A system based on a dynamic cryptographic architecture for securing resource-constrained networks

Abstract

A system based on a dynamic cryptographic architecture for securing resource-constrained networks, consisting of: a multitude of wireless sensor nodes, each node comprising a central processing unit configured to enable lightweight encryption for secure and energy-efficient communication in the sensor network, the central processing unit comprising the following: a dynamic cluster selection module configured to regularly rotate the selection of the cluster head based on node performance, node spacing, and network topology; a flexible, lightweight encryption module configured to automatically select encryption parameters using a symmetric block cipher algorithm, with the encryption module dynamically adjusting the complexity based on the available computing resources; a key management module configured to establish a secure connection between the sensor, the cluster head, and the neighborhood access point; an authentication module that includes a two-stage authentication mechanism to secure data transmission between sensor nodes, cluster heads and an access point; a wireless communication interface configured to transmit encrypted data packets with embedded encrypted encryption parameters; and a routing device that acts as an access point and is configured to enable secure communication between the wireless sensor network and the cloud storage or database.

Description

AREA OF INVENTION

[0001] The present disclosure relates to a dynamic system for secure and energy-efficient communication in wireless sensor networks. More specifically, the present invention relates to a dynamic system based on cryptographic architecture for securing resource-constrained networks. BACKGROUND OF THE INVENTION

[0002] The proliferation of wireless sensor networks (WSNs) has revolutionized monitoring in various fields, from healthcare to environmental science. However, these networks face critical challenges stemming from their resource limitations. Wireless sensor nodes typically operate with severely restricted processing power, low bandwidth, limited memory, and minimal battery life, significantly limiting their ability to implement robust security mechanisms.

[0003] Existing communication protocols and encryption approaches designed for resource-rich networks prove inadequate for WSNs. Classical cryptographic techniques consume excessive amounts of energy and computing resources, potentially leading to frequent node disconnections and network outages. The fundamental conflict arises between maintaining stringent security and preserving network operational efficiency, particularly in scenarios requiring dynamic, real-time performance with limited computing and power resources.

[0004] To address the aforementioned challenges, the present invention offers a system that introduces a holistic approach to WSN security. The present invention provides an automated system for secure and energy-efficient communication in wireless sensor networks, enabling secure communication with minimal power consumption and offering a differentiated solution to the long-standing trade-off between robust security and network sustainability in resource-constrained wireless sensor environments. SUMMARY OF THE INVENTION

[0005] This disclosure relates to a dynamic system for secure and energy-efficient communication in wireless sensor networks, in particular a dynamic system based on cryptographic architecture for securing resource-constrained networks. The present invention relates to an automated, flexible, and lightweight encryption system called AutoCrypt for wireless sensor networks. The proposed system uses a dynamic clustering mechanism to effectively rotate cluster leadership among the network nodes. Furthermore, the proposed system includes a lightweight encryption mechanism for selecting encryption parameters in the resource-constrained sensor nodes. This mechanism secures the wireless sensors and the transmitted data.Finally, the proposed system includes a lightweight key management mechanism designed to establish a secure connection between sensors, the cluster leadership, and the access points.

[0006] An objective of the present invention is to provide a dynamic system based on a cryptographic architecture for securing resource-constrained networks. The system comprises: a plurality of wireless sensor nodes, each node comprising a central processing unit configured to enable lightweight encryption for secure and energy-efficient communication in the sensor network, wherein the central processing unit comprises: a dynamic cluster selection module configured to periodically rotate the cluster head selection based on node power, node spacing, and network topology; and a flexible, lightweight encryption module configured to automatically select encryption parameters using a symmetric block cipher algorithm, the encryption module dynamically adjusting the complexity based on the available computing resources.A key management module configured to establish a secure connection between the sensor, the cluster head, and the neighborhood access point; and an authentication module incorporating a two-factor authentication mechanism to secure data transmission between sensor nodes, cluster heads, and an access point. The system further includes: a wireless communication interface configured to transmit encrypted data packets with embedded encrypted encryption parameters; and a routing device acting as an access point, configured to enable secure communication between the wireless sensor network and the cloud storage or database.

[0007] Another objective of the present invention is to provide a system based on a dynamic cryptographic architecture for securing resource-constrained networks.

[0008] Another objective of the present invention is to provide a dynamic clustering mechanism that supports node mobility and regularly rotates the cluster heads to balance power consumption across the entire wireless sensor network.

[0009] Another objective of the present invention is the implementation of a dynamic, lightweight encryption mechanism that dynamically selects and adapts encryption parameters based on the computing and energy resources available in real time in individual sensor nodes.

[0010] Another objective of the present invention is to provide a flexible key management mechanism that generates unique symmetric encryption keys for each transmission session, thereby minimizing the risk of unauthorized data access and providing robust protection against various network security threats.

[0011] Another objective of the present invention is to provide a two-stage authentication mechanism that ensures secure communication between sensor nodes, cluster heads and access points, thereby reducing the risks of replay attacks, eavesdropping and network identity theft.

[0012] Another objective of the present invention is to optimize the lifetime and performance of the network by providing a comprehensive security solution that simultaneously takes into account encryption complexity, power consumption, computing power and data protection in resource-constrained wireless sensor networks.

[0013] To further clarify the advantages and features of the present disclosure, a more detailed description of the invention is given with reference to specific embodiments thereof, which are illustrated in the accompanying drawings. It should be noted that these drawings represent only typical embodiments of the invention and are therefore not to be considered as limiting its scope. The invention is described and explained with additional details and information with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE FIGURES

[0014] These and other features, aspects, and benefits of this disclosure will be better understood when the following detailed description is read with reference to the accompanying drawings, in which identical symbols consistently represent identical parts. The following applies: Fig. Figure 1 shows a block diagram of a system based on a dynamic cryptographic architecture for securing resource-constrained networks according to an embodiment of the present invention. Fig. Figure 2 represents a diagram showing the general structure of the proposed system according to an embodiment of the present invention.

[0015] Furthermore, those skilled in the art will recognize that elements in the drawings are presented for the sake of simplicity and are not necessarily drawn to scale. For example, the flowcharts illustrate the method by outlining the main steps to enhance understanding of aspects of this disclosure. Additionally, with regard to the design of the device, one or more components of the device may be represented in the drawings by conventional symbols, and the drawings may show only the specific details relevant to understanding the embodiments of this disclosure, so as not to clutter the drawings with details that are readily apparent to those skilled in the art who benefit from the description herein. DETAILED DESCRIPTION:

[0016] To facilitate understanding of the principles of the invention, reference is now made to the embodiment illustrated in the drawings, which is described in specific language. However, it is clear that this is not intended to limit the scope of the invention, since such changes and further modifications of the illustrated system and such further applications of the principles of the invention as they are shown therein are considered as would normally occur to a person skilled in the art in the field to which the invention relates.

[0017] It is clear to the person skilled in the art that the preceding general description and the following detailed description are exemplary and explanatory of the invention and are not intended as a limitation of it.

[0018] References in this specification to “an aspect”, “another aspect”, or similar formulations mean that a particular feature, structure, or property described in connection with the embodiment is included in at least one embodiment of the present disclosure. Therefore, occurrences of the phrase “in one embodiment”, “in another embodiment”, and similar formulations in this specification may all refer to the same embodiment, but need not.

[0019] The terms "includes," "comprehensive," or other variations thereof are intended to cover non-exclusive inclusion, so that a process or method that includes a list of steps may include not only those steps but also other steps not expressly listed or inherent in such process or method. Likewise, one or more devices, subsystems, elements, structures, or components preceded by "includes...a" do not, without further limitations, exclude the existence of other devices, subsystems, elements, structures, components, or additional devices, subsystems, elements, structures, or components.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as they are generally understood by a person skilled in the art in the field to which this invention belongs. The system, methods, and examples provided herein are for illustrative purposes only and are not to be understood as limiting.

[0021] Embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0022] The functional units described in this specification are referred to as devices. A device may be implemented in programmable hardware devices such as processors, digital signal processors, central processing units, field-programmable gate arrays, programmable array logic, programmable logic devices, cloud processing systems, or the like. Devices may also be implemented in software for execution by various processor types. An identified device may contain executable code and may, for example, comprise one or more physical or logical blocks of computer instructions, which may be organized, for example, as an object, procedure, function, or other construct.However, the executable file of an identified device does not need to be physically arranged together, but may comprise different instructions stored in different locations which, when logically connected, constitute the device and fulfill the stated purpose of the device.

[0023] In fact, the executable code of a device or module can be a single instruction or multiple instructions, and can even be distributed across several different code segments, across different applications, and across multiple storage devices. Similarly, operational data can be identified and represented within the device, embodied in any suitable form, and organized in any suitable type of data structure. The operational data can be captured as a single data record or distributed across different locations, including different storage devices, and can exist, at least in part, as electronic signals within a system or network.

[0024] References in this specification to "a selected embodiment," "an embodiment," or "an embodiment" mean that a particular feature, structure, or property described in connection with the embodiment is included in at least one embodiment of the disclosed subject matter. Therefore, occurrences of the expressions "a selected embodiment," "in an embodiment," or "in an embodiment" at different locations in this specification do not necessarily refer to the same embodiment.

[0025] Furthermore, the described features, structures, or properties can be combined in one or more embodiments in any suitable manner. Numerous specific details are provided in the following description to enable a comprehensive understanding of the embodiments of the disclosed subject matter. However, a person skilled in the art will recognize that the disclosed subject matter can be implemented without one or more of the specific details or with other methods, components, materials, etc. In other cases, known structures, materials, or processes are not shown or described in detail to avoid obscuring aspects of the disclosed subject matter.

[0026] According to the exemplary embodiments, the disclosed computer programs or modules can be executed in many exemplary ways, for example, as an application stored in the memory of a device, or as a hosted application running on a server and communicating with the device application or browser via a number of standard protocols such as TCP / IP, HTTP, XML, SOAP, REST, JSON, and other suitable protocols. The disclosed computer programs can be written in exemplary programming languages ​​and executed from memory on the device or from a hosted server, for example, BASIC, COBOL, C, C++, Java, Pascal, or scripting languages ​​such as JavaScript, Python, Ruby, PHP, Perl, or other suitable programming languages.

[0027] Some of the disclosed embodiments include or otherwise involve data transmission over a network, such as the communication of various inputs or files over the network. The network may include, for example, one or more of the following: the Internet, wide area networks (WANs), local area networks (LANs), analog or digital wired and wireless telephone networks (e.g., a PSTN, Integrated Services Digital Network (ISDN), a cellular network, and Digital Subscriber Line (xDSL)), radio, television, cable, satellite, and / or any other transmission or tunneling mechanism for carrying data. The network may include multiple networks or subnetworks, each of which may, for example, include a wired or wireless data path. The network may include a circuit-switched voice network, a packet-switched data network, or any other network capable of transmitting electronic communications.For example, the network can include networks based on the Internet Protocol (IP) or the Asynchronous Transfer Mode (ATM), and can support voice by using, for example, VoIP, Voice over ATM, or other comparable protocols used for voice data communication. In one implementation, the network includes a mobile phone network configured for exchanging text or SMS messages.

[0028] Examples of the network include, but are not limited to, a Personal Area Network (PAN), a Storage Area Network (SAN), a Home Area Network (HAN), a Campus Area Network (CAN), a Local Area Network (LAN), a Wide Area Network (WAN), a Metropolitan Area Network (MAN), a Virtual Private Network (VPN), an Enterprise Private Network (EPN), the Internet, a Global Area Network (GAN), and so on.

[0029] Fig. Figure 1 shows a block diagram of a system (100) based on a dynamic cryptographic architecture for securing resource-constrained networks according to an embodiment of the present invention.

[0030] With reference to Fig. 1 The system (100) comprises a plurality of wireless sensor nodes (102), each node comprising a central processing unit (104) configured to enable lightweight encryption for secure and energy-efficient communication in the sensor network, the central processing unit (104) comprising: a dynamic cluster selection module (104a) configured to periodically rotate the cluster head selection based on node power, node spacing, and network topology; a flexible lightweight encryption module (104b) configured to automatically select encryption parameters using a symmetric block cipher algorithm, the encryption module dynamically adjusting the complexity based on available computing resources;a key management module (104c) configured to establish a secure connection between the sensor, the cluster head, and the neighborhood access point; and an authentication module (104d) incorporating a two-factor authentication mechanism to secure data transmission between sensor nodes, cluster heads, and an access point. The system (100) further comprises a wireless communication interface (106) configured to transmit encrypted data packets with embedded encrypted encryption parameters; and a routing device (108) acting as an access point, configured to enable secure communication between the wireless sensor network and the cloud storage or database (110).

[0031] In one embodiment, the dynamic cluster selection module (104a) implements a mobility support mechanism that enables sensor nodes to dynamically change cluster memberships based on network conditions, wherein the dynamic cluster selection module (104a) selects the cluster head based on node-specific parameters, thus ensuring an even distribution of power consumption among the nodes, and wherein the dynamic cluster selection module (104a) allows the cluster head responsibilities to rotate in order to balance power consumption and maintain network service quality.

[0032] In one embodiment, the flexible, lightweight encryption module (104b) uses primitive computational operations including random permutations, substitutions and rotations at the bit level to minimize power consumption, wherein the flexible, lightweight encryption module (104b) adapts the encryption complexity based on a real-time assessment of the available power and computational resources of individual sensor nodes, and wherein the flexible, lightweight encryption module (104b) uses a lightweight encryption algorithm that dynamically adjusts cryptographic parameters such as key length or complexity to balance energy efficiency and computational effort.

[0033] In one embodiment, the key management module (104c) is configured to generate symmetric encryption keys by XORing pre-distributed keys with random nonce values, thereby ensuring lower computational complexity for sensor nodes with limited resources; and to derive session-specific master keys (Mk) using session times and hashed CH identities (HID) to secure the encryption parameters and symmetric keys for each transmission session.

[0034] In one embodiment, the authentication module (104d) is configured to validate the authenticity of sensor nodes at the cluster head (CH) by using the master key (Mk) to decrypt encrypted parameters, thereby ensuring the legitimacy of the nodes; and to perform secondary authentication at the access point (AP) by verifying the CH identity and decrypting the encryption parameters, thereby protecting against unauthorized nodes or compromised CHs.

[0035] In one embodiment, the authentication module (104d) provides protection against replay attacks, eavesdropping and identity theft by using unique session-based mechanisms for key generation and verification.

[0036] In one embodiment, the wireless communication interface (106) enables secure data transmission by encrypting both the user data and the encryption parameters using dynamically generated symmetric keys.

[0037] In one embodiment, the routing device (108), acting as an access point, also ensures smooth data transfer to the cloud storage or database (110), thus guaranteeing data integrity and protection against replay, eavesdropping and identity theft attacks.

[0038] The present invention provides a system called AutoCrypt for secure and energy-efficient communication in wireless sensor networks. The proposed system offers three main features: an automated, lightweight cryptographic mechanism for WSNs, a dynamic clustering mechanism, and a novel, lightweight key management and authentication mechanism. The present invention aims to optimize wireless sensor networks for improved security and performance.

[0039] Fig. Figure 2 represents a diagram showing the general structure of the proposed system according to an embodiment of the present invention.

[0040] The proposed AutoCrypt scheme consists of three main phases. The first phase employs a local dynamic cluster selection mechanism to regularly rotate the cluster heads (CHs). This rotation aims to balance power consumption among the nodes and improve quality of service (QoS). The second phase introduces an automated, lightweight encryption mechanism to secure the wireless sensors and ensure the security of transmitted data. The third phase implements a lightweight key management mechanism to establish secure connections between the sensors, the cluster heads, and the adjacent access point (AP).

[0041] The overall architecture of the proposed AutoCrypt scheme is described in Fig.The wireless sensor network (WSN) nodes are configured to collect data from their environment and transmit it to the access point (AP). The network consists of n sensor nodes, designated N1, N2, ..., Nn, which can either remain stationary or move in different directions. The process begins with the selection of cluster heads (CHs) based on several criteria, including node power, distance between nodes, and the number of neighboring nodes. Once the CHs are selected, the network topology is configured to implement an automated, lightweight encryption scheme. This scheme secures communication and data transmission between nodes, CHs, and the AP.

[0042] The automated encryption mechanism dynamically adjusts the encryption parameters based on the performance of each node and its distance from the CH (Channel Hub). This adaptability allows the system to efficiently balance computational complexity and energy consumption, thereby optimizing secure network communication. The lightweight key management mechanism operates in two stages to ensure secure connections and facilitate the exchange of data and symmetric keys. These connections include interactions between sensor nodes and their respective CHs, as well as between the CHs and the AP (Access Point).

[0043] The objective of the present invention is to provide a system that implements mechanisms in wireless sensor networks that reduce power consumption, maintain performance, and thus ensure the security of data communication.

[0044] The present invention provides a system comprising a clustering mechanism designed to save energy and improve QoS, wherein the clustering mechanism selects the best cluster head for each region, the selection being primarily based on node power (P), average distance between nodes (Ω), and shortest distance (d). A) depends on the access point. Once the cluster head is selected, the data is transferred to the access point using the parent cluster head nodes.

[0045] The clustering mechanism of this invention is configured to optimize power consumption, improve communication efficiency, and maintain network connectivity within wireless sensor networks (WSNs). It comprises several key steps and criteria for effectively selecting and managing cluster heads (CHs).

[0046] The power consumption model is based on communication between nodes, as this is the primary source of energy consumption. Transmitters consume power to operate electronic circuits and amplify signals, while receivers consume power to operate wireless electronics. Energy consumption depends on the distance between transmitting and receiving nodes. Furthermore, each node communicates with its neighbors by sending data messages, which helps manage power levels and update information for neighboring nodes.

[0047] The CH selection process takes several parameters into account to ensure efficient clustering: 1. Nodes with higher residual power are prioritized as CHs to extend the operational lifetime of the network. 2. The number of neighboring nodes influences the CH selection. A higher number of neighboring nodes increases the probability of being selected as CH. 3. Nodes that are closer to their neighbors are more likely to be selected as CHs, thus optimizing communication efficiency. 4. Nodes that are closer to the AP (determined via received signal strength or GPS data) are preferred. 5. Nodes with a power output below a defined threshold are excluded from the CH selection process.

[0048] First, the AP selects CHs within its operational area and distributes the selection across different zones. Over time, the CHs are autonomously rotated to balance power consumption. After selection, the CH transmits its identity within its domain, allowing neighboring nodes to calculate distances and establish a connection to the nearest CH. Furthermore, the present invention uses animated nodes to implement the reclustering process.

[0049] The system accommodates mobile nodes by implementing a reclustering process. If a node moves beyond the threshold distance from its cluster hub (CH), it searches for a closer CH to join. If no suitable CH is available, the node initiates the formation of a new cluster. If a CH moves too far from its associated nodes and has too few connections, it relinquishes its role and reverts to a regular node, prompting its associated nodes to either join another cluster or form a new one.

[0050] The Routing Protocol for Low Power and Lossy Networks (RPL) is used exclusively for CHs to create and manage the network topology. CHs exchange information using a broadcast mechanism to create the topology, and the best paths are determined using a distance-vector approach. The routing tables are updated regularly to reflect changes in the network.

[0051] The clustering mechanism mentioned above ensures energy efficiency, robust connectivity and adaptability to node mobility through dynamic CH selection, re-clustering processes and efficient routing protocols.

[0052] This invention implements a flexible, lightweight encryption mechanism designed to minimize power consumption and computational demands during the encryption of data received from sensors. The proposed flexible, lightweight encryption mechanism automates the selection of encryption parameters based on the currently available resources of each node for encrypting the data. The proposed system employs a symmetric block cipher algorithm (FlexenTech) for encryption, an algorithm designed for devices with sufficient resources and offering flexibility in balancing complexity and security levels. To encrypt the plaintext, the algorithm performs primitive computations using a combination of random permutations, substitutions, and rotations at the bit level.

[0053] The proposed automated scheme for selecting encryption parameters aims to balance security, performance, and power consumption in wireless nodes, taking into account two critical metrics: 1. Residual power level (P): The remaining power in the wireless node. 2. Distance (d): The distance between the node and its nearest cluster head (CH).

[0054] Security mechanisms inherently consume a node's power, which can lead to downtime or delays in data processing and transmission. However, it is crucial to ensure data security even when the node's available power is limited. To address this, the scheme balances the applied security level with the power consumption incurred by encryption, thereby extending the node's operating time. This balance is achieved by relying heavily on the P-matrix, which governs the trade-off between security robustness and encryption cost. The calculated weight (ω) dynamically determines the appropriate encryption parameters, optimizing the trade-off between security strength and energy efficiency.

[0055] Key encryption parameters: 1. Number of rounds (r): This parameter significantly affects the robustness and computation time of the encryption. Higher r values ​​increase security but also increase processing time and power consumption. 2. Block size (b): Determines the size of the data blocks processed during encryption. Larger block sizes improve security but also increase computational effort and energy consumption.

[0056] The weight (ω) is calculated based on the calculated values ​​of P and d. A higher ω value indicates the need for stronger encryption, leading to higher values ​​of r and b. The number of rounds (r) is calculated dynamically, and the block size (b) is determined based on r. This ensures that the cryptographic overhead is controlled while maintaining sufficient security.

[0057] The scheme assigns block sizes according to certain threshold values: • A block size of 32 for higher r-values. • A block size of 16, 8, or 4 for increasingly lower r ranges.

[0058] These thresholds allow the system to dynamically adjust the encryption parameters, thus ensuring efficient power consumption while simultaneously securing the data.

[0059] The AutoCrypt system, integrated into the FlexenTech cipher, offers flexibility in selecting encryption parameters to balance high security with speed. This block-based encryption approach divides the plaintext data (M) into fixed-length blocks of b bits. Each input is a single b-bit plaintext block, and the output is a corresponding block of ciphertext of the same size. The number of encryption rounds, r, is determined based on the required security level. The encryption key, k, is randomly selected by the sensor node for each data transmission using a key pre-allocation method. The key must satisfy two conditions: k must be greater than b, and the greatest common divisor of k and b must be 1.

[0060] In each encryption round, a random permutation is performed at the bit level. The position of the permuted bits is determined using a mathematical formula that arranges the bits in ascending order according to their new positions. This ensures randomness at the bit level. After the permutation, a series of random rotations is applied within each round. The starting bit for the rotation, known as Sbr, is dynamically calculated for each round, thus ensuring irregularities in the rotation process. A nonce value is incorporated to update the encrypted data without incurring additional processing overhead.

[0061] The encryption process continues iteratively for r rounds. After the last round, the encrypted output for each block is created, labeled Cb. The decryption process reverses these steps to restore the original plaintext data, thus ensuring the secure transmission of information.

[0062] FlexenTech also offers data integrity verification by generating parity bits (pt) for each encryption round. These parity bits, whose size corresponds to the number of rounds, are encrypted as an additional cipher block (Cpt) and appended to the entire ciphertext. On the receiving end, data integrity is verified by comparing the parity bits from the decryption process with those in the received data. This mechanism ensures that any unauthorized modification of the transmitted data can be detected. The process is automated and detailed within the encryption algorithm, making it a robust and efficient solution for securing data in wireless sensor networks.

[0063] The present invention also employs a simple key management mechanism for a secure connection between nodes, cluster heads, and access points. In wireless sensor networks (WSNs), data is transmitted in open, unsecured environments, making secure communication essential. The key management scheme used must minimize the overhead for generating, agreeing upon, and distributing keys in resource-constrained networks. The AutoCrypt system meets these requirements with a simple key management mechanism that reduces power consumption and transmission latency while ensuring secure and authenticated communication between sensor nodes, their cluster heads (CHs), and the access point (AP).

[0064] The key management process in the system operates in two phases. In the first phase, a symmetric encryption key is generated, while in the second phase, a session key is created and distributed to protect these symmetric keys. To minimize computational complexity and power consumption during key generation and exchange, a key pre-allocation approach is used. A large pool of keys is pre-generated using a pseudorandom function, and a random subset of these keys is assigned to each sensor node before deployment. To ensure secure key usage, each key is combined with a random nonce value (e.g., its index in the pool) using an XOR operation, resulting in the symmetric encryption key. This key is then used to encrypt the node's data.

[0065] In the second phase, the nodes encrypt their plaintext data and additionally secure the encryption key and parameters before transmitting it to the CH. Each node has a unique ID (e.g., its MAC address) that is pre-registered with the AP and known to the CH. Furthermore, the ID of the selected CH is shared with all associated nodes and updated with each new CH selection. Before each data transmission session, the CH generates a session key (Sk), utilizing the session's transmission time to reduce overhead. This key is distributed to all connected nodes and changes with each session. When the nodes receive the Sk, they compute a master key (Mk) by hashing the CH ID (using MD5) to produce a hashed ID (HID) and applying the XOR function between the Sk and the HID.This Mk is then used to encrypt the parameters required for decryption, and the encrypted parameters are sent to the CH along with the payload.

[0066] After receiving the encrypted data, the CH forwards it, along with the Sk, to other CHs using a modified RPL protocol until it finally reaches the AP. At the AP, the HID is calculated from the registered CH ID, and the Mk is calculated by XORing the HID with the Sk. The Mk is used to decrypt the encrypted parameters, which then decrypt the data. This process is repeated for all nodes connected to the CH, allowing the AP to retrieve their plaintext data.

[0067] The proposed system offers a two-stage authentication process. The first stage takes place at the CH, where the Mk is used to validate the authenticity of nodes by decrypting the parameters contained in their payload. The second stage is performed at the AP, where the Mk is verified using the Sk and the ID hash of the CH. If the Mk cannot decrypt the parameters, the AP rejects the data and terminates the process, indicating that the CH is either unregistered or unauthorized.

[0068] This authentication mechanism effectively counters replay, eavesdropping, and identity theft attacks. Each node encrypts its data for each transmission session with a unique key. Even if an attacker intercepts encrypted packets, they cannot derive CH identities or retrieve the encryption keys without the precise session time and the HID of the CH. Consequently, the proposed AutoCrypt system ensures secure, efficient, and reliable communication within the WSN.

[0069] In one embodiment, the performance of the proposed system is evaluated in a simulation environment. A model of the system is set up, and the system is analyzed based on the performance of the encryption algorithm, power consumption, and network lifetime. First, the cluster rotations are designed, and then the system's mechanisms are applied. The system's performance is then compared to standard and lightweight cryptographic algorithms. The performance of the proposed system is evaluated using four metrics: system execution speed, number of rounds and block size, power consumption and node residual current, and network lifetime. Following the performance evaluation, a security analysis is performed, considering a formal attack model and the proposed system's ability to resist attacks and meet security requirements.The attack models considered include brute-force attacks, eavesdropping attacks, network traffic analysis attacks, replay attacks, and man-in-the-middle attacks.

[0070] The results of the performance analysis showed that the proposed system can effectively save 66% of power compared to FlexenTech and extend network lifespan by 86%, 94%, and 90%, respectively, compared to FlexenTech, AES, and TEA encryption. A security analysis of the proposed scheme demonstrates its resistance to known WSN attacks such as brute-force, eavesdropping, man-in-the-middle, and replay attacks.

[0071] The drawings and the preceding description provide examples of embodiments. Those skilled in the art will recognize that one or more of the described elements can be combined to form a single functional element. Alternatively, certain elements can be divided into several functional elements. Elements from one embodiment can be added to another embodiment. For example, the sequences of the processes described herein can be changed and are not limited to the manner described herein. Furthermore, the actions of any flowchart need not be implemented in the order shown; nor do all actions necessarily need to be performed. Actions that are not dependent on other actions can also be performed in parallel with the other actions. The scope of embodiments is in no way limited by these specific examples.Numerous variations are possible, whether explicitly stated in the specification or not, such as differences in structure, dimensions, and material use. The range of embodiments is at least as broad as specified in the following claims.

[0072] Advantages, other merits, and problem solutions have been described above in relation to specific embodiments. However, the advantages, merits, problem solutions, and all components that may lead to an advantage or solution occurring or becoming more apparent are not to be construed as a critical, necessary, or essential feature or component of any or all claims. REFERENCES 100 A system based on a dynamic cryptographic architecture for securing resource-constrained networks. 102 Variety of Wireless Sensor Nodes 104 Central unit 104a Dynamic Cluster Selection Module 104b Flexible, Lightweight Encryption Module 104c Key Management Module 104d authentication module 106 Wireless Communication Interface 108 Routing device 110 Cloud storage or database 202 Wireless Sensor Nodes 204 cluster heads 206 Edge access point 208 Internet 210 devices 212 IPv4 or IPv6

Claims

[1] A system based on a dynamic cryptographic architecture for securing resource-constrained networks, consisting of: a plurality of wireless sensor nodes, each node comprising a central processing unit configured to enable lightweight encryption for secure and energy-efficient communication in the sensor network, the central processing unit comprising: a dynamic cluster selection module configured to regularly rotate the cluster head selection based on node performance, node spacing, and network topology; a flexible, lightweight encryption module configured to automatically select encryption parameters using a symmetric block cipher algorithm, wherein the encryption module dynamically adjusts the complexity based on available computing resources; a key management module configured to establish a secure connection between the sensor, the cluster head, and the neighborhood access point; an authentication module that includes a two-factor authentication mechanism to secure data transmission between sensor nodes, cluster heads, and an access point; a wireless communication interface configured to transmit encrypted data packets with embedded encrypted encryption parameters; and a routing device that acts as an access point and is configured to enable secure communication between the wireless sensor network and the cloud storage or database. [2] The system of claim 1, wherein the dynamic cluster selection module implements a mobility support mechanism that allows sensor nodes to dynamically change cluster memberships based on network conditions, wherein the dynamic cluster selection module selects the cluster head based on node-specific parameters, thus ensuring an even distribution of power consumption among the nodes, and wherein the dynamic cluster selection module rotates the responsibilities of the cluster heads to balance power consumption and maintain network service quality. [3] The system of claim 1, wherein the flexible, lightweight encryption module uses primitive computational operations including random permutations, substitutions, and rotations at the bit level to minimize power consumption, wherein the flexible, lightweight encryption module adjusts encryption complexity based on a real-time assessment of the available power and computational resources of individual sensor nodes, and wherein the flexible, lightweight encryption module uses a lightweight encryption algorithm that dynamically adjusts cryptographic parameters such as key length or complexity to balance energy efficiency and computational overhead. [4] The system of claim 1, wherein the key management module is configured to: Generate symmetric encryption keys by XORing pre-distributed keys with random nonce values ​​to ensure lower computational complexity for resource-constrained sensor nodes. Derive session-specific master keys (Mk) using session times and hashed CH identities (HID) to secure the encryption parameters and symmetric keys for each transfer session. [5] The system of claim 1, wherein the authentication module is configured to: Verify the authenticity of the sensor nodes at the cluster head (CH) by using the master key (Mk) to decrypt encrypted parameters, thus ensuring the legitimacy of the nodes. Perform secondary authentication at the access point (AP) by verifying the CH identity and decrypting the encryption parameters, thus protecting against unauthorized nodes or compromised CHs. [6] The system of claim 1, wherein the authentication module provides protection against replay attacks, eavesdropping, and identity theft through the use of unique session-based key generation and verification mechanisms. [7] The system of claim 1, wherein the wireless communication interface enables secure data transmission by encrypting both payload data and encryption parameters using the dynamically generated symmetric keys. [8] The system of claim 1, wherein the routing device acting as an access point further ensures smooth transmission of the data to the cloud storage or database, thus ensuring data integrity and protection against replay, eavesdropping and identity theft attacks.

Images