Pu Haoyang, Chen Wen, Wang Hongchao, Bao Shenghong
School of Cyber Science and Engineering, Sichuan University, Chengdu 610207, China.
Sensors (Basel). 2024 Sep 25;24(19):6217. doi: 10.3390/s24196217.
Due to their inherent openness, wireless sensor networks (WSNs) are vulnerable to eavesdropping attacks. Addressing the issue of secure Internet Key Exchange (IKE) in the absence of reliable third parties like CA/PKI (Certificate Authority/Public Key Infrastructure) in WSNs, a novel key synchronization method named NDPCS-KS is proposed in the paper. Firstly, through an initial negotiation process, both ends of the main channels generate the same initial key seeds using the Channel State Information (CSI). Subsequently, negotiation keys and a negative database (NDB) are synchronously generated at the two ends based on the initial key seeds. Then, in a second-negotiation process, the NDB is employed to filter the negotiation keys to obtain the keys for encryption. NDPCS-KS reduced the risk of information leakage, since the keys are not directly transmitted over the network, and the eavesdroppers cannot acquire the initial key seeds because of the physical isolation of their eavesdropping channels and the main channels. Furthermore, due to the NP-hard problem of reversing the NDB, even if an attacker obtains the NDB, deducing the initial key seeds is computationally infeasible. Therefore, it becomes exceedingly difficult for attackers to generate legitimate encryption keys without the NDB or initial key seeds. Moreover, a lightweight anti-replay and identity verification mechanism is designed to deal with replay attacks or forgery attacks. Experimental results show that NDPCS-KS has less time overhead and stronger randomness in key generation compared with other methods, and it can effectively counter replay, forgery, and tampering attacks.
由于其固有的开放性，无线传感器网络（WSN）容易受到窃听攻击。针对无线传感器网络中在没有像CA/PKI（证书颁发机构/公钥基础设施）这样可靠第三方的情况下安全互联网密钥交换（IKE）的问题，本文提出了一种名为NDPCS-KS的新型密钥同步方法。首先，通过初始协商过程，主信道两端利用信道状态信息（CSI）生成相同的初始密钥种子。随后，基于初始密钥种子在两端同步生成协商密钥和一个否定数据库（NDB）。然后，在第二次协商过程中，利用NDB对协商密钥进行过滤以获得加密密钥。NDPCS-KS降低了信息泄露的风险，因为密钥不是直接在网络上传输，并且窃听者由于其窃听信道与主信道的物理隔离而无法获取初始密钥种子。此外，由于反转NDB的NP难问题，即使攻击者获得了NDB，推导出初始密钥种子在计算上也是不可行的。因此，攻击者在没有NDB或初始密钥种子的情况下生成合法加密密钥变得极其困难。此外，还设计了一种轻量级的抗重放和身份验证机制来应对重放攻击或伪造攻击。实验结果表明，与其他方法相比，NDPCS-KS在密钥生成方面具有更少的时间开销和更强的随机性，并且能够有效对抗重放、伪造和篡改攻击。
