Symmetric Key Generation Engine for Secure Wireless Sensor Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional key-distribution schemes in wireless sensor networks face challenges in providing strong security while minimizing resource requirements and ensuring network resilience against node capture, particularly due to inefficiencies in symmetric cryptography and vulnerabilities in key-distribution methods.
Innovation Solution
A symmetric key generation engine (SKGE) is introduced, which uses a management device to generate partial keying material shares from a root keying material, allowing nodes to efficiently and securely establish pairwise keys with reduced computational and memory requirements, while making it difficult for attackers to retrieve the initial root keying material.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If symmetric cryptography is used to enable security services in resource-constrained nodes, then energy consumption and computational complexity are reduced, but key distribution becomes vulnerable to node capture attacks
Solution Approach 1:
The patent divides the keying material into multiple shares using secret sharing schemes. Each node receives only a portion of the keying material rather than the complete key, so that capturing a single node does not compromise the entire system. The keying material is segmented across multiple nodes, requiring collaboration of multiple compromised nodes to reconstruct the root keying material.
Solution Approach 2:
The patent introduces a management device as an intermediary that generates and distributes keying material shares to nodes. This intermediary maintains the root keying material securely and performs key establishment operations on behalf of resource-constrained nodes, enabling symmetric cryptography benefits while centralizing secure key management functions.
2Ease of operation
If random key pre-distribution schemes are used to enable secure communication, then key establishment becomes simpler, but the storage requirements increase significantly
Solution Approach 1:
The patent extracts only the necessary portions of keying material from the complete key and distributes these minimal shares to individual nodes. Instead of storing entire keys or large key pools, each node receives a compact share that can be combined with other shares through the management device to establish secure communication, significantly reducing per-node storage requirements.
Solution Approach 2:
The patent creates a universal keying material share format that can be used for multiple purposes: establishing pairwise keys with any other node, authenticating communications, and deriving session keys. This multi-functional share design eliminates the need for separate key storage for different communication partners, reducing overall memory requirements while maintaining ease of operation.
3Reliability
If public-key cryptography is used for key agreement, then security against node capture is improved, but computational complexity and energy consumption increase
Solution Approach 1:
The patent performs key establishment operations in advance through the management device, which generates keying material shares and prepares authentication credentials before nodes need to communicate. This preliminary action allows resource-constrained nodes to simply store their shares and use them for authentication, avoiding the need to perform computationally intensive public-key operations during actual communication while maintaining security.
Solution Approach 2:
The management device acts as an intermediary that performs the computationally intensive public-key cryptography operations centrally, while distributing the benefits to resource-constrained nodes. The intermediary handles complex key generation, storage, and combination operations, allowing end nodes to use simpler symmetric cryptography for actual communication, thus reducing their energy consumption while maintaining security.
Data Source
Figure 1~2
Figure 3
Figure 4a
AI summary
A method for securing communications between a first node (N1) and a second node (N2) in a network (1) further comprising a management device (2) provided with root keying materials, the method comprising the following steps: the management device generating, based on root keying materials, a first node keying material shares comprising a number of sub-elements and the first node keying material shares being arranged for generating a first complete key, the management device selecting a subset of sub-elements of the first keying material shares, the number of sub-elements selected being less or equal than the total number of sub-elements of the first keying material shares, and the selected sub-elements forming a first node partial keying material shares or symmetric-key generation engine, the first node generating, based on the first node symmetric-key generation engine and on an identifier of the second node, a first key, used for securing communications with the second node.