WO2010032161A1

WO2010032161A1 - A method for secure communication in a network, a communication device, a network and a computer program therefor

Info

Publication number: WO2010032161A1
Application number: PCT/IB2009/053930
Authority: WO
Inventors: Martijn Maas; Oscar Garcia Morchon
Original assignee: Philips Intellectual Property & Standards Gmbh; Koninklijke Philips Electronics N.V.
Priority date: 2008-09-19
Filing date: 2009-09-09
Publication date: 2010-03-25
Also published as: KR20110069103A; CN102160324B; JP5637991B2; KR101604596B1; BRPI0913565A2; JP2012503399A; EP2359521A1; US8588411B2; RU2528078C2; US20110167273A1; CN102160324A; RU2011115207A

Abstract

The present invention relates to a method for secure communications and communication networks having communication devices, using secure means like encryption system for securing communications. More particularly, the present invention relates to a method for secure communications from a first node (N1) to a second node (N2) in a network, the first node comprising a first node keying material (KM^(ID1)), the second node comprising a second node keying material (KM^(ID2)), wherein the keying materials of the first node and of the second node comprise each a plurality of keying root shares formed by keying root share segments. The method using key segmentation for pre-distributing keying material according to a variable distribution for increasing the resiliency of existing methods.

Description

A METHOD FOR SECURE COMMUNICATION IN A NETWORK, A COMMUNICATION DEVICE, A NETWORK AND A COMPUTER PROGRAM

THEREFOR

FIELD OF THE INVENTION

The present invention relates to method for secure communications and communication networks having communication devices, using secure means like encryption system for securing communications. This invention finds an advantageous application in mobile wireless sensor and actuator networks (WSNs), and more particularly in medical wireless networks for patient monitoring.

BACKGROUND OF THE INVENTION

Due to these sensitive applications, networks of the like must be provided with security services like confidentiality, authentication, integrity, and authorization.

Encryption systems used in conventional communication networks typically carry out encryption methods based on cryptography for securing the communications.

More particularly, in some networks comprising nodes having to be very cost- efficient, symmetric cryptography is therefore usually applied to enable required security services. Indeed, in networks of the like, such as wireless sensor networks, nodes are typically resource-constrained, namely in terms of battery power, communication bandwidth, processing power, or memory. Security methods based on asymmetric cryptography are thus generally considered either inefficient or infeasible in such nodes. The fundamental issue in symmetric cryptography lies in key-distribution, i.e. in the establishment of shared secrets in nodes belonging to a network and having to communicate securely. This problem is particularly eminent in WSNs, since their size can vary from tens to several tens of thousands of nodes, and their nature can be very dynamic, e.g. the network topology may not be known a priori. Conventional key pre-distribution methods used in WSN are combinatorial methods, which consist in splitting nodes of a network into classes, and in assigning to each node a set of keys corresponding to its class. A class within the meaning of the present description corresponds to a set of elements gathered in accordance with a predetermined law such as a mathematical, arithmetical, or logical law. In such methods, nodes in a same class all share the same keys, and nodes from different classes are guaranteed to share at least one key, so as to enable communication.

However, those methods present a major drawback in terms of resiliency, since the capture of a node by an adversary implies that all the keys in the captured node key set are compromised and, consequently, communication of all nodes in that class, and even nodes in other classes using the same keys, is compromised.

In addition, some WSN application scenarios such as patient monitoring in hospitals require different security domains organized in a hierarchical manner. In such networks, sensor nodes belong to one or several security domains, depending on their level of authorization. In existing hierarchical key distribution schemes, each security domain is linked to a key distribution, thus the capture of a security domain at a low level, i.e. a security domain comprising many nodes, even if not leading to compromise the keying material of other security domains at low levels, can still break the security at higher levels.

SUMMARY OF THE INVENTION

It is an object of the invention to propose a method using a key distribution concept in order to overcome the drawbacks previously presented.

It is another object of the invention to propose a method offering a better resiliency to attacks. Still another object of the invention is to provide a method for secure communications in an efficient way.

To this end, a method for secure communications from a first node to a second node in a network is proposed, the first node comprising a first node keying material, the second node comprising a second node keying material, wherein the keying materials of the first node and of the second node comprise each a plurality of keying root shares formed by keying root share segments.

Such a method comprises the following steps: a step a) of determining an identifier of the second node; a step b) of determining the composition of the keying material of the second node, the keying material comprising a plurality of keying root shares formed by keying root share segments, this determination comprising the selection of each i^th keying root share segment of the keying material from a predistributed keying material set, such set depending at least on i and on the second node's identifier; a step c) of comparing the first node keying material and the second node keying material, for identifying the common keying root share segments, wherein an i^th common keying root share segment is determined by retrieving the keying root share segment in common between a set comprising all i^th keying root share segments of the second node keying material and a set comprising all i^th keying root share segments of the first node keying material, and a step d) of computing a shared key between the first node and the second node, based on at least one of the identified common keying root share segments, the identifier of the second node, and the segment identifier i.

In the following specification, two nodes m and n will be said as belonging to the same class for a key segment i when the predistributed keying material set depending on i and m is the same as the predistributed keying material set depending on i and n.

A method according to the invention allows key segment diversification since two nodes belonging to a same class for key element i are likely to belong to different classes for the other keying root share segments. As a consequence, the size of the groups of nodes sharing exactly the same root segments is highly decreased as compared with conventional methods. Accordingly, capturing a limited number of nodes belonging to the same class for one key segment would compromise only that particular segment of the corresponding keys rather than the whole key, thus increasing the resiliency of this method. In one embodiment, step d) comprises the step of computing key segments from the identified keying roots share segments and from both identifiers of the first node and second node, and the step of generating the shared key either by concatenating or combining the computed key segments.

Concatenating the key segments to generate the shared key allows increasing the computational efficiency of the method, since the bit length of the key segments is smaller than the bit length of the shared key, which means that there is no storage or computation overhead. This is of particular importance for WSNs where computation power in the nodes is limited.

Apart from concatenation, one of the possible combination methods lies in logically combining the segments using an XOR operator. In such a case, the bit length of the key segments is the same as the bit length of the eventual key, which is advantageous in that the compromise of any number of segments less than the size of the key does not decrease the strength of the key. In one embodiment, the predistributed keying material set used for determining the keying material of a node corresponds to a set of elements of one or several finite projective planes, distributed according to a variable distribution of the nodes in the network, indexed by a variable parameter of the distribution, and depending on i and on an identifier of the node whose keying material is being determined.

Using a variable parameter for the distribution helps increasing the resiliency of the method, since it allows adding another source of variation in the computation of the shared key.

Moreover, in an advantageous embodiment, the variation law of the variable parameter is initially kept secret, and the method thus comprises a step, for the node, of receiving values of the variable parameter from a centralized or distributed network authority comprising one or several nodes.

This receiving step may be performed as follows : the first node sends a request to the network authority, who decides whether the first node is allowed to generate shared key and, upon positive result, eventually sends, preferably in a secure way, the values of the variable parameter to the first node.

Keeping the variation law of the variable parameter secret means that, during a pre- deployment phase, i.e. before the nodes actually join a specific network, a node is not provided with the values of the parameter used for the variable distribution, and two major advantages are reached in this way : first, an access control is performed, since the nodes first have to report to the network authority of the network they have joined, who controls whether a node is allowed, or not, to generate a key, and the resiliency is increased due to the fact that if a node is captured before having been deployed, i.e. before having joined a network, the attacker would be able to retrieve the keying material in the node, but not the keying roots who depend on the secret variable parameter.

The present invention also relates to a communication device designed for being included in a network as a first node, comprising : - storage means for storing a keying material of the first node, the keying material of the first node comprising a plurality of keying root shares formed by keying root share segments, means for determining an identifier of a second node of the network, a controller arranged for determining the composition of the keying material of the second node, the keying material comprising a plurality of keying root shares formed by keying root share segments, the controller comprising a selector for selecting each i^th keying root share segment of the keying material from a predistributed keying material set, such set depending at least on i and on the second node's identifier, the controller further comprising comparison means for comparing the first node keying material and the second node keying material, for identifying the index common keying root share segments, comparison means comprising retrieving means for determining an i^th common keying root share segment by retrieving the keying root share segment in common between a set comprising the i^th keying root share segment for each keying root share of the second node keying material and a set comprising the i^th keying root share segment of each keying root share of a predetermined first node keying material, - the controller further comprising computation means for computing a shared key between the first node and the second node, based on at least one of the identified common keying root share segments, the identifier of the second node and the segment identifier i.

The present invention also relates to a network comprising at least two communication devices as described above, wherein one communication device represents a first node of the network, and another communication device represents a second node of the network, and wherein the first node and the second node communicate one with each other by using the shared key, so as to secure the communication.

In accordance to another aspect of the invention, a computer program is provided for implementing a method according to the invention.

The invention also finds an advantageous application in some networks comprising different security domains distributed in a hierarchical manner. In such networks, each security domain is generally linked to different and independent cryptographic information, and the distribution of kleying material when deploying the network is made in such a way as to ensure full security interoperability between nodes as well as distributed access control and hiereachical node identification. Thus, in one embodiment, a method according to the invention is such that, in the case of a network comprising several security domains hierarchically distributed, the determination of keying material of the nodes is carried out in such a way that the correlation of keying material shares in different nodes and the amount of compromised keying roots under attack is minimized.

These and other aspects of the invention will be apparent from and will be elucidated with reference to the embodiments described hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will now be described in more detail, by way of example, with reference to the accompanying drawings, wherein: - Fig. 1 represents a network according to one embodiment of the invention,

Fig. 2 is a block diagram of a method for secure communications from a first node to a second node, according to an embodiment of the invention, Fig. 3 is a detailed block diagram of one step of the method shown on Figure 1, Fig. 4 represents an example of hierarchical key distribution, and - Fig. 5 shows the resiliency against smart attackers of systems with and without key segment diversification.

DETAILED DESCRIPTION OF THE INVENTION

The present invention relates to a method for secure communications from a first node to a second node in a network. The present invention is more especially dedicated to wireless sensor and actuator networks used for patient monitoring, e.g. networks comprising sensor nodes for sensing physical parameters of a patient, receptor nodes for providing medical staff with the parameters, and actuator nodes. However, it is to be noted that the present invention is not limited to networks of the like, and can be carried out in any type of network, used for any technical application.

A method according to one embodiment of the invention will now be described in connection with figures 1 and 2.

A network according to the invention comprises at least two nodes Nl and N2, each one being provided with an identifier, respectively IDl and ID2. In an embodiment, the network also comprises a trust center node TC, used for the configuration of the network and for providing the nodes Nl and N2 with all necessary keying material information for generating cryptographic keys. This trust centre node TC represents one possible embodiment of a network authority previously mentioned. During operational phase, to ensure the communication between the first node Nl and the second node N2 of the network, each of the nodes generates a shared key by using the distributed keying material information and uses this key to protect any communication sent to the other node, or to decode any communication received from this other node. Figure 2 describes the different steps required for the first node to generate a shared key for communicating with the second node. Similar steps are performed by the second node for generating the corresponding shared key for communicating with the first node.

To generate a key, a node needs to be provided with a keying material share, respectively KM¹-¹⁰¹-* and KM¹-¹⁰²-* for the first node and the second node, i.e. some information allowing for key establishment. The keying material share is generally received from the trust center TC during a configuration phase of the network. The keying material shares provided to the nodes are generated from the root keying material KM, which is a crypto information only known to the trust center.

The method described above is thus not intended to be applied to a particular node, but can be carried out by any node of the network.

When a communication is to be established between the first node and the second node, the first node receives from the second node, on step a), an identifier ID2 of the second node.

In order to discover the shared key for communicating with the second node, the first node needs to determine, in step b), the composition of the keying material share of the second node.

A keying material share comprises a plurality of keying root shares and, in a method according to the invention, those keying root shares are segmented, which means that they are formed by a plurality segment. It is to be noted that all keying root shares generally comprise the same number of segments.

Accordingly, in a method according to one embodiment of the present invention, the shared key between the first node and the second node is composed of a number of key segments.

Thus, determining the composition of a keying material, in step b), corresponds to determining separately each segment of the keying root shares.

Such a determination will be further detailed in connection with figure 3.

In one embodiment of a method according to the invention, the keying root shares are key elements, divided into segments. Accordingly, determining the different segments of the keying root shares correspond to determining ready-made key segments further combined for generating the eventual shared key between the fist node and the second node.

However, in an advantageous embodiment, a method according to the invention is combined with a λ-resilient method that relies on the fact that nodes do not share ready-made keys. Instead, nodes are provided with node-specific information that allows them to compute a shared key with another node on input of that node's identifier. This node specific information, called a keying root share, is derived from a keying root. As an example, a keying root share is a polynomial of degree λ, thus a polynomial having λ+1 coefficients.

After having determined the composition of the second node keying material KM¹-¹⁰²-*, the first node compares, in step c), this second node keying material KM¹-¹⁰²-* with its own keying material KM^¹⁰¹I This comparison can also be performed based on the keying material identifiers.

As said before, in one embodiment, each node is provided with its own keying material share during the configuration phase. However, in another embodiment, the first node determines its own keying material share during operational phase, using a method similar to the one that will be further described, based on figure 3. Moreover, in one embodiment, the determination of the node keying material is carried out in such a way as to minimize the correlation of the different keying material segments.

The comparison of the first node keying material KM¹-¹⁰¹-* with the second node keying material KM¹-¹⁰²-* is performed as follows: for each segment, the first node finds out which keying root segment they have in common, which means that, for each segment i comprised between 1 and the number of segments, the first node finds out the common element between a set comprising the i^th segment of each keying root share of the first node keying material and a set comprising the i^th segment of each keying root share of the second node keying material.

After having identified the common segments, the first node computes, in step d), the shared key K with the second node.

This composition may be performed in several ways, according to several embodiments of the invention. For example, the key segments k_t may be simply concatenated in order to get the eventual key K: K = ki || fo || ... || k_t. In this case where the number of key segments used for composing the key K is t, the bit length of the key segments is a factor t smaller than the bit length of the eventual key K, so there is no storage or computation overhead. Such a composition makes it possible to increase computation efficiency of the method. Another option is to compose K by mathematical, arithmetical or logical combinations of the different key segments, for example by XOR-ing the different key segments: K = ki ® k₂ ® ... ® k_t.

For this composition, the bit length of the key segments should equal the required bit length of K. The XOR composition is advantageous in that, in case of an attack, compromising any number of key segments less than t does not decrease the strength of the key.

There may be other methods for key composition, like methods applying a hash function to get an output of desired bit length and to remove possible algebraic relations between keys.

In case a λ-resilient method is used, computation comprises the step, before the combination step, of determining the common key segments by evaluating the common keying root keying root share segments on input of the second node's identifier.

We will now describe, in connection with figure 3, the determination of a specific keying root share segment i of the first node.

First of all, we will describe some general concepts carried out while performing such a determination, those concepts being used in some, but not necessarily all, embodiments of the invention.

As explained before, keying root share segments are selected among a predistributed keying material set, depending at least on the first node identifier, and on i.

In the embodiment herein described, a method according to the invention carries out a combinatorial key pre-distribution method for predistributing the keying material sets.

Typically, the combinatorial concept herein used is a Finite Projective Plane, called FPP, an thus the predistributed keying material set used for the determination of a node keying material corresponds to a set of elements of a FPP.

An FPP of order n and parameters (n²+n+l, n+1, 1) is defined as an arrangement of n²+n+l distinct elements into n²+n+l blocks such that:

• Each block contains exactly n+1 elements.

• Every element occurs in exactly n+1 blocks. • Every pair of blocks has exactly 1 element in common.

The set of elements is denoted by E = {0,..., n²+n] and the set of blocks by B = [B₀,..., B_n), where block s = {b_li0,...,b_lin} C E.

As an example, an FPP of order 2, i.e. where n = 2, defines the following blocks: B₀ = (0, 2, 4); B₄ = (O, 1, 6); B₁ = (1, 3, 4); B₅ = (2, 3, 6);

B₂ = (0, 3, 5); B₆ = (4, 5, 6);

B₃ = (1, 2, 5);

As stated previously, one of the properties of FPP is the fact that every pair of block has exactly 1 element in common. Accordingly, when two nodes want to communicate, they can use a shared key element based on the common element of their corresponding FPP blocks to agree on a common secret and communicate in a secure manner.

In a typical clever distribution, the different blocks of an FPP correspond to different classes of nodes, j. The node identifier, ID, can be mapped to the node class according to the following relationship: j ≡ ID (mod n²+n+l).

Nodes from class C₁ are provided with keys indexed by the elements of block B₁. For instance, node 8 belongs to class Ci and therefore its Keying Material, denoted

is given by the set of keys

KM^ = {k_{bι o} ,k_{bι ι} ,k_{bι i} } = {k_ι,k₃ ,k₄} If this node wants to communicate with node 14, they use the FPP properties to discover a shared key. This key is ^, because this node belongs to class Co and therefore:

KM^(U) = {k_{bo o} ,k_{bo ι} ,k_{bo 2} } = {k_o,k₂,k₄}

This distribution has a period of n²+n+l, which means that all nodes whose identities differ a multiple of n²+n+l are in the same class. To increase this period, and thus increase the resiliency of the method, in one embodiment a variable distribution is used for predistributing the key material.

This variable distribution is indexed by a parameter v, depending of the keying root share segment to be determined, so that a node belongs to different classes for different segments of the keying root shares, and - two nodes belonging to the same class for one segment are likely to belong to different classes for another segment.

Advantageously, the variable distribution is defined as follows : node ID is assigned to class C_jv, where: .

Parameter v depends on the segment to be determined, and it appears that different values of v give different distributions of nodes. In total, there are n²+n+l different distributions for 0 < v < n +n. For a particular value of v, the period of the distribution is equal to:

where gcd (a,b) is the great common divisor between a and b, i.e. the largest positive integer that divides both numbers without remainder.

So the period of a distribution is maximal for gcd (v, n² + n + I) = 1, in which case the period is (n²+n+l)². This is always the case for n²+n+l prime and v > 0.

Accordingly, the size of the groups of nodes that share exactly the same root segments is decreased by a factor n²+n+l. Hence, the relative resiliency per class is increased by a factor n²+n+l.

Table 1 below lists the class C_JV for nodes with identifiers up to ID = 20 in the variable distribution for n = 2.

Table 1: Variable Distribution for « = 2

We will now describe in detail the determination of i^th keying root share segments belonging to the keying material of node ID. In this example, the parameter v depends on i as follows : v = i-1.

A first node, identified as IDl, already provided with its own keying material

receives a second node identifier ID2, in view of establishing communication with this second node.

The first node is also provided with information for determining v, as mentioned above, and with the order n of the FPP used for predistributing the keying material sets. Those elements are provided to the nodes by the trust center node TC, either during pre- deployment or deployment phase, or during operational phase. In a first step (DET C_JV), the first node determines, for segment i, the class to which the second node belongs to. As stated before, a variable distribution is used, with the

ID following relation : j_v ≡ v ^■ + ID (modn² + n + l) where |_xj represents the n + n + \ integer part of x. Thus, with the notations of the present description, the second node belongs to Class

IDl

C_JV with j_v ≡ (/ - !) ^■ + ID2 (modn 2 + n + V) . n + n + \_

The parameter j_v is then used, in a second step (SELECT KM SET), to determine the predistributed keying material set in which the keying root share segments are selected.

The Keying Material set corresponding to Class C_JV is the block B_JV of a Finite projective Plane of order n.

Thereafter, in step (DET S), the i^th segments of the keying root shares are determined, based on the element of the block B_{j v} previously determined.

The number of elements of a block B_{j v} is n+1, which is equal to the number of keying root shares forming the keying material of a node. Accordingly, the i^th segment of the 1^th keying root share is determined based on the 1^th element of block B_JV.

The method described in accordance with figure 3 is performed for each i, i being an integer between 1 and the number of segments forming a keying root share.

For example, let us suppose the key is composed of t segments, with t < n²+n+l. The Keying Material for node ID, consisting of n+1 KR shares that each have t segments, is constructed as follows. The first segments of the KR shares correspond to the FPP block for

ID according to the distribution with v = 0, which is block B_Jo = ψ_{Jo O},...,b_{Jo ll}\. Hence, these first segments of the KR shares are given by kr_{b ^}^^1D) ,kr_{b ^}J^1D) ,...,kr_b ^^ID) . The second KR

share segments are distributed according to v = 1, so they take their index from block

^Bh ⁼ ^Λ.o^>- ^"Λ.^» * . Therefore, these shares are kr, ^(m,kr ^(m,...,kr ^(m . Similarly,

the /^th segments of the KR shares are distributed according to v = / -1. This results in the following construction of node ID's Keying Material:

KM^{{m ~} far ^(m kr ^(m kr ^(m \ \kr ^(m kr ^(m kr ^(m W

We will now fully describe a specific example for determining a shared key between two nodes, using a method according to the present invention. This example takes the following parameters : the nodes' identifiers are IDl = 8 and ID2 = 14, the order of the FPP is n=2, the number of segment of the keying root shares is t = 3, and - the dependency between the parameter v and the segment s is v = s-1.

For node 8, the first segments are distributed according to block B_j0 withy ₀ = 1, as can be seen from the row in Table 1 shown above with v = 0 and ID = 8. Hence, the first segments of the keying root shares have indices listed by Bi = {1, 3, 4}. Similarly, the second segments correspond to B 2 = {0, 3, 5} (sincey; = 2 for ID = 8) and the third segments to B 3 = {1, 2, 5} (sincey^'2 = 3 for ID = 8). Hence, the Keying Material for node 8 is given by:

_KM (S) - _kr (8) £ (*) Λ

JSJVi —

) ^κrs,i ) ^κrsfi s )

In the same way, the segments for node 14 correspond to blocks Bo, B 2, and B 4, respectively. Hence, node 14 is provided with Keying Material:

_KM W - \{_kr d4) r (14) , (14) , , , (14) , (14) , (14) , ₍ , (14) , (14) , (14) , 1 ΛΛ4 - ^Kr_{0 1} , κr_{0 2} , Kr_{0 3} ) , \κr_{2 l} , κr_{3 2} , κr_{l 3} ) , \κr_{A l} , κr_{5 2} , κr_{6 3} )j

To compute a shared key with node 14, node 8 finds out for each segment which Keying

Root segment they have in common. This turns out to be hr_4,i for the first segment, and krjj for the third.

In the present case, for the second segment, all the elements are common between KM⁽⁸⁾ and KM⁽¹⁴⁾.

In an embodiment of the invention, in such a case, the common segment is selected in accordance with a predetermined law known by all nodes.

Let us assume, in the present example, that the selected common element chosen for the second segment is kr_u. As mentioned previously, in an advantageous embodiment, a method according to the invention is combined with a λ-resilient method, which means that the first node and the second node do not directly share ready-made keys, but share some node-specific information. Thus, in this case, the common segments do not represent directly key segments, but information used for evaluating the key segment. Typically, the keying root share segments represent lambda-secure functions such as multivariate polynomials of degreeλ. In the present case, bivariate polynomials are used, i.e. for any i and j, kr_m__n ^(l)(j)= kr_mj^})(j). In the specific example, node 8 evaluates each of its KR shares

and krij⁸-¹ at ID = 14 and composes the resulting t key segments into the eventual key shared between nodes 8 and 14.

Now referring to Figure 4, we will describe the application of a method according to the invention, with variable distribution and key segmentation, to a system with hierarchical key distribution.

Applying variable node distribution to hierarchical key distribution makes it possible to reduce the amount of compromised keying material among different levels.

Let us assume a simple hierarchical key distribution method with 2 levels. At the first level there is a single security domain, and at the second level there are a total of m different security domains. In a trivial approach, two nodes belonging to different security domains at the second level can get keying material from arbitrary classes at level 1. This means that an attacker aiming at compromising a specific security domain at level 2 can obtain keying material at level 1 from any class. Therefore, the attacker can compromise the whole security domain at level 1 by only capturing nodes from a specific security domain at level 2.

The concept of variable node distribution allows to minimize this problem by assigning the keying material to nodes in variably distributed way. Figure 4 illustrates this for a single segment or for a hierarchical key distribution without segment diversification. In the figure we can observe a hierarchical distribution with 3 levels where nodes belonging to a security domain (SD) index-i at level l+l carry keying material generated from i^th FPP block of security domain SD index at level /. For instance, a node belonging to SD ₁₃₄ carries keying material:

> At level 1 from the 3^rd FPP block OfSD₁.

> At level 2 from the 4^th FPP block of SD₁₃. > At level 3 from any FPP block OfSD₁₃₄.

This system presents several advantages. On the one hand, it allows encoding the SDs the SDs a node belongs to by means of the FPP block identifiers reducing in this manner the communicational overhead. On the other hand, this approach reduces the amount of compromised keying material at a generic level / when an intruder attacks a SD at level l+l to small fraction of keying material, namely (n+\)/(n²+n+\), where n is the FPP order of the SD linked to the SD index at level /. The main drawback of this solution is that the number of SDs index-i at level l+l that SD index at level / can accommodate is limited to n²+n+\.

Such an approach can also be combined with key segmentation and segment diversification as follows : a node belonging to a SD index-i at level / gets keying material from SD index at level / from class i. This increases the number of sub-SDs at level l+l that a SD at level / can accommodate by a factor n²+n+\. Additionally, if a SD at level 1+1 is compromised, the amount of keying material compromised at a higher level is reduced again due to the concept of segment diversification previously described. A possible inter-level distribution algorithm using the concept of segment diversification can be designed as follows. Nodes at an arbitrary level / get keying material from different security domains SDs according to different variable distribution C_JV assigned to security domain. All those nodes get keying material at level l-l from a number of classes (n²+n+l)² in the same security domain. Classes in the security domain at level 1-1 are distributed among the security domains at level 1 in such a way that the inter- layer keying materials are randomized so that the capture of a a number of nodes in any SD at a level / minimizes the impact on the compromised keying material at level l-l. Different approaches can be used to this end, for instance Nc classes (e.g., n²+n+l classes) at level l-l out of (n²+n+l)² possible classes at that level can be assigned to the nodes belonging to a security domain at level 1. The chosen Nc clases (e.g., n²+n+l classes) at level l-l can be in a consecutive order, i.e., {j,j+l, ...J+Nc} so that a clever distribution can be applied to it.

So as to point out the performances of a system carrying out a method according to the invention, we will now analyze and compare the resiliency of schemes with and without key segment diversification. In this analysis, the composition of keys is defined by concatenation of the key segments and, for fair comparison, a threshold T is introduced for the amount of entropy needed for a key to be sufficiently strong.

The analysis is performed in a case where λ-resilient method is used in combination wih a combinatorial pre-distribution concept. The analysis will be performed in a situation where the system is attacked by a clever attacker, i.e. an attacker who does not compromise nodes at random, but chooses the nodes selectively in order to compromise the whole keying material with the less number of captured nodes.

First consider a system without diversification, A clever attacker first selects λ + 1 nodes from the same class, thereby compromising n + 1 keys. Next he repeatedly selects λ + 1 nodes from other classes, each time compromising n more keys, because the classes are chosen cleverly. After n + 1 classes, i.e. (λ + \){n + 1) compromised nodes, the attacker knows all the keys in the system. Hence, the fraction of keys that are compromised as function of the number of compromised nodes Nc is as follows: 0 for N_c ≤ λ,

J nodiv, clever V * C ) "K^{/(λ + 1)J+ 1} for_{λ +} l _{≤ Wc} < (_{λ +} lK_{B +} l), w + /? + !

1).

Now in a case with key segment diversification, when a key is composed of t ≥ TIq segments, a key is still suffϊcently strong after the compromise of t_r = TIq - t key segments,. So an adversary needs to gather at least t_r + 1 segments to break a key. If the total number of nodes ^~ ^ ^^{n n} ' , then a clever attacker can repeadedly compromise λ + 1 nodes

/ 2 i \ 2 whose identifiers are equivalent mod ^^{n n} ' . Hence, with every λ + 1 nodes, for every segment a complete FPP block is compromised. Hence, this can be seen as a clever attack on each segment seperately. The fraction of compromised keys is defined by the fraction of keys that take at least t_r + 1 segments from those compromised blocks:

J dιv,dever

Figure 5 plots the resiliency against a clever attacker for the system without diversification for parameters λ = 6 and n = 23 (Rl) and the one with diversification for parameters λ = 3 and n = 31 (R2). On this figure, the abscissa axis represents the number or captures nodes, and the ordinate axis represents the fractions of compromised nodes. Here the total number of nodes N is assumed to be smaller than 986049. Up to 74 captures nodes, the system with key segment diversification performs better than the one without.

Consequently, it appears that a method according to the invention makes it possible, by use of key segment diversification, to increase the resiliency of security systems carried out in WSNs networks. Such a method finds a particular application in Zigbee networks as a key feature that improves the security of λ-secure key distribution schemes. More generally, a method according to the invention can also be applied to bootstrap security in resource-constrained wireless nodes used in patient monitoring and distributed wireless control networks.

In the present specification and claims the word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Further, the word "comprising" does not exclude the presence of other elements or steps than those listed. The inclusion of reference signs in parentheses in the claims is intended to aid understanding and is not intended to be limiting. From reading the present disclosure, other modifications will be apparent to persons skilled in the art. Such modifications may involve other features which are already known in the art of radio communication and the art of transmitter power control and which may be used instead of or in addition to features already described herein.

Claims

1. A method for secure communications from a first node (Nl) to a second node (N2) in a network, the first node comprising a first node keying material (KM¹-¹⁰¹-*), the second node (KM¹-¹⁰²-') comprising a second node keying material, wherein the keying materials of the first node and (Nl) of the second node (N2) comprise each a plurality of keying root shares formed by keying root share segments, the method comprising, for the first node, the following steps : a) determining an identifier (ID2) of the second node (N2), b) determining the composition of the keying material of the second node

(KM^(ID2)), this determination comprising the selection of each i^th keying root share segment of the second node keying material from a predistributed keying material set, such set depending at least on i and on the second node's identifier, c) comparing the first node keying material (KM¹-¹⁰¹-*) and the second node keying material (KM¹-¹⁰²-'), for identifying the common keying root share segments, wherein an i^th common keying root share segment is determined by retrieving the keying root share segment in common between a set comprising the i^th keying root share segments of each keying root share of the second node keying material and a set comprising the i^th keying root share segments of each keying root share of the first node keying material, d) computing a shared key (K) between the first node (Nl) and the second node (N2), based on at least one of the identified common keying root share segments, the identifier of the second node (ID2) and the segment identifier i.

2. A method according to claim 1, comprising an initial step, performed before step a), consisting in the first node (Nl) determining the composition of the first node keying material (KM^^ID1^), wherein the determination comprises the selection of each i^th segment of the first node keying material from a predistributed keying material set, such set depending at least on i and on the first node's identifier.

3. A method according to claim 1, comprising an initial step, performed before step a), consisting in the first node (Nl) determining the composition of the first node keying material (KM^^ID1^), wherein the determination of the node keying material is carried out in such a way as to minimize the correlation of the different keying material segments.

4. A method according to claim 3, wherein the network is organized into different security domains (SDs) hierarchically distributed, and wherein the determination of keying material of the nodes is carried out in such a way that the correlation of keying material shares in different nodes and the amount of compromised keying roots under attack is minimized.

5. A method according to claim 1, wherein step d) comprises the step of computing key segments from the identified keying roots segments and from an identifier of the first node (IDl) and the identifier of the second node (ID2), and the step of generating the shared key (K) either by concatenating or combining the computed key segments.

6. A method according to claim 1, wherein the predetemined sef of segments used for selecting an i^th keying root share segment in step b) is indexed by elements generated as elements of Finite Projective Planes.

7. A method according to claim 4, wherein the predistributed keying material set used for the determination of a node keying material corresponds to a set of elements of finite projective planes distributed according to a variable distribution of the nodes in the network, indexed by a variable parameter, and depending on i and on an identifier of the node whose keying material is being determined.

8. A method according to claim 7 wherein the variable distribution is defined as follows:

ID node ID is assigned to class C_JV, where j_v ≡ v ^■ + ID (modn² + n + Y) , v n + n + \_ being the variable parameter, n being the order of a finite projective plane, and |_xj is the integer part of x.

9. A method according to claim 7 or 8, wherein the variable parameter depends on i.

10. A method according to claim 5, comprising, prior to step b), a step of receiving the values of the variable distribution from a centralized or distributed network authority comprising one or several nodes, said receiving step comprising : a step, for the first node (Nl), of sending a request to the network authority, - a step, for the network authority of deciding whether the first node is allowed to generate a shared key, and in case the node is allowed to generate a shared key, a step, for the network authority NA of sending the values of the variable parameter to the node.

11. A method according to claim 1 , wherein keying roots used for deriving keying root shares are lambda-secure functions such as multivariate polynomials of degree lambda..

12. A communication device designed for being included in a network as a first node

(Nl), comprising : storage means for storing a keying material of the first node (KM¹-¹⁰¹-*), the keying material of the first

comprising a plurality of keying root shares formed by keying root share segments, - means for determining an identifier (ID2) of a second node, a controller arranged for determining the composition of the keying material of the second node (KM¹-¹⁰²-*), the keying material of the second node comprising a plurality of keying root shares formed by keying root share segments, the controller further comprising determination means comprising selecting means for selecting each i^th keying root share segment of the keying material from a predistributed keying material set, such set depending on i and on the second node's identifier,

- the controller further comprising comparison means for comparing the first node keying material (KM¹-¹⁰¹-*) and the second node keying material (KM¹-¹⁰²-*), for identifying the common keying root share segments, comparison means comprising retrieving means for determining an i^th common keying root share segment by retrieving the keying root share segment in common between a set comprising the i^th keying root share segment of each keying root share of the second node keying material and a set comprising the i^th keying root share segment of each keying root share of a predetermined first node keying material,

- the controller further comprising computation means for computing a shared key (K) between the first node and the second node, based on at least one of the identified common keying root share segments, the identifier of the second node, and the segment identifier..

13. A network comprising at least two communication devices according to claim 8, wherein one communication device represents a first node (Nl) of the network, and another communication device represents a second node (N2) of the network, and wherein the first node and the second node communicate one with each other by using a method according to claim 1.

14. A computer program for implementing a method according to claim 1.