Fast Hierarchical Key Management Scheme With Transitory Master Key for Wireless Sensor Networks

• Published in: IEEE internet of things journal Vol. 3; no. 6; pp. 1334 - 1345
• Main Authors: Gandino, Filippo, Ferrero, Renato, Montrucchio, Bartolomeo, Rebaudengo, Maurizio
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 01-12-2016; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Authentication; Encryption; Hardware; Internet of things; Key management; Locks & keys; Security management; symmetric encryption; transitory master key (MK); Wireless networks; wireless sensor network (WSN); Wireless sensor networks
• ISSN: 2327-4662; 2327-4662
• DOI: 10.1109/JIOT.2016.2599641

Symmetric encryption is the most widely adopted security solution for wireless sensor networks. The main open issue in this context is represented by the establishment of symmetric keys. Although many key management schemes have been proposed in order to guarantee a high security level, a solution without weaknesses does not yet exist. An important class of key management schemes is based on a transitory master key (MK). In this approach, a global secret is used during the initialization phase to generate pair-wise keys, and it is deleted during the working phase. However, if an adversary compromises a node before the deletion of the MK, the security of the whole network is compromised. In this paper, a new key negotiation routine is proposed. The new routine is integrated with a well-known key computation mechanism based on a transitory master secret. The goal of the proposed approach is to reduce the time required for the initialization phase, thus reducing the probability that the master secret is compromised. This goal is achieved by splitting the initialization phase in hierarchical subphases with an increasing level of security. An experimental analysis demonstrates that the proposed scheme provides a significant reduction in the time required before deleting the transitory secret material, thus increasing the overall security level. Moreover, the proposed scheme allows to add new nodes after the first deployment with a suited routine able to complete the key establishment in the same time as for the initial deployment.