Key management and node authentication method for sensor network

A key management and node authentication method for a sensor network comprising:

• obtaining, by respective nodes, keys pre-distributed from a deployment server to establish secure connections between the nodes, and broadcasting, by each node, its identity identifier information to its neighbor nodes after the network is deployed;
• determining, by each node, from the received identity identifier information transmitted from a neighbor node whether there is a shared key with the corresponding neighbor node, and if so, creating, by each node, a pair-wise key with the corresponding neighbor node;
• otherwise, creating, by each node, a pair-wise key with a node with a multi-hop secure connection thereto;
• and
• performing, by each node, identity authentication with the created pair-wise key prior to formal communication with another node to verify the identity of the other node for legality and validity,
• wherein each node is configured with an ID list comprising an N_ID field, a K_ID field, a K_STA field, a K_ATTR field, a K_ATTR_EX field and a K_VAL field wherein:
• the N_ID field represents a node ID indicating the identifier value of the identity of a node sharing a key with the each node;
• the K_ID field represents a key ID indicating the identifier value of the key shared between the each node and the node identified by the N_ID field;
• the K_STA field represents a key status indicating the status of the key identified by the K_ID field, wherein the value of the K_STA field is “Created” if the each node has created a pair-wise key with the node identified by the N_ID field or otherwise “Not Created”, and this field is initialized to “Not Created”;
• the K_ATTR field represents a key attribute, wherein the value of this field is significant, when the value of the K_STA field is “Created”, to indicate whether the key identified by the K_ID field is a shared key or a path key, and this field is defaulted to indicate a shared key;
• the K_ATTR_EX field represents an extended key attribute, wherein the value of this field is significant, when the key identified by the K_ATTR field is a path key, to indicate that whether the path key is a direct connection key or a multi-hop connection key, and this field is defaulted to indicate a direct connection key;
• and
• the K_VAL field represents a key value for storing the value of the key identified by the K_ID field,
• wherein creating, by each node, a pair-wise key with a node with a multi-hop secure connection thereto comprises:
• when there is a secure path between a source node and a destination node, which is consisted of a plurality of nodes between every two of which there is a shared key, the source node generating a path key PK, selecting a different ID from standby path key IDs and transmitting the path key PK and a corresponding key ID together with the ID of the source node and the ID of the destination node to the destination node over the secure path with the destination node while being hop-wise encrypted and decrypted by the nodes along the secure path;
• and
• the destination node receiving and decrypting a key message of the source node to obtain the path key PK and then transmitting a key creation success message to the source node over the secure path with the source node to indicate that a secure connection has been established with the source node;
• and each of the source node and the destination node inserting the identity identifier ID of the other node into its ID list as a new entry, inserting the ID of PK and the value of PK into a corresponding K_ID field and K_VAL field and setting a corresponding K_STA field to “Created”, a K_ATTR field to “Path Key” and a corresponding K_ATTR_EX field to “Direct Connection Key”, if there is a single-hop path between the source node and the destination node when the path key is created, which indicates that each of the source node and the destination node comes into a range of direct communication with the other, or to “Multi-Hop Connection Key” otherwise.

A key management and node authentication method for a sensor network comprising:

• obtaining, by respective nodes, keys pre-distributed from a deployment server to establish secure connections between the nodes, and broadcasting, by each node, its identity identifier information to its neighbor nodes after the network is deployed;
• determining, by each node, from the received identity identifier information transmitted from a neighbor node whether there is a shared key with the corresponding neighbor node, and if so, creating, by each node, a pair-wise key with the corresponding neighbor node;
• otherwise, creating, by each node, a pair-wise key with a node with a multi-hop secure connection thereto;
• and
• performing, by each node, identity authentication with the created pair-wise key prior to formal communication with another node to verify the identity of the other node for legality and validity,
• wherein each node is configured with an ID list comprising an N_ID field, a K_ID field, a K_STA field, a K_ATTR field, a K_ATTR_EX field and a K_VAL field wherein:
• the N_ID field represents a node ID indicating the identifier value of the identity of a node sharing a key with the each node;
• the K_ID field represents a key ID indicating the identifier value of the key shared between the each node and the node identified by the N_ID field;
• the K_STA field represents a key status indicating the status of the key identified by the K_ID field, wherein the value of the K_STA field is “Created” if the each node has created a pair-wise key with the node identified by the N_ID field or otherwise “Not Created”, and this field is initialized to “Not Created”;
• the K_ATTR field represents a key attribute, wherein the value of this field is significant, when the value of the K_STA field is “Created”, to indicate whether the key identified by the K_ID field is a shared key or a path key, and this field is defaulted to indicate a shared key;
• the K_ATTR_EX field represents an extended key attribute, wherein the value of this field is significant, when the key identified by the K_ATTR field is a path key, to indicate that whether the path key is a direct connection key or a multi-hop connection key, and this field is defaulted to indicate a direct connection key;
• and
• the K_VAL field represents a key value for storing the value of the key identified by the K_ID field,
• wherein performing by each node identity authentication with the created pair-wise key prior to formal communication with another node to verify the identity of the other node for legality and validness comprises:
• a node A transmitting a message IDB∥K_IDAB∥NA to a node B to request for authentication with the node B, wherein K_IDAB represents the identifier of a pre-shared key of the node A and the node B, NA represents a random number generated by the node A, and IDB represents the identity identifier of the node B;
• upon reception of the authentication request of the node A, the node B firstly determining whether IDB in the request message is identical with its identity identifier ID, and if not, the node B discarding the request message;
• otherwise, the node B determining whether a key corresponding to K_IDAB is stored in its ID list, and if not, terminating authentication;
• otherwise, generating an inquiry NB and calculating MAKAB∥SKAB=F(PSKAB,IDA∥IDB∥NA∥NB) from IDA, IDB, NA and NB using the value of the K_VAL field in the ID list corresponding to K_IDAB, wherein the value of the K_VAL field is a pre-shared key PSKAB of the node node and the node B, wherein MAKAB represents a message authentication key between the node A and the node B, and SKAB represents a session key between the node A and the node B;
• and then generating a message authentication code MAC1=H(MAKAB,IDA∥NA∥NB) from MAKAB and constructing and transmitting a message IDA∥NA∥NB∥MAC1 to the node A, wherein F represents a key derivation algorithm, and H represents a message authentication code calculation method, both of which are typically a unidirectional function;
• upon reception of the message of the node B, the node A firstly checking the inquiry NA in the message for consistency with the inquiry NA the node A transmitted, and if they are inconsistent, terminating authentication;
• otherwise, the node A calculating MAKAB∥SKAB=F(PSKAB,IDA∥IDB∥NA∥NB) and calculating a message authentication code MAC2=H(MAKAB,IDA∥NA∥NB) from MAKAB, and if MAC2=MAC1, the node A authenticating the node B successfully, storing SKAB as a session key with the node B, calculating MAC3=H(MAKAB,IDB∥NB) and transmitting IDB∥NB∥MAC3 to the node B, wherein F represents a key derivation algorithm, and H represents a message authentication code calculation method, both of which are typically a unidirectional function;
• and
• upon reception of the message of the node A, the node B checking the inquiry NB in the message for consistency with the inquiry NB the node B has transmitted to the node A, and if they are inconsistent, failing with authentication;
• otherwise, the node B calculating MAC4=H(MAKAB,IDB∥NB), and if MAC4=MAC3, the node B authenticating the node A successfully, and the node B storing SKAB as a session key with the node A, calculating MAC5=H(MAKAB,IDA∥NA) and transmitting a message IDA∥NA∥MAC5 to the node A, wherein F represents a key derivation algorithm, and H represents a message authentication code calculation method, both of which are typically a unidirectional function.