A cryptographic scheme for real-world wireless sensor networks applications
Stefano Marchesani, Luigi Pomante, Fortunato Santucci, M. Pugliese · 2013
This demo deals with the cryptographic aspect of security applied to the WSN domain. In particular, it shows in action a novel cryptographic scheme compliant to security requirements of real-world WSN applications (i.e. with very limited system resources). The proposed scheme exploits benefits from both symmetric and asymmetric ones where the keys, for each communicating node pairs, can be generated only if such nodes have been authenticated with respect to the network topology. As a main difference with respect to existing approaches, the proposed scheme doesn't rely on the pre-distribution of keys but it is based on their dynamic generation exploiting partial information stored on nodes. Then, through computationally inexpensive operations, a node can compute the decrypt/encrypt key in a single phase with no steps of setup/negotiation. Furthermore, the proposed approach allows to authenticate a message with respect to a set of planned network topologies. For this, it has been called TAK2 (Topology Authenticated Key 2, i.e. an improvement of [1]). TAK2 has been implemented in nesC/TinyOS_1.x [2]. In particular, TAK2 has been integrated in the SW component provided by TinyOS_1.x to manage basic communications (i.e. GenericComm) while keeping its original interface to be completely transparent to the upper layers. In fact, GenericComm is the TinyOS_1.x component that allows the exchange of messages with the physical layer through the SendMsg and ReceiveMsg interfaces. Then, it has been replaced by the so called SecureComm component: it provides the same interfaces of GenericComm so that it is able to intercept the exchange of original messages while introducing described security mechanisms. So, a SW component that needs to send a radio messages will use the send() command of SecureComm instead of the GenericComm one. The new implementation delegates the elaborations to a send_message() task. This task generates a random number, performs topology authentication and computes the key by knowing the address of destination node. Then, it encrypts the plain text and produce the packet to be sent on air by means of the original GenericComm send() command. Received messages are managed in a similar way: a new event handler is wired to the receive() handler of GenericComm to delegate some processing to a receive_message() task. Such a task performs topology authentication computing also the key used to decipher the message. It is worth noting that the task is able to authenticate the message accepting or discarding it. When a valid message is identified, it is delivered as it was processed by the original GenericComm receive() handler.