathrm{4}t.\end{array}$$

(22)

And the authentication cost of $T_{\mathrm{1}}$ and $T_{\mathrm{2}}$ is showed in Figure 5, where $t=\mathrm{0.01}\hspace{0.17em}\mathrm{s}$ . It is obvious that $T_{\mathrm{1}}$ is increased gradually with the time change, which also shows that the μTESLA needs more authentication cost with the time change, while the authentication cost of MBAP is not changed all the time.

Figure 5

T changes.

It shows the cost changes of once authentication calculation on different time slices in Figure 5, but there will be amounts of authentication calculation happening on each time slice actually, which can cause some time delay for each authentication calculation. So, the authentication delay is increased with the time changes. For this reason, we assume that there will be n times authentication calculation happening on each time slice, and we assume that $T_{\mathrm{3}}$ is the authentication cost on time slice i by n times authentication calculation in μTESLA, and

$$\begin{array}{cc}& T_{\mathrm{3}}=n\left(\left(i-\mathrm{2}\right)t+t\right)+\delta =n\left(i-\mathrm{1}\right)t+\delta =n\left(i-\mathrm{1}\right)t+\mathrm{2}.\end{array}$$

(23)

Similarly, we assume that $T_{\mathrm{4}}$ is the authentication cost on time slice i by n times authentication calculation in MBAP, and

$$\begin{array}{cc}& T_{\mathrm{4}}=n\left(\mathrm{4}t\right)=\mathrm{4}nt.\end{array}$$

(24)

For ease of calculating, we assume $n=\mathrm{10}$ , and the authentication cost of these two protocols is showed in Figures 6, 7, and 8.

Figure 6

T changes of μTESLA protocol.

Figure 7

T changes of MBAP protocol.

Figure 8

T changes between two protocols.

It is indicated in Figures 6 and 7 that the authentication delays of these two protocols are all increased with the time changes, but the authentication delays of μTESLA are increased much faster with the authentication calculation increasing, while the authentication delay of MBAP is changed stably.

It is indicated in Figure 8 that there will be some messages abandoned on some slices with the authentication delay increasing in μTESLA; it is one of the issues in μTESLA analyzed in Section 2.

4.5. Initialization Parameter

In MBAP, the only predistributed initialization parameter is $f(x)$ , and if $f(x)$ is a quadratic polynomial, this can make a mutual authentication.

While in μTESLA the initialization parameters are $\left\{K_{\mathrm{0}},\delta ,D,T_{\mathrm{0}}\right\}$ and if the nodes send the initialization parameters $\left\{K_{\mathrm{0}},\delta ,D,T_{\mathrm{0}}\right\}$ in unicast way upon network initialization, that will cause much resource consumption, because the sending node needs to encrypt $\left\{K_{\mathrm{0}},\delta ,D,T_{\mathrm{0}}\right\}$ in different keys shared with the receiving node, which will cause the delay for data packet transmission and authentication, and the delay may lead to DoS attacks.

4.6. Length of the Key Chain

In μTESLA, when the sensor nodes receive the published key $K_j$ , we can verify the correctness of $K_j$ by $K_{\mathrm{0}}=H^j\left(K_j\right)$ or $K_i=H^{\left(j-i\right)}\left(K_j\right)$ , where $K_i$ is the verified key before $K_j$ and $K_{\mathrm{0}}$ is the initial key. So in order to complete the authentication task in μTESLA, it needs to save a long secret key chain and needs to reconstruct the key chain sometimes, which makes a large network load.

In MBAP, the authentication key $K(i)$ is Fourier series, and we can get $K^{\prime }\left(i\right)=K(i-\mathrm{1})+\left(a_i^{\prime }\cos ix+b_i^{\prime }\sin ix\right)$ in (16), where $K(i-\mathrm{1})$ is the authentication key on time slice $i-\mathrm{1}$ which has been authenticated on last time slice, so we can get $K^{\prime }\left(i\right)=K(i)$ by verifying $h\left(a_i^{\prime }\right)=h\left(a_i\right)$ and $h\left(b_i^{\prime }\right)=h\left(b_i\right)$ in Step  4 of Section 3.3, which shows that the calculation of $K(i)$ avoids amounts of the calculation of Fourier series coefficients each time and reduces the computation cost greatly.

5. Summary

This thesis presents a mutual broadcast authentication protocol (MBAP) for wireless sensor networks based on Fourier series according to the problems of the main broadcasting authentication protocol μTESLA being limited in authentication delay, more initial parameters, limited time, large key chain, and network congestion. And the mutual authentication between nodes and base station is achieved according to the characteristic of continuous-integrability function $f(x)$ in $\left[-\pi ,\pi \right]$ which could be expanded into Fourier series. Firstly, one has predistributing $f(x)$ for each node upon network initializing, calculating the current Fourier series coefficients, establishing authentication key $K^{\prime }$ , verifying the correctness of the broadcast authentication information, achieving entity authentication, and source attestation. Secondly, assuming that $f(x)$ is the quadratic form function and achieving the reverse authentication work for base station to common sensor nodes by detecting the security of $f(x)$ , it also means that the MBAP protocol can achieve mutual security authentication. The analysis results of safety performance in MBAP show that the captured nodes in WSN will not affect the security of broadcast authentication protocol and have a low computation and communication cost, the base station can make broadcast randomly, and common sensor nodes can authenticate messages instantly, which solves the problem of network congestion well. The most important thing of MBAP is the mutual broadcast authentication method which ensures the security of the network greatly.