Network and method for initializing a trust center link key

p-0002The invention relates in general to a network and to a method for initializing a trust center link key.

p-0003Wireless sensor networks (WSNs) have gained in importance for home monitoring and control, like lighting applications. For such applications, security methods protecting users' confidentiality are of special interest. While typically a wide range of security services are offered in existing standards, such as, for instance, ZigBee®: ZigBee Alliance; ZigBee® Specification. December 2006, the secure initialization of cryptographic keys is still unsolved.

p-0004The secure management, especially the secure initialization, of cryptographic keys is of essential importance for wireless sensor networks security. The initialization of cryptographic symmetric keys represents a procedure that results in a shared secret between two devices. This shared secret allows setting up another cryptographic key between these devices in a secure manner, and hence establishing secure communication between two devices.

p-0005In the relevant standards, such as ZigBee®, the initialization of such shared secrets, the so-called master keys, is not sufficiently covered, even though security services are defined that rely on the availability of master keys. Only two cases are considered in the ZigBee® specification, the pre-programming and the plain-text transmission of master keys. The pre-programming mechanism is only applicable, if it is known during manufacture which sensor node will belong to a certain network. This may not be the case for commercial products, where the user shall be able to simply buy a node in a shop and add it to his network. The plain-text transmission of master keys, i.e., the second mechanism considered in ZigBee®, should be avoided, since it allows an easy attack on the network.

p-0006WO 2006/131849 is directed to a wireless network for monitoring a patient, comprising a body sensor network including wireless sensors, a set-up server and a base station. The set-up server configures the wireless sensors before being deployed to the wireless network. The base station distributes a key certificate to the sensors such that two sensors generate a unique pair wise key, based at least in part upon the pre-distributed keying material and the key certificate distributed by the base station.

p-0007It is an object of the present invention to provide an improved network, an improved trust center and an improved method for initializing a network key.

p-0008The object is solved by the independent claims. Further embodiments are shown by the dependent claims.

p-0009A basic idea of the invention is to provide new solutions for the secure initialization of cryptographic keys of a network, like a ZigBee® wireless sensor network, which may be based on an easy-to-use automated procedure, where a user only once has to authenticate upon request.

p-0010One solution would be to pre-configure all sensor nodes with the same keying material during manufacture. However, since commercial applications, such as home monitoring and control including lighting applications, are considered here, this solution may be not feasible due to the following reason. Letting all sensor nodes be preconfigured with the same keying material during manufacturing process would allow an attacker to simply buy a sensor node in a shop and use it to compromise the wireless sensor network of a user without any effort.

p-0011Using key pre-distribution schemes, as described in “Key distribution mechanisms for wireless sensor networks: a survey” by S. A. Camtepe et al, Rensselaer polytechnic” leads to a similar problem, since for commercial products it may be not possible to specify in advance the network a sensor node will belong to. Hence, during manufacture all sensor nodes would need to be preconfigured with keying material that would enable each pair of nodes to agree on one cryptographic key, resulting in a situation comparable to the case where all sensor nodes would obtain the same keying material, and thus the same attack would be possible.

p-0012Another solution would be to let all sensor nodes be uninitialized and leave it to the user to perform the initialization by hand. However, this may not represent an easy-to-use solution, at least not from a user's perspective, since the user would need to configure all nodes prior to deployment.

p-0013A system according to the invention represents an easy-to-use solution for a secure key initialization in wireless sensor networks. Such wireless sensor networks may be ZigBee® commercial applications such as, home monitoring and control including lighting applications. Initial keying material, like master keys stored in one sensor node may be easily loaded to another sensor node, such as, for instance, a trust center of a ZigBee® based wireless sensor network, without requiring a user to have detailed knowledge of the underlying security mechanisms. Only a few very easy steps need to be carried out to securely initialize keying material allowing further security mechanisms like the secure establishment of trust center link keys, and thus the secure exchange of a network key.

p-0014The inventive solutions for the secure initialization of cryptographic keys of a network satisfy major security requirements.

p-0015In particular, initial keying material, like a master key may be sensor node specific in order to avoid the possibility of an easy-to-perform attack on the privacy of the user running the wireless sensor network.

p-0016Further, security breaks of the initial keying material are identifiable. The user may be able to check whether the initial keying material has been broken prior to deployment of the respective sensor node.

p-0017A procedure for key initialization to be performed by the user is easy to use, in order to avoid security breaks caused by wrong usage. To be more specific, the complexity may be restricted to simply entering one character string once per device.

p-0018In addition, the initialization procedure is robust against attacks during the period of time required for the initialization procedure and allows secure reconfiguration of the network.

p-0019According to an embodiment of the invention, a network is provided which comprises:

p-0020a new node comprising node specific cryptographic keying material, wherein the new node is configured to specify a cryptographic key based on the node specific cryptographic keying material;

p-0021a first node requiring the cryptographic key for a network security initialization; and

p-0022means for providing a missing cryptographic key to the first node from a storage different to the new node, wherein the missing cryptographic key is equal to the cryptographic key.

p-0023As the missing cryptographic key is stored separately from the cryptographic key, there is no need to transfer the cryptographic key from the new node to the first node via a possibly insecure link between the new node and the first node. The link between the new node and the first node is considered insecure as long as the first node has not received the cryptographic key of the new node. Storing the missing cryptographic key separately from the cryptographic key allows the first node to receive the cryptographic key via a secure link. Despite the different storage location, the cryptographic key and the missing cryptographic key may be identical.

p-0024The cryptographic keying material may be stored in the new node before the new node is connected to the network. Thus, the cryptographic keying material can be stored in the new node while the new node is located in a secure environment which prevents an attacker to get knowledge of the cryptographic keying material during a transfer of the cryptographic keying material into the new node.

p-0025The new node may be configured to specify the cryptographic key after being connected to the network or after a reconfiguration of the network. In case that the new node is able to choose between a plurality of different cryptographic keys, the specification of the cryptographic key allows the new node to define which one of the possible cryptographic keys shall be used in the network.

p-0026A cryptographic function may be implemented in the new node and the new node may be configured to calculate the cryptographic key from the node specific cryptographic keying material using the cryptographic function. This allows the new node to calculate different cryptographic keys. This allows the new node to specify a new cryptographic key in case secrecy of a current cryptographic key can not be guaranteed any more.

p-0027The first node may be configured to detect a presence of the new node and may be configured to request the cryptographic key after having detected the presence of the new node. This allows a quick and automatic integration of the new node into the network.

p-0028The means for providing may comprise a user interface which allows a user to input the missing cryptographic key. This allows an uncomplicated and inexpensive providing of the missing cryptographic key. For example, the missing cryptographic key may be stored on a tamper-proof sticker which is provided to the user. The user may provide the missing cryptographic key from the tamper-proof sticker to the first node via the user interface. Accordingly, a sensor network key initialization may be performed in the network without requiring a secure server and corresponding network infrastructure

p-0029Alternatively, the storage may be a secure server comprising cryptographic keying material corresponding to the new node and the means for providing may be configured to download the missing cryptographic key from the secure server. This allows storing the missing cryptographic key in a secure place like a server being operated by a manufacturer of the new node.

p-0030The secure server may be configured to calculate the missing cryptographic key from the cryptographic keying material corresponding to the new node. In case the new node is capable of calculating different cryptographic keys, the secure server may calculate the same cryptographic keys based on the same cryptographic keying material.

p-0031The cryptographic keying material corresponding to the new node may be stored in the secure server before the new node is connected to the network. This allows storing the cryptographic keying material corresponding to the new node at a time an attention of an attacker is not evoked due to the connection of the new node into the network. For example, the cryptographic keying material corresponding to the new node may be stored in the secure server while the new node is manufactured.

p-0032The means for providing may comprise an authentification interface which allows a user to input authentification data being necessary for providing the missing cryptographic key. Thus, the missing cryptographic key may only be requested, calculated or provided after a user authentification. This prevents an attacker not having access to the authentification data to successfully perform a network key initialization.

p-0033The authenfication data may be specific to the new node. This prevents an attacker to use previous authenfication data to perform a network key initialization for the new node.

p-0034The new node may be capable of calculating different cryptographic keys each being characterized by a key index and the new node may be configured to provide a key index characterising the associated key to the first node and the first node may be configured to request the cryptographic key characterized by the key index after having received the key index. This allows the new node to declare which one of a plurality of different cryptographic keys is specified as the cryptographic keys. Further, the index allows the user or the secure server to provide the correct cryptographic key to the first node.

p-0035The network may be a wireless sensor network and the new node may be a sensor of the wireless sensor network. In particular, the network may be a ZigBee® based wireless sensor network such as a wireless sensor network lighting system, a wireless sensor network home monitoring and control system or a wireless sensor network personal healthcare and wellness system.

p-0036According to a further embodiment of the invention, a trust center suitable for a network security initialization is provided which comprises:

p-0037means for detecting a presence of a new node in the network, wherein the new node comprises an cryptographic key;

p-0038means for requesting the cryptographic key; and

p-0039means for receiving a missing cryptographic key from a device different to the new node, wherein the missing cryptographic key is equal to the cryptographic key.

p-0040The trust center may be used as the first node in an inventive network. Thus, the trust center allows a secure network key initialization when a new node is connected to the network or the network is reconfigured.

p-0041According to a further embodiment of the invention, a method for initializing a network key is provided which comprises the steps of:

p-0042specifing a cryptographic key by a new node of a network, based on a node specific cryptographic keying material;

p-0043requesting the cryptographic key by a first node of the network;

p-0044providing a missing cryptographic key to the first node from a storage different to the new node, wherein the missing cryptographic key is equal to the cryptographic key.

p-0045The method for initializing a network key can be advantageously performed in connection with an inventive network when a new node is connected to the network or the network is reconfigured.

p-0046According to an embodiment of the invention, a computer program may be provided, which is enabled to carry out the above method according to the invention when executed by a computer. This allows realizing the inventive approach in a compiler program.

p-0047According to a further embodiment of the invention, a record carrier storing a computer program according to the invention may be provided, for example a CD-ROM, a DVD, a memory card, a diskette, or a similar data carrier suitable to store the computer program for electronic access.

p-0048These and other aspects of the invention will be apparent from and elucidated with reference to the embodiments described hereinafter.

p-0049The invention will be described in more detail hereinafter with reference to exemplary embodiments. However, the invention is not limited to these exemplary embodiments.

p-0050<figref idrefs="DRAWINGS">FIG. 1</figref> shows a network according to the invention;

p-0051<figref idrefs="DRAWINGS">FIG. 2</figref> shows a further network according to the invention;

p-0052<figref idrefs="DRAWINGS">FIG. 3</figref> shows a further network according to the invention; and

p-0053<figref idrefs="DRAWINGS">FIG. 4</figref> shows a flow diagram of a method according to the invention.

p-0054In the following, functional similar or identical elements may have the same reference numerals.

p-0055<figref idrefs="DRAWINGS">FIGS. 1 and 2</figref> show similar networks according to different embodiments of the invention. According to the embodiment shown in <figref idrefs="DRAWINGS">FIG. 1</figref>, a missing cryptographic key may be provided to the network by a user via a user interface. According to the embodiment shown in <figref idrefs="DRAWINGS">FIG. 2</figref> the missing cryptographic key may be provided to the network by a secure server. <figref idrefs="DRAWINGS">FIG. 3</figref> depicts a key initialization in a network in which the missing cryptographic key is provided by a secure server as shown in <figref idrefs="DRAWINGS">FIG. 2</figref>.

p-0056<figref idrefs="DRAWINGS">FIG. 1</figref> shows a network according to an embodiment of the invention. The network comprises a first node <b>102</b>, a node <b>104</b>, a new node <b>106</b> and means for providing <b>108</b>. The nodes <b>102</b>, <b>104</b>, <b>106</b> and the means for providing <b>108</b> may be connected via a communication infrastructure and may comprise suitable communication means. The network may comprise further nodes.

p-0057The network may be a wireless sensor network like a ZigBee® based

p-0058WSN lighting system, a WSN home monitoring and control system or a WSN personal healthcare and wellness system. Accordingly, the nodes <b>102</b>, <b>104</b>, <b>106</b> may be sensors. The nodes <b>102</b>, <b>104</b>, <b>106</b> may comprise cryptographic keys. The first node <b>102</b> may be a trust center of the network. The trust center <b>102</b> may collect cryptographic keys belonging to the nodes <b>104</b>, <b>106</b> of the network. The cryptographic keys may be master keys required for establishing secure communication links within the network.

p-0059One of the services relying on the availability of the master keys is the establishment of trust center link keys by using the symmetric key key exchange (SKKE) protocol. The trust center link keys may be used for a secure exchange of a network key. Hence, without the secure initialization of cryptographic keys, being shared secrets or master keys, the secure exchange of a network key is not possible.

p-0060The new node <b>106</b> comprises node specific cryptographic keying material. The cryptographic keying material may be stored in the new node before the new node is connected to the network, for example during manufacture of the new node. According to an embodiment the node specific cryptographic keying material comprises one or more cryptographic keys which are assigned to and are specific to the new node <b>106</b>. According to an alternative embodiment, the cryptographic keying material may comprise cryptographic data which allows deriving one or more cryptographic keys which are assigned to and are specific to the new node <b>106</b>. For example, the cryptographic keying material may further comprise a cryptographic function allowing the new node to calculate one or more cryptographic keys from the cryptographic keying material by using the cryptographic function.

p-0061The new node <b>106</b> may specify its cryptographic key after being connected to the network or after a reconfiguration of the network. Depending on the type of the cryptographic keying material, the new node <b>106</b> may comprise means for selecting the cryptographic key from the cryptographic keying material or means for calculating the cryptographic key from the cryptographic keying material

p-0062The first node <b>102</b> may require the cryptographic keys of the node <b>104</b> and the node <b>106</b> for a network security initialization which may be necessary for a secure operation of the network. The first node <b>102</b> may comprise storage means for storing the cryptographic keys of the node <b>104</b> and the new node <b>106</b>. In case the first node <b>102</b> does not comprise a required cryptographic key of one of the nodes <b>104</b>, <b>106</b> connected to the network, the respective missing cryptographic key has to be made available for the first node <b>102</b>. The first node <b>102</b> may comprise means for requesting a missing cryptographic key and means for receiving the requested cryptographic key. The first node <b>102</b> may comprise means for detecting a presence of the new node <b>106</b> after its connection to the network which allows the first node <b>102</b> to request the missing cryptographic key immediately or soon after the connection of the new node <b>106</b> to the network.

p-0063The cryptographic key, for example the cryptographic key of the new node <b>106</b>, is additionally stored or deposited at a secure place, for example in a security device which is not the new node. The cryptographic key and the separately stored cryptographic key, referred to as the missing cryptographic key, form a pair of cryptographic keys. According to this embodiment, both cryptographic keys are identical. There may be cryptographic keys requiring a pair of different cryptographic keys.

p-0064The missing cryptographic key may be provided to the first node <b>102</b> via the means for providing <b>108</b>. According to this embodiment, a user of the network has access to the missing cryptographic key. In order to provide the missing cryptographic key to the first node <b>102</b>, the means for providing <b>108</b> may comprise a user interface which allows the user to input the missing cryptographic key. The means for providing <b>108</b> may be integrated in one of the network nodes, may be a special network node or may be a device connected to the network only for allowing the user to input the cryptographic key. According to this embodiment, the means for providing may be a computer connected to the network.

p-0065According to a further embodiment, the new node <b>106</b> is a sensor node of a wireless sensor network, the first node <b>102</b> is a trust center of the network and the means for providing <b>108</b> is a customer tool. The sensor node specific cryptographic key is stored on the sensor node <b>106</b> during manufacture. In addition, the sensor node specific cryptographic key is printed on a tamper-proof sticker that is provided with the sensor node <b>106</b> itself When the sensor node <b>106</b> is brought into the wireless sensor network, the trust center <b>102</b> initializes a procedure requesting the master key of the sensor node <b>106</b>. In this case, using a network infrastructure and the customer tool <b>108</b>, a window may pop up at the customer tool <b>108</b> requesting the sensor node specific cryptographic key from the user. The user may break the tamper-proof sticker and may enter the sensor node specific cryptographic key which is then stored on the trust center <b>102</b>. When the association procedure is successfully finished, the user may be notified. The solution described in the embodiments is well suited not only for

p-0066ZigBee® based wireless sensor networks but for all networks and specifically for all wireless sensor networks relying on a trust center and shared secrets.

p-0067<figref idrefs="DRAWINGS">FIG. 2</figref> shows a network according to a further embodiment of the invention. The network corresponds to the network described in <figref idrefs="DRAWINGS">FIG. 1</figref>. In difference to the network described in <figref idrefs="DRAWINGS">FIG. 1</figref>, the missing cryptographic key is not provided via a user interface of the means for providing <b>108</b> but from a secure server <b>210</b>.

p-0068The secure server <b>210</b> may comprise cryptographic keying material corresponding to the cryptographic keying material of the nodes <b>104</b>, <b>106</b> of the network. According to this embodiment, the secure server <b>210</b>, in particular, comprises cryptographic keying material corresponding to the new node <b>106</b>. The cryptographic keying material may be stored in the secure server before the new node is connected to the network. The secure server <b>210</b> may be configured to calculate the missing cryptographic key, for example the missing cryptographic key corresponding to the new node <b>106</b>, from the cryptographic keying material corresponding in order to provide the missing cryptographic key. The secure server <b>210</b> may be configured to provide the missing cryptographic key via the means for providing <b>108</b> to the first node <b>102</b>. For example, the means for providing <b>108</b> may be configured to download the missing key from the secure server <b>210</b>. Alternatively, the secure server <b>210</b> may provide the missing cryptographic key directly to the first node <b>102</b>.

p-0069The means for providing <b>108</b> may comprise an authentification interface which allows a user to input authentification data which may be necessary for providing the missing cryptographic key. The authenfication data may be specific to the node whose cryptographic key is requested from the secure server <b>210</b>.

p-0070According to a further embodiment the network is a, e.g. ZigBee® based, wireless sensor network. The new node <b>106</b> is a sensor node <b>106</b> to be securely brought into the wireless sensor network. The first node <b>102</b> is another node of the wireless sensor network acting as a coordinator and trust center of the wireless sensor network. The network further comprises a sensor node infrastructure, i.e. an interface the sensor node <b>102</b> acting as coordinator is attached to. Further, the wireless sensor network comprises the secure server <b>210</b>. The means for providing <b>108</b> is a customer tool. The customer tool <b>108</b> may be a device capable to run a small application program, such as a workstation, a laptop, or the like, and to connect to a network infrastructure. The network infrastructure may enable the user to connect to the secure server <b>210</b>. The network may further comprise protocols for the communication between the customer tool <b>108</b> and the sensor node <b>102</b> acting as a coordinator, user authentication material and a tamper-proof device, e.g. a tamper-proof sticker.

p-0071An initialization of cryptographic keys for the network may include that, during manufacture of the sensor node <b>106</b>, sensor node specific cryptographic keying material, being secret, is stored in a memory of the sensor node <b>106</b>. Additionally, a cryptographic function is implemented on the sensor node <b>106</b>.

p-0072The same cryptographic keying material and a cryptographic function are stored and implemented, respectively, on the secure server <b>210</b>.

p-0073User authentication material is generated for every sensor node <b>104</b>, <b>106</b> and provided in a tamper-proof manner with the corresponding sensor node <b>104</b>, <b>106</b>.

p-0074When the new sensor node <b>106</b> is brought into the wireless sensor network for secure association, the sensor node <b>106</b> calculates a cryptographic key from its sensor node specific cryptographic keying material using the cryptographic function. A coordinator which is also the trust center <b>102</b> of the network realizes the presence of this new sensor node <b>106</b> and searches for the master key, being a shared secret, of the new sensor node <b>106</b> in its database. Since the sensor node <b>106</b> is new, no entry is found. Consequently, the coordinator <b>102</b> initializes an association procedure using the interface to the infrastructure. Automatically, the user is notified by the customer tool <b>108</b>, a connection is established to the secure server <b>210</b> and user authentication is requested. Upon user authentication using the authentication material, the system firstly logs information about the key download procedure, like date, time, IP address and displays the corresponding information of the last login, thus allowing the user to detect security breaks. Due to the tamper-proof manner the authentication material is provided, the user can easily detect a security break. Then, the cryptographic key for the respective sensor node <b>106</b> is calculated using the sensor node specific cryptographic keying material and the cryptographic function stored on the secure server <b>210</b>. Then, the calculated key is downloaded to the customer tool <b>108</b> and to the trust center <b>102</b> connected to the customer tool.

p-0075When the secure association has successfully been finished, an acknowledgement message is displayed on the infrastructure to notify the user.

p-0076If the network is reconfigured or when the sensor node is brought into a new network, the node <b>106</b> notices that a new trust center <b>102</b> tries to securely associate with it, and initializes a key change procedure. Using the cryptographic function, the new cryptographic key is calculated. Furthermore, a counter is used to indicate the number of key changes. Now, the senor node <b>106</b> transmits its identifier and the counter value to the trust center <b>102</b> that, since the node <b>106</b> is new to it, and thus it does not share a master key with it, initializes an initialization procedure as described. A connection to the secure server <b>210</b> is established upon user authentication. The counter value is also transmitted to the server <b>210</b> such that it can calculate the same cryptographic key and transmit it to the customer tool <b>108</b> of the user, and then to the trust center <b>102</b> of the new network. The secure association procedure is finished and the user is notified.

p-0077<figref idrefs="DRAWINGS">FIG. 3</figref> depicts a key initialization in a network comprising a trust center <b>102</b>, a sensor node <b>106</b> and a secure server <b>210</b>, according to a further embodiment of the invention. The network may be the network shown in <figref idrefs="DRAWINGS">FIG. 2</figref>.

p-0078The key initialization uses the secure server <b>210</b> and the trust center <b>102</b>. The sensor node <b>106</b> may be capable of calculating different cryptographic keys. Each cryptographic key may be characterized by a key index. In case the sensor node <b>106</b> specifies a new cryptographic key, the sensor node <b>106</b> may provide the key index to the trust center <b>102</b>. The trust center <b>102</b> may request the cryptographic key characterized by the key index after having received the key index.

p-0079<figref idrefs="DRAWINGS">FIG. 3</figref> depicts a communication between the sensor node <b>106</b> shown as Node A and the trust center <b>102</b>, as well as a communication between the trust center <b>102</b> and the secure server <b>210</b>.

p-0080In a first step the sensor node <b>106</b> calculates its association key from its sensor node specific keying material. In a second step the sensor node <b>106</b> transmits an index i of its association key to the trust center <b>102</b>. In a third step the trust center <b>102</b> requests the association key for the sensor node <b>106</b> with index i from the secure server <b>210</b>. In a fourth step, the secure server calculates the corresponding association key upon authentication and transmits it to the trust center <b>102</b>. In a fifth step the trust center <b>102</b> receives the association key. In a six step the trust center <b>102</b> and the sensor node <b>106</b> launch a mutual authentication protocol.

p-0081In <figref idrefs="DRAWINGS">FIG. 3</figref>, KA,i denotes the cryptographic key used as a master key, i.e.

p-0082the shared secret common to the sensor node <b>106</b> and the trust center <b>102</b>. The sensor node specific cryptographic keying material is called KNode A, which represents the keying material that is exclusively stored on the sensor node <b>106</b> itself and the secure server. Furthermore, h(KNode A∥i) represents a cryptographic function having the master keying material and an index i as input.

p-0083<figref idrefs="DRAWINGS">FIG. 4</figref> shows a flow diagram of a method for initializing a network key according to an embodiment of the invention. The method may be used for a network according to embodiments of the invention.

p-0084The method assumes that during a manufacturing process of a sensor node, a sensor node specific cryptographic key is stored on a secure server and coded into the memory of the sensor node. In addition, a cryptographic function, like a hash function, is implemented on the sensor node and the secure server, respectively.

p-0085In a first step <b>422</b>, the sensor node specifies a cryptographic key. In particular, when the new sensor node is brought into the network, the new sensor node calculates the cryptographic key using its sensor node specific cryptographic key and the cryptographic function.

p-0086In a second step <b>424</b>, a trust center requests the cryptographic key. In particular, the trust center associated to the network notices the presence of the sensor node and starts an automated initialization protocol. It connects to a secure server, e.g. via the internet, of the sensor node provider and requests the current key assigned to the node.

p-0087In a third step <b>426</b>, a missing cryptographic key is provided to the first node from a storage place different to the new sensor node. In particular, upon user authentication the secure server calculates the requested key and transmits it to the trust center that uses the shared secret for node association. For user authentication, the node comes, for instance, with login and password or personal identification number (PIN).

p-0088The proposed system also supports secure association in the case of a network reconfiguration or if the sensor node is brought into another network. To this end, the node calculates a new cryptographic key using its sensor node specific cryptographic key and the cryptographic function. Then, the node notifies the trust center of the change in its association message. The trust center requests the cryptographic key of this node from the secure server that calculates this key upon user authentication. Then, the key is transmitted to the trust center that uses it to associate or re-associate the node.

p-0089The use of the presented solutions for initialization of cryptographic keys in a network benefits from several features.

p-0090First, a sensor node specific cryptographic keying material used to calculate the master key may be stored on the corresponding sensor node during manufacture. Furthermore, a cryptographic function may be implemented on the sensor node.

p-0091The same sensor node specific cryptographic keying material used to calculate the master key may be stored on a secure server of the sensor node provider. Furthermore, a cryptographic function may be implemented on the secure server.

p-0092User authentication material, e.g., login and password or PIN, may be produced for the corresponding sensor node during manufacture. This material may be provided on a tamper-proof device, e.g., a tamper-proof sticker.

p-0093Further, an automatic protocol may support the user to securely bring a new sensor node into the network, i.e. to securely set up the shared secret. A secure connection to the server of the sensor node provider may be established upon user authentication and the cryptographic key may be transmitted in return. Furthermore, this process may be logged. Information about it, like date, time, IP address, or the like may be stored, and the corresponding information about previous key downloads may be displayed before a new key download. This allows the user to detect security breaks.

p-0094The user may need to perform the described procedure, i.e. user authentication, only once for each new sensor node.

p-0095Further, the sensor node and user authentication material can be distributed together. There is no need for additional mechanisms or procedures which makes the solution especially suited for commercial products.

p-0096The network can be reconfigured and the sensor node can be brought into a new network, respectively, without disclosure of previous symmetric cryptographic keys. Thus protecting all networks the node has been associated to.

p-0097In other words, an embodiment of the present invention offers an easy to use secure initialization of cryptographic keys in a wireless sensor network which may be used for a ZigBee® wireless sensor network security initialization. Sensor node specific cryptographic keying material used to calculate a master key is stored on a sensor node during manufacture. The same is stored on a secure server of the sensor node provider. Further a cryptographic function is implemented on the sensor node and also on the secure server. User authentication material, for example login and password or the PIN is produced for the corresponding sensor node during manufacture and is provided on a tamperproof device, such as a sticker. An automatic protocol supports the user for setup by a secure connection to the server of the sensor provider. Upon a one time user authentication the cryptographic key is transmitted in return. Further, this process is logged. Information, like date, time, IP address or the like is stored and the corresponding information about the previous key downloads is displayed before a new key download, allowing the user to detect security breaks. The network can be reconfigured and the sensor node can be brought into a new network, without disclosure of previous symmetric cryptographic keys, thus protecting all networks the node has been associated to. The key initialization may use the secure server and the trust center. An alternative approach does not require a secure server and the corresponding network infrastructure. When the sensor node is brought into the network, the trust centre initializes a procedure requesting the master key of the sensor node. The user breaks the tamper proof sticker and enters the key that is then stored on the trust center. The association completes the procedure and the user is notified.

p-0098The described embodiments may be combined. The invention is not limited to the shown networks. The inventive approach may be used in any network which requires a key initialization. The nodes may be any network nodes. The network nodes may comprise any means required by the network functionality, for example communication units or processing units.

p-0099At least some of the functionality of the invention may be performed by hard- or software. In case of an implementation in software, a single or multiple standard microprocessors or microcontrollers may be used to process a single or multiple algorithms implementing the invention.

p-0100It should be noted that the word “comprise” does not exclude other elements or steps, and that the word “a” or “an” does not exclude a plurality. Furthermore, any reference signs in the claims shall not be construed as limiting the scope of the invention.