无线传感器网络中自治愈的群组密钥管理方案

 群组密钥管理的自治愈机制是保证无线传感器网络在不可靠信道上进行安全群组通信的重要 手段.基于采用双方向密钥链的群组密钥分发与撤销方法,提出了一个无线传感器网络中具有撤销能力的自治愈群组密钥管理方案.该方案实现了群组密钥的自治愈功能和节点撤销能力, 能够满足在较高丢包率的无线通信环境下传感器网络群组密钥管理的安全需求,确保了群组密钥保密性、前向保密性和后向保密性等安全属性.性能分析表明,该方案具有较小的计算和通信开销,能够适用于无线传感器网络.     

EPC网络中可证明安全的EPCIS通信方案

针对EPC信息服务存在的安全问题,提出一种EPC信息服务安全通信方案ESCM,方案使用数字签名、消息认证码等安全机制,实现了分属查询应用程序和外域EPCIS服务器之间的相互认证服务与密钥协商服务,能够保护EPCIS通信的机密性和完整性。利用Canetti-Krawczyk模型证明了ESCM方案是会话密钥安全的。此外,性能分析表明该方案的通信开销、计算开销较少,适合EPC网络特性。     

基于滑动窗口的移动自组网的自愈密钥发布机制

针对MANET(移动自组网)中存在用户实际生命期跨越2个会话窗口的现象,同时为了降低自愈密钥移动自组网管理者的负担,提出了基于滑动窗口的自愈密钥发布机制;建立了双向散列密钥链模型;利用控制参数,实现了t-撤销能力.安全分析表明,在解决用户跨步问题的前提下,没有降低模型的安全性.由于管理者对跨步用户仅需传递一次初始私有信息,避免了会话重建过程中的再次传递,降低了通信开销.     

基于混沌映射的密钥预分配方案

文中提出一种新的无线传感器网络密钥预分配方案——基于混沌映射的密钥预分配方案CMKP（Chaos Mapping based Key Pre-distribution）。CMKP方案利用整数混沌映射产生具有良好随机性和自相关性能的混沌序列形成密钥池,其传感节点只需存储密钥池中部分密钥的密钥标识ID,改进了节点会话密钥计算方法。性能分析结果表明：在不增加通信开销的同时CMKP方案能够提高无线传感器网络的连通概率和安全性能。     

无线传感器网络中具有撤销功能的自愈组密钥管理方案

在有限域F_q上构造基于秘密共享的广播多项式,提出一种具有节点撤销功能的组密钥更新方案.同时,基于单向散列密钥链建立组密钥序列,采用组密钥预先更新机制,容忍密钥更新消息的丢失,实现自愈.分析表明,在节点俘获攻击高发的环境中,方案在计算开销和通信开销方面具有更好的性能.     

传感器网络中基于DNA模型的对偶密钥建立算法研究

在KDC(Key Distribution Center)和DNA多样性的基础上,提出了一种用于密钥预置的DNA模型及其密钥预置(Key Predistribution)机制,然后,在结合密钥池(Key Pool)加密技术优点的基础上,提出了一种传感器网络中基于DNA模型的新对偶密钥建立算法.新算法利用DNA链中寡聚核苷酸编码特性进行密钥预置,任意节点对之间以DNA链进行信息交换,而以DNA链中包含的某段寡聚核苷酸对应的编码作为实际对偶密钥.理论与实验分析表明,与基于多项式、多项式池的密钥预置模型的对偶密钥建立算法相比,新算法具有更好的安全性能,更低的通信开销、以及更高的直接对偶密钥建立概率.因此,是一种更适合传感器网络特点的新型高效对偶密钥建立算法.     

基于服务器组的群组密钥协商机制

为了解决现有的组密钥协商机制需要组成员在本地全部参与协商,从而严重制约安全群组通信系统可扩展性与高效性的问题,提出一种基于服务器端的密钥协商策略.该机制中,仅需要与每个组成员连接的服务器组间密钥协商,降低了群组的存储开销和通信开销.同时在客户端函数库内通过设计一个单向映射机制实现从服务器组密钥到群组密钥变换.与基于客户端函数库的密钥协商机制相比,其可扩展性及密钥协商效率更高.     

基于双向散列链具有撤销能力的自愈组密钥分发机制

提出了一种MANET中基于双向散列链具有撤销能力的自愈组密钥分发机制.通过建立会话密钥之间的冗余关联,实现了在不增加管理节点负担的情况下,合法节点利用当前广播信息和自身秘密信息自主恢复由于网络原因遗失会话的组密钥.利用撤销多项式管理者实现了对节点的撤销能力,此外赋予节点与其生命期相对应的秘密掩码值集合.安全分析和效率分析表明在保证安全属性的前提下,降低了通信开销和存储开销.     

智能电网中基于层次密钥的细粒度访问机制的研究

为了保证通信的安全,加密是基本的也是重要的解决办法,其中密钥的管理是关键问题。目前已有的方案大多采用公钥加密来实现通信过程的安全,开销花费较大。本文提出基于层次密钥管理的对称加密方案保证数据的完整可用性,防止数据被篡改。并给出了性能分析,方案可以实现基本的安全传输并能够降低开销,节约成本。     

WSN的网络安全管理机制研究

本文提出一种基于多项式的WSN密钥管理方案.基站通过计算节点秘密信息构成的多项式来生成网络的全局密钥,节点通过全局密钥可以认证网络中的合法节点.节点用全局密钥经过对称多项式密钥交换来生成与簇头节点之间的会话密钥.该方案能够动态更新密钥,从而解决了由于节点被捕获所导致的信息泄露、密钥连通性下降和密钥更新通信开销大等问题.性能分析表明,该方案与现有的密钥预分配方案相比,具有更低的存储开销、通信开销、良好的扩展性和连通性.     

One-way hash chain-based self-healing group key distribution scheme with collusion resistance capability in wireless sensor networks

In order to resolve the collusion resistance problem in the one-way hash chain-based self-healing group key distribution schemes and improve the performance of previous self-healing group key distribution schemes, we propose a self-healing group key distribution scheme based on the revocation polynomial and a special one-way hash key chain for wireless sensor networks (WSNs) in this paper. In our proposed scheme, by binding the time at which the user joins the group with the capability of recovering previous group session keys, a new method is addressed to provide the capability of resisting the collusion attack between revoked users and new joined users, and a special one-way hash chain utilization method and some new methods to construct the personal secret, the revocation polynomial and the key updating broadcast packet are presented. Compared with existing schemes under same conditions, our proposed scheme not only supports more revoked users and sessions, but also provides a stronger security. Moreover, our proposed scheme reduces the communication overhead, and is especially suited for a large scale WSN in bad environments where a strong collusion attack resistance capability is required and many users will be revoked.     

Self-healing group-wise key distribution schemes with time-limited node revocation for wireless sensor networks

In this article two novel group-wise key distribution schemes with time-limited node revocation are introduced for secure group communications in wireless sensor networks. The proposed key distribution schemes are based on two different hash chain structures, dual directional hash chain and hash binary tree. Their salient security properties include self-healing rekeying message distribution, which features a periodic one-way rekeying function with efficient tolerance for lost rekeying messages; and time-limited dynamic node attachment and detachment. Security evaluation shows that the proposed key distribution schemes generally satisfy the requirement of group communications in WSNs with lightweight communication and computation overhead, and are robust under poor communication channel quality.     

Hexagonal Clustered Trust Based Distributed Group Key Agreement Scheme in Mobile Ad Hoc Networks

Secure and efficient group communication among mobile nodes is one of the significant aspects in mobile ad hoc networks (MANETs). The group key management (GKM) is a well established cryptographic technique to authorise and to maintain group key in a multicast communication, through secured channels. In a secure group communication, a one-time session key is required to be shared between the participants by using distributed group key agreement (GKA) schemes. Due to the resource constraints of ad hoc networks, the security protocols should be communication efficient with less overhead as possible. The GKM solutions from various researches lacks in considering the mobility features of ad hoc networks. In this paper, we propose a hexagonal clustered one round distributed group key agreement scheme with trust (HT-DGKA) in a public key infrastructure based MANET environment. The proposed HT-DGKA scheme guarantees an access control with key authentication and secrecy. The performance of HT-DGKA is evaluated by simulation analysis in terms of key agreement time and overhead for different number of nodes. Simulation results reveal that the proposed scheme guarantees better performance to secure mobile ad hoc network. It is demonstrated that the proposed scheme possesses a maximum of 2250 ms of key agreement time for the higher node velocity of 25 m/s and lower key agreement overhead. Also, the HT-DGKA scheme outperforms the existing schemes in terms of successful message rate, packet delivery ratio, level of security, computation complexity, number of round, number of exponentiations and number of message sent and received that contribute to the network performance.

     

An effective key management scheme for heterogeneous sensor networks

Security is critical for sensor networks used in military, homeland security and other hostile environments. Previous research on sensor network security mainly considers homogeneous sensor networks. Research has shown that homogeneous ad hoc networks have poor performance and scalability. Furthermore, many security schemes designed for homogeneous sensor networks suffer from high communication overhead, computation overhead, and/or high storage requirement. Recently deployed sensor network systems are increasingly following heterogeneous designs. Key management is an essential cryptographic primitive to provide other security operations. In this paper, we present an effective key management scheme that takes advantage of the powerful high-end sensors in heterogeneous sensor networks. The performance evaluation and security analysis show that the key management scheme provides better security with low complexity and significant reduction on storage requirement, compared with existing key management schemes.     

SBK: A Self-Configuring Framework for Bootstrapping Keys in Sensor Networks

Key pre-distribution has been claimed to be the only viable approach for establishing shared keys between neighboring sensors after deployment for a typical sensor network. However, none of the proposed key pre-distribution schemes simultaneously achieves good performance in terms of scalability in network size, key-sharing probability between neighboring sensors, memory overhead for keying information storage, and resilience against node capture attacks. In this paper, we propose SBK, an in-situ self-configuring framework to bootstrap keys in large-scale sensor networks. SBK is fundamentally different compared to all key pre-distribution schemes. It requires no keying information pre-deployment. In SBK, sensors differentiate their roles as either service nodes or worker nodes after deployment. Service sensors construct key spaces, and distribute keying information in order for worker sensors to bootstrap pairwise keys. An improved scheme, iSBK, is also proposed to speed up the bootstrapping procedure. We conduct both theoretical analysis and simulation study to evaluate the performances of SBK and iSBK. To the best of our knowledge, SBK and iSBK are the only key establishment protocols that simultaneously achieve good performance in scalability, key-sharing probability, storage overhead, and resilience against node capture attacks.     

一种基于ID的传感器网络密钥管理方案

对偶密钥的建立是无线传感器网络的安全基础,它使得节点之间能够进行安全通信。但是由于节点资源的限制,传统的密钥管理方法在传感器网络中并不适用。在分析了现有密钥预分配协议的前提下,该文提出一种新的基于ID的密钥预分配协议。此协议用计算和比较散列值的方式替代广播方式协商密钥,减少了传感器节点大量的通信消耗。然后,分析了所提出方案的安全性、通信量和计算量,并和已有协议进行了比较。结果表明本文的方法不仅能保证安全性,而且节约了大量通信资源。     

On Self-Healing Key Distribution Schemes

Self-healing key distribution schemes allow group managers to broadcast session keys to large and dynamic groups of users over unreliable channels. Roughly speaking, even if during a certain session some broadcast messages are lost due to network faults, the self-healing property of the scheme enables each group member to recover the key from the broadcast messages he has received before and after that session. Such schemes are quite suitable in supporting secure communication in wireless networks and mobile wireless ad-hoc networks. Recent papers have focused on self-healing key distribution, and have provided definitions, stated in terms of the entropy function, and some constructions. The contribution of this paper is the following: We analyze current definitions of self-healing key distribution and, for two of them, we show that no protocol can achieve the definition. We show that a lower bound on the size of the broadcast message, previously derived, does not hold. We propose a new definition of self-healing key distribution, and we show that it can be achieved by concrete schemes. We give some lower bounds on the resources required for implementing such schemes, i.e., user memory storage and communication complexity. We prove that the bounds are tight     

A Secure Key Predistribution Scheme for WSN Using Elliptic Curve Cryptography

Security in wireless sensor networks (WSNs) is an upcoming research field which is quite different from traditional network security mechanisms. Many applications are dependent on the secure operation of a WSN, and have serious effects if the network is disrupted. Therefore, it is necessary to protect communication between sensor nodes. Key management plays an essential role in achieving security in WSNs. To achieve security, various key predistribution schemes have been proposed in the literature. A secure key management technique in WSN is a real challenging task. In this paper, a novel approach to the above problem by making use of elliptic curve cryptography (ECC) is presented. In the proposed scheme, a seed key, which is a distinct point in an elliptic curve, is assigned to each sensor node prior to its deployment. The private key ring for each sensor node is generated using the point doubling mathematical operation over the seed key. When two nodes share a common private key, then a link is established between these two nodes. By suitably choosing the value of the prime field and key ring size, the probability of two nodes sharing the same private key could be increased. The performance is evaluated in terms of connectivity and resilience against node capture. The results show that the performance is better for the proposed scheme with ECC compared to the other basic schemes.