Ad Hoc Networks xxx (2012) xxx xxx. Contents lists available at SciVerse ScienceDirect. Ad Hoc Networks

Transcription

1 Ad Hoc Networks xxx (2012) xxx xxx Contents lsts avalable at ScVerse ScenceDrect Ad Hoc Networks journal homepage: Practcal and secure localzaton and key dstrbuton for wreless sensor networks q Q M a, John A. Stankovc a, Radu Stoleru b, a Department of Computer Scence, Unversty of Vrgna, Unted States b Department of Computer Scence and Engneerng, Texas A&M Unversty, Unted States artcle nfo abstract Artcle hstory: Receved 1 August 2011 Receved n revsed form 14 November 2011 Accepted 17 December 2011 Avalable onlne xxxx Keywords: Wreless sensor network Secure localzaton Key dstrbuton In many applcatons of wreless sensor networks, sensor nodes are manually deployed n hostle envronments where an attacker can dsrupt the localzaton servce and tamper wth legtmate n-network communcaton. In ths artcle, we ntroduce Secure Walkng GPS, a practcal and cost effectve secure localzaton and key dstrbuton soluton for real, manual deployments of WSNs. Usng the locaton nformaton provded by the GPS and nertal gudance modules on a specal master node, Secure Walkng GPS acheves accurate node localzaton and locaton-based key dstrbuton at the same tme. We evaluate our localzaton soluton n real deployments of McaZ. Our experments show that 100% of the deployed nodes localze (.e., have a locaton poston) and that the average localzaton errors are wthn 1 2 m, due manly to the lmtatons of the exstng commercal GPS devces. Our further analyss and smulaton results ndcate that the Secure Walkng GPS scheme makes a deployed WSN resstant to the Dolev-Yao, the wormhole, and the GPS-denal attacks, the scheme s practcal for large-scale deployments wth resource-constraned sensor nodes and has good localzaton and key dstrbuton performance. Ó 2011 Elsever B.V. All rghts reserved. 1. Introducton Wreless sensor networks (WSNs) are envsoned to be wdely used n medcal, mltary, and envronmental montorng applcatons. A future WSN mght consst of hundreds to thousands of deployed sensor nodes whch are expected to self-organze nto an autonomous network, perform desred sensng tasks, and react properly to the envronment or specfc events. Localzaton s one of the most mportant servces provded by a WSN, because n most applcatons we are nterested not only n the types of events that have taken place, q A prelmnary verson of ths artcle was presented at the ACM Conference on Wreless Network Securty (WSec), 2010 [1]. Correspondng author. Address: Department of Computer Scence and Engneerng, Texas A&M Unversty, MS 3112, College Staton, TX 77843, USA. Tel.: ; fax: E-mal addresses: qm@cs.vrgna.edu (Q. M), stankovc@cs.vrgna.edu (J.A. Stankovc), stoleru@cse.tamu.edu (R. Stoleru). but also n where the events have taken place. For example, sensor nodes can be deployed along the border of a restrcted area to detect ntrudng targets [2] or they can be scattered n a thcket to montor sunlght and carbon doxde concentraton at dfferent locatons [3]. In addton, the normal operaton of many other WSN servces depends on the correct knowledge of node locatons. For example, the geographc forwardng [4,5] protocol makes routng decsons based on the locatons of ndvdual sensor nodes. Hence, the locatons of the deployed sensor nodes need to be determned accurately. In many cases, a WSN s manually deployed n a potentally hostle envronment and left unattended for a long perod of tme. As a result, t s vulnerable to varous attacks durng and after ts deployment. An attacker usually launches a malcous attack for three purposes: (1) to steal senstve data from legtmate messages, (2) to nject false messages nto the network, and (3) to dsrupt the normal operaton of WSN servces and applcatons. Therefore, to ensure that a WSN operates as expected, t s crucal that /$ - see front matter Ó 2011 Elsever B.V. All rghts reserved. do: /j.adhoc

2 2 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx WSN desgners consder potental attacks and nclude countermeasures n ther desgns. In ths work, we focus on three typcal types of attacks: the Dolev-Yao, the wormhole, and the GPS-denal attacks, and present an ntegral soluton to secure localzaton and key dstrbuton n manual deployments of large-scale WSNs. The major contrbutons of ths work are: (1) a practcal localzaton protocol whch s secure aganst the three aforementoned attacks; (2) an ntegrated localzaton and key dstrbuton protocol that keeps key sets on deployed nodes very small; thereby meetng memory constrants, and ensures network communcaton connectvty and protecton aganst wormhole attacks; (3) a securty analyss demonstratng the correctness of our soluton; and (4) a performance evaluaton usng parameters from a real WSN deployment, whch demonstrates: a hgh localzaton accuracy, that almost all nodes are localzed, the excellent scalng propertes to networks of at least sze 1000, the excellent performance even n the presence of realstc rregular communcaton ranges, and low overhead. The rest of the artcle s organzed as follows. We present our Secure Walkng GPS soluton n Secton 2 and ts securty analyss n Secton 3. We present the evaluaton of our secure localzaton and key dstrbuton n Secton 4. In Secton 5 we present the related work and dscuss ther lmtatons and conclude our work n Secton Secure localzaton system desgn An alternatve to the Secure Walkng GPS localzaton scheme s enablng each sensor node wth GPS capabltes. Ths monolthc soluton s both expensve and neffcent. In the Secure Walkng GPS archtecture, however, the system s decoupled nto two man components: the master node and the sensor node, as depcted n Fg. 1. In our soluton the master node s present durng the deployment of nodes. The master node obtans ts current locaton from an onboard GPS devce, and sends t to each newly deployed sensor node wrelessly. An nertal gudance (IG) module complements the functon of GPS on the master node. The IG module uses moton and rotaton sensors to contnuously capture the orentaton and velocty of the deployer, and estmates the master node s locaton (stll represented usng GPS coordnates) va dead reckonng [6]. Snce the IG module does not depend on external resources, t s always avalable and t serves as a backup source of current locaton durng a GPS-denal attack. Communcaton keys, for neghborhood communcaton, are also dstrbuted effcently to sensor nodes durng the node localzaton process. Ths archtecture enabled us to push all complexty derved from the nteracton wth the GPS devce to a sngle node, the master node, and to sgnfcantly reduce the sze of the code and data memory used on the sensor node. Through ths decouplng, a sngle master node s suffcent for the localzaton of an entre sensor network, and the costs are thus reduced Local coordnate system A GPS locaton s represented by a lattude k and a longtude /, whch are angular measures from the Equator to North or South, and Prme Merdan to East or West, respectvely. A relatvely smple desgn for the master node would have been to use a GPS coordnate system, snce actual GPS and IG locatons are represented usng GPS coordnates. Due to the relatvely small sze of a sensor network (hundreds to a few thousand meters), the use of global (.e. GPS) coordnates s very neffcent. The neffcency stems from the sze of the packets used for passng locaton nformaton a sgnfcant porton of the locaton s lkely to be the same for all sensor nodes as well as from the computatonal costs encountered when aggregatng data, e.g., trangulaton of several GPS coordnates for postonng a target. In order to reduce the aforementoned overhead we use a local, Cartesan, coordnate system. Ths local coordnate system of reference, whch uses lnear unts, s better suted for WSN, than a global coordnate system. A local coordnate system s bult from a global system, that uses GPS coordnates, n the followng way: the local system of reference has an orgn (called a Reference Pont) specfed n terms of global coordnates (GPS coordnates). The dstance between ths Reference Pont (wth coordnates k 1 and / 1 ) and another pont, wth a GPS locaton specfed by k 2 and / 2, can be computed as follows [7]: qffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff Dstance ¼ ðf lat ð/ 1 / 2 ÞÞ 2 þðf lon ðk 1 k 2 ÞÞ 2 ð1þ where p F lat ¼ 180 p F lon ¼ 180! a 2 b 2 ða 2 cos 2 / þ b 2 sn 2 /Þ þ h 3=2 a 2 ða 2 cos 2 / þ b 2 sn 2 /Þ 1=2 þ h! cos / ð2þ ð3þ Master Node Sensor Node Fg. 1. Decouplng of the Secure Walkng GPS localzaton system nto two components: the master node (enabled wth a GPS and nertal modules) and the sensor node. are converson factors that represent the dstances for 1 change n lattude and longtude, respectvely. The unt of measure s meter/degree. The parameters n the above formulas are: a = 6,378,137 m, b = 6,356, m and h s the heght over the earth ellpsod. The nfluence of h on the converson factors s mnmal and a value of 200 m s assumed. The X and Y coordnates of the pont wth a GPS locaton specfed by k 2 and / 2 are gven by the two

3 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx 3 addtve terms n Eq. (1). The Y-axs of the local coordnate system s orented n the North/South drecton and the X- axs n the East/West drecton. All varables specfed n Eqs. (1) (3) (.e., k, / and h) can be drectly obtaned from a commercal GPS devce. The result of our desgn s that the master node transforms the global coordnates receved from the GPS devce nto local coordnates and broadcasts these local coordnates Attack model and assumptons Attack model The goal of an attacker s to mslead sensor nodes nto obtanng false locatons and also threaten locaton-dependent servces such as trackng. We explore three types of WSN attacks whch are typcal and the most threatenng to localzaton, namely the Dolev-Yao attack, the wormhole attack and the GPS-denal attack. The Dolev-Yao and wormhole attacks are the two man securty attacks to whch wreless sensor networks are very vulnerable [8]. In a Dolev-Yao attack, an attacker can overhear, ntercept, and synthesze any message and s only lmted by the constrants of the cryptographc methods used [9]. A Dolev-Yao attack compromses the authentcty, legtmacy and confdentalty of messages. In a wormhole attack, an attacker creates a lnk between two dstant locatons, tunnels legtmate messages from one end of the lnk to the other end, and replays them there. A wormhole attacker attempts to make sensor nodes appear closer than they really are, volatng the communcaton range constrant. It s dffcult to detect a wormhole attack because the vctm messages are stll legtmate and kept ntact. In a GPS-denal attack, an attacker ntermttently jams the GPS sgnals. GPS sgnals are typcally used by WSN anchor nodes (.e., nodes that know ther locatons) to obtan ther locatons. There are also other WSN attacks such as the physcal tamperng of sensor nodes and the denal-of-servce (DoS) attacks, but they are outsde our scope Assumptons We assume that there s an attack-free base staton located behnd the deployment feld, where t s secure to perform any necessary pre-deployment operaton, such as downloadng program code and dstrbutng an ntal key to each sensor node. However, the actual deployment takes place n a two-dmensonal nfrastructure-less feld consstng of open spaces and heavy woods. We assume that the GPS sgnals are not always avalable durng deployment, ether because of temporary lack of Lne-of- Sght GPS sgnals due to the surroundng envronment, or because of purposeful GPS-denal attacks. As a result, not all sensor nodes can be localzed usng the GPS module alone. We also assume that sensor nodes are close to the master node when they are deployed. Therefore, t s reasonable for the master to make all the localzaton and key dstrbuton decsons and securely nform the sensor node of ts decsons. We assume that the master node s a powerful node and t wll not be compromsed by any attack. We assume that Table 1 Cryptographc notatons. Notaton Meanng M The master node s The th deployed sensor node A? B:msg A sends the msg to B msg 1 kmsg 2 The concatenaton of msg 1 and msg 2 msg msg n plan text {msg} k The encrypton of msg wth k k D The deployment key dstrbuted to s K C The set of m communcaton keys, (k C ;l where l ¼ 1; m) dstrbuted to s NID(M) The node d of M NID(s ) The node d of s KID(k) The key d of k the nertal gudance (IG) module s always avalable and provdes trustworthy readngs. We also assume that when GPS sgnals are avalable, they are trustworthy. These assumptons are reasonable, because an IG module reles on ts own moton and rotaton sensors to nfer ts locaton, and a mltary GPS devce usually has ant-spoofng capabltes Pre-deployment Secure Walkng GPS begns wth a pre-deployment phase, whch takes place n the secure base staton. The man goal of pre-deployment s to dstrbute a unque deployment key to every sensor node n order to bootstrap the secure communcaton between the master node and each of the sensor nodes durng the deployment. Cryptographc notatons descrbng our securty scheme are lsted n Table 1. It s best practce to keep the master node turned on durng the entre pre-deployment but allow only one sensor node to be turned on at any tme (.e., so that t can obtan a deployment key). Ths not only saves the energy of sensor nodes, but also prevents potental nterference between sensor nodes. For management purposes, the master node saves all dstrbuted deployment keys, whch are ndexed by ther key ds, n a non-volatle memory so that they are retaned even f the master node s turned off. The master node also mantans a lst of <node-d, deployment-key-d> entres, mappng each dstrbuted deployment key to a sensor node to whch t has been dstrbuted. Because the pre-deployment s done n a secure base staton, the dstrbuton of deployment keys s done as follows: s! M : NIDðs ÞkREQ PRE DEPLOYMENT M! s : NIDðMÞkk D s! M : NIDðs ÞkACK PRE DEPLOYMENT A sensor node s sends a message to the master node M, contanng ts node d and a REQ_PRE_DEPLOYMENT re-

4 4 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx quest (both of whch are n plan text) to request ts deployment key, f t has not successfully obtaned one from M before. When M receves such a request, t checks whether a deployment key has already been dstrbuted to s earler, by checkng the <node-d, deployment-key-d> entres. If no entry maps to s, M generates a new random deployment key k D and sends t to s. 1 Meanwhle, M adds a correspondng <node-d, deployment-key-d> entry for s. If, on the other hand, M fnds out that a deployment key has been dstrbuted to s earler, M smply resends that key to s. Ths desgn prevents M from generatng and dstrbutng dfferent deployment keys to s when s s nadvertently turned off and on multple tmes durng predeployment. Once s obtans k D, t saves t n a non-volatle memory for later use and reples to M wth an acknowledgment message. Due to the unqueness of the deployment keys and the fact that each of them s known only by the master node and one sensor node, further messages between the master node and each sensor node can be encrypted, provdng cryptographc protecton for the vulnerable wreless communcaton durng the deployment Deployment Secure localzaton After the preparaton n the pre-deployment phase, the master node and the sensor nodes are taken to the deployment feld. Durng the deployment, the master node remans turned on. Sensor nodes are n the proxmty of the master node and are, n arbtrary order, turned on and deployed one after another. A sensor node s communcates wth the master node M usng the followng secure protocol to obtan ts locaton and the set of m communcaton keys: s! M : NIDðs ÞkfREQ DEPLOYMENTg k D n o M! s : NIDðMÞflocatong k D k C ;1 ; kc ;2 ;...; kc ;m s! M : NIDðs ÞkfACK DEPLOYMENTg k D After ntalzaton, s sends a message to M, contanng ts node d and a REQ_DEPLOYMENT request. Note that only the REQ_DEPLOYMENT request s encrypted usng s s deployment key k D. The source d s sent n plan text n order for the master node to ndex k D from ts own memory and decrypt ths request message [10] usng t. Then M reples wth messages to s, n whch M s source d s sent n plan text, but the locaton and the m communcaton keys for s are encrypted usng k D.2 If s obtans the desred nformaton, t securely acknowledges success to the master node. 1 There are a varety of algorthms for key generaton, such as a random generaton based on a preloaded seed. We do not focus on the specfc mplementaton of the key generaton algorthm n ths work. 2 Dependng on the maxmum message length, the entre encrypted payload may be sent over multple messages. k D Algorthm 1. Locaton-based key dstrbuton 1: for all k C j n P do 2: k C j :state never-dstrbuted 3: end for 4: S 1 = / 5: deploy node s 1 6: K C 1 fmnever-dstrbuted keys from Pg 7: M transmts key set K C 1 to node s 1 8: P 0 K C 1 9: for all k C j n P 0 do 10: k C j :state dstrbutable 11: end for 12: for from 2 to n do 13: deploy node s 14: S = S 1 [ {s 1 }={s 1,s 2,...,s 1 } 15: K C GET KEYSðS ; P; P 0 Þ 16: M transmts key set K C to node s 17: P 0 P 0 [ K C 18: for all k C j n P 0 do 19: k C j :state dstrbutable 20: end for 21: end for In a WSN deployment usng Walkng GPS, sensor nodes are physcally close to the master node at the tme of deployment. Therefore, t s reasonable for a sensor node to take on the master node s current locaton, when the node s deployed. Gven the relatvely hgh accuracy of GPS, locatons provded by the GPS module are preferred. Only when the GPS module fals to work due to ntermttent or temporary loss of GPS sgnals wll the locatons provded by the IG module be used as a backup. Also note that, snce the error of the locaton estmates provded by the IG module alone s lkely to accumulate f no remedal measure s taken, IG module needs to be calbrated perodcally wth the GPS, whenever the GPS sgnals are avalable. Through the use of GPS and IG modules, all the sensor nodes can be localzed at deployment tme. No further collaboraton among neghbors s needed for localzaton. Ths elmnates a potental securty vulnerablty that could occur f collaboraton were needed Locaton-based key dstrbuton In addton to a locaton, a set of communcaton keys s dstrbuted to each sensor node when t s deployed. The choce of communcaton keys that make up ths key set s determned by the master node at deployment tme, based on the estmated locatons of the current sensor node and the sensor nodes whch have been deployed earler. Our key dstrbuton scheme ensures that every deployed node shares at least one communcaton key wth one or more of ts neghbors, enablng them to communcate securely usng the shared key(s). Note, whle

5 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx 5 our scheme does not guarantee that a sensor node shares a communcaton key wth every neghbor, t attempts to allow a sensor node to share communcaton keys wth as many dfferent neghbors as possble, makng t better connected wth ts neghbors. The algorthms for our locaton-based key dstrbuton are presented n Algorthms 1 and 2. In the remanng part of ths secton, we descrbe n detal the steps of these algorthms and how we enforce the followng two rules: Algorthm 2. GET_KEYS (S, P, P 0 ) 1: for j from 1 to 1 do 2: Calculate d,j = js s j j 3: end for 4: for j from 1 to 1 do 5: f M cannot communcate wth s j then 6: d,j +1 7: end f 8: end for 9: fr ðlþ jl ¼ 1; 1g ¼PERMUTATEfjjj ¼ 1; 1g, where d ;rðlþ 6 d ;rðlþ1þ 10: S = A [ B, where A ¼fs rðjþ jd ;rðjþ < r ^ M can communcate wth s j g and B = S A 11: for l from(ja j +1)to(jA j + jb j) do 12: for n from 1 to m do 13: k C r ðlþ ;n:state non-dstrbutable 14: end for 15: end for 16: num 0 17: K C / 18: u 1 19: whle (num < m 1) ^ ($dstrbutable keys n P 0 ) ^ (u < ) do 20: D ¼fk C r ðuþ ;v jv ¼ 1; m ^ kc r ðuþ ;v:state ¼ dstrbutableg 21: fd ðwþ jw ¼ 1; jd jg ¼ PERMUTATEfvjv ¼ 1; jd jg, where k C r ðuþ ;d ðwþ :freq P k C r ðuþ ;d ðwþ1þ :freq n o 22: K C K C [ k C r ðuþ ;d ð1þ 23: num num +1 24: f d ;rðuþ P r=2 then 25: for w from 1 to j D j do 26: k C r ðuþ ;d ðwþ :state non-dstrbutable 27: end for 28: else 29: k C r ðuþ ;d ð1þ :state non-dstrbutable 30: end f 31: u u +1 32: end whle 33: K C K C [fðm numþ never-dstrbuted keys from Pg 34: return K C Dstance Boundng Rule: Two sensor nodes are allowed to share a communcaton key only f they are physcal neghbors. 3 Connectvty Rule: Each sensor node needs to share a communcaton key wth at least one of ts already deployed physcal neghbors so as to ensure neghbor connectvty. In the proposed Secure Walkng GPS, the master node mantans a large key pool P, from whch m communcaton keys are carefully chosen and dstrbuted to each sensor node (note: secure communcaton s possble wth a sensor node by usng sensor s deployment key). Each communcaton key n P s randomly generated, unque, and s ndexed by a communcaton key d. Each communcaton key can be n one of three possble states: never-dstrbuted, dstrbutable and non-dstrbutable. Intally, all have ther states set to never-dstrbuted (Algorthm 1 Lnes: 1 3). The choce of the set of communcaton keys for the frst sensor node s 1 s trval. The master node smply chooses m keys wth a never-dstrbuted state from P and transmts them to s 1 (Algorthm 1 Lnes: 4 7). Then the master node sets the states of these m keys to dstrbutable so that they may be shared by sensor nodes whch are deployed later and become s 1 s neghbors (Algorthm 1 Lnes: 8 11). For each subsequent sensor node s ð ¼ 2; nþ deployed, the master node M goes through the followng steps to determne whch keys should be transmtted to t (Algorthm 1 Lnes: 12 21). Step 1: Fnd s s physcal neghbors from the set of sensor nodes that have already been deployed (Algorthm 2 Lnes: 1 10). M frst calculates d,j, the dstances between s and sensor nodes s j ðj ¼ 1; 1) based on ther locatons reported by the GPS or IG modules. Then, M attempts to communcate wth each of them securely usng ther respectve deployment keys. If a sensor node s j s unreachable and does not reply, M updates the correspondng dstance d,j to +1. M sorts these dstances n ascendng order and parttons the set of already deployed nodes S ={s 1,s 2,...,s 1 } nto A and B as follows: A ¼fs rðjþ jd ;rðjþ < r ^ M can communcate wth s j g B ¼ S A Note that, due to the actual rregular rado patterns (whch are common n WSNs), some sensor nodes n B may be able to communcate wth M as well. However, we take a conservatve approach and only consder the physcal neghbors that le wthn s s theoretcal communcaton range r. Step 2: Set the states of all the communcaton keys whch have been dstrbuted to the sensor nodes n B to non-dstrbutable, n order to satsfy the Dstance Boundng Rule (Algorthm 2 Lnes: 11 15). Step 3: Determne whch communcaton keys can be dstrbuted to s (Algorthm 2 Lnes: 16 33). If s s closest physcal neghbor s rð1þ has only one dstrbutable communcaton key, M ncludes t n s s commun- 3 Ths means that nodes far apart do not share communcaton keys. Ths s mportant n protectng the WSN aganst the wormhole attack.

6 6 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx caton key set K C and sets ts state to non-dstrbutable. Otherwse, f s rð1þ has more than one dstrbutable communcaton key, M chooses the one that has been most frequently dstrbuted to s s physcal neghbors n A, ncludes t n K C, and then sets ts state to non-dstrbutable. If the dstance between s rð1þ and s s greater than or equal to r/2, M also changes the states of s rð1þ s remanng communcaton keys to non-dstrbutable. If, however, the dstance between s rð1þ and s s less than r/2, M does not make ths change. Ths ensures that s shares at most one communcaton key wth each of ts physcal neghbors whch are farther than r/2 away, so that s has a better chance to share communcaton keys wth more physcal neghbors. After the communcaton keys of s rð1þ have been consdered, M consders those of s s second, thrd,..., closest physcal neghbors ðs rð2þ ; s rð3þ ;...Þ untl (m 1) dstrbutable communcaton keys from s s physcal neghbors are ncluded n K C or fewer than (m 1) such dstrbutable communcaton keys are avalable to be ncluded. In ether case, remanng communcaton keys for s wll be chosen from the never-dstrbuted keys n P to make up K C. Note that M delberately ncludes at least one never-dstrbuted communcaton key n K C so that s may share t wth potental neghbors whch have not been deployed. The above desgn ensures that every node s able to securely communcate wth at least one physcal neghbor usng a common communcaton key wthout volatng the Dstance Boundng Rule. Step 4: Send the set of m carefully chosen communcaton keys to s, securely usng s s deployment key (Algorthm 1 Lne: 16). Step 5: Reset the states of all non-dstrbutable communcaton keys to dstrbutable before the next sensor node s deployed (Algorthm 1 Lnes: 17 20). In our key dstrbuton scheme, the total number of communcaton keys whch are dstrbuted to each node s denoted by m, whose value can be specfed by the deployer n the program code. Observe that f m s too small, the Dstance Boundng Rule and the Connectvty Rule may not be satsfed n arbtrary topology and deployment order of the sensor nodes. However, f m s too large, many of the communcaton keys may be redundant and take up much memory on resource-constraned sensor nodes. Therefore, a tradeoff exsts between the sze of a communcaton key set and the performance of the deployment. The followng theorem gves a theoretcal lower bound for m. For smplcty, we assume that each node has the same crcular communcaton range. Theorem 1. Let N be the maxmum number of neghbors of each sensor node, and m be the requred number of communcaton keys dstrbuted to each sensor node. Assumng that each node has the same crcular communcaton range, n order to satsfy the Dstance Boundng Rule and the Connectvty Rule n the arbtrary topology and arbtrary order of deployment, a lower bound of m s gven by: m mn ðnþ ¼ N f N f N P 6 Proof. Before proceedng wth the proof, we provde some ntuton behnd the choce of ntervals (.e., N 6 5 and N P 6). Assumng deal condtons where the communcaton range s crcular and all nodes have equal communcaton range r, a node s can communcate wth any node that s n the crcle centered at s wth a radus of r. If we dvde ths crcle nto sx equal sectors, then any two nodes wthn the same sector can communcate wth each other snce ther dstance wll be smaller than r. Therefore, the lower bound can be at least as small as 6. As we wll show later, the lower bound can be further reduced to 5. Let N be the maxmum number of physcal neghbors of each sensor node. Assume that every sensor node has a perfect crcular communcaton range of r. (a) Case N 6 5 Wthout loss of generalty, suppose sensor node S has N physcal neghbors. On the one hand, f each of the N physcal neghbors uses a unque communcaton key to communcate wth S, the Connectvty Rule s trvally satsfed. So, m mn (N) 6 N. On the other hand, f these N physcal neghbors are mutually not physcal neghbors to each other, these N nodes are not allowed to share communcaton keys by the Dstance Boundng Rule (Consder the extreme case where the N physcal neghbors are unformly dstrbuted on a crcle wth a center at S and a radus of (r ), and s nfntely small. Each par of the physcal neghbors are further than r apart.) As a result, each of the N physcal neghbors has to share a dfferent communcaton key wth S n order to keep connected to the network. Ths means that S has at least N communcaton keys. So, m mn (N) P N. Therefore, m mn (N)=N. (b) Case N P 6 Snce m mn (N) s a non-decreasng functon of N. m mn ðnþ P m mn ð5þ ¼5 when N P 6. Therefore, t s a necessary condton to dstrbute fve communcaton keys to every sensor node n order to ensure that the Dstance Boundng Rule and Connectvty Rule can be satsfed n arbtrary cases. Next, we show that t s also a suffcent condton. Assume that the N physcal neghbors of S are A 1, A 2,..., A N. We show that we can always group them nto sx mutually exclusve and exhaustve sets P 1, P 2, P 3, P 4, P 5 and Q, where there always exsts a feasble key dstrbuton scheme for these N physcal neghbors wth the sze of ther key sets beng 5, whch satsfes the Dstance Bondng Rule and the Connectvty Rule. Wthout loss of generalty, choose an arbtrary physcal neghbor and denote t as A 1. Draw a radal from S to A 1 and sweep ths radal clockwse wth ts end fxed at S. The subscrpts of the remanng physcal neghbors are assgned n the order that ths radal hts them sequentally. Defne A d SA j as the angle for the radal SA to sweep to the radal SA j n a clockwse fashon. P 1 s defned as follows:

7 8 n o A 1 ; A 2 ;...; A 1 j A1 dsa 1 6 p ^ A1 SA d 3 1 þ1 > p ; 3 >< P 1 ¼ f A1 dsa N > p 3 >: fa 1 ; A 2 ;...; A N g; f A1 dsa N 6 p 3 If d A1 SA N > p 3, then $ 1, such that d A 1 SA 1 6 p 3 ^ d A1 SA 1 þ1 > p 3 Snce d A ;A j < rð1 6 ; j 6 1 ; jþ, all the nodes n P 1 are allowed to share a communcaton key wth S, say k C S;1. If A1 dsa N 6 p 3, then P 2, P 3, P 4, P 5, and Q become empty sets. In ths case, t s suffcent to dstrbute fve communcaton keys to each sensor node. When A d 1 SA N > p 3, we further defne P 2 n a smlar way: 8 n A 1 þ1; A 1 þ2;...; A 2 j A1 dsa 2 6 p 3 >< ^ o P 2 ¼ A 1 dsa 2 þ1 > p ; f A1 dsa 3 N > p 3 >: fa 1 þ1; A 1 þ2;...; A N g; f A1 dsa N 6 p 3 All the nodes n P 2 are allowed to share another communcaton key wth S, say k C S;2. If A1 dsa N 6 p 3, then P 3, P 4, P 5, and Q become empty sets. In ths case, t s suffcent to dstrbute fve communcaton keys to each sensor node. When A d 1 SA N > p 3, we further defne P 3 n a smlar way. If we repeat ths process, we can defne at most fve mutually exclusve (but not necessarly exhaustve) sets P 1, P 2, P 3, P 4, P 5. We are unable to defne sx such sets, because f we were able to, then: A 1 SA d 1 þ1 þ A 1 þ1sa d 2 þ1 þ A 2 þ1sa d 3 þ1 þ A 3 þ1sa d 4 þ1 þ A 4 þ1sa d 5 þ1 þ A 5 þ1sa d 6 þ1 > 6 p 6 ¼ 2p whch s contradctory. If 5 s stll smaller than N, we can defne Q ¼fA 5 þ1; A 5 þ2;...; A N g Snce: A 1 SA d 1 þ1 þ A 1 þ1sa d 2 þ1 þ A 2 þ1sa d 3 þ1 þ A 3 þ1sa d 4 þ1 þ A 4 þ1sa d 5 þ1 > 5p 3 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx 7 communcaton keys are suffcent for all the sensor nodes and the Dstance Boundng Rule and the Connectvty Rule are both satsfed. h Note that the smplfyng assumpton of crcular communcaton range s used n the theorem only to provde the reader wth a general feel for how many communcaton keys each sensor node should obtan and whether they ft on resource-constraned sensor nodes. Accordng to ths theorem, fve communcaton keys suffce n the deal case. Even n real envronments where the rado pattern s rregular, we do not expect m mn to ncrease much beyond fve. Our emprcal evaluaton results n Secton confrm ths concluson Post-deployment After the deployment, each sensor node has obtaned ts locaton and a set of communcaton keys from the master node. Then each sensor begns to dscover ts useful neghbors, whch are wthn ther actual communcaton ranges and share at least one communcaton key. To do so, every sensor node broadcasts messages whch are encrypted usng each of ts communcaton keys. If a sensor node can hear a message from another sensor node and decrypt the message usng one of ts own communcaton keys, these two sensor nodes are useful neghbors. So ths sensor node reples to the other node wth a message whch s encrypted wth the same communcaton key. After both sensor nodes dscover each other as new useful neghbors, subsequent communcaton between them s encrypted usng any of ther shared communcaton keys. Some attackers may montor encrypted messages between two sensor nodes and attempt to recover the key used to encrypt these messages by studyng the encrypton patterns. Therefore, f two neghborng nodes share two or more communcaton keys, they can encrypt each message usng a key that s randomly chosen from among all shared communcaton keys nstead of encryptng every message wth the same shared communcaton key. Dong so can further confuse the attackers judgment and defeat ther attempt to fgure out a correct key. It s mportant to menton that no matter how sophstcated an encrypton technque s, t s subject to be compromsed. Randomzng communcaton keys helps add a second layer of securty. we have: d A 5 þ1sa 1 < 2p 5p 3 ¼ p 3 Therefore: d A ;A j < r and d A ;A 1 < r; for 5 þ 1 6 ; j 6 N; j Ths means that all the nodes n Q can share any of A 1 s communcaton keys other than k C S;1 n order to keep connected. In summary, physcal neghbors n P securely communcate wth S usng one of k C s ( = 1, 2, 3, 4, 5), whle the physcal neghbors n Q securely communcate wth A 1 usng a communcaton key that s dfferent from k C s. Fve 2.6. A key deployment example In ths subsecton we brefly gve an example of our proposed locaton-based key dstrbuton scheme. Our example s depcted n Fg. 2 and s further descrbed below. Let s assume that the communcaton range of each sensor node s regular and that M dstrbutes a set of fve communcaton keys to each sensor node when t s deployed. Also assume that s 1, s 2, s 3, and s 4 (shown as sold dots wth ther key sets n curly braces) have already been deployed. When s 5 (shown n the hollow dot) s beng deployed, the master node M determnes whch communcaton keys can consttute s 5 s key set K C 5. For

8 8 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx (a) (b) (c) (d) Fg. 2. Example for the locaton-based key dstrbuton process (keys n talc : non-dstrbutable keys, and keys n bold : the dstrbutable key chosen to be ncluded n K C 5 at ths step.) reference, the dashed crcle s centered at s 5 wth a radus of r/2, whle the sold concentrc crcle has a radus of r. Snce only s 4 s outsde s 5 s communcaton range, A 5 ={s 1, s 2, s 3 } and B 5 ={s 4 }. M sets each key n K C 4 to nondstrbutable to prevent potental wormhole attacks. Snce s 2 s s 5 s closest neghbor and k 6 n K C 2 has been the most frequently dstrbuted to both s 2 and s 3, k 6 s ncluded n K C 5 (as shown n Fg. 2a). Snce d 5,2 < r/2, M only sets k 6 to non-dstrbutable and keeps the remanng keys n K C 2 as dstrbutable. As shown n Fg. 2b, M checks K C 3, the communcaton key set of s 5 s second closest neghbor s 3. Snce k 6 and k 10 have been set to non-dstrbutable, only k 7, k 11, and k 12 are avalable dstrbutable keys. Snce k 7 has been more frequently dstrbuted than the other two, k 7 s ncluded n K C 5. Then, M sets k 7 to non-dstrbutable before checkng K C 1, the communcaton key set of the thrd closest neghbor s 1. Among the dstrbutable keys n K C 1 ; k 1 has been the most frequently dstrbuted key (to both s 1 and s 2 ). Therefore, k 1 s also ncluded n K C 5,as shown n Fg. 2c. Snce d 5,1 P r/2, every key n K C 1 s set to non-dstrbutable. As depcted n Fg. 2d, after each of s 5 s neghbors have been checked, M chooses from P two addtonal never-dstrbuted keys to nclude n K C 5 so that t contans 5 keys. Fnally, M transmts K C 5 to s 5 and sets the states of all prevously dstrbuted keys,.e., k 1, k 2,..., k 18, back to dstrbutable before the next sensor node s deployed. 3. Securty analyss In ths secton we present the securty analyss of Secure Walkng GPS wth respect to Dolev-Yao and Wormhole attacks. It s worth notng nose/nterference effects on Secure Walkng GPS. In the pre-deployment phase, we can assume that they are neglgble snce pre-deployment occurs n a secure base/area. When key dstrbuton takes place durng the actual deployment, f the messages between the master node and the sensor nodes are corrupt or lost, n addton to lnk layer retransmssons, the nodes can always be programmed to ndcate the falure to the deployer (e.g., va LED) and auto-retry ther communcaton untl t succeeds. If t s mpossble to have successful communcaton, the spot s probably non-deployable. In ths case, the deployer can select another nearby spot for deployment. Nevertheless, nose/nterference mght affect the deployment completon tme. Note also that t s unlkely that the sensors mstake a tampered message for a legtmate one, because all messages are encrypted usng preset deployment keys Resstance to Dolev-Yao attack Accordng to our assumpton, the secure base staton s attack-free. Therefore, a deployer can be assured that

9 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx 9 legtmate program code s downloaded and that unque deployment key s dstrbuted to each sensor node. Each unque deployment key s known only by the master node and one of the sensor nodes. Durng the deployment, all the messages transmtted between the master node and the sensor nodes are encrypted usng ther respectve deployment keys. Transmtted messages nclude a request message from each sensor node and a message from the master node contanng the locaton and communcaton key set of the deployed sensor node. Snce a Dolev-Yao attacker does not have a legtmate key, t s unable to decrypt legtmate messages and steal senstve nformaton from them. The attacker s unable to nject false messages ether, because these false messages are not encrypted usng proper keys and wll, therefore, be smply dropped by sensor nodes. Smlarly, the post-deployment neghbor dscovery process and all subsequent communcaton between neghbors are encrypted usng legtmate communcaton keys. Therefore, a Dolev-Yao attacker s not a sgnfcant threat. Even f an attacker obtans a legtmate deployment or communcaton key by chance, ts mpact s lmted because ether one s dstrbuted to and shared by only a small number of sensor nodes wthn a local regon accordng to the Dstance Boundng Rule Resstance to wormhole attack A wormhole attacker delberately launches ths attack to replay legtmate messages at a remote pont away from ts orgn, whch volates the communcaton range constrant. A wormhole attack does not do much harm f the replay pont and the orgn of the tunneled message are close. In Secure Walkng GPS, the master node and each of the sensor nodes are very close durng the deployment. Therefore, a wormhole attack that occurs at ths tme (.e., a wormhole attacks aganst the localzaton) would have lmted effect. For post-deployment nter-node communcaton, the Dstance-Boundng Rule ensures that sensor nodes whch are geographcally located beyond ther communcaton ranges do not share a communcaton key. If a node receves a message from a remote node whch s tunneled through a wormhole lnk, t cannot process ths message snce t does not have a proper shared communcaton key to decrypt t. As a result, ths message wll be smply dropped. Snce the locatons provded by the master node are not perfectly accurate, a locaton estmated by the master node may dffer from the actual locaton. Consequently, the master node may consder two sensor nodes whose dstance s a lttle greater than ther communcaton range to be physcal neghbors and dstrbute shared communcaton keys to them, resultng n a potental wormhole lnk. However, ths vulnerablty s nsgnfcant. Frst, snce prortes are gven to the communcaton keys shared by closer neghbors when the master node determnes each communcaton key set, t s less lkely for two sensor nodes whch are barely neghbors to share a communcaton key. Therefore, the number of potental wormhole lnks s relatvely low, whch means that t s dffcult for a wormhole attacker to explot such vulnerablty. Second, even f an attacker launches a wormhole attack through one of the potental wormhole lnks, t causes lmted threat snce the replayed message s only tunneled to some pont that s a lttle farther away from ts legtmate reach. In summary, our Secure Walkng GPS scheme effectvely reduces the mpact of the wormhole attack on a WSN. 4. Performance evaluaton For our performance evaluaton, we consder the followng metrcs: (1) the localzaton error obtaned when usng Secure Walkng GPS; (2) the mpact of dstrbutng neghborhood keys on nodes communcatng wth ther neghbors; (3) how successful s Secure Walkng GPS n preventng the creaton of wormholes (.e., through ts neghborhood key dstrbuton); (4) scalablty of Secure Walkng GPS; and (5) overhead of our soluton. It s worth mentonng that the presence of wormholes (a few mght be establshed, despte our neghborhood keys) wll not affect localzaton accuracy, snce nodes obtan ther locatons drectly from the master node, and not through node-to-node communcaton. The aforementoned metrcs of nterest, are further descrbed below. Let p be the probablty that GPS sgnals are avalable to the master node durng the deployment. Let S GPS and S IG be the sets of sensor nodes whch are localzed by the GPS module and by the IG module, respectvely. The total number of sensor nodes n s equal to js GPS j + js IG j. Also let (x, y ) be the reported locaton of sensor node s by the master node and x real ; y real be ts real locaton. The average localzaton error s defned by the cumulatve localzaton error of all the sensor nodes dvded by the total number of sensor nodes and can be expressed by: X q ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff!, err AVG ¼ x x real 2 þ y y real 2 n s 2S GPS [S IG Snce part of the average localzaton error comes from the GPS module and the other part comes from the IG module, we can further express the average localzaton error n terms of the average GPS localzaton error err AVG GPS and the average IG localzaton error err AVG IG as follows. 0 qffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff P x x real 2 þ y y real 2 s err AVG ¼ js GPS j 2S GPS js GPS j þjs IG j qffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff1 P x x real 2 þ y y real 2, C n js IG j A s 2S IG ¼ js GPSjerr AVG GPS þjs IG jerr AVG IG p err AVG GPS n þð1 pþerr AVG IG ¼ f ðp; err AVG GPS ; err AVG IG Þ For a large-scale wreless sensor network, err AVG GPS and err AVG IG approxmate the nomnal localzaton accuraces of the GPS and the IG modules over whch we have no control. Snce the GPS module s often more accurate

10 10 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx than the IG module, the above expresson suggests that the average localzaton error s approxmately a decreasng lnear functon of the GPS avalablty probablty p. Ideally, f a sensor node can communcate wth all of ts physcal neghbors usng some communcaton key, the rato of the number of ts useful neghbors to the number of ts physcal neghbors s 1. In realty, snce two physcal neghbors may not necessarly share a communcaton key and the fact that physcal neghbors may not be able to communcate due to localzaton errors, ths rato s usually less than 1. The closer ths rato s to 1, the better a sensor node s connected wth ts neghbors. We defne the average of such ratos for all sensor nodes as average neghbor connectvty N c :! N c ¼ Xn # of s s useful neghbors =n # of s s physcal neghbors ¼1 Ths average reflects the degree to whch neghborng sensor nodes n the WSN are nter-connected when they are allowed. If two sensor nodes share a communcaton key and ther dstance s smaller than ther actual communcaton ranges (whch may be dfferent n two drectons due to the rregularty and asymmetry of wreless rado patterns), there exsts a legtmate lnk between them. If two sensor nodes share a communcaton key and ther dstance s greater than the theoretcal communcaton range r, there exsts a potental wormhole lnk between them. On the one hand, the total number of legtmate lnks s another ndcator of neghbor connectvty, because the greater t s, the hgher the chance neghborng sensor nodes can communcate. On the other hand, the total number of wormhole lnks and the percentage of the total number of potental wormhole lnks to the total number of legtmate lnks reflect the mpact of potental wormhole attacks. A small percentage suggests that the mpact of a wormhole attack s not severe to the network System evaluaton The proposed localzaton scheme requres that the deployer has a master node attached to t. We bult a prototype master node that can be worn durng deployment. Ths prototype conssts of a GPS devce mounted on top of a bcycle helmet. The GPS devce s connected through and RS232 cable to the master node that s attached wth a velcro to a wrstband. Fg. 3 llustrates the prototype. For the GPS devce, we used the etrex Legend devce. The GPS devce s WAAS (wde-area augmentaton system) enabled, and t provdes updated locaton nformaton wth hgh accuracy (error less than 3 m), at a rate of 1 Hz. Our choce to use a commercal GPS devce for experments was due to ts ease of use and seamless ntegraton. More sophstcated and better ntegrated, but more expensve, solutons are readly avalable today (e.g., Mnature Inertal Navgaton Unt GPS 3DM-GX3-35 from Mcrostran). We mplemented our localzaton scheme n nesc (approxmately 1500 lnes of code) for the TnyOS operatng system. For the master node, the total code sze was approxmately 17 KB and the data sze was 595 bytes. The code sze for the sensor nodes module was 972 bytes Fg. 3. Master node assembly. and the data sze was 117 bytes. For sensor nodes we used Mcaz motes. The localzaton accuracy of the proposed localzaton soluton, when only the GPS devce s used, was evaluated n an open feld. For an easer estmate of the localzaton error, we marked a 6 5 grd on the ground and we deployed the sensor motes n ths grd. We want to emphasze the fact that the deployment beng done n a grd was not used n any way durng our localzaton. A deployment n any other regular geometrc shape could have been performed. We used a grd because t was easy to create and t was easer to vsually assess the performance. In the experments that follow, we provde numerc localzaton errors by performng a manual best ft of a strct grd wth unt 10 m, to the expermental data. It s crtcal n understandng the followng expermental results to note that the average locaton errors are not wth respect to the ground truth locaton, but rather are relatve to the known geometry of the deployment grd Sngle deployer In ths experment we evaluated the localzaton accuracy from a deployment consstng of 30 McaZ motes, n the aforementoned grd. Each node was turned on at ts place of deployment, rght before beng deployed. The expermental results are shown n Fg. 4. The average Fg. 4. Performance of the grd deployment wth sngle deployer.

11 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx 11 localzaton error obtaned from fttng a grd to the expermental data s 0.8 m wth a standard devaton of 0.5 m. From Fg. 4, as well as from the numercal results of the localzaton error, t can be observed a remarkably good ft. In ths deployment type the errors are only due to the estmaton of the global coordnate, done by the GPS hardware Dual deployer The purpose of ths experment was to evaluate the performance of the proposed localzaton scheme when usng two commercal GPS devces (the same model). A GPS devce, as any other hardware devce s dependent on calbraton. Even after strngent calbraton procedures, some varablty n the ndcated locaton s expected. From the drect readng of the global GPS locaton as shown by two GPS devces postoned next to each other, dfferences on the order of 1/1000 of a mnute and sometmes even 1/100 of a mnute, were observed. It was antcpated that these dfferences wll contrbute to an even larger localzaton error. The deployment n ths experment was done along the length of the grd feld (lnes contanng 6 motes). Three of the vertcal lnes (the mddle and the two extreme ones) were deployed usng one of the GPS devces, the other two vertcal lnes were deployed usng the second GPS devce. The expermental results are shown n Fg. 5. The localzaton error obtaned from our fttng of a grd to the expermental data s 1.6 m wth a standard devaton of 0.9 m. In ths deployment scenaro, the average localzaton error s the largest. In addton to the errors encountered n prevous experments, here, the GPS devce calbraton has an addtonal contrbuton. When comparng the results of ths experment wth the prevous one, n whch only one GPS devce was used, t can be observed that the effect the devce calbraton has on locaton error was relatvely small, of about 0.8 m Smulatons For nvestgatng the accuracy (from the ncluson of the IG system) and robustness of Secure Walkng GPS aganst attacks, we performed smulatons. For our smulatons we adopt the parameters of a real WSN survellance system that we had experence wth [2]. A large-scale sensor network of n sensor nodes s deployed n an outdoor feld where the GPS sgnals are avalable to the master node wth a probablty p. Ths means that about p 100% of the nodes wll be localzed by the GPS module and about (1 p) 100% wll be localzed by the IG module. Let the number of communcaton keys that each node obtans from the master node be 5, and assume that these keys can always be transmtted from the master node to each deployed sensor node durng the deployment. Let the localzaton error of the GPS module be unformly dstrbuted U( 1.5, 1.5) m. The localzaton error of the IG module s a combned result of the error of degree estmaton by the rotaton sensors and the error of tmely movement detecton by the moton sensors. Let the rotaton sensor error be unformly dstrbuted U( 10, 10), and the moton sensor error result n a reducton of dstance estmaton of the deployer s path between consecutve sensor nodes whch s unformly dstrbuted U(0, 3) m. Let the regular communcaton range of each sensor node r be 30 m. When we consder rregular rado ranges (to evaluate the mpact of an asymmetrc rado on our proposed secure localzaton and key dstrbuton scheme), the communcaton range of a sensor node, n each 1 drecton, s unformly dstrbuted U(15, 45) m Lne deployment Frst, we consder a lne deployment wheren a deployer roughly follows a lne and deploys sensor nodes at desred locatons. Fg. 6a gves an example of such a deployment, where the dashed lne represents the deployment lne, sold dots represent deployed sensor nodes, and arrows represent the deployer s path. We smulate a deployment of 500 sensor nodes wth the same regular rado pattern. The horzontal spacng between sensor nodes s normally dstrbuted N (10, 2) m, and the vertcal offset of each sensor node from the deployment lne s normally dstrbuted N (0, 2) m. We evaluate the performance of our scheme at p = 0.75, 0.80, 0.85, 0.90, 0.95, For each p, we performed 30 smulatons (a) (b) Fg. 5. Performance of the grd deployment wth dual deployer. Fg. 6. A lne deployment (a), and a grd deployment (b).

12 12 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx (a) (b) (c) Fg. 7. Performance of the lne deployment wth regular rado. and calculated the average localzaton error, average neghbor connectvty, the total number of legtmate lnks, and the total number of potental wormhole lnks. Mean values wth one standard devatons for each of these metrcs are plotted n Fg. 7. As shown n Fg. 7a, the average localzaton errors are between 0.72 m and 1.18 m. We observe a decrease n both the mean and the standard devaton of the average localzaton error as p ncreases. Whle the decrease n mean s because more nodes can be localzed usng the more accurate GPS module, the decrease n the standard devaton s explaned by the fact that the smaller the porton of the nodes whch are localzed usng the IG module, the less the mpact of ts cumulatve errors due to more often calbratons wth the GPS module durng the deployment. The average localzaton error curve s roughly lnear, whch confrms that t s a lnear functon of p gven an average GPS localzaton error and an average IG localzaton error. Fg. 7b shows the average neghbor connectvty wth respect to p. The average neghbor connectvty ranges between [0.72, 0.97] and s an ncreasng functon of p, reflectng the mpact of locaton errors on the key dstrbuton decsons. Fg. 7c depcts the total number of legtmate lnks n the WSN versus the total number of potental wormhole lnks. Compared wth that of legtmate lnks (rangng between 2040 and 2100), the number of potental wormhole lnks s extremely low (below 50). Therefore, a wormhole attacker has only a chance of about 2.5% of successfully explotng a potental wormhole lnk and establshng a wormhole attack. Even f a wormhole attack occurs, ts mpact wll be small, due to the Dstance Boundng Rule Grd deployment Next, we consder a grd deployment wheren a deployer walks back and forth horzontally through the grd and deploys sensor nodes at desred locatons. Fg. 6b gves an example of a small grd deployment to llustrate how the deployer traversed the grd for the deployment. In ths fgure, dashed lnes represent the borders of the grds, sold dots represent deployed sensor nodes, and arrows represent the deployer s path. Assume that 500 sensor nodes wth the same regular rado pattern are gong to be deployed n a grd fashon. Let the horzontal spacng between sensor nodes be normally dstrbuted N (10, 2), and let the vertcal offset of each sensor node from each horzontal deployment lne be normally dstrbuted N (0, 2). We performed 30 smulatons for each p = 0.75, 0.80, 0.85, 0.90, 0.95, and We plot our results wth mean values and one standard devaton error bars n Fg. 8. From Fg. 8a, the mean value of the average localzaton error drops from 1.33 m to 0.73 m, as p ncreases from 0.75 to There s also an observable decrease n the standard devaton as well. The average localzaton error curve s roughly lnear wth p. In Fg. 8b, the average neghbor connectvty s as hgh as 0.97 when p = However, t drops to about 0.68 when p = Snce our key dstrbuton scheme attempts to be far to every neghbor, sensor nodes wll have more useful neghbors n a grd deployment. However, the number of shared keys per neghbor wll be smaller. Therefore, the combned effect does not cause a sgnfcant change n the total number of legtmate lnks. Ths s confrmed from the result n Fg. 8c that the total number of legtmate lnks ranges between 2050 (a) (b) (c) Fg. 8. Performance of the grd deployment wth regular rado.

13 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx 13 (a) (b) (c) Fg. 9. Performance of the scaled deployment deployment wth regular rado (n = 500, 1000). and However, the total number of potental wormhole lnks grows to about 250 when p drops to 0.75, due to more localzaton errors Scalablty We evaluated the performance of Secure Walkng GPS as the sze of a deployed WSN ncreases. We perform smulatons wth the total number of sensor nodes beng 1000 n a grd deployment wth the same regular rado pattern, at p = 0.75, 0.80, 0.85, 0.90, 0.95, and 1.00, and compared the results wth those n Secton Mean values wth one standard devatons for each of the metrcs are plotted n Fg. 9. From ths fgure, we observe that the average localzaton error and average neghbor connectvty are almost the same for n = 500 and n = Therefore, the curves correspondng to dfferent n are qute close to each other both n Fg. 9a and b. In Fg. 9c, the total number of legtmate lnks and the total number of potental wormhole lnks ncrease proportonally wth n, the sze of the WSN. These results ndcate that our scheme s scalable for large-scale WSN deployments Rado rregularty Fnally, we performed smulatons to explore the mpact of rregular rado pattern n a grd deployment. The smulaton settngs were the same as those n Secton 4.2.2, except that the communcaton range of each sensor node n each drecton was unformly dstrbuted U(15, 45) m. The results showed that the rregular rado patterns could reduce the average neghbor connectvty, the total number of legtmate lnks and the total number of wormhole lnks: the average localzaton error range was [0.73, 1.31] m. The average neghbor connectvty ranges between [0.52, 0.85]. The total number of legtmate lnks s between [1627, 1740], and the total number of potental wormhole lnks s between [222, 17]. In our 30 runs of the smulaton, we have not encountered any (worst) case where more than fve communcaton keys are requred for each sensor node to establsh neghbor connectvty Overhead The overhead of our Secure Walkng GPS scheme s low n several aspects Hardware overhead The only addtonal hardware used s the GPS and IG modules, whose costs are fxed and occur only once. Snce the sze of the sensor network can be arbtrarly large and the hardware can be reused for multple deployments, the amortzed hardware overhead s neglgble Communcaton overhead In pre-deployment and post-deployment, all nodes communcate n a request-reply fashon, thus transmttng the mnmum necessary number of messages and consumng as lttle energy as possble. Encryptng every message could lead to an ncrease n the total number of necessary messages transmtted n the sensor network after the deployment. For example, nstead of broadcastng the messages, two physcal neghbors may have to use ntermedate neghbors to route ther messages, when they do not drectly share a communcaton key. However, we are wllng to trade ths ncrease for securty Storage overhead To enable cryptography, each sensor node needs to store 1 deployment key (for communcaton wth the master node) and m communcaton keys (for communcaton wth ts neghbors). If each key s 16 bytes long, the requred amount of memory on each sensor node to store them s only 16 (m + 1) bytes, whch s small and adequately fts well on most of today s sensor nodes. Evaluatng the tradeoff between the sze of the communcaton keys and the performance of the deployment would requre an mplementaton of a realstc WSN applcaton. Due to the dversty of WSN applcatons, s t dffcult to precsely measure an average effect of communcaton keys on applcaton performance. Instead, we ndcate that the communcaton keys n Secure Walkng GPS requre less storage than smlar, state of art solutons [11]. Addtonally, the number of keys managed by the master node s roughly proportonal to the number of sensor nodes. However, ths s not a problem for a typcal master node, whch should be able to support the necessary memory needs. 5. Related work WSNs are nherently vulnerable to varous attacks due to the nsecure nature of wreless communcaton and

14 14 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx the severe resource constrants on sensor nodes. As a result, determnng node locatons n a hostle envronment s challengng. Sequence-based localzaton s an approach to resstng attacks on rangng results n wreless networks. Specfcally, a deployment area s dvded nto non-overlappng subregons by the perpendcular bsectors for the anchor pars. Each subregon s assgned a unque sequence code word that represents the relatve dstance rankng of each anchor; and each node s mapped to a subregon once ts estmate or measured dstances to anchors are avalable. Observe that f the number of vald sequence code words s consderably smaller than the total number of possble sequence code words, robust detecton of attacks and correcton of locaton errors n the sequences can be acheved. The performance of sequenced-based localzaton s largely dependent on the number of anchors. Capkun proposed two mechansms for secure localzaton n wreless networks [12]. The frst one, Verfable Multlateraton, enables secure computaton and verfcaton of locatons based on dstance boundng and authentcated rangng protocols. The second one, Secure Localzaton wth Hdden Base statons, makes use of the unpredctablty of base staton locatons to enable secure localzaton. Both mechansms requre hardware support such as hgh clock precson and complex base staton nfrastructure. Therefore, they may face challenges n resource-constraned sensor networks. In [13], Park and Shn presented an attack-tolerant localzaton protocol, Verfcaton for Iteratve Localzaton (VeIL). Localzaton s acheved usng a profle manager that adaptvely tracks the profle of normal localzaton behavor and an attack detector that detects attacks by teratvely verfyng locaton announcements va comparson aganst the normal profle. However, f the number of anchors s small, or the anchors are non-trustworthy, or the rangng accuracy s low, the performance of VeIL s lkely to degrade. Lazos and Poovendran proposed a range-ndependent localzaton algorthm called SeRLoc n [14]. Usng message encrypton, the propertes of sector unqueness and communcaton range volaton, and the Attach to Closer Locator Algorthm, sensor nodes can determne ther locatons durng wormhole attacks, sybl attacks, and compromsed sensors. As a successor to SeRLoc, HRLoc [15] acheves passve sensor localzaton based on beacon nformaton transmtted from the locators wth mproved resoluton at the cost of ncreased computatonal complexty and communcaton. In both SeRLoc and HRLoc, locators are assumed to be trusted and have known locatons. However, they are often the actual targets n a real attack. Lu et al. proposed two methods to acheve attack-resstant beacon-based locaton estmaton n sensor networks n [16]. The frst method, attack-resstant Mnmum Mean Square Estmaton, dentfes malcous locaton references by examnng the nconsstency among locaton references and removes malcous data. The second method quantzes the deployment feld nto grds and has each locaton reference vote on the cells where a node may resde. These two methods work under the assumptons that the majorty of locaton references are bengn and rangng s accurate, whch may not always hold n hostle envronments. Sequence-based localzaton s an approach to resstng attacks on rangng results n wreless networks [17]. The performance of sequenced-based localzaton s largely dependent on the number of anchors. In [18], L et al. developed two robust statstcal methods to make localzaton attack-tolerant. These two methods assume that legtmate dstance or sgnal strength measurements outnumber malcous readngs. However, n a sophstcated attack such as the wormhole attack, legtmate measurements may be outnumbered. Shokr et al. desgned a secure neghbor verfcaton protocol wth a proof-of-concept mplementaton on Crcket motes [19]. The protocol nvolves rangng, neghbor table exchange, and geometrc lnk verfcaton and has been demonstrated to be effectve aganst the wormhole attack. However, t requres that each sensor node has specal hardware to perform rangng and be synchronzed to mcrosecond order wth each other, whch may be dffcult to apply to large-scale deployments where cost becomes an ssue. Secure communcaton between legtmate nodes can be acheved by encryptng and authentcatng the messages usng keys. As a result, many works have been dedcated to effcent key dstrbuton n a WSN. In the probablstc parwse key predstrbuton scheme [20] by Eschenauer, each node s preassgned a random set of k keys from a large key pool P. Ths scheme may requre the key manager and sensor nodes to have a large storage capacty n order to hold the keys. In addton, ths scheme cannot guarantee that a node wll always share a key wth a neghbor. In [21], Camtepe and Yener proposed a determnstc mplementaton of Eschenauer s scheme. Each node stll receves a subset of keys from a key pool P. However, rather than choosng each subset randomly, the subsets are constructed to guarantee that each node par share a key and each key n P appears n the same number of key subsets. The dffculty of ths scheme s that the number of nodes must be known n advance when key subsets are generated. Lu and Nng proposed two locaton-based parwse key establshment schemes for statc sensor networks [22]. Ther schemes have a hgh probablty to establsh drect keys between neghbors. However, not only are expected node locatons requred to be known before key establshment, but specfc nodes also need to be correctly placed at ther expected locatons. These two requrements mpose substantal manual work before and durng the deployment. In [23], the authors formalzed the modelng of wormhole lnks usng the graph theory and presented two mechansms to defend aganst the wormhole attacks. However, ther centralzed mechansm requres that all node locatons be known n advance to a central authorty before key dstrbuton and ther decentralzed mechansm uses multple specal guard nodes where ther locatons must be determned n some way and they share a global key that s assumed not to be compromsable. Whle keys are prepopulated before the deployment n the prevous works, Kuo et al. proposed Message-In-A-Bottle (MIB) [24], a scheme to securely deploy keys to sensor nodes nsde a shelded Faraday cage durng the

15 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx 15 deployment. Technques such as key segmentaton, actvaton, and verfcaton are employed to defeat the Dolev-Yao attacks. Nevertheless, ths deployment scheme requres much human nteracton. Ths artcle extends the results reported n [1,25] wth a formal proof for the theorem that gves the lower bound on the number of keys to be dstrbuted on a sensor nodes, a clarfyng example, and more extensve securty analyss and performance evaluatons. 6. Conclusons In ths artcle, we presented the desgn and evaluaton of Secure Walkng GPS, an ntegral soluton for secure localzaton and locaton-based key dstrbuton n largescale and manually deployed WSNs. Secure Walkng GPS s practcal and low-cost, requres mnmal human nteracton durng the deployment, and makes the deployed WSN resstant to the Dolev-Yao, the wormhole, and the GPSdenal attacks. In our current verson of Secure Walkng GPS, the communcaton among neghbors s mostly uncast or multcast snce not all neghbors have the communcaton key to decrypt any legtmate message that they can hear. We plan to consder the dstrbuton of neghborhood keys n our next step so that broadcast communcaton n the presence of attacks can also be supported n a secure way. Acknowledgments Ths work was supported, n part, by Grants ARO W911NF , and NSF OCI and CNS References [1] Q. M, J.A. Stankovc, R. Stoleru, Secure Walkng GPS: a secure localzaton and key dstrbuton scheme for wreless sensor networks, n: Proceedngs of the 3rd ACM Conference on Wreless Network Securty (WSec), ACM, [2] T. He, P. Vcare, T. Yan, L. Luo, L. Gu, G. Zhou, R. Stoleru, Q. Cao, J. Stankovc, T. Abdelzaher, Achevng real-tme target trackng usng wreless sensor networks, n: Proceedngs of the 12th IEEE Real-Tme and Embedded Technology and Applcatons Symposum (RTAS), IEEE Computer Socety, 2006, pp [3] L. Selavo, A. Wood, Q. Cao, T. Sookoor, H. Lu, A. Srnvasan, Y. Wu, W. Kang, J. Stankovc, D. Young, J. Porter, Luster: Wreless sensor network for envronmental research, n: Proceedngs of the 5th Internatonal Conference on Embedded Networked Sensor Systems (SenSys), ACM, 2007, pp [4] K. Seada, M. Zunga, A. Helmy, B. Krshnamachar, Energy effcent forwardng strateges for geographc routng n lossy wreless sensor networks, n: Proceedngs of the 2nd Internatonal Conference on Embedded Networked Sensor Systems (SenSys), ACM, 2004, pp [5] C. Intanagonwwat, R. Govndan, D. Estrn, Drected dffuson: a scalable and robust communcaton paradgm for sensor networks, n: Proceedngs of the 6th ACM Internatonal Conference on Moble Computng and Networkng (Mobcom), ACM, 2000, pp [6] S. Beauregard, Omndrectonal Pedestran Navgaton for Frst Responders, Tech. Rep., Unverstat Bremen, [7] V. Adamchuk, Global Postonng System Data Processng, Tech. Rep., Unversty of Nebraska Lncoln, [8] A. Srnvasan, J. Wu, A Survey on Secure Localzaton n Wreless Sensor Networks, CRC Press, Taylor and Francs Group, [9] D. Dolev, A. Yao, On the securty of publc key protocols, IEEE Trans. Inform. Theory 29 (2) (1983) [10] A. Wood, J. Stankovc, Poster abstract: AMSecure secure lnk-layer communcaton n tnyos for IEEE based wreless sensor networks, n: Proceedngs of the 4th Internatonal Conference on Embedded Networked Sensor Systems (SenSys), ACM, 2006, pp [11] P. Traynor, R. Kumar, H. Bn Saad, G. Cao, T. La Porta, LIGER: mplementng effcent hybrd securty mechansms for heterogeneous sensor networks, n: Proceedngs of the 4th Internatonal Conference on Moble Systems, Applcatons and Servces (MobSys), ACM, [12] S. Capkun, Secure localzaton n wreless networks (usng verfable multlateraton and covert base statons), n: Book Chapter, Secure Localzaton and Tme Synchronzaton for Wreless Sensor and Ad Hoc Networks, Sprnger, [13] T. Park, K.G. Shn, Attack-tolerant localzaton va teratve verfcaton of locatons n sensor networks, ACM Trans. Embed. Comput. Syst. 8 (1) (2008). [14] L. Lazos, R. Poovendran, Serloc: secure range-ndependent localzaton for wreless sensor networks, n: Proceedngs of the 3rd ACM Workshop on Wreless Securty (WSe), 2004, pp [15] L. Lazos, R. Poovendran, Hrloc: hgh-resoluton robust localzaton for wreless sensor networks, IEEE J. Select. Areas Commun. 24 (2) (2006) [16] D. Lu, P. Nng, W.K. Du, Attack-resstant locaton estmaton n sensor networks, n: Proceedngs of the 4th Internatonal Symposum on Informaton Processng n Sensor Networks (IPSN), IEEE, 2005, pp [17] B. Krshnamachar, K. Yedavall, Secure sequence-based localzaton for wreless networks, n: Book Chapter, Secure Localzaton and Tme Synchronzaton for Wreless Sensor and Ad Hoc Networks, Sprnger US, [18] Z. L, W. Trappe, Y. Zhang, B. Nath, Robust statstcal methods for securng wreless localzaton n sensor network, n: Proceedngs of the 4th Internatonal Symposum on Informaton Processng n Sensor Networks (IPSN), IEEE, 2005, pp [19] R. Shokr, M. Poturalsk, G. Ravot, P. Papadmtratos, J.-P. Hubaux, A practcal secure neghbor verfcaton protocol for wreless sensor networks, n: Proceedngs of the 2nd ACM Conference on Wreless Network Securty (WSec), ACM, 2009, pp [20] L. Eschenauer, V. Glgor, A key-management scheme for dstrbuted sensor networks, n: Proceedngs of the 9th ACM Conference on Computer and Communcatons Securty (CCS), ACM, 2002, pp [21] S. Camtepe, B. Yener, Combnatoral desgn of key dstrbuton mechansms for wreless sensor networks, IEEE/ACM Trans. Network. 15 (2) (2007) [22] D. Lu, P. Nng, Locaton-based parwse key establshments for statc sensor networks, n: Proceedngs of the 1st ACM Workshop on Securty of Ad Hoc and Sensor Networks (SASN), 2003, pp [23] R. Poovendran, L. Lazos, A graph theoretc framework for preventng the wormhole attack n wreless ad hoc networks, Wrel. Netw. 13 (1) (2007). [24] C. Kuo, M. Luk, R. Neg, A. Perrg, Message-n-a-bottle: user-frendly and secure key deployment for sensor nodes, n: Proceedngs of the 5th ACM Conference on Embedded Networked Sensor Systems (SenSys), ACM, 2007, pp [25] R. Stoleru, T. He, J. Stankovc, Walkng GPS: a practcal soluton for localzaton n manually deployed wreless sensor networks, n: Proceedngs of the 29th Annual IEEE Internatonal Conference on Local Computer Networks (LCN), IEEE Computer Socety, 2004, pp Q M receved hs BS degree n Electrcal Engneerng from Shangha Jao Tong Unversty, Chna n 2004 and an ME degree n Computer Engneerng from the Unversty of Vrgna n Hs research nterests are wreless sensor networks, node localzaton, and securty. He currently works as a software developer at Mcrosoft n Redmond, WA.

16 16 Q. M et al. / Ad Hoc Networks xxx (2012) xxx xxx John A. Stankovc s the BP Amerca Professor n the Computer Scence Department at the Unversty of Vrgna. In the past he served as Char of the department for 8 years. He s a Fellow of both the IEEE and the ACM. He also won the IEEE Real-Tme Systems Techncal Commttee s Award for Outstandng Techncal Contrbutons and Leadershp. He also won the IEEE Techncal Commttee on Dstrbuted Processng s Dstngushed Achevement Award (naugural wnner). He has won four Best Paper awards n sensor networks ncludng for ACM SenSys Before jonng the Unversty of Vrgna, Professor Stankovc taught at the Unversty of Massachusetts where he won an outstandng scholar award. He has also held vstng postons n the Computer Scence Department at Carnege-Mellon Unversty, at INRIA n France, and Scuola Superore S. Anna n Psa, Italy. He was the Edtor-n-Chef for IEEE Transactons on Dstrbuted and Parallel Systems and was founder and co-edtor-n-chef for the Real-Tme Systems Journal. Hs research nterests are n cyber physcal systems, dstrbuted computng, real-tme systems, wreless sensor networks, and securty for sensor networks. Prof. Stankovc receved hs PhD from Brown Unversty. Radu Stoleru s an Assstant Professor n the Department of Computer Scence and Engneerng at Texas A&M Unversty, and the head of the Laboratory for Embedded & Networked Sensor Systems (LENSSs). Hs research nterests are n deeply embedded wreless sensor systems, dstrbuted systems, embedded computng, and computer networkng. He receved hs PhD n computer scence from the Unversty of Vrgna n Whle at the Unversty of Vrgna, he receved from the Department of Computer Scence the Outstandng Graduate Student Research Award for He has authored or co-authored over 50 conference and journal papers wth over 1000 ctatons. He s currently servng as an edtoral board member for three nternatonal journals and has served as techncal program commttee member on numerous nternatonal conferences.