Hash Tree Authentication for Wireless Sensor Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless sensor networks (WSN) face challenges in authenticating and securely transmitting messages due to the computational limitations of tag nodes, which lack embedded power supplies and are vulnerable to physical attacks, making conventional security mechanisms like RSA and AES impractical.
Innovation Solution
A lightweight authentication method using a hash tree-based signature scheme, where a sink device generates a private key with sub-private keys and constructs a hash tree to create a public key, allowing for efficient message authentication and encryption without requiring high computational power from tag devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security mechanisms like RSA or AES are used for message authentication and encryption in WSNs, then security protection is improved, but computational power requirement increases making it infeasible for weak tag nodes
Solution Approach 1:
The private key is segmented into multiple sub-private keys, and the public key is segmented into multiple sub-public keys. This segmentation allows the authentication process to use only a subset of sub-keys rather than requiring full key operations, significantly reducing computational burden on tag nodes while maintaining security through the hash tree structure that binds all sub-keys together.
Solution Approach 2:
The invention changes the parameter of key operation from full-key RSA/AES operations to selective sub-key hash operations. By transforming the authentication mechanism to use hash functions on selected sub-private keys rather than complex cryptographic operations on full keys, the computational complexity is reduced from O(n^3) for RSA to O(n) for hash operations, making it feasible for weak tag nodes.
2Reliability
If tag nodes store and process encrypted data with high security requirements, then data protection is improved, but the tag nodes require higher computational capability which contradicts their low-power design
Solution Approach 1:
The sink node performs preliminary actions by pre-computing the hash tree structure and pre-selecting authentication paths before data retrieval operations. The public key and authentication paths are prepared in advance, so that during actual data retrieval, the tag node only needs to perform simple verification using pre-computed values rather than complex real-time cryptographic operations.
Solution Approach 2:
The hash tree structure acts as an intermediary between the private key and the authentication process. Instead of directly using complex cryptographic keys for authentication, the hash tree transforms them into a structure where selective sub-key verification provides both security and computational efficiency, mediating between strong security requirements and weak computational capabilities.
3Productivity
If tag nodes perform decryption and searching operations on stored data, then data retrieval functionality is improved, but power consumption and computational load increase significantly
Solution Approach 1:
Instead of requiring tag nodes to perform complete decryption and full-data searching operations, the invention enables partial action where the sink node performs the computationally intensive decryption and searching operations using its greater computational power, while tag nodes perform only lightweight verification of authentication signatures. This divides the workload such that energy-intensive operations are performed by the sink node rather than the power-constrained tag nodes.
Data Source
AI summary
A method for authenticating a message in a network is provided. The method includes a step of generating, in a sink device, a private key and a public key. The private key includes a plurality of sub-private keys. The method further includes a step of generating, in the sink device, a signature for the message. The signature includes a sub-private key and an authentication path associated with the sub-private key in a hash tree. The hash tree is constructed during the generation of the sub-public keys.