HAL Id: hal-00776477https://hal.archives-ouvertes.fr/hal-00776477

Submitted on 15 Jan 2013

HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.

A new class of Hash-Chain based key pre-distributionschemes for WSN

Walid Bechkit, Yacine Challal, Abdelmadjid Bouabdallah

To cite this version:Walid Bechkit, Yacine Challal, Abdelmadjid Bouabdallah. A new class of Hash-Chain based keypre-distribution schemes for WSN. Computer Communications, Elsevier, 2013, 36 (3), pp.243-255.�10.1016/j.comcom.2012.09.015�. �hal-00776477�

A New Class of Hash-Chain Based Key Pre-distribution Schemes for WSN

Walid BECHKIT1, Yacine CHALLAL1, Abdelmadjid BOUABDALLAH1

Universite de Technologie de Compiegne, Laboratoire HeuDiaSyc, UMR CNRS 7253, Compiegne, France

Abstract

In the last decade, we witness a proliferation of potential application domains of wireless sensor networks (WSN).Therefore, a host of research works have been conducted by both academic and industrial communities. Nevertheless,given the sensitivity of the potential applications that are generally tightly related to the physical world and may behuman beings, a large scale deployment of WSN depends on the dependability provided by these emerging networks.Particularly, security emerges as a challenging issue in WSN because of the resource limitations. Key management isone of the required building blocks of many security services, such as confidentiality, authentication, etc. Unfortunately,public key based solutions, which provide efficient key management services in conventional networks, are unsuitablefor WSN because of resource limitations. Symmetric key establishment is then one of the most suitable paradigms forsecuring wireless sensor networks.In this paper, we tackle the resiliency of symmetric key pre-distribution schemes against node capture. We proposea hash-based mechanism which enhances the resiliency of key pre-distribution for WSN. Applied to existing key pre-distribution schemes, our solution gives birth to enhanced schemes which are more resilient against node capture attacks.We analyze and compare our solution against the existing schemes, with respect to some important criteria such as: thenetwork resiliency against node capture, secure connectivity coverage, storage requirement, communication overhead andcomputation complexity. We show through analytical analysis that our solution enhances the network resiliency withoutintroducing any new storage or communication overheads. Moreover, we show that our solution introduces insignificantcomputational overhead.

Keywords: wireless sensor networks, security, key management, resilience

1. Introduction

A Wireless Sensor Network (WSN) is a wireless networkwhich is composed of a set of tiny autonomous sensor nodeswith sensing, computation, and wireless communicationcapabilities [1]. The purpose of such networks is to collectinformation issued from a controlled environment or a tar-get object and then send it to a base station usually calledthe sink. Because of size factor and cost considerations,wireless sensor networks suffer from resource constraintsincluding energy, memory, computation power and com-munication bandwidth and range. Nowadays, wireless sen-sor networks are increasingly used in numerous fields suchas military, medical, industrial and environmental sectors;they are more and more involved in several sensitive appli-cations which require sophisticated security services. Dueto the resource limitation, existing security solutions forconventional networks could not be used in wireless sensornetworks. So, the security issues became then one of themain challenges for the resource restricted environment ofWSN which requires new specific solutions.

Email addresses: wbechkit@hds.utc.fr (Walid BECHKIT),ychallal@hds.utc.fr (Yacine CHALLAL), bouabdal@hds.utc.fr(Abdelmadjid BOUABDALLAH)

Key management is a corner stone service for many se-curity services such as confidentiality and authenticationwhich are required to secure communications in wirelesssensor networks. The establishment of secure links be-tween nodes is then one of the most challenging problemsin WSN. The public key based solutions, which provide ef-ficient key management services in conventional networks,are unsuitable for wireless sensor networks because of theenergy, computation and storage limitations. Some pub-lic key schemes have been implemented on real sensors[2][3], however most researchers believe that these tech-niques are still too heavyweight over actual sensors’ tech-nology because they induce an important communicationand computation overhead [4]. Symmetric key establish-ment is then one of the most suitable paradigms for secur-ing exchanges in wireless sensor networks. Because of thelack of infrastructure in WSN, we have usually no trustedthird party which can attribute pairwise secret keys toneighboring nodes, that is why key pre-distribution is themost suitable paradigm for wireless sensor networks.

Many symmetric key pre-distribution schemes for wire-less sensor networks have been proposed in literature[5][6][7][8][9][10][11][12][13]. We classify these schemes intotwo categories: deterministic schemes which ensure a to-

Preprint submitted to Computer Communications May 23, 2012

tal secure connectivity coverage and probabilistic schemeswhere secure connectivity is not guaranteed and condi-tioned by the existence of shared keys. In order to evalu-ate the performances of key pre-distribution schemes, weconsider five main metrics which are: network resiliencyagainst node capture, secure connectivity coverage, com-munication overhead, computation complexity and storageoverhead. In this paper, we consider in particular the re-siliency of symmetric key pre-distribution schemes. Exist-ing research works which addressed the network resiliencyeither introduce an important storage and communicationoverhead or degrade the secure connectivity coverage. Incontrast to these solutions, our goal is to enhance the re-siliency of WSN key management schemes without intro-ducing any new storage or communication overheads whilemaintaining a high secure connectivity coverage.

In this work, we propose a hash-based mechanism whichcan be applied to existing pool based key pre-distributionschemes to enhance the network resiliency. To achievethis goal, we introduce a new method based on one wayhash chain which conceals keys in such a way that the dis-closure of some keys reveals only derived versions, whichcannot be used to compromise other links in the networkusing backward keys. We call our solution: Hash-Chainclass of key pre-distribution schemes and denote it by HC.Our class, applied to existing key pre-distribution schemes,gives birth to new schemes which are more resilient againstnode capture attacks. We carried out analytical analysisto compare the efficiency of our approach against basicschemes with respect to important performance criteria:the network resiliency against node capture, the secureconnectivity coverage, the communication overhead, thecomputation complexity and the storage overhead. Theobtained results show that our solution enhances the net-work resiliency and reduces the fraction of compromisedlinks up to 40% compared to existing schemes while itguarantees the same secure connectivity coverage, stor-age and communication performance. Moreover, we showthrough analytical analysis and simulations that the in-duced computational overhead is insignificant and that theenergy consumed by hash computations in our solution isnegligible.

The contributions of our work are many folds and canbe summarized in the following points:

• We review the state of the art of key managementin wireless sensor network. Then, we propose a clas-sification of symmetric key management schemes forWSN into two categories: probabilistic schemes anddeterministic ones. We further refine the classifica-tion into sub-categories with respect to the underly-ing concepts and techniques used in key exchange andagreement.

• We introduce a mechanism to enhance the networkresiliency of key pre-distribution schemes for WSN.The proposed solution is based on lightweight hash

chains and improves the resiliency of existing pool-based key pre-distribution schemes.

• We analyze and compare our solution against theexisting schemes, with respect to important crite-ria which are: the network resiliency against nodecapture, secure connectivity coverage, storage re-quirement, communication overhead and computationcomplexity. We show through analytical analysis thatour solution enhances the network resiliency withoutintroducing any new storage or communication over-heads. Moreover, we show that our solution does notintroduce significant computational overhead.

The remainder of this paper is organized as follows: sec-tion 2 presents related works on key management for wire-less sensor networks. We define in section 3 the metricsused to evaluate our solution and to compare it to exist-ing schemes. Section 4 gives a general idea of our class ofpool based key pre-distribution schemes. In section 5, wepresent the resilient HC(q-composite) scheme issued fromthe application of our mechanism to the well known proba-bilistic q-composite scheme , we compare the performancesof the two schemes and we discuss analytical results. Insection 6, we apply our class to a deterministic schemebased on the combinatorial design which gives birth to amore resilient deterministic scheme; we also analyze andcompare their performances. In section 7, we introduce anew smart attack against our mechanism and propose anenhanced version as countermeasures against this attack.Finally, section 8 ends up this paper with some conclu-sions.

2. Related works: key management schemes forWSN

Key management problem in wireless sensor networkshave been extensively studied in the literature and sev-eral solutions have been proposed. Many classificationsof symmetric key management schemes can be found in[14][15][16]. In this work, we mainly classify symmetricschemes into two categories: probabilistic schemes anddeterministic ones. In deterministic schemes, each twoneighboring nodes are able to establish a direct securelink which ensures a total secure connectivity coverage. Inprobabilistic schemes, the secure connectivity is not guar-anteed because it is conditioned by the existence of sharedkeys between neighboring nodes.

2.1. Probabilistic schemes

In probabilistic key management schemes, each twoneighboring nodes can establish a secure link with someprobability. If two neighboring nodes cannot establish asecure link, they establish a secure path composed of suc-cessive secure links.Eschenauer and Gligor proposed in [5] the basic Ran-

dom Key Pre-distribution scheme denoted by RKP. In this

2

scheme, each node is pre-loaded with a key ring of m keysrandomly selected from a large pool S of keys. After thedeployment step, each node i exchanges with each of itsneighbor j the list of key identifiers that it maintains. Thisallows node j to identify the keys that it shares with nodei. If two neighbors share at least one key, they establisha secure link and compute their session secret key whichis one of the common keys. Otherwise, nodes i and j donot have common keys. So, they should determine securepaths which are composed by successive secure links. Thevalues of the key ring size m and the key pool size |S| arechosen in such a way that the intersection of two key ringsis not empty with a high probability p. This basic ap-proach is CPU and energy efficient but it requires a largememory space to store the key ring. Moreover, if the net-work nodes are progressively corrupted, the attacker maydiscover a large part or the whole global key pool. Hence,a great number of links will be compromised. This is dueto the fact that a given key may be used to secure differentlinks if it is common between key rings of different pairsof nodes.Chan et al. proposed in [6] a protocol called q-composite

scheme that enhances the resilience of RKP. In this solu-tion, two neighboring nodes can establish a secure linkonly if they share at least q keys. The pairwise session keyis calculated as the hash of all shared keys concatenatedto each other: Ki,j = Hash(Ks1‖Ks2‖...‖Ks

q′) where

Ks1 ,Ks2 , ...Ksq′

are the q′ shared keys between the twonodes i and j (q′ ≥ q). This approach enhances the re-silience against node capture attacks because the attackerneeds more overlap keys to break a secure link. However,this approach degrades the network secure connectivitycoverage because neighboring nodes must have at least qcommon keys to establish a secure link.Chan et al. proposed in [6] another pairwise key pre-

distribution scheme in which they aim to ensure a per-fect resiliency and a given secure coverage probability p.Authors propose to use a distinct key to secure each linkbetween each pair of nodes. They assign to each two neigh-boring nodes i and j a distinct key ki,j . Prior to deploy-ment, each node is pre-loaded with p ∗N keys, where N isthe network size (number of nodes in the network) and p isthe desired secure coverage probability. Hence, the prob-ability that the key ki,j belongs to the key set of the nodei is p. Since we use distinct keys to secure each pair-wiselink, the resiliency against node capture is perfect and anynode that is captured reveals no information about linksthat are not directly connected to it. It is obvious thatthe main drawback of this scheme is the non scalabilitybecause the number of the stored keys depends linearly onthe network size. In addition, this solution does not allowthe node post-deployment because existing nodes do nothave the new nodes’ keys.Du et al. proposed in [7] to enhance the secure con-

nectivity and the resiliency of the basic random key pre-distribution schemes. Their solution requires deploymentknowledge and uses several key pools instead of one. Nodes

are organized in regional groups to which is assigned dif-ferent key pools and each node selects its m keys from thecorresponding key pool. The key pools are constructed insuch a way that neighboring key pools share more keyswhile key pools far away from each other share fewer keysor no keys at all. This approach allows to enhance the se-cure connectivity coverage because the key pools becomesmaller. Moreover, the resiliency of Du et al. solution isimproved since if some nodes of a given region are cap-tured, the attacker could discover only a part of the cor-responding group key pool. However, the application ofthis scheme is restrictive since the deployment knowledgeof the wireless sensor network is not always possible.In [8], Castelluccia and Spognardi adapted the basic

scheme described above to the multi-stage wireless sen-sor networks where new nodes are periodically deployedto ensure the network connectivity. With a one-stage de-ployment, if the network is continuously attacked, the at-tacker could discover an important part of the global keypool and new established links will be immediately com-promised. Authors in [8] proposed the use of keys withlimited lifetimes and which are updated periodically. Theproposed solution divides the lifetime of a node into k gen-erations. Initially, each node has two key rings: a forwardkey ring (FKR) and a backward one (BKR). The forwardkey rings are updated at each generation using a securehash function while the backward ones are updated usinga hash-based Lamport chain, where they start by generat-ing the keys of the last expected generation. If a node isdeployed at generation i and will last at most until gener-ation j, it will be configured with the FKR of generationi and the BKP of the generation j. The two key subsetsare updated at each generation thanks to the two hashfunctions. Authors in [8] showed that by using limitedlifetime keys, the network self-heals and recovers its initialstate when attacks stop. In the other hand, the ratio ofcompromised links remains constant when the network isconstantly attacked in contrast to the basic schemes.In [9], Liu et Ning proposed a new pool based polyno-

mial pre-distribution scheme for WSN based on previouswork of Blundo et al. [17]. This approach can be con-sidered as an extension of the basic RKP scheme wherenodes are pre-loaded with polynomials instead of keys. Ba-sic polynomial key management scheme proposed in [17] isbased on symmetric bivariate λ-degree polynomials P(x,y)generated over a finite field Fq where q is prime. Themain property of symmetric bivariate polynomial is thatP (x, y) = P (y, x). In this scheme, each node i is pre-loaded with the polynomial Pi(y) = P (i, y). In order toestablish a secure link between two neighbors i and j, eachnode evaluates its polynomial at the identifier of the othernode. Hence the secret key between two nodes i and j isKij = Pi(j) = Pj(i). The node identifiers are supposedto be unique. This approach was proved to be secure andλ-collusion resistant. In [9], Liu and Ning extended thisapproach to wireless sensor networks when they proposed apool based polynomial pre-distribution scheme to establish

3

Figure 1: Classification of symmetric key management schemes for WSN

secure links. A global pool of symmetric bivariate poly-nomials is generated off-line and each node is pre-loadedprior to deployment with a subset of polynomials. If twoneighboring nodes share a common polynomial, they es-tablish a direct secure link as described above; else, theytry to find a secure path as proposed in the RKP scheme.This approach allows to compute distinct secret session, sothe resilience against node capture is enhanced. However,this solution requires more memory to store the symmet-ric bivariate polynomials and induces more computationaloverhead.

In [18], Blom proposed a symmetric key generationsystem in which each node i stores a column i and arow i of size (λ + 1) of two matrices G and (D ∗ G)T

respectively where : D(λ+1)×(λ+1) is a symmetric matrix,G(λ+1)×n is a public matrix and (D ∗ G)T is a secretmatrix. The matrix of pairwise keys of a group of nnodes is then K = (D ∗ G)TG. In other terms, eachpair of nodes i and j compute their session key asKij = rowi ∗ columnj = rowj ∗ columni. This solution isproved to be λ-secure, which means that keys are secureif no more than λ nodes are compromised. The Blom’sscheme cannot be applied to all the network nodes in awireless sensor network because each node needs memoryto store huge vectors. Yu and Guan [10] adapted theBlom’s scheme to group-based wireless sensor networkswhere they assume deployment knowledge. Nodes aredeployed into a grid and each group is assigned a distinctsecret matrix. Using deployment knowledge, the potentialnumber of neighboring nodes decreases which requires lessmemory. We believe that this scheme is only adapted forsome restrictive applications of wireless sensor networkssince deployment knowledge is not always possible.

2.2. Deterministic schemes

Deterministic schemes ensure that each node is able toestablish a pair-wise key with all its neighbors. Many so-lutions were proposed to guarantee determinism.

LEAP [11] make use of a common transitory key which ispreloaded into all nodes prior to deployment of the WSN.The transitory key is used to generate pairwise session keysand is cleared from the memory of nodes by the end of ashort time interval after their deployment. LEAP is basedon the assumption that a sensor node, after its deployment,is secure during a time Tmin and cannot be compromisedduring this period of time. LEAP is vulnerable to nodecompromise. For instance, if the transitory initial key isdiscovered, the entire network could be compromised.

In [12], Camtepe and Yener proposed a deterministicpool based key pre-distribution scheme. Instead to selectrandomly a subset of keys from the global key pool, theypropose a new construction methodology based on combi-natorial design theory. The main purpose is that each twosubsets of keys share exactly one common key which en-sures a total secure connectivity coverage. To achieve thisgoal, authors make use of particular combinatorial designwhich is the Symmetric Balanced Incomplete Block De-sign theory. This scheme is presented with more details insection 6.

In [19], authors propose to use the Camtepe scheme forkey management in grid group WSN. Authors divide thedeployment area into square regions. In each region, theypropose to use the symmetric Balanced Incomplete BlockDesign based key pre-distribution in order to ensure theintra-region secure communications. Inter-region commu-nications are guaranteed thanks to special nodes havingplentiful resources and called agents. Furthermore, au-thors propose to enhance the Camtepe scheme in order toavoid key identifier exchanges. For this purpose, they in-dex all nodes and keys and propose a mapping between

4

node indexes and key indexes.Perrig et al. proposed in [20][21] a security suite for

WSN having two blocks: i) SNEP which provides dataconfidentiality, two-party data authentication, and datafreshness and ii) µTESLA which provides authenticatedbroadcast. SPINS propose to use the base station (Sink)as a trusted third party (TTP) in order to establishsecure links between nodes. If a node i wants to establisha session secret key with node j, it sends a requestmessage to node j. Upon receiving this message, thenode j sends a message to the sink (TTP) which verifiesthe authentication, generates the secret session key andsends it to the nodes i and j. The use of the sinkas a third trust party leads to an important commu-nication overhead and degrades the network performances.

We focus in this paper on probabilistic and determinis-tic pool based key management schemes as illustrated infigure 1. In what follows, we propose a mechanism to en-hance the resilience of these schemes by concealing keysthrough the use of an efficient hash chaining mechanism.Our approach can be applied to any pool based key pre-distribution scheme including [5], [6], [7], [8], [12] and allschemes derived from them. This allows to define a newresilient class of pool based key pre-distribution schemes.In this paper, we apply our class to two schemes: the wellknown probabilistic q-composite scheme proposed by Chanet al. [6] and the deterministic scheme based on Symmet-ric Balanced Incomplete Block Design theory proposed byCamtepe and Yener [12]. We evaluate our hash chain classand compare it against the basic schemes with respect toimportant performance metrics that we define in the nextsection.

3. Evaluation Metrics

In this work, we consider five metrics to evaluateperformances of wireless sensor network key managementschemes:

Network resiliency against node capture : Due tothe resource limitations in WSN, sensor nodes are usuallynot tamper resistant. If an adversary compromises a node,he can read all secret information from its memory. Suchan attack can compromise not only adjacent links of com-promised links but also external links that are independentof the compromised nodes. We define the resilience againstnode capture Rx as the fraction of uncompromised exter-nal links when x sensor nodes are compromised. We notethat we consider in a first time the oblivious attacks wherenodes are randomly captured. We discuss later in section7, possible smart attacks as well as countermeasures.Secure connectivity coverage : We define the secure

connectivity coverage as the fraction of secured direct linksamong possible links in the network which is the proba-bility that a given pair of neighboring nodes are able toestablish a secure link. Note that we focus in our metric

on the direct (one hop) secure link establishment; some so-lutions propose to establish a multi-hop secure path whenthe direct secure link establishment fails which we do notconsider in this metric.Computation complexity : Some key management

schemes like [6], [9], [10] and the approach that we proposein this work require to perform additional computationaloperations such as hash functions or modulo multiplica-tions. The additional processing may consume more en-ergy and may induce a computational delay. We calculatein this metric the average number of additional operationsrequired to establish secure links.Communication overhead : The communication

overhead measures the size of data exchanged between apair of nodes in order to establish direct secure links. Thismetric has a significant influence on the energy consump-tion because the most of the consumed energy is due tocommunication.

Storage overhead : Because of their small size, sensornodes are very constrained in term of memory resource.In what relates to key management schemes, we focus onthe memory required to store the keys.

The proposed classification of key pre-distributionschemes into deterministic schemes and probabilistic onesis based on the secure connectivity coverage metric. Deter-ministic schemes are those which ensure a total secure con-nectivity coverage (the probability of establishing directsecure links is one). However, the probabilistic schemesare those which have not a total secure connectivity cov-erage.

4. Our Solution: HC(x) A resilient class of hash-chain based key pre-distribution schemes

As introduced before, we consider in this work the re-siliency of symmetric key pre-distribution schemes againstnode capture. We propose a resilient class of key pre-distribution protocols that we denote by HC(x) for Hash-Chain(x), where x is an existing pool based key pre-distribution protocol. This class of protocols enhances theresilience of existing schemes through a lightweight hashchaining technique that conceals the same keys pre-loadedin different sensor nodes. A preliminary work and few dis-cussions on the network resiliency were presented in [22].To conceal keys, we apply a one way hash function to thepre-distributed keys before deployment: a hash function his applied to each node keys a number of times dependingon the node identifier. As known, the main characteristicof hash functions is that knowing a value of the chain itis computationally infeasible to determine the backwardvalues. So, with our approach, when an attacker corruptsone or more keys it can only discover a derived version(forward values).Let us consider two neighboring nodes i and j. Node

i applies i times the hash function h to each key of its

5

Figure 2: Illustration of the hash-chain based approach

key ring. Node j applies j times the hash function h toeach key of its key ring. When nodes i and j discover acommon key identifier id, the common key between i andj is then hmax(i,j)(Kid)). Node min(i, j) can calculate thecommon key by applying the hash function h, |i− j| timesto the key having the identifier id. Figure 2 illustratesthese steps applied to two nodes whose identifiers are 3,and 7 respectively. We notice that key having the identifier5 is common to both nodes 3 and 7. The common key isthen h7(K5) and node 3 can then calculate this commonkey by applying again the hash function h, |3 − 7| = 4times to its key h3(K5).The application of this version of our class in large scale

wireless sensor network may introduce an important hashcomputation overhead. Indeed, nodes may have high iden-tifiers and should then apply the hash function a largenumber of times. In order to reduce the computation over-head, we introduce a parameter called L. Each node i ap-plies the one way hash function h to their keys (i mod L)times instead of i times, the number of hash computationis then bounded by L. We discuss later how to choose theL parameter and its impact on the network resiliency andthe hash computation overhead.We show in what follows that we enhance the networkresiliency against node capture where the computationaloverhead remains insignificant. Our approach can be ap-plied to any pool based key pre-distribution scheme. Tofacilitate the explanation of the concepts behind our ap-proach, we have chosen to apply our mechanism to twoconcrete schemes. A probabilistic scheme which is the q-composite scheme [6] and a deterministic one which is theSymmetric Balanced Incomplete Block Design scheme [12].

5. HC(q-composite): A highly resilient q-composite scheme

In this section, we develop a highly resilient key manage-ment solution by applying our solution to the q-compositescheme [6]. The proposed protocol which we denote byHC(q-composite) is more resilient against node capture aswe demonstrate in the following analysis.Before the deployment of the WSN, a large pool S of

keys and their identifiers are generated off-line. Each nodeis preloaded with a key ring of m keys randomly selectedfrom the key pool S. Before the deployment phase, weapply a hash function h, (i mod L) times to the pre-loadedkeys of each node, where i is the node identifier and L is aparameter of our class, which allows to reduce the numberof hash operation as explained before. So, each node i is

preloaded with the set of keys KRi such us:KRi =

{

hi mod L(K1), hi mod L(K2), ...h

i mod L(Km)}

where K1,K2, ...Km are the randomly selected keys fromS.

After the deployment phase, each two neighboring nodescan establish a secure link only if they share q or morecommon keys. The pairwise secret key between two neigh-boring nodes is computed as the hash of all their sharedkeys concatenated to each other.Let us assume that the node i shares q′ keys (q′ >= q)with its neighbor j and that (i mod L) > (j mod L).The node i computes its shared secret key with j as fol-lows:

Kij = Hash(Kis1‖Ki

s2‖...‖Ki

sq′)

where Kis1,Ki

s2, ...,Ki

sq′

are the common keys with the

node j.

The node j computes its key as :

Kji = Hash(h(i mod L)−(j mod L)(Kjs1)‖

h(i mod L)−(j mod L)(Kjs2)‖

...‖h(i mod L)−(j mod L)(Kjsq′))

where Kjs1,Kj

s2, ...,Kj

sq′

are the common keys with the

node i. Indeed, node j which have the minimum iden-tifier may apply the hash function (i mod L)− (j mod L)times to each shared key (Kj

sp) in order to compute the

key having the same identifier and pre-loaded in node iwhich is (Ki

sp). The session key between i and j is then

Kij = Kji.

5.1. Example:

To illustrate our idea, let us refer to the figure 3. Tosimplify the comprehension, we apply our approach to the1-composite scheme (q-composite scheme with q=1) andwe consider a network of seven nodes, a key pool contain-ing six keys (|S| = 6) and each node is pre-loaded withm = 2 keys. In the basic 1-composite scheme (Figure3(a)), the corruption of nodes 4 and 7 induces the disclo-sure of the keys K1,K3 and K5, and then the compromiseof the three external links (1,2),(2,3) and (5,6).

Using our protocol HC(1-composite) (Figure 3(b)), keysare hashed before the deployment phase (we assume in theexample that L = 5). So the node 4 is pre-loaded with thekeys h4(K1) and h4(K5) instead of K1 and K5, the node 7is pre-loaded with the keys h2(K3) and h2(K5) instead ofK3 and K5 and so on. If we consider the same scenario asabove, the corruption of the two nodes 4 and 7 induces thedisclosure of the derived keys h4(K1), h

4(K5), h2(K3) and

h2(K5). In this case, the link (2,3) can be compromisedbecause the attacker can compute h3(K3) knowing h

2(K3).However, the two other external links (1,2) and (5,6) can-not be compromised because it is infeasible to calculateh2(K1) knowing h4(K1) and h(K3) knowing h2(K3).

6

(a) 1-composite (b) HC(1-composite)

Figure 3: Example: 1-composite Vs HC(1-composite)

5.2. Analysis

In this section, we will evaluate the performance of ourprotocol HC(q-composite), we compare it to the basic q-composite scheme with respect to the metrics defined insection 3. We recall in table 1 the main symbols that weuse in what follows:

Table 1: SUMMARY OF NOTATIONS

S The global key pool|S| The size of the global key poolm The size of the node key ringq The minimum number of common keys required

to establish a secure linkp(k) The probability that two nodes share exactly k

keys in their subset of keysp The probability that two nodes can establish a

secure linkL The parameter of the HC approachn The network size (number of nodes)

5.2.1. Network resiliency against node capture

In this section, we compare the network resiliency ofthe two schemes: q-composite and HC(q-composite). Asstated before, we define the network resiliency Rx as thefraction of uncompromised links when x nodes are cap-tured, we have then:Rx = 1− P (LC|NCx)where :

• LC is the event that a link is compromised

• NCx is the event that x nodes are compromised

Let us compute Rx when we use the q-composite andthe HC(q-composite) scheme and let us first computeP (LC|NCx) in the two cases. We recall that we consideronly external links which are independent of the compro-mised nodes.When x nodes are captured, all their keys are com-

promised. In the two schemes, q-composite and HC(q-composite), each external secure link is computed as thehash of k keys concatenated to each other where q ≤ k ≤m. The probability of a link compromise when x nodesare captured is then given as follows :

P (LC|NCx) =

m∑

k=q

P (LCk|NCx)P (LSk) (1)

where:

• LCk is the event that a link secured with k keys iscompromised

• LSk is the event that a secure link is secured with kkeys

Proposition 1. In the basic q-composite scheme, theprobability of link compromise when x nodes are capturedis :

P (LC|NCx) =

m∑

k=q

(1− (1−m

|S|)x)

k p(k)

p

Proof. In the basic q-composite scheme, the probabil-ity that a key is compromised when a node is capturedis c = m

|S| because each node is pre-loaded with m keys

selected randomly from the global key pool S.The fraction of uncompromised keys is then 1 − c. Whenx nodes are compromised, the fraction of uncompromised

7

0 20 40 60 80 100 120 140 160Number of compromised nodes

0.0

0.2

0.4

0.6

0.8

1.0

Resi

liency

1-compositeHC(1-composite)

0 20 40 60 80 100 120 140 160Number of compromised nodes

0.0

0.2

0.4

0.6

0.8

1.0

Resi

liency

2-compositeHC(2-composite)

0 20 40 60 80 100 120 140 160Number of compromised nodes

0.0

0.2

0.4

0.6

0.8

1.0

Resi

liency

3-compositeHC(3-composite)

(a) q=1 (b) q=2 (c) q=3

Figure 4: Network resiliency depending on the number of compromised nodes (q-composite Vs HC(q-composite))

keys is (1 − c)x. So, the probability that a given key hasbeen known is then 1− (1− c)x.As a result, the probability that a given link is compro-mised when it is secured with k shared keys and when xnodes are compromised is:

P (LCk|NCx) = (1− (1 − c)x)k

(2)

On the other hand, p(k) which is the probability thattwo nodes share exactly k keys was given in [6] as :

p(k) =

|S|k

|S| − k2 (m− k)

2 (m− k)m− k

|S|m

2

The probability that two given nodes can establish asecure link is then: p =

∑m

k=q p(k) and the probabilitythat a secure link is secured exactly with k keys is:

P (LSk) =p(k)

p(3)

From equation (2) and (3) the equation (1) becomes:

P (LC|NCx) =

m∑

k=q

(1− (1−m

|S|)x)

k p(k)

p(4)

�

The resulting formula (4) is similar to the one calculatedby Chan et al. in [6]. Let us now compute P (LC|NCx)of our HC(q-composite) scheme.

Lemma 1. Using the hash chain class with L ≥ 1, Theprobability that a given key is known when a node is ran-domly captured is:

ch =L+ 1

2L

m

|S|

Proof. For any discovered key, it is initially hashed ltimes (0 ≤ l ≤ L − 1) with a probability 1

L. When the

initial key is hashed l times, the probability that a key hav-ing the same identifier can be discovered is L−l

L. Indeed,

forward values can be computed when it is impossible tocompute backward values.Thus, we find that the probability to disclose a key havingthe same identifier with a compromised key is :

L−1∑

l=0

1

L×

L− l

L=

L+ 1

2L

Since each node has m keys, the probability that a keyhas been discovered when a node is compromised is ch =L+12L

m|S| . �

Proposition 2. In the HC(q-composite) scheme, theprobability of link compromise when x nodes are randomlycaptured is :

P (LC|NCx) =

m∑

k=q

(1− (1−L+ 1

2L

m

|S|)x)

k p(k)

p

Proof. Based on the lemma 1 and following the samesteps of the proof of proposition 1, we find that using ourHC(q-composite) scheme, the fraction of compromisedlinks when x nodes are captured is :

P (LC|NCx) =

m∑

k=q

(1 − (1−L+ 1

2L

m

|S|)x)

k p(k)

p(5)

�

Propositions 1 and 2 show that the probability of link com-promise is reduced when we apply our hash chain mech-anism. Thus, our scheme is more resilient than the basicone. As we have defined resiliency against node captureas the fraction of uncompromised links when x nodes arecompromised, we plot in the figure 4 the fraction of uncom-promised links depending on the number of captured nodeswith the two schemes (q-composite and HC(q-composite)when q=1,2 and 3. In this analysis, we fixed |S| = 1000,m = 40 and L = 10 (we discuss the choice of L’s value

8

later). This figure shows clearly that the resilience againstnode capture attacks is better when using our approach.For instance, with q = 3, when the number of compro-mised nodes is between 50 and 100, our approach reducesthe fraction of compromised links up to 40%. The figureshows also that higher is the q value, better is the improve-ment.

5.2.2. Secure connectivity coverage

Since we maintain the same common key discoveryphase based on the key identifier exchange, the secure con-nectivity coverage of the network when we use hash chainq-composite scheme is the same as the basic q-compositescheme. Indeed, each two neighbors can establish a se-cure link only if they share at least q keys. The secureconnectivity is then given as:

pconnect = p =

m∑

k=q

p(k)

We plot in figure 5 (a) the secure connectivity cover-age depending on the key ring size m when q=1 ,2 and 3and |S| = 1000. The figure shows that the secure connec-tivity coverage increases when the key ring size increasesbecause the probability of sharing at least q keys increases.Moreover, the figure shows that higher is q worse is the se-cure connectivity coverage. For instance, with q = 1 andm = 40, we ensure a network secure connectivity coverageof 80%. To reach the same connectivity, we need about 55keys per ring when q = 2 and about 65 keys when q = 3.Indeed, the q value represents the minimum required num-ber of common keys to establish secure links.In addition to the secure connectivity coverage, we plot

also in figure 5 (b) the network resiliency when 50 nodesare compromised (R50) depending on the key ring size mwhen q = 2, |S| = 1000 and L = 10. This figure showsthat the network resiliency decreases when m increases.It shows clearly that our solution is more resilient againstnode capture attacks depending on the key ring size. In-deed, the network resiliency is improved up to 40% whenm ≥ 60.

5.2.3. Computation overhead

In the basic q-composite scheme, nodes apply a hashfunction one time on the common keys concatenated toeach other in order to compute the secret key. Withour solution, the node having the minimum hash degreeshould apply the hash function h a number of times beforecomputing the secret key. In the example 3 (b) whereL = 5, the node 7 for example should apply two times thehash function to compute h4(K5) because it is initiallypre-loaded with h2(K5).In order to evaluate this extra-computation overhead, wecalculate the average number of times that a node appliesthe hash function per secure link in the initializationphase of our approach.

Lemma 2. Using the hash chain approach with (L ≥ 1),if two nodes can establish a secure link, then they have to

apply on average NHavg = L2−16L times the hash function

on their common keys before computing the session secretkey.

Proof. Let us assume that two nodes i and j can estab-lish a secure link (which means that they share q′ keyswith q′ > q ).So, the node i is pre-loaded with keyshashed (i mod L) times where the node j is pre-loadedwith keys hashed (j mod L) times. One of the nodes i orj would have to apply |(i mod L)− (j mod L)| times thehash function on their q′ common keys. Note that i and jare natural numbers chosen randomly, which means that(i mod L) and (j mod L) are uniformly distributed overZL. The average number of hash computation is then:

NHavg =1

2

L−1∑

k=0

k × P (|(i mod L)− (j mod L)| = k)

=1

2(

L−1∑

k=1

k ×2(L− k)

L2)

=1

L2(

L−1∑

k=1

k × L−

L−1∑

k=1

k2)

=1

L2(L2(L− 1)

2−

L(L− 1)(2L− 1)

6)

=L2 − 1

6L

�

Proposition 3. In the HC(q-composite) scheme, GivenL and m, if two nodes can establish a secure link, then

they have to apply on average L2−16L

∑m

k=q (k × p(k)p

) hashfunctions.

Proof. Following the lemma 2, when using the HC(q-

composite) scheme, each node applies on average L2−16L

times the hash function on all the q′ shared keys where

q′ ≥ q. Since p(k)p

is the probability that an establishedlink is secured with k keys, the overall average number ofhash computation is then:

m∑

k=q

(L2 − 1

6L× k ×

p(k)

p) =

L2 − 1

6L

m∑

k=q

(k ×p(k)

p)

�

In table 2, we summarize the average number of hashcomputations for 1 ≤ L ≤ 15, when q=1, 2 and 3. Notethat with L = 1 we have exactly the basic scheme wherethe pre-loaded keys are not hashed. This table showsthat the average number of hash computations remainsreasonable when L ≤ 15.

9

0 20 40 60 80 100m

0.0

0.2

0.4

0.6

0.8

1.0

Connectivity

q=1q=2q=3

0 20 40 60 80 100m

0.0

0.2

0.4

0.6

0.8

1.0

Connect

ivit

y /

Resi

liency

(x=

50)

Resiliency of 2-composite

Resiliency of HC(2-composite)

Connectivity

(a) Connectivity (b) Connectivity and resiliency (R50) with q=2

Figure 5: Network connectivity and resiliency depending on the key ring size

Table 2: Average number of hash computation in HC(q-composite)L NHavg HC(q-composite)

q=1 q=2 q=31 0.0 0.0 0.0 0.02 0.25 0.493 0.659 0.8613 0.444 0.877 1.171 1.5314 0.625 1.233 1.646 2.1525 0.8 1.578 2.107 2.7556 0.972 1.918 2.561 3.3487 1.143 2.255 3.01 3.9368 1.313 2.589 3.457 4.529 1.481 2.923 3.902 5.10210 1.65 3.255 4.346 5.68211 1.818 3.587 4.789 6.26112 1.986 3.918 5.232 6.8413 2.154 4.249 5.673 7.41714 2.321 4.58 6.115 7.99415 2.489 4.91 6.556 8.571

Energy consumption overhead :We were interested in evaluating the energy consumed dueto the execution of hash functions over a mote’s processor.For this end, we developed a nesC component of SHA1hash function [23]. Then, we compiled the component fora Mica2 platform [24] using TinyOS [25]. We used theAVRORA simulator [26] to simulate and evaluate the con-sumed energy due to SHA1 calculation over a 160 bitsstring. The obtained results confirm our claims regardingthe negligible induced energy overhead. Indeed, we foundthat the SHA1 calculations consume only 0.4 mJ. We alsofound that this is equivalent to only 4% of the energy con-sumed by a idle Atmel processor of a Mica2 node during1 second. This means that 25 SHA1 executions consumeonly the equivalent energy required to maintain the node’sprocessor idle during 1 second.

We have also evaluated the energy consumed by the ra-dio module to send 128 bytes using 8× 16 TOS messages.We found that the consumed energy is around 40 timesthe energy consumed by a hash function computation. Wenotice that this transmission takes about 600 milliseconds.In figure 6, we plot the average consumed energy by hash

0 2 4 6 8 10 12 14 16L

0

2000

4000

6000

8000

10000

12000

14000

16000

18000

Avera

ge c

onsu

med e

nerg

y (

mic

rojo

ule

)

q=1q=2q=3transmission of 128 bytes

Figure 6: Energy consumption overhead of HC(q-composite)

computations when using the HC(q-composite) schemewith q=1, 2 and 3. The figure shows that this energy isnegligible compared to the energy consumed by the radiowhen sending 128 bytes. In addition, the hash functioncomputation is done only one time during the commonkey discovery phase.

Choice of L’s value:As we have shown in the figures 4 and 5, our approachenhances the network resiliency. In addition, we noticefrom the proposition 2 that higher is L, better is the re-silience. When L is too high, the value L+1

2L approaches12 , so the optimal resiliency with our approach is reached

when L+12L approaches 1

2 . However, we notice from proposi-tion 3 that higher is L higher is the induced computationaloverhead. Indeed, the average number of hash computa-tions depends linearly on the L value. We propose thento choose L = 10 which allows to approach the optimalresiliency (L+1

2L = 0.55 which is close to 1/2), while the in-duced computational overhead is reasonable. For instance,with L = 10 the average hash computation is insignificant

10

(3.255 for q=1, 4.346 for q=2 and 5.682 for q=3).

5.2.4. Storage overhead

The storage memory required by the q-compositescheme is mainly the memory used to store the m pairs(key identifier, secret key) where the keys are selectedrandomly from S. If we neglect the q value storagememory, the required storage memory is then Msize =m × (Ksize + Isize) where Ksize is the size of a given keyand Isize is the size of the key identifier (Isize = log2 |S|bits). Our solution requires exactly the same storage mem-ory as the basic scheme in addition to the L value whichis a short integer.

5.2.5. Communication overhead

The communication overhead depends linearly on thevalue of m. Indeed, each node must exchange the keyidentifiers and its own identifier in order to determine thecommon keys and then establish the secure link. The num-ber of exchanged bits in the basic q-composite scheme ism×(log2 |S|) if we neglect the node identifier. As we main-tain the same common key discovery phase with the basicscheme and which is based on the key identifier exchange,our scheme induces exactly the same communication over-head.

6. HC(SBIBD): A resilient combinatorial design-based key management scheme

In this section, we present a deterministic pool basedkey management scheme highly resilient against nodecapture. The latter results from the application of ourhash chain class to the Symmetric Balanced IncompleteBlock Design scheme proposed by Camtepe and Yener[12]. First, we present the basic scheme, then we explainhow to apply our hash chain class to this scheme, andfinally we compare the performances of the two schemes.

In [12], Camtepe and Yener introduced the use of combi-natorial design for key pre-distribution in WSN. In orderto guarantee the determinism when using a pool basedkey management scheme, authors made use of a particu-lar combinatorial design which is the Symmetric BalancedIncomplete Block Design (SBIBD).Given a finite set X of ν objects, a Balanced Incomplete

Block Design (BIBD) is defined to be a set of k-distinctelement subsets of X , called blocks, constructed is such away that each object occurs in exactly r different blocksand every pair of distinct objects appears together in λblocks. The number of resulting blocks is b. A BIBD(ν, b, r, k, λ) two properties: (i) λ(ν−1) = r(k−1) and (ii)bk = νr. It can then be identified by (ν, k, λ).A BIBD is called symmetric when b = v and in conse-quence r = k. A Symmetric BIBD (SBIBD) has the prop-erties:

• every block contains k elements;

Table 3: Mapping from symmetric design to key distributionSBIBD Key distributionX: Object set S : Key poolν: Size of the object set X |S|: Size of the key pool SBlocks Key ringsObjects in a Block (k) Keys in a key ring (m)number of generated blocks(b = ν = k2 − k + 1)

Number of generated keyrings (|S| = b = m2 −m+ 1)

Two blocks share (λ = 1) ob-ject

Two key rings share (λ = 1)key

• each element occurs in exactly k blocks;

• each pair of elements occurs in λ blocks;

• each pair of blocks intersects in λ elements.

Let’s take the example where we have 7 objects{1, 2, 3, 4, 5, 6, 7} (ν = 7). With (k = 3) andλ = 1, a configuration of the SBIBD blocks can be:{1, 2, 3}{1, 4, 5}{1, 6, 7}{2, 4, 6}{2, 5, 7}{3, 4, 7}{3, 5, 6}.We have then 7 blocks (b = ν = 7). Each block containsk = 3 distinct objects. Each object appears in r = k = 3blocks, each pair of distinct elements occurs in λ = 1block, and each pair of blocks intersects in exactly (λ = 1)object.Camtepe and Yener introduce in [12] a mapping from

the SBIBD to the pool based key distribution. In thismapping, to each object is associated a distinct key, tothe global set of objects is is associated the key pool andto each block is associated the node key ring (see table3). We can then generate from a global key pool of |S|keys, |S| key rings of m keys in such a way that each twokey rings shares exactly λ keys. Note that this generationhas the property λ(|S| − 1) = m(m − 1). Therefore,|S| = m2 −m+ 1 when λ = 1. In other terms, thanks tothe symmetric design we can generate m2 − m + 1 keysubsets of m keys each one in such a way that each twokey rings share exactly one common key. We use for thata global key pool S of m2 − m + 1 keys. This approachguarantees a total connectivity coverage when nodes arepre-loaded with the generated subsets of keys.

The application of our hash chain-based approach tothe SBIBD scheme gives birth to a deterministic key pre-distribution scheme which enhances the resiliency whileensuring a total connectivity coverage. Before the deploy-ment step, |S| key rings are generated from the key pool Swhere |S| = m2 −m+1. Instead of pre-loading each nodewith a distinct key ring, we propose to apply a hash func-tion h, (i mod L) times on all the pre-loaded keys of eachnode, where i is the node identifier and L is a parameterof our class.Thanks to the symmetric balanced incomplete block de-sign (with λ = 1), any two neighboring nodes i and jshare exactly one key having the same identifier. Let usconsider s the identifier of the common key between thekey rings of the neighboring nodes i and j. In the basic

11

0 20 40 60 80 100 120 140 160Number of compromised nodes

0.0

0.2

0.4

0.6

0.8

1.0

Resi

liency

SBIBDHC(SBIBD)

0 20 40 60 80 100 120 140 160Number of compromised nodes

0.0

0.2

0.4

0.6

0.8

1.0

Resi

liency

SBIBDHC(SBIBD)

0 20 40 60 80 100 120 140 160Number of compromised nodes

0.0

0.2

0.4

0.6

0.8

1.0

Resi

liency

SBIBDHC(SBIBD)

(a) m=20 (b) m=40 (c) m=60

Figure 7: Network resiliency depending on the number of compromised nodes (SBIBD Vs HC(SBIBD))

scheme, the link secret key is ks = kis = kjs.In our scheme HC(SBIBD), the node i is initially pre-loaded with kis = hi mod L(ks) where the node j is pre-loaded with kjs = hj mod L(ks). The common secret keyis then kjs if we suppose that (i mod L) > (j mod L).Then, the node i computes its secret key with the node jas follows: kij = h(i mod L)−(j mod L)(Ki

s).

6.1. Analysis

In this section, We compare the performance ofour scheme HC(SBIBD) against the basic SBIBD-basedscheme with respect to the metrics defined in section 3.

6.1.1. Network resiliency against node capture

In the two schemes, each secure link is composed of onesecret key. The fraction of compromised external linkswhen x nodes are compromised is given as follows:

P (LC|NCx) =m2−m+1∑

k=1

P (LCk|NCx)P (Lk) (6)

where:

• LC is the event that a link is compromised

• NCx is the event that x nodes are compromised

• LCk is the event that a link secured with the keyhaving the identifier k is compromised.

• Lk is the event that a link is secured with a key havingthe identifier k.

Since keys having the identifier k occurs exactly in mkey rings, the fraction of links secured with a key havingthe identifier k is then:

P (Lk) =

(

m2

)

(

m2 −m+ 12

) =1

m2 −m+ 1(7)

So, equation (6) becomes:

P (LC|NCx) =1

m2 −m+ 1

m2−m+1∑

k=1

P (LCk|NCx) (8)

Proposition 4. Using the basic SBIBD scheme, the prob-ability that an external link is compromised when x nodesare compromised is:P (LC|NCx) = 1−

∏x−1t=0 (1− m

m2−m+1−t)

Proof. The probability that a link secured with the keyhaving the identifier k is compromised when x nodes arecompromised is the probability that the key k occurs one ormore times in the x discovered key rings. Let us denote byB1, B2, B3, ... and Bx the x discovered key rings. Applyingthe bayes’ theorem, we find that the probability that thekey k occurs one or more times in the x discovered keyrings is:

P (LCk|NCx) = 1− P (Kk /∈ B1 ∩ .. ∩ ki /∈ Bx)

= 1− P (Kk /∈ B1)×

P (Kk /∈ B2|Kk /∈ B1)× ...

P (Kk /∈ Bx|(Kk /∈ B1 ∩ .. ∩Kk /∈ Bx−1))

Since the key k occurs exactly in m key rings from them2 −m+ 1 possible key rings, we have:

P (LCk|NCx) = 1− ((1−m

m2 −m+ 1)×

(1−m

m2 −m+ 1− 1)× ...

×(1−m

m2 −m+ 1− (x − 1)))

= 1−

x−1∏

t=0

(1−m

m2 −m+ 1− t)

By replacing in equation (8), we find that the probabilitythat an external link is compromised when x nodes arecompromised is:P (LC|NCx) = 1−

∏x−1t=0 (1− m

m2−m+1−t)

�

12

Table 4: Average hash computation in HC(SBIBD)L NHavg HC(SBIBD)1 0.0 0.02 0.25 0.253 0.444 0.4444 0.625 0.6255 0.8 0.86 0.972 0.9727 1.143 1.1438 1.313 1.3139 1.481 1.48110 1.65 1.6511 1.818 1.81812 1.986 1.98613 2.154 2.15414 2.321 2.32115 2.489 2.489

We give in appendix A another proof which is similarto the one given by Camtepe and Yener in [12].

Proposition 5. Using the HC(SBIBD) scheme, the prob-ability that an external link is compromised when x nodesare compromised is:P (LC|NCx) = 1−

∏x−1t=0 (1 − L+1

2Lm

m2−m+1−t)

Proof. As proved in section 5.2.1, if a key having theidentifier k is compromised, then the average fraction ofdiscovered keys having the same identifier is L+1

2L (the at-tacker discovers only derived versions). Similar to theproof of proposition 4 and following the same steps, wefind that the probability that an external link is compro-mised when x nodes are compromised in the HC(BIBD)scheme is:P (LC|NCx) = 1−

∏x−1t=0 (1 − L+1

2Lm

m2−m+1−t)

�

From propositions 4 and 5, we notice that our solutionreduces the fraction of compromised links, the resiliencyis so enhanced. We plot in figure 7 the resiliency of thetwo schemes, SBIBD and HC(SBIBD) depending on thenumber of compromised nodes (Rx = 1 − P (LC|NCx)).We choose m respectively: 20 (a), 40 (b) and 60(c). No-tice that the size of the global pool (|S|) is therefore 379,1559 and 3539 respectively. We have chosen L = 10 whenusing our hash chain scheme. The figure shows that thenetwork resiliency against node capture is better when us-ing the HC(SBIBD) scheme. For instance, with m = 40we enhance the resilience up to 20% when x is between 40and 80.

6.1.2. Secure connectivity coverage

As explained before, the use of SBIBD theory ensures atotal secure connectivity coverage. Each two nodes shareexactly one key in their key subsets. When using our hashchain approach, we have also this property. The only dif-ference is that the node having the low hash degree should

0 2 4 6 8 10 12 14 16L

0

2000

4000

6000

8000

10000

12000

14000

16000

18000

Avera

ge c

onsu

med e

nerg

y (

mic

rojo

ule

)

hash function computationtransmission of 128 bytes

Figure 8: Energy consumption overhead of HC(SBIBD)

apply the hash function a number of times on its sharedkey. Therefore, the two schemes ensure a total secure cov-erage (secure connectivity coverage = 1) thanks to theSBIBD based construction.

6.1.3. Computation overhead

After the common key discovery phase in the basicscheme, each two neighboring nodes determine their com-mon shared key which is unique. This key is then thesecret pairwise key used to secure the link.With our solution, each two neighboring nodes deter-

mine, after the common key discovery phase, the identifierof their shared key. However, the node having the mini-mum hash degree should apply the hash function h a num-ber of times to compute the common secret key. We haveproved in lemma 2 that nodes have to apply in average

NHavg = L2−16L times the hash function on the their set of

common keys before computing the secret key, where L isthe parameter of our class. Using the SBIBD with λ = 1,each two nodes share exactly one key. Hence, nodes ap-ply in averageNHavg times the hash function on the singlecommon key. In the table 4, we compute the average num-ber of hash computations when (1 ≤ L ≤ 15). Note thatL = 1 represents the basic scheme because we do not ap-ply at all the hash function. This table shows that thenumber of hash computations is negligible when L ≤ 15.Since the energy consumption due to computation is neg-ligible, we believe that the application of our solution tothe SBIBD key management schemes does not degrade itsperformances.In order to confirm our claim, we have evaluated theenergy consumed by the hash function computation ofHC(SBIBD) over a mote’s processor. We simulated thecomputation of SHA1 hash function [23] over a Mica2 plat-form [24] using TinyOS [25]. We used the AVRORA sim-ulator [26] to simulate and evaluate the consumed energydue to SHA1 calculation over a 160 bits string.In figure 8, we plot the average consumed energy by hash

computations when using the HC(SBIBD) scheme. This

13

figure shows that this energy is negligible compared to theenergy consumed by the radio when sending 128 bytes.We notice also that the consumed energy in HC(SBIBD)is lower than the energy consumed by hash computationswhen applying HC to probabilistic schemes. Indeed, thehash function in HC(SBIBD) is applied on only one keyduring the common key discovery phase.As explained before, we propose to choose L = 10 to

achieve a good tradeoff between the resilience improve-ment and the computational overhead.

6.1.4. Storage overhead

We give the memory required to store the pairs (keyidentifier, secret key) in the basic SBIBD scheme as:Msize = m × (Ksize + Isize), where Ksize is the size of agiven key and Isize is the size of the key identifier: Isize =log2

∣

∣m2 −m+ 1∣

∣ bits. We summarize in table 5 the re-quired storage memory when Ksize = 128 bits (16 bytes)and whenm is between 10 and 100. Notice that our schemerequires exactly the same storage memory in addition tothe L value which is a short integer.

Table 5: Required storage memory in SBIBD & HC(SBIBD) schemes

m Isize

(bits)Isize

(bytes)Msize

(bytes)10 7 1 17020 9 2 36030 10 2 54040 11 2 72050 12 2 90060 12 2 108070 13 2 126080 13 2 144090 13 2 1620100 14 2 1800

6.1.5. Communication overhead

The communication overhead depends linearly on thevalue of m. In fact, each node must exchange the keyidentifiers and its own identifier in order to find the onlycommon key and then establish the secure link. The num-ber of exchanged bits in the basic SBIBD scheme is thenm × (log2

∣

∣m2 −m+ 1∣

∣) if we omit the node identifier.When applying our hash chain class, we maintain thesame common key discovery phase with the basic scheme;our scheme induces then exactly the same communicationoverhead compared to the basic one.

7. Extensions and Enhancements

As shown above, the mechanism that we propose allowsto enhance the resiliency of existing key pre-distributionschemes against oblivious node capture attacks. Neverthe-less, the proposed scheme may incur unbalanced calcula-tion overhead. Indeed, some nodes might hash their keysmany times to deduce the shared key while others do not.Moreover, a smart attacker which captures nodes having

the lowest values (i mod L) would allow a largest link com-promise. In this section, we tackle these two issues and wepropose countermeasures against both the smart attacksand the unbalanced overhead.

7.1. Smart node capture attacks:

The selective node capture attacks or smart attacks wereproposed for the first time by Pietro et al. in [27]. Au-thors proposed in this paper a new attack where the ad-versary greedily uses the information disclosed by compro-mised nodes in order to choose the next node to capture.Authors defined a random variable called key informationgain G(s) for each potential node s. This variable is equalto the number of keys in the key ring of s which are notyet compromised. At each step, the attacker chooses thenext node to compromise as the node which maximizesE[G(s)|I(s)], the expectation of the key information gainG(s) given the information I(s) that the attacker knows onthe key ring of sensor s. This approach allows maximizingthe number of useful keys to collect at each step.This kind of vulnerability is due mainly to the exchanges

of key identifiers which may allow an attacker to knowwhich keys are pre-loaded in which node. Therefore, coun-termeasures must hide key identifiers while allowing nodesto determine the shared keys. A lot of solutions were pro-posed. For instance, the challenge response solution intro-duced in [5] and used later in many schemes, consists ofencrypting a challenge α with each key of a node. After re-ceiving the encrypted values, the second node can deducethe shared keys by trying to decrypt the challenge α withits own keys. This solution is known to be secure but in-duces a high communication and computation complexityof order O(m2) where m is the key size. In pseudo-randomkey index transformation, used in [28] for instance, eachnode generates the key indexes using a pseudo-randomgenerator initialized with a given node seed. Even thissolution is communication efficient, it is not secure sincethe attacker can generate key indexes knowing the pseudo-random generator and the seeds which are usually sup-posed to be public. Authors in [19] propose to enhance theCamtepe scheme in order to avoid key identifier exchangesand counter active attacks. For this purpose, they indexall nodes and keys and propose a mapping between nodeindexes and key indexes. This solution remain efficient aslong as the mapping algorithm is not known, otherwise, anattacker can easily reveal the key identifers knowing thenode identifier.Pietro et al. proposed in [27][29] an efficient and secure

shared key discovery way trading off communications forlocal computations. In the proposed solution, each nodei is pre-loaded with keys from the global pool such as :fy(i‖Ku) ≡ 0 mod (m

S) where fy is a one way pseudo-

random function having y as a seed. So, each node candeduce the shared keys with a neighbor by verifying therelation on its own keys.When using our hash function based mechanism, all

the proposed countermeasures, presented above, can be

14

adapted to face this kind of attacks. In addition, a par-ticular smart attack can be launched and should be con-sidered: the attacker may target nodes having lower hashdegree (i mod L) in order to compute a larger numberof derived keys and hence compromise more links. In theworst case, the attacker could target only the nodes hav-ing the identifier i such that (i mod L) = 0, in this casethe attacker will have original keys which can be used tocompute derived versions and so nullifies the effect of oursolution.

7.2. Unbalanced calculation overhead

We proved in previous sections that the average intro-duced computational overhead, due to hash calculations,is insignificant. Nevertheless, it is obvious that the lim-ited introduced workload is unbalanced. Indeed, most cal-culations are shifted to nodes having a low hash degree(i mod L), , where i is the node identifier and L is the pa-rameter of our approach. Using the proposed mechanismHC, a node i have to perform hash computations with a

probability L−1−(i mod L)L

which is unbalanced.

7.3. Balanced and smart-attack free extension

We propose in this subsection an improvement of ourhash-based mechanism which alleviates both the smart at-tack presented above and the computation overhead un-balance. For analysis simplicity, we assume that the keyring size m is an even number, we assume also that thekey identifiers are totally ordered and that the keys withina key ring are distinct.In order to balance hash computations and render the

above smart attack inefficient, we divide the original keys,to be pre-loaded in each node i, to two subsets of size m

2each. The first subset contains the keys having the loweridentifers while the second one contains the keys havingthe higher identifers. Before de deployment, we proposeto apply a hash function h, (i mod L) times to the keysof the lower subset and ((L− 1)− (i mod L)) times to thekeys of the higher subset. Thus, each node i is preloadedwith the set of keys KRi such as:KRi = LKRi ∪HKRi where:LKRi =

{

hi mod L(K1), ..., hi mod L(Km

2)}

and

HKRi ={

hL−1−(i mod L)(Km

2+1), ..., h

L−1−(i mod L)(Km)}

where K1,K2, ...Km are the distinct original keys to bepre-loaded in node i totaly ordered with respect to theiridentifiers.After the deployment step, each node can determine

the hash degree of a shared key thanks to the common keydiscovery phase. Hence, each node can deduce whether itapplies the hash function on the stored key or it uses thiskey without hash computation.

The use of this enhanced version allows to balance thehash function computations between nodes. Indeed, forany given two nodes i and j, the node i will perform thehash function with probability 1

2 if we assume that any

given shared key belongs to the lower set or the highersubset with the same probability 1

2 .

Let us assume that s is the identifier of a given sharedkey and that (i mod L) 6= (j mod L) and that (i mod L) 6=L− 1− (j mod L). The probability that the node i has toapply the hash function is then given by :

P = P (Ks ∈ LKRi ∩Ks ∈ LKR

j)×

P (i mod L < j mod L)

+ P (Ks ∈ LKRi ∩Ks ∈ HKR

j)×

P (i mod L < L− 1− (j mod L))

+ P (Ks ∈ HKRi ∩Ks ∈ LKR

j)×

P (L− 1− (i mod L) < j mod L)

+ P (Ks ∈ HKRi ∩Ks ∈ HKR

j)×

P (L− 1− (i mod L) < L− 1− (j mod L))

=1

4× [P (i mod L < j mod L) +

P (L− 1− (i mod L) < L− 1− (j mod L))]

+1

4× [P (i mod L < L− 1− (j mod L)) +

P (L− 1− (i mod L) < j mod L)]

=1

2

Following a similar reasoning, we find that when(i mod L) = (j mod L) or (i mod L) = L− 1− (j mod L)exclusively, the probability that the node i has to ap-ply the hash function is also equal to 1

2 . Finally, if(i mod L) = (j mod L) and (i mod L) = L−1−(j mod L),both nodes do not perform hash computations.

In addition to load balancing hash computations, theproposed enhancement allows to counteract the smart at-tack presented above. Indeed, when using the basic solu-tion, the probability that a key is compromised following

the capture of a node i is L−(i mod L)L

m|S| . In other words,

the capture of nodes having low values (i mod L) reveals ahigh number of pre-loaded keys while the capture of nodeshaving high values (i mod L) reveals low number of keys.The above smart attack relies on this unbalanced revealingof keys following a node capture.

When using the enhanced version presented in thissubsection, the probability that a given key is compro-mised following the capture of a node i is equal toL−(i mod L)

L× m

2|S| due to the capture of the lower subset

plus L−[(L−1)−(i mod L)]L

× m2|S| due the capture of the high-

est subset (the two subsets within a key ring are assumedto be distinct). Therefore, the capture of one node revealsa fraction of L+1

2Lm|S| of keys independently of its identifier.

Hence, the smart attack described above can no more beconducted against this enhanced scheme, since the num-ber of keys revealed following a node capture is the samewhatever the identifier of the node.

15

8. Conclusion

Asymmetric key management schemes are likely to beunsuitable for WSN because of resource limitations. More-over, because of the lack of infrastructure in WSN, itis difficult to assume the existence of a trusted thirdparty which can attribute pairwise secret keys to neigh-boring nodes. This is why symmetric key pre-distributionschemes are the most suitable paradigm for wireless sensornetworks to secure exchanges.In this paper, we presented a hash chain class of key

management schemes highly resilient against node cap-ture. We enhance resilience by concealing keys through theuse of an efficient hash chaining mechanism. Our class canbe applied to any pool based key pre-distribution scheme.In this work, we applied it to the well known probabilisticq-composite scheme in a first time and to the determinis-tic Symmetric Balanced Incomplete Bock Design schemein a second time. The analytical study showed that ourapproach may enhance resiliency up to 40% without in-troducing any new storage or communication overheads,it induces an insignificant computational overhead.

9. Acknowledgement

This work is made as part of the Picardie regionalproject under reference I159C. The authors wish to thankthe Picardie regional council in France and the EuropeanRegional Development Fund (ERDF) for funding and sup-porting this project.

Appendix A. proof of proposition 4

When using the SBIBD scheme, the probability that alink secured with the key having the identifier k is com-promised when x nodes are compromised is the probabilitythat the key k occurs one or more times in the x discov-ered key rings. Since the key occurs exactly in m key ringsamong the possible m2 −m+ 1 key rings, we have:

P (LCk|NCx) = 1−

(

(m2 −m+ 1−m)x

)

(

m2 −m+ 1x

)

= 1−

(

m2 − 2m+ 1x

)

(

m2 −m+ 1x

)

= 1−(m2 − 2m+ 1)!

(m2 −m+ 1)!

(m2 −m+ 1− x)!

(m−2m+ 1− x)!

= 1−x−1∏

t=0

m2 − 2m+ 1− t

m2 −m+ 1− t

= 1−

x−1∏

t=0

(1−m

m2 −m+ 1− t)

Following the equation (8), we find that the probabilitythat an external link is compromised when x nodes arecompromised is:

P (LC|NCx) = 1−

x−1∏

t=0

(1 −m

m2 −m+ 1− t)

References

[1] I. F. Akyildiz, W. Su, Y. Sankarasubramaniam, and E. Cayirci.Wireless sensor networks: a survey. Computer Networks,38:393–422, 2002.

[2] R. Watro, D. Kong, S. Cuti, C. Gardiner, C. Lynn, andP. Kruus. Tinypk: securing sensor networks with public keytechnology. In Proceedings of the 2nd ACM Workshop on Secu-rity of Ad Hoc and Sensor Networks, pages 59–64. ACM Press,2004.

[3] N. Gura, A. Patel, A. Wander, H. Eberle, and S. C. Shantz.Comparing elliptic curve cryptography and rsa on 8-bit cpus.In Cryptographic Hardware and Embedded Systems (CHES),pages 119–132, 2004.

[4] J. Zhang and V. Varadharajan. Wireless sensor network keymanagement survey and taxonomy. Journal of Network andComputer Applications, 33(2):63 – 75, 2010.

[5] L. Eschenauer and V.D. Gligor. A key-management scheme fordistributed sensor networks. In ACM CCS ’02, pages 41–47,2002.

[6] H. Chan, A. Perrig, and D. Song. Random key predistributionschemes for sensor networks. In IEEE SP ’03, 2003.

[7] W. Du, J. Deng, Y. Han, S. Chen, and P. Varshney. A key man-agement scheme for wireless sensor networks using deploymentknowledge. In IEEE INFOCOM, pages 586–597, 2004.

[8] C. Castelluccia and A. Spognardi. A Robust Key Pre-distribution Protocol for Multi-Phase Wireless Sensor Net-works. In IEEE Securecom, pages 351–360, 2007.

[9] D. Liu and P. Ning. Establishing pairwise keys in distributedsensor networks. In ACM CCS, pages 52–61, 2003.

[10] Z. Yu and Y. Guan. A robust group-based key managementscheme for wireless sensor networks. In Wireless Communi-cations and Networking Conference, pages 1915–1920. IEEE,2005.

[11] S. Zhu, S. Setia, and S. Jajodia. Leap: efficient security mecha-nisms for large-scale distributed sensor networks. In ACM CCS,pages 62–72, 2003.

[12] S. A. Camtepe and B. Yener. Combinatorial design of key dis-tribution mechanisms for wireless sensor networks. IEEE/ACMTransactions on Networking, 15:346–358, April 2007.

[13] B. Maala, Y. Challal, and A. Bouabdallah. Hero: Hierarchcalkey management protocol for heterogeneous wsn. In SpringerBoston, editor, IFIP WSAN, pages 125–136, 2008.

[14] K. Kifayat, M. Merabti, Q. Shi, and D. Llewellyn-Jones. Se-curity in wireless sensor networks. In Handbook of Informationand Communication Security, pages 513–552. 2010.

[15] D. Sanchez and H. Baldus. Key management for mobile sensornetworks. In Secure Mobile Ad-hoc Networks and Sensors, vol-ume 4074 of Lecture Notes in Computer Science, pages 14–26.Springer Berlin / Heidelberg, 2006.

[16] A. Ouadjaout, M. Bagaa, A. Bachir, Y. Challal, N. Lasla, andL. Khelladi. Encyclopedia on Ad Hoc and Ubiquitous Comput-ing, chapter Information Security in Wireless Sensor Networks,pages 427–472. World Scientific, 2009.

[17] C. Blundo, A. Santis, A. Herzberg, S. Kutten, U. Vaccaro, andM. Yung. Perfectly-secure key distribution for dynamic confer-ences. In Proceedings of the 12th Annual International Cryp-tology Conference on Advances in Cryptology, pages 471–486.Springer-Verlag, 1993.

16

[18] R. Blom. An optimal class of symmetric key generation sys-tems. In Proceedings of the Eurocrypt 84 Workshop on Ad-vances in Cryptology: Theory and Application of CryptographicTechniques., pages 335–338. Springer-Verlag, 1985.

[19] S. Ruj and B. Roy. Key predistribution using combinatorial de-signs for grid-group deployment scheme in wireless sensor net-works. Transactions On Sensor Networks, 6(1), 2009.

[20] A. Perrig, R. Szewczyk, J. D. Tygar, V. Wen, and D. E. Culler.Spins: Security protocols for sensor networks. Wireless Net-works, 8(5):521–534, 2002.

[21] A. Perrig, R. Szewczyk, V. Wen, D. E. Culler, and J. D. Ty-gar. Spins: security protocols for sensor netowrks. In ACMMOBICOM, pages 189–199, 2001.

[22] W. Bechkit, A. Bouabdallah, and Y. Challal. Enhancing re-silience of probabilistic key pre-distribution schemes for wsnsthrough hash chaining. In ACM CCS, pages 642–644, 2010.

[23] National Institute of Standards and Technology. Secure hashstandard. Federal Information Processing Standards Publica-tion, 1995.

[24] http://www.memsic.com.[25] http://www.tinyos.net.[26] B. L. Titzer, D. K. Lee, and J. Palsberg. Avrora: Scalable

sensor network simulation with precise timing. In IPSN, 2005.[27] R. Di Pietro, L. V. Mancini, and A. Mei. Efficient and resilient

key discovery based on pseudo-random key pre-deployment.Parallel and Distributed Processing Symposium, International(IPDPS), 13:217b, 2004.

[28] S. Zhu, S. Xu, S. Setia, and S. Jajodia. Establishing pairwisekeys for secure communication in ad hoc networks: A proba-bilistic approach. In IEEE International Conference on Net-work Protocols, pages 326–, 2003.

[29] R. Di Pietro, L. V. Mancini, and A. Mei. Energy efficientnode-to-node authentication and communication confidentialityin wireless sensor networks. Wireless Networks, 12(6):709–721,2006.

17