Key management method and system

Abstract

The present invention discloses a key management method and system, which relates to the technical field of key management and includes a key distribution scheme and a key revocation scheme. The wireless sensor network consists of at most M base stations and N sensors, where the number of base stations is much less than the number of sensors. Each sensor node is at least γ-hop reachable from m base stations, and γ < m. Each base station or sensor node in the network is assigned a globally unique digital identifier. The key distribution scheme includes the following: A1: Pairwise keys and individual keys; A2: Session keys; A3: Encryption keys and message authentication keys. For the key management method and system of the present invention, the base stations and sensor nodes can verify each other's identity information; the capture or destruction of any base station does not affect the security of the entire sensor network.

Description

Technical Field

[0001] The present invention relates to the technical field of key management, and particularly to a key management method and system. Background Art

[0002] Wireless Sensor Network (WSN) can be applied to many fields and is a promising solution. Security is the main problem faced by WSN currently. Among all the security issues of WSN, key management is the most important and is the core mechanism to ensure network service security.

[0003] Currently, when people study the security issues of WSN, they usually only consider the case where there is only one base station in the network. However, as the number of sensor nodes deployed in the network increases, one base station cannot well guarantee the network service quality. Therefore, deploying multiple base stations in the sensor network is a good solution, which can reduce the distance between sensor nodes and base stations, reduce the energy consumption of sensor nodes, and improve the performance of the sensor network.

[0004] The following problems exist in the prior art:

[0005] Existing key management protocols for WSN all assume that the base station is trusted, assume that each sensor node pre-loads a master key, which is shared by all nodes in the sensor network, and loads a pairwise key shared with the base station. When considering the security of WSN with multiple base stations, the currently proposed key management protocols cannot be directly used. Assuming that all base stations use the same master key or the same pairwise key, several problems will occur. First, the base station can verify messages from sensor nodes, but sensor nodes cannot verify messages from the base station. Second, once a base station is captured or compromised, the master key and pairwise keys of the entire WSN will be exposed, and any attacker with this key set can access the network. Summary of the Invention

[0006] The present invention provides a key management method and system to solve the problems raised in the above background art.

[0007] To solve the above technical problems, the technical solutions adopted by the present invention are:

[0008] A key management method and system, including a key distribution scheme and a key revocation scheme. The wireless sensor network consists of at most M base stations and N sensors, where the number of base stations is much less than the number of sensors. Each sensor node is reachable by at least γ (γ < m) base stations in a single hop, and each base station or sensor node in the network is assigned a globally unique digital identifier;

[0009] The key distribution scheme includes the following:

[0010] A1: pairwise keys and single keys;

[0011] A2: Session key;

[0012] A3: encryption key and message authentication key;

[0013] The key revocation scheme includes the following:

[0014] B1: the base station is damaged, the sensor node is damaged, and both the base station and the sensor node are damaged;

[0015] B2: Assume that each sensor maintains a list: Node Revocation List (NRL), which includes the identifiers of all failed entities (base stations or sensor nodes) in the network;

[0016] B3: The revocation list is initially empty and will continue to grow over time.

[0017] Preferably, the pairwise key and the single key: before deploying the sensor node, the configuration server randomly generates a binary t-order polynomial , in a finite field On, where q is a prime number, satisfying ; For sensor i, the configuration server calculates f(x, y) to obtain f(i, y), and loads the univariate polynomial f(i, y) to sensor i; for any two sensor nodes i and j, node i can calculate the shared key with node j as f(i, j) through the univariate polynomial f(i, y); similarly, node j can calculate the shared key with node i as f(j, i) through the univariate polynomial f(j, y). Since f(i, j) = f(j, i), nodes i and j share a pairwise key.

[0018] Preferably, the session key is a global key shared by all nodes in the network. First, assuming that each base station shares a group key, the session key can be derived from the group key and dynamically distributed to each sensor node; assuming that the group key is , the session key for the i-th session Pseudo-random function Export: .

[0019] Preferably, the is the session key of the current i-th session. The session key distribution process is described as follows:

[0020] A21: Secret Sharing Allocation: During the pre-allocation phase, the configuration server randomly selects an m 2t-order polynomial In finite fields On each sensor All pre-loaded with personal secrets Each base station Preloaded polynomials ;

[0021] A22: Different shared broadcast: Given a set of revoked sensor nodes , base station Randomly select a polynomial of order t and , then the base station will and Shared with non-revoked sensors;

[0022] A23: Session Key Recovery: If there is any unrevoked sensor node Upon receiving such a broadcast message, it calculates the polynomial and ,get , Since the sensor nodes Know and , so we can calculate , ,at last, A new session key can be obtained For the revoked sensor nodes, due to , therefore, the session key cannot be recovered.

[0023] Preferably, the encryption key and message authentication key: Assume is the pairwise key shared between sensor A and sensor B, is the current session key, then the encryption key and message authentication key It can be obtained by the following formula:

[0024] , ;

[0025] The complete message sent by sensor A to sensor B is:

[0026] ;

[0027] Message M and timestamp By encryption key Encrypted and then attached by the message authentication key Ciphertext After receiving the complete message, sensor B first uses the message authentication key generated by itself to Ciphertext Perform integrity authentication. After authentication is passed, use the generated encryption key Ciphertext Decrypt to get message M.

[0028] Preferably, when a base station is damaged, it needs to be deleted from the network: because the security of communication is guaranteed by encryption keys and message authentication keys, and both encryption keys and message authentication keys are generated by session keys, if the damaged base station cannot generate the next session key, it will be deleted from the network; for this purpose, the damaged base station will be forced to leave the group and generate a new group key, and then generate a new session key from the new group key.

[0029] Preferably, if a sensor node is found to be damaged, the damaged sensor can be deleted using the session key distribution scheme: for a damaged sensor node, its identifier will be added to the revocation list NRL; the revoked sensor cannot recover a new session key because .

[0030] Preferably, once the base station and the sensor nodes are destroyed, the base station needs to be revoked first, and then the sensor nodes.

[0031] Due to the adoption of the above technical solution, the present invention has the following technical advancements compared to the prior art:

[0032] 1. The present invention provides a key management method and system, where base stations and sensor nodes can verify each other's identity information;

[0033] 2. The present invention provides a key management method and system, where the capture or destruction of any base station does not affect the security of the entire sensor network;

[0034] 3. The present invention provides a key management method and system, whereby the capture or destruction of any sensor node does not affect the security of the sensor network;

[0035] 4. The present invention provides a key management method and system, whereby the capture or destruction of a base station and a sensor node does not affect the security of the sensor network. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a flow chart of the key distribution scheme of the present invention;

[0037] Figure 2 Flowchart of the key revocation scheme of the present invention;

[0038] Figure 3 This is a flow chart of the session key of the present invention. DETAILED DESCRIPTION

[0039] To make the technical means, creative features, achieved objectives and effects of the present invention easy to understand, the present invention will be further described below in conjunction with specific embodiments.

[0040] As Figure 1-Figure 3 shown, a key management method and system include a key distribution scheme and a key revocation scheme, and are characterized in that: the wireless sensor network consists of at most M base stations and N sensors, where the number of base stations is much less than the number of sensors, each sensor node is reachable by at least γ (γ < m) base stations in a single hop, and each base station or sensor node in the network is assigned a globally unique digital identifier;

[0041] Each sensor node generates five types of keys: pairwise keys, individual keys, session keys, encryption keys, and message authentication (MAC) keys.

[0042] Pairwise keys: Each sensor node shares a pairwise key with each of its neighbor nodes, and the pairwise key is used to generate encryption keys and MAC keys.

[0043] Individual keys: Each node shares a unique individual key with the base station, and the individual key is used for the base station to authenticate a single sensor node.

[0044] Session keys: These are global keys shared by all nodes in the network and are used for the key revocation scheme.

[0045] Encryption keys and message authentication code keys: The encryption keys and MAC keys are used to ensure the security of communication in the sensor network, and the encryption keys and MAC keys can be derived from the pairwise keys and session keys;

[0046] The key distribution scheme includes the following:

[0047] A1: Pairwise keys and individual keys;

[0048] A2: Session keys;

[0049] A3: Encryption keys and message authentication keys;

[0050] The key revocation scheme includes the following:

[0051] B1: The base station is damaged, the sensor node is damaged, and both the base station and the sensor node are damaged;

[0052] B2: Assume that each sensor maintains a list: the node revocation list (NRL), and the NRL includes the identifiers of all expired entities (base stations or sensor nodes) in the network;

[0053] B3: The revocation list is initially empty and will increase over time.

[0054] As Figure 1-Figure 3 As shown, the pairwise key and the single key: Before deploying the sensor node, the configuration server randomly generates a binary t-order polynomial , in a finite field On, where q is a prime number, satisfying For sensor i, the configuration server calculates f(x, y) to obtain f(i, y), and loads the univariate polynomial f(i, y) to sensor i. For any two sensor nodes i and j, node i can calculate the shared key with node j as f(i, j) through the univariate polynomial f(i, y). Similarly, node j can calculate the shared key with node i as f(j, i) through the univariate polynomial f(j, y). Since f(i, j) = f(j, i), nodes i and j share a pairwise secret.

[0055] The generation of a single key is similar to that of a pairwise key. Before base station j is deployed, the configuration server loads the univariate polynomial f(j, y) to base station j. The base station and the sensor node can calculate the same single key by exchanging their respective identifiers.

[0056] like Figure 1-Figure 3 As shown, the session key: The session key is a global key shared by all nodes in the network. First, it is assumed that each base station shares a group key. The session key can be derived from the group key and dynamically distributed to each sensor node; assuming the group key is , the session key for the i-th session Pseudo-random function Export: .

[0057] like Figure 1-Figure 3 As shown, is the session key of the current i-th session. The session key distribution process is described as follows:

[0058] A21: Secret Sharing Allocation: During the pre-allocation phase, the configuration server randomly selects an m 2t-order polynomial In finite fields On each sensor All pre-loaded with personal secrets Each base station Preloaded polynomials ;

[0059] A22: Different shared broadcast: Given a set of revoked sensor nodes , base station Randomly select a polynomial of order t and , then the base station will and Shared with sensors that have not been revoked; the message format is as follows:

[0060] ;

[0061] where the revocation polynomial ;

[0062] A23: Session key recovery: If there are any sensors nodes that have not been revoked receive such a broadcast message, it calculates the polynomials and , and obtains , . Since the sensor node knows and , it can calculate , . Finally,[[]] can obtain the new session key . For revoked sensor nodes, since , therefore, the session key cannot be recovered;[[ID=�9]]

[0063] Since each sensor node is within single-hop reach of at least γ (γ < m) base stations, an unrevoked sensor node can recover multiple copies of the session key. Only when the node obtains at least γ copies of the session key can the session key be accepted.

[0064] As Figure 1-Figure 3 shown, the encryption key and message authentication key: Assume is the pairwise key shared between sensor A and sensor B, is the current session key, then the encryption key and the message authentication key can be obtained through the following formulas:

[0065] , ;

[0066] The complete information sent by sensor A to sensor B is:

[0067] ;

[0068] The message M and the timestamp are encrypted by the encryption key , and then the message authentication code formed by the message authentication key for the ciphertext is attached; after receiving the complete message, sensor B first uses the message authentication key it generates itself to authenticate the ciphertext Perform integrity authentication. After authentication is passed, use the generated encryption key Ciphertext Decrypt to get message M.

[0069] like Figure 1-Figure 3 As shown in the figure, when a base station is damaged, it needs to be deleted from the network: because the security of communication is guaranteed by encryption keys and message authentication keys, and both encryption keys and message authentication keys are generated by session keys, if the damaged base station cannot generate the next session key, it will be deleted from the network; to this end, the damaged base station will be forced to leave the group and generate a new group key, and then generate a new session key from the new group key. Because a sensor node can only accept a session key if it obtains at least γ copies of the session key, the attacker must control γ base stations at the same time to launch an attack.

[0070] If a sensor node is found to be compromised, the compromised sensor can be removed using the session key distribution scheme: for a compromised sensor node, its identifier will be added to the revocation list NRL; the revoked sensor cannot recover the new session key because ,Therefore, the revoked sensor is also unable to generate new encryption keys and message ,authentication keys. Although the revoked sensor still has pairwise keys with ,the neighboring nodes, it cannot decrypt and authenticate all messages in the ,network.

[0071] Once the base station and sensor nodes are destroyed, the base station needs to be revoked first, and then the sensor nodes. The detailed steps are the same as described above.

[0072] A key distribution scheme supports multiple base stations in the network; a key revocation scheme is used to effectively remove damaged nodes in the network.

[0073] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

Claims

1. A key management method, including a key distribution scheme and a key revocation scheme, characterized in that: The wireless sensor network consists of at most M base stations and N sensors, where the number of base stations is much less than the number of sensors. Each sensor node is within single-hop reach of at least γ < m base stations. Each base station or sensor node in the network is assigned a globally unique digital identifier; The key distribution scheme includes the following: A1: Pairwise keys and individual keys; A2: Session keys; A3: Encryption keys and message authentication keys; The key revocation scheme includes the following: B1: Base station compromised, sensor node compromised, and both base station and sensor node compromised; B2: Assume each sensor maintains a list: Node Revocation List (NRL), and NRL includes the identifiers of all invalid entities in the network; B3: The revocation list is initially empty and will increase over time; The session key is a global key shared by all nodes in the network. First, it is assumed that each base station shares a group key. The session key is derived from the group key and dynamically distributed to each sensor node. Assume that the group key is , the session key for the i-th session Pseudo-random function Export: ; The encryption key and message authentication key: Assume is the pairwise key shared between sensor A and sensor B, is the current session key, then the encryption key and message authentication key It is obtained by the following formula: ， ； The complete information sent from sensor A to sensor B is: ； Message M and timestamp By encryption key Encrypted and then attached by the message authentication key Ciphertext After receiving the complete message, sensor B first uses the message authentication key generated by itself to Ciphertext Perform integrity authentication. After authentication is passed, use the generated encryption key Ciphertext Decrypt to get message M.

2. A key management system, implemented based on the key management method according to claim 1, characterized in that: When the base station is compromised, the base station needs to be removed from the network: Since the security of communication is guaranteed by encryption keys and message authentication keys, and both encryption keys and message authentication keys are generated by session keys, if the compromised base station cannot generate the next session key, it will be removed from the network; For this reason, the compromised base station will be forced to leave the group and generate a new group key, and then a new session key will be generated from the new group key.

3. A key management system according to claim 2, characterized in that: If a compromised sensor node is detected, the compromised sensor will be removed using the session key distribution scheme: For a compromised sensor node, its identifier will be added to the revocation list NRL; The revoked sensor cannot recover a new session key.

4. A key management system according to claim 3, characterized in that: Once the base station and sensor node are compromised, the base station needs to be revoked first, and then the sensor node.

Images