Denial of service attack-resistant flooding authentication in wireless sensor networks

To achieve scalable and efficient broadcast authentication in large-scale networks, two asymmetry mechanisms have often been employed: the cryptographic asymmetry and the time asymmetry. Authentication schemes using digital signatures are based on the cryptographic asymmetry, while TESLA and related protocols using hash chains and delayed-key release methods are based on the time asymmetry. However, the former is computationally expensive while the latter provides delayed authentication only. Therefore, they are vulnerable to denial of service attacks that repeatedly request signature verifications with false messages. In this paper, we propose a novel broadcast authentication mechanism based on our “Information Asymmetry” model. It leverages an asymmetric distribution of keys between a sink and sensor nodes and uses the Bloom filter as an authenticator, which efficiently compresses multiple authentication information. In addition, with a novel “false negative” tuning knob introduced in construction of the Bloom filter, we show that scalability of our authentication method can greatly be improved. Through an intensive analysis, we demonstrate optimized trade-off relationships between resiliency against compromised nodes and scalability of system size. Optimization results indicate that the proposed authentication scheme achieves low false positive rates with small signature verification costs.