Key management and node authentication method for sensor network

Method of encryption key management and node authentication of sensor network {KEY MANAGEMENT AND NODE AUTHENTICATION METHOD FOR SENSOR NETWORK}

The present invention relates to the field of network security technology, and more particularly, to an encryption key management and node authentication method of a sensor network.

A sensor network consists of a large number of small, low-cost, battery-powered sensor nodes with wireless communication and monitoring capabilities. These nodes are densely placed in the monitoring area to achieve the purpose of monitoring the physical world. As a new research direction in information technology, wireless sensor networks have broad application prospects in environmental monitoring, military, homeland security, traffic control, regional safety prevention, forest fire prevention, target location estimation, and the like.

Since sensor networks are usually deployed in unmanned areas, especially hostile areas, communication between nodes is easily eavesdropped, tampered with, or reproduced, and the nodes themselves are easily captured, duplicated, or counterfeited, giving a great threat to network security. By introducing basic security mechanisms such as encryption key management and node authentication to detect and respond to the above security threats, it is necessary to ensure the safety of communication between nodes and effective verification of the legitimacy of node identity in the network. The encryption key management mechanism is the basis of sensor network security. Existing methods can be classified into three types: a method of sharing a single encryption key within the overall network, a method of bidirectionally sharing an encryption key between nodes, and a method of pre-distributing a random encryption key. Sensor network nodes are easily subjected to capture attacks and the storage resources of the nodes are strictly limited. Therefore, the first two encryption key management methods described above cannot resist node capture attacks or require a large amount of storage overhead. cannot be fully applied. The encryption key management method that pre-distributes the random encryption key is a relatively practical method at present, as it has excellent scalability, high encryption key connectivity, and excellent survivability. However, in the method, since one and the same encryption key can be distributed to different nodes multiple times, the node can only verify the legitimacy of the other party and can only verify the legitimacy of the other party in performing identity authentication based on the encryption key between the nodes. Since the identity cannot be verified, end-to-end identity authentication cannot be realized. Likewise, authentication mechanisms are fundamental to sensor network security. The currently proposed sensor network node authentication mechanism is mainly a lightweight, pre-shared encryption key-based authentication method, and the pre-shared encryption key used is generally provided by the encryption key management method employed by the network. When the network adopts the existing random encryption key pre-distribution method, the encryption key generated by it cannot provide an end-to-end authentication service for the network node, and can only verify the legitimacy of the other party and can confirm the specific identity of the other party. In this case, the sensor network cannot resist attacks such as capture, duplication, or counterfeiting of the node, and there is a huge security risk in the network.

<p>In order to solve the technical problem existing in the prior art, the present invention provides an encryption key management and node authentication method of a sensor network that can provide secure communication for a sensor network and provide an end-to-end node authentication service.</p>

<p>As a solution to the problems of the present invention, the present invention provides an encryption key management and node authentication method of a sensor network, the method comprising:</p><p>each node obtains an encryption key for establishing a secure connection between nodes, which is pre-distributed by the deployment server, and after network deployment, each node broadcasts its own identification information to all its neighboring nodes;</p><p>Each node determines whether or not a shared encryption key with the corresponding adjacent node exists according to the identification information received from the adjacent node. establishing a dual key between each node and a node having a multi-hop security connection when it is established and it is determined that the shared encryption key does not exist;</p><p>Before formal communication between each node, in order to confirm the legitimacy and validity of the identity of the other party, the step of performing identity authentication according to the established dual key is included.</p><p>Preferably, the method further comprises the step of pre-distributing, by the deployment server, an encryption key for establishing a secure connection between nodes to all nodes before deployment of the network.</p><p>Preferably, the specific realization method of the deployment server pre-distributing the encryption key for establishing a secure connection between nodes to all nodes is as follows.</p><p>Before network deployment, the deployment server initializes the encryption key pool and <i>KP</i>To create a bar, the corresponding encryption key pool <i>KP</i>includes several cryptographic keys and their cryptographic key identifiers, and the number of cryptographic keys in the cryptographic key pool |<i>KP</i>| and the deployment server is assumed to be secure,</p><p>Pre-set network connectivity <i>P</i><i>_c</i>and the number of nodes in the network <i>n</i>Assuming that each node has an identifier ID corresponding to it, the degree of the node according to the representative random graph theory is <i>d</i>=(<i>n</i>-1)*(ln<i>n</i>-ln(-ln<i>P</i><i>_c</i>))/<i>n</i> calculate,</p><p>degree of node<i>d</i> and the number of adjacent nodes of the node after the desired network deployment. <i>n</i>Probability of pre-sharing the encryption key between mutually adjacent nodes according to ' <i>p = d</i>/<i>n</i>' is calculated,</p><p>The deployment server allocates encryption keys for all nodes.</p><p>Preferably, the specific realization method in which the distribution server allocates encryption keys for all nodes is as follows.</p><p>node <i>N</i><i>_It's</i>For, the batch server takes precedence <i>N</i><i>_It's</i>For constituting an ID list, the ID list includes an N_ID field, a K_ID field, a K_STA field, a K_ATTR field, a K_ATTR_EX field, and a K_VAL field, </p><p>here, </p><p>N_ID field: node ID bar, node<i>N</i><i>_It's</i> Displays the identification value of the node that shares the encryption key with</p><p>K_ID field: Encryption key ID, node <i>N</i><i>_It's</i> and the identification value of the shared encryption key between the nodes indicated by the N_ID field,</p><p>K_STA field: It is an encryption key status, indicating the status of the encryption key indicated by the K_ID field, <i>N</i><i>_It's</i> If the node indicated by the and N_ID field has previously established a dual key, the value of the K_STA field is established, otherwise, it is not established, and the initial value of the field is not established,</p><p>K_ATTR field: As an encryption key attribute, if the value of the K_STA field is already established, the value of the field is valid, and indicates whether the encryption key indicated by the K_ID field is a shared encryption key or a path encryption key, The initial value indicates the shared encryption key, </p><p>K_ATTR_EX field: This is an encryption key attribute extension. If the encryption key indicated by the K_ATTR field is a path encryption key, the value of the corresponding field is valid. Indicates whether the path encryption key is a direct connection encryption key or a multi-hop connection encryption key. For this purpose, the default of this field indicates the direct connection encryption key of the encryption key,</p><p>K_VAL field: As an encryption key value, it is to store the encryption key value indicated by the K_ID field,</p><p><i>N</i><i>_It's</i> After establishing the ID list on the <i>n</i>-1 randomly among nodes <i>n</i>*<i>p</i> Select nodes and assign their node IDs to each <i>N</i><i>_It's</i> After inserting it into the ID list of the batch server, the encryption key pool <i>KP</i> Select one encryption key from <i>N</i><i>_It's</i>Insert into the corresponding K_ID field and K_VAL field in the ID list of <i>KP</i>deletes the corresponding encryption key and identifier from <i>t</i>(<i>t</i>&lt;<i>n</i>') spare encryption key IDs, but all spare encryption key IDs are the encryption key pool initially created by the batch server <i>KP</i> It does not overlap with the encryption key identifier ID in the <i>N</i><i>_It's</i> loaded on the node, and the deployment server <i>N</i><i>_It's</i> Record all information in the ID list of <i>KP</i> It is to display the dual key not included in the</p><p>node <i>N</i><i>_j</i> For, the deployment server is a node <i>N</i><i>_It's</i> After pre-distributing the encryption key for<i>N</i><i>_j</i> We start to distribute the encryption key in advance for<i>n</i>-1 randomly among nodes <i>n*p</i> Select nodes and assign their node IDs to each <i>N</i><i>_j</i> After inserting it into the ID list of the batch server <i>N</i><i>_j</i> A non-duplicate cryptographic key pool for each item in the ID list of <i>KP</i> Select one encryption key from <i>N</i><i>_j</i>Insert into the corresponding K_ID field and K_VAL field in the ID list of <i>KP</i>Deletes the encryption key and identifier from <i>N</i><i>_j</i>randomly selected for <i>n*p</i> among the nodes <i>N</i><i>_It's</i> no more if included <i>N</i><i>_j</i>Wow <i>N</i><i>_It's</i> Instead of reassigning the encryption key to <i>N</i><i>_It's</i> Allocating the shared encryption key between the two previously assigned to them, <i>N</i><i>_j</i>in the ID list of <i>N</i><i>_It's</i> Inserts the ID and encryption key value of the shared encryption key into the K_ID field and the K_VAL field of the corresponding clause, respectively, and the batch server creates an initially generated encryption key pool <i>KP</i> encryption key ID and <i>N</i><i>_It's</i> does not overlap with the spare encryption key ID of <i>t</i>(<i>t</i>&lt;<i>n</i>') generate spare encryption key IDs, and these also <i>N</i><i>_j</i> loaded on the node, and the deployment server <i>N</i><i>_j</i> Record all information in the ID list of</p><p>For the remaining nodes, the deployment server <i>N</i><i>_j</i> After distributing the encryption key for <i>N</i><i>_j</i> and the batch server records the ID list information of all remaining nodes.</p><p>Preferably, a specific realization method in which each node and an adjacent node establish a dual key is as follows.</p><p>After network deployment, each node broadcasts its own identification information to all its neighboring nodes,</p><p>After receiving the broadcasting message, the neighboring node determines whether or not it shares the encryption key with the broadcasting node according to the identification information included therein. If the same ID exists in the N_ID field in its ID list indicates that the node and itself share an encryption key, that is, a twin key, and the adjacent node has previously established a twin key with the broadcasting node by setting the K_STA field in the corresponding term of the ID list to established. , that is, indicates that a direct secure connection has already been established.</p><p>Preferably, a specific realization method in which each node and a node having a multi-hop security connection establish a dual key is as follows.</p><p>If there is one secure path between the source node and the target node, consisting of a plurality of nodes in which a shared encryption key exists for both, the source node has one path encryption key. <i>PK</i>, and select one ID not to be duplicated from the spare path encryption key ID, and pass the path encryption key through the secure path to the target node. <i>PK</i>and the corresponding encryption key ID and own ID and target node's ID are transmitted to the target node through hop-by-hop encryption and decryption transmission by nodes on the secure path,</p><p>The target node receives and decrypts the source node's encryption key message to <i>PK</i>After obtaining , the encryption key establishment success message is sent to the source node through a secure path with the source node to indicate that a secure connection with the source node has been established, where the source node and the target node each identify each other Insert ID into your ID list as a new term, <i>PK</i>ID and <i>PK</i>Inserts the value of in the K_ID field and the K_VAL field, sets the K_STA field to established, and sets the K_ATTR field as the path encryption key. If it is, that is, when it is indicated that both the source node and the target node are within the direct communication range of the counterpart, the corresponding K_ATTR_EX field is set as the direct connection encryption key, otherwise, the corresponding K_ATTR_EX field is set as the multi-hop interconnection encryption key.</p><p>Preferably, before formal communication between the respective nodes, in order to confirm the legitimacy and validity of the identity of the other party, a specific realization method of performing identity authentication according to the established dual key is as follows.</p><p>Node A sends message ID to Node B_B||K_ID_AB||N_Arequest to start authentication with Node B by sending_ABdenotes the identifiers of the pre-shared cryptographic keys of Node A and Node B, and N_Arepresents the random number generated by node A and ID_Brepresents the identity identifier of Node B,</p><p>After receiving the authentication request from node A, node B first receives the ID in the request message._BDetermines whether or not is the same as its identity identifier ID. If it is different, Node B discards the request message. If it is the same, Node B determines whether K_ID in its ID list_ABIt is determined whether the encryption key corresponding to_BCreate a K_ID in the ID list_ABThe value of the K_VAL field corresponding to_ABID using_A, ID_B, N_A, N_Baccording to MAK_AB||SK_AB=F(PSK_AB,ID_A||ID_B||N_A||N_B), where MAK_ABis the message authentication encryption key between node A and node B, and SK_ABis the session encryption key between node A and node B, then MAK_ABMessage authentication code using MAC₁=H(MAK_AB, ID_A||N_A||N_B) and create a message ID_A||N_A||N_B||MAC₁is constructed and sent to node A, where F indicates the encryption key derivation calculation method and H indicates the message authentication code calculation method, both of which are one-way functions,</p><p>After node A receives the message from node B, first, the query N in the message_AInquiry N sent by_AChecks whether it matches the MAK_AB||SK_AB=F(PSK_AB,ID_A||ID_B||N_A||N_B) by calculating the MAK_ABMessage authentication code using MAC₂=H(MAK_AB, ID_A||N_A||N_B), and if MAC₂=MAC₁Then, node A succeeds in authentication to node B and SK_ABis stored as the session encryption key with Node B, and MAC₃=H(MAK_AB,ID_B||N_B) to calculate the ID_B||N_B||MAC₃to node B, where F denotes the encryption key derivation calculation method and H denotes the message authentication code calculation method, both of which are one-way functions, </p><p>Node B receives the message from Node A and then asks N_BInquiry N sent by itself to node A by_BChecks whether it matches the MAC₄=H(MAK_AB,ID_B||N_B), and if MAC₄=MAC₃, then Node B succeeds in authentication to Node A, and Node B is SK_ABis stored as the session encryption key with node A, and MAC₅=H(MAK_AB,ID_A||N_A) to calculate the message ID_A||N_A||MAC₅is sent to node A, where F denotes an encryption key derivation calculation method and H denotes a message authentication code calculation method, both of which are one-way functions.</p>

<p>As can be seen from the above technology, the present invention realizes secure communication between sensor network nodes by mutually combining encryption key management and node authentication mechanism, and at the same time provides an end-to-end identity authentication service between nodes, eavesdropping, tampering and It can effectively resist attacks on network communication, such as regeneration, and realize secure communication between nodes. provides a basic network security solution for sensor networks. In addition, the encryption key management and node authentication method proposed in the present invention has a low overhead compared to the storage and calculation of the existing method, and can effectively reduce the resource of the sensor network node and extend the service life of the sensor network.</p>

1 is a flowchart of a sensor network encryption key management and node authentication method provided by the present invention; Fig. 2 is a flow chart of inter-node identity authentication provided by the present invention.

Referring to FIG. 1, there is shown a flowchart of an encryption key management and node authentication method of a sensor network provided in the present invention, and the method includes the following steps.

Step 101: Each node obtains an encryption key for establishing a secure connection between nodes, which is pre-distributed by the deployment server, and after network deployment, each node broadcasts its own identification information to all its neighboring nodes.

Step 102: Each node determines whether a shared encryption key with the corresponding neighbor node exists according to the identification information received from the neighbor node, and if there is, executes steps 103 and 105; 104 and step 105 are executed.

Step 103: A dual key is established between each node and its adjacent node.

Step 104: A twin key is established between each node and a node where a multi-hop secure connection exists.

Step 105: Before formal communication between each node, in order to confirm the legitimacy and validity of the identity of the other party, identity authentication is performed according to the established dual key.

Preferably, the method may further include a step of pre-distributing the encryption key, in which the deployment server pre-distributes the communication encryption key for establishing a secure connection between the nodes to all nodes before deployment of the network, and the specific implementation method Is as follows.

1.1) Before network deployment, the deployment server initializes the encryption key pool and <i>KP</i>To create a bar, the corresponding encryption key pool <i>KP</i>includes several cryptographic keys and their cryptographic key identifiers, and the number of cryptographic keys in the cryptographic key pool |<i>KP</i>| and the deployment server is assumed to be secure.

1.2) Pre-set network connectivity <i>P</i><i>_c</i>and the number of nodes in the network <i>n</i>It is assumed that each node has an identifier ID corresponding to it, and the degree of the node is assumed according to the representative random graph theory. <i>d</i>=(<i>n</i>-1)*(ln<i>n</i>-ln(-ln<i>P</i><i>_c</i>))/<i>n</i> , and a preset number of network nodes to ensure relatively good scalability. <i>n</i>is somewhat larger than the actual number of network nodes.

1.3) Degree of Node<i>d</i> and the number of adjacent nodes of the node after the desired network deployment. <i>n</i>Probability of pre-sharing the encryption key between mutually adjacent nodes according to ' <i>p = d</i>/<i>n</i>' is calculated.

1.4) The encryption key is pre-distributed for the nodes, and the deployment server allocates the encryption key to all nodes, and the specific implementation method is as follows.

1.4.1) Nodes <i>N</i><i>_It's</i>For, the batch server takes precedence <i>N</i><i>_It's</i>For constituting an ID list, the ID list includes an N_ID field, a K_ID field, a K_STA field, a K_ATTR field, a K_ATTR_EX field, and a K_VAL field,

<img file="KR101447339B1_D0001.tif" />

here,

N_ID field: node ID bar, node <i>N</i><i>_It's</i> Displays the identification value of the node that shares the encryption key with

K_ID field: Encryption key ID, node <i>N</i><i>_It's</i> and the identification value of the shared encryption key between the nodes indicated by the N_ID field,

K_STA field: It is an encryption key status, indicating the status of the encryption key indicated by the K_ID field, <i>N</i><i>_It's</i> If the node indicated by the and N_ID fields has previously established a twin key, the value of the K_STA field is "established", otherwise, "not established", and the initial value of the field is "not established".

K_ATTR field: As an encryption key attribute, if the value of the K_STA field is "established", the value of the corresponding field is valid, and indicates whether the encryption key indicated by the K_ID field is a shared encryption key or a path encryption key, The initial value of this field indicates the shared secret key,

K_ATTR_EX field: This is an encryption key attribute extension. If the encryption key indicated by the K_ATTR field is a path encryption key, the value of the corresponding field is valid. Indicates whether the path encryption key is a direct connection encryption key or a multi-hop connection encryption key. For this purpose, the default of this field indicates the direct connection encryption key of the encryption key,

K_VAL field: As an encryption key value, it is to store the encryption key value indicated by the K_ID field.

<i>N</i><i>_It's</i> After establishing the ID list on the <i>n</i>-1 randomly among nodes <i>n</i>*<i>p</i> Select nodes and assign their node IDs to each <i>N</i><i>_It's</i> After inserting it into the ID list of the batch server, the encryption key pool <i>KP</i> Select one encryption key from <i>N</i><i>_It's</i>Insert into the corresponding K_ID field and K_VAL field in the ID list of <i>KP</i>deletes the corresponding encryption key and identifier from <i>t</i>(<i>t</i>&lt;<i>n</i>') spare encryption key IDs are generated, but the spare encryption key IDs are the encryption key pool initially created by the batch server. <i>KP</i> It does not overlap with the encryption key ID in the <i>N</i><i>_It's</i> loaded on the node, and the deployment server <i>N</i><i>_It's</i> Record all information in the ID list of <i>KP</i> This is to display a dual key that is not included within.

1.4.2) Nodes <i>N_j</i> For, the deployment server is a node <i>N_It's</i> After pre-distributing the encryption key for <i>N_j</i> Start distributing encryption keys in advance for First, the batch server is<i>n</i>-1 randomly among nodes <i>n*p</i> Select nodes and assign their node IDs to each <i>N_j</i> After inserting it into the ID list of the batch server <i>N_j</i> A non-duplicate cryptographic key pool for each item in the ID list of <i>KP</i> Select one encryption key from <i>N_j</i>Insert into the corresponding K_ID field and K_VAL field in the ID list of <i>KP</i>Deletes the encryption key and identifier from <i>N_j</i>randomly selected for <i>n*p</i> among the nodes <i>N_It's</i> no more if included <i>N_j</i>Wow <i>N_It's</i> Instead of reassigning the encryption key to <i>N_It's</i> Allocating the shared encryption key between the two already assigned to them, <i>N_j</i>in the ID list of <i>N_It's</i> Inserts the ID and encryption key value of the shared encryption key into the K_ID field and the K_VAL field of the corresponding clause, respectively, and the batch server creates an initially generated encryption key pool <i>KP</i> encryption key ID and <i>N_It's</i> does not overlap with the spare encryption key ID of <i>t</i>(<i>t</i>&lt;<i>n</i>') encryption key IDs are generated, and these are also <i>N_j</i>loaded on the node, and the deployment server <i>N_j</i> Record all information in the ID list of

1.4.3) For the remaining nodes, the deployment server <i>N</i><i>_j</i> After distributing the encryption key for <i>N</i><i>_j</i> same as Similarly, the batch server records the ID list information of all remaining nodes.

In steps 101 to 104, that is, after the network is deployed, a dual key is established for secure connection between each node, and the specific realization method is as follows.

2.1) Establishing a shared encryption key The specific implementation method of establishing a twin key with an adjacent node where the shared encryption key exists is as follows.

2.1.1) After network deployment, each node broadcasts its own identification information to all its neighboring nodes,

2.1.2) After receiving the broadcasting message in 2.1.1), the neighboring node determines whether or not it shares the encryption key with the broadcasting node according to the identification information included therein. If its ID If the same ID exists in the N_ID field in the list, it indicates that the node and the node share an encryption key, that is, a twin key. .1) indicates that a pair of keys has been established with the node broadcasting in .1), that is, a direct security connection has already been established.

2.2) Establishing a path encryption key, the specific realization method of establishing a dual key with a node that does not have a shared encryption key but has a multi-hop security connection is as follows.

2.2.1) If there is one secure path between the source node and the target node, consisting of a plurality of nodes in which a shared encryption key exists for both, the present invention will not discuss how to establish the secure path. , the source node has one path encryption key <i>PK</i>, and select one ID not to be duplicated from the spare path encryption key ID, and pass the path encryption key through the secure path to the target node. <i>PK</i>and the corresponding encryption key ID and own ID and target node's ID are transmitted to the target node through hop-by-hop encryption and decryption transmission by nodes on the secure path,

2.2.2) The target node receives and decrypts the source node's encryption key message to <i>PK</i>After obtaining , the encryption key establishment success message is sent to the source node through a secure path with the source node to indicate that a secure connection with the source node has been established, where the source node and the target node each identify each other Insert ID into your ID list as a new term, <i>PK</i>ID and <i>PK</i>Inserts the value of in the K_ID field and K_VAL field, sets the K_STA field to "established" and sets the K_ATTR field to "path encryption key". If the path of is a single hop, that is, if both the source node and the target node are indicated to be within the direct communication range of the other party, the corresponding K_ATTR_EX field is set to "direct connection encryption key"; otherwise, the corresponding K_ATTR_EX field is set to "multi-hop". Interconnection encryption key".

In step 105, node identity authentication is performed. Before formal communication between nodes, identity verification must be performed to confirm the legitimacy and validity of the counterpart's identity. Specifically, FIG. 2 is a flowchart showing identity authentication between nodes provided in the present invention. In this embodiment, node A and node B are taken as an example, and the node authentication method is as follows.

3.1) Node A sends message ID to Node B_B||K_ID_AB||N_Arequest to start authentication with Node B by sending_ABdenotes the identifiers of the pre-shared cryptographic keys of Node A and Node B, and N_Arepresents the random number generated by node A and ID_Brepresents the identity identifier of Node B,

3.2) After receiving Node A's authentication request, Node B first receives the ID in the request message._BDetermines whether or not is the same as its identity identifier ID. If it is different, Node B discards the request message. If it is the same, Node B determines whether K_ID in its ID list_ABIt is determined whether the encryption key corresponding to_BCreate a K_ID in the ID list_ABThe value of the K_VAL field corresponding to_ABID using_A, ID_B, N_A, N_Baccording to MAK_AB||SK_AB=F(PSK_AB,ID_A||ID_B||N_A||N_B), where MAK_ABis the message authentication encryption key between node A and node B, and SK_ABis the session encryption key between node A and node B. Then MAK_ABMessage authentication code using MAC₁=H(MAK_AB, ID_A||N_A||N_B) and create a message ID_A||N_A||N_B||MAC₁is constructed and sent to node A, where F denotes an encryption key derivation calculation method and H denotes a message authentication code calculation method, both of which are generally one-way functions, and so on.

3.3) After node A receives the message from node B, it first receives the query N in the message._AInquiry N sent by itself in step 3.1)_AChecks whether it matches the MAK_AB||SK_AB=F(PSK_AB,ID_A||ID_B||N_A||N_B) by calculating the MAK_ABMessage authentication code using MAC₂=H(MAK_AB,ID_A||N_A||N_B), and if MAC₂=MAC₁Then, node A succeeds in authentication to node B and SK_ABis stored as a session encryption key with node B, and MAC₃=H(MAK_AB,ID_B||N_B) to calculate the ID_B||N_B||MAC₃is sent to Node B.

3.4) Node B receives the message from Node A and then asks N_BInquiry N sent by itself to node A in step 3.2)_BChecks whether it matches the MAC₄=H(MAK_AB,ID_B||N_B), and if MAC₄=MAC₃, then Node B succeeds in authentication to Node A, and Node B is SK_ABis stored as the session encryption key with node A, and MAC₅=H(MAK_AB,ID_A||N_A) to calculate the message ID_A||N_A||MAC₅is sent to node A, and the authentication process is terminated.

The present invention is based on an encryption key management method of a sensor network in which a random encryption key is distributed in advance and an encryption key is shared by both nodes between nodes, encryption key management and node authentication of a sensor network to provide secure communication between sensor network nodes Propose the implementation process of the method. In addition, based on the encryption key generated by the method and the binding relationship between the encryption key and the node ID, end-to-end identity authentication between sensor network nodes is realized by sharing the encryption key in advance.

The above content is only a preferred embodiment of the present invention, and for those skilled in the art, various advances and modifications can be made under the premise that does not deviate from the principles of the present invention, and such advances and modifications are also within the protection scope of the present invention. It is self-evident that it should belong.