2. A Pairwise Key Pre-Distribution Scheme for Wireless Sensor Networks Wenliang (Kevin) Du, Jing Deng, Yunghsiang S. Han and Pramod K. Varshney Department of EECS Syracuse University

3. Overview Wireless Sensor Networks (WSN). Key management problem in WSN. Existing solutions. Our solution. Security and performance analysis. Conclusion and future work.

4. Wireless Sensor Networks Deploy Sensors

5. Securing WSN Deploy Sensors Secure Channels

6. Problem Description How can each pair of neighboring nodes find a secret key? Pairwise: secret keys are unique for each pair. Can be used for authentication.

7. Approaches Trusted-Server Schemes Finding trusted servers is difficult. Public-Key Schemes Expensive and infeasible for sensors. Key Pre-distribution Schemes

8. Goal: Loading Keys into sensor nodes prior to deployment, s.t. any two nodes can find a secret key between them after deployment Challenges Security: nodes can be compromised Scalability: new nodes might be added later Memory/Energy efficiency Authentication: pairwise keys Key Pre-distribution

9. Naïve Solutions Master-Key Approach Memory efficient, but low security. Needs Tamper-Resistant Hardware. Pair-wise Key Approach N-1 keys for each node (e.g. N=10,000). Security is perfect. Need a lot of memory and cannot add new nodes.

10. Eschenauer-Gligor Scheme m keys (random) m A B E D C Key Pool S m m m E.g., when |S| = 10,000, m=75, the local connectivity p = 0.50 This scheme is further improved by Chan, Perrig, and Song (IEEE S&P 2003).

11. Our Goal Pairwise key pre-distribution scheme. Use Blom Scheme. Further improvement on performance and resilience. Use random key pre-distribution scheme.

12. Blom Scheme Public matrix G Private matrix D (symmetric). D G +1 N A G = (D G) T G = G T D T G = G T D G = (A G) T Let A = (D G) T

13. Blom Scheme X = A = (D G) T G(D G) T G i j i j K ji K ij N +1 N N Node i carries: Node j carries:

14. G Matrix To achieve -secure: Any +1 columns of G must be linearly independent. Vandermonde matrix has such a property. 1111 ss2s2 s3s3 sNsN s2s2 (s 2 ) 2 (s 3 ) 2 (s N ) 2 s (s 2 ) (s 3 ) (s N ) G =

15. Properties of Blom Scheme Blom’s Scheme Network size is N Any pair of nodes can directly find a secret key Tolerate compromise up to nodes Need to store +2 keys Our next goal: increase without increasing the storage usage.

16. Multiple Space Scheme (D 2, G) (D 1, G) (D , G) Key-Space Pool  spaces Two nodes can find a pairwise Key if they carry a common Key space!

17. How to select  and  ? If the memory usage is m, the security threshold (probablistic) m is To improve the security, we need to increase  /  2. However, such an increase affects the connectivity.

18. Measure Local Connectivity p local = the probability that two neighboring nodes can find a common key.

19. P local for different  and 

20. Security Analysis Network Resilience: When x nodes are compromised, how many other secure links are affected?

21. Resilience (p = 0.33, m=200) Blom

22. Resilience (p = 0.50, m =200) Blom

23. Other Analysis Communication overhead Computation overhead

24. Improvement: Using Two-hop Neighbors  = 7  = 2  = 31  = 2

25. Conclusion We have proposed a pairwise key pre- distribution scheme for WSN. We analyzed security, computational overhead, communication overhead. Our scheme substantially improves the network resilience.

26. Independent Discoveries The similar scheme is independently discovered by two other groups: Liu and Ning from NC State (next talk). Katz and his group from University of Maryland.