Access authorization method and apparatus for a wireless sensor network

• US 8,461,963 B2
• Filed: 01/06/2010
• Issued: 06/11/2013
• Est. Priority Date: 10/14/2009
• Status: Active Grant

• Current Assignee: Carnegie Mellon University, Industrial Technology Research Institute
• Original Assignee: Carnegie Mellon University, Industrial Technology Research Institute
• Inventors: Ko, Lee-Chun, Gligor, Virgil D., Lee, Hayan
• Primary Examiner(s): Mehmood, Jennifer
• Assistant Examiner(s): POINT, RUFUS C
• Application Number:
  US12/652,743
• Publication Number:
  US 20110084800A1
• Time in Patent Office: 1,252 Days
• Field of Search: 340/539.2, 340/5.74, 340/7.2, 709/224, 709/223, 455/410, 370/220, 370/313
• US Class Current: 340/7.2
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

An access authorization method and apparatus for a wireless sensor network comprises at least a base station and a wireless sensor network formed by a plurality of sensor nodes. After having obtained an access authorization of a user, the at least a base station issues a request message to a target sensor node in the wireless sensor network. The target sensor node requests at least a controlling node in the wireless sensor network for sensing data sensed by the at least a controlling node, and checks if the sensing data meets the requirements of the access authorization of the user. Whether the target sensor node responds with the required multimedia or not is based on the checking result.

Claims

1. An access authorization apparatus for a wireless sensor network, comprising:

a wireless sensor network formed by a plurality of sensor nodes, each of said sensor nodes collecting sensing data and multimedia data; and

at least a base station for receiving a request of an access authorization from a user for accessing multimedia data based on sensing data requirements;

wherein said at least a base station issues a request message to a target sensor node selected from said sensor nodes, and said target sensor node requests at least a controlling node selected from said sensor nodes for said sensing data sensed by said at least a controlling node, and refers to the sensing data returned by said at least a controlling node to check if the sensing data returned meet said sensing data requirements, and returns said multimedia data collected by said target sensor node to said at least a base station if the sensing data returned meet said sensing data requirements.

2. The apparatus as claimed in claim 1, wherein said at least a controlling node is a wireless sensor node in said wireless sensor network, and provides at least a type of sensing data of physical environment information for returning to said target sensor node.

3. The apparatus as claimed in claim 1, wherein said request message further includes authentication information, said authentication information is provided to each of intermediate routing nodes between said at least a base station and said target sensor node for using as a parameter in a future authentication reply message.

4. The apparatus as claimed in claim 1, wherein said at least a base station further includes:

a first communication interface and a second communication interface;

a storage unit for storing data; and

a central processing unit (CPU) that transmits said access authorization through said second communication interface to said target sensor node and transmits the multimedia data returned by said target sensor node through said first communication interface to a server.

5. The apparatus as claimed in claim 1, wherein each of said at least a controlling node further includes:

at least a sensor that senses at least a type of physical environment information;

a communication interface that communicates with said at least a base station and said target sensor node; and

a central processing unit (CPU) that instructs said at least a sensor to sense said sensing data and returns said sensing data of said at least a sensor through said communication interface.

6. The apparatus as claimed in claim 1, wherein said target sensor node further includes:

at least a sensor that captures said multimedia data;

a communication interface that communicates with said at least a base station and said at least a controlling node; and

a central processing unit (CPU), based on said request message to request said at least a controlling node for sensing data through said communication interface, and based on the sensing data returned to determine whether to return said multimedia data to said at least a base station.

7. The apparatus as claimed in claim 1, wherein said at least a controlling node executes a node-movement detection protocol to check and base on whether said at least a controlling node has been moved to determine whether to return said sensing data.

8. The apparatus as claimed in claim 1, wherein said target sensor node executes a node-movement detection protocol to check and base on whether said target sensor node has been moved to determine whether to return a reply message.

9. The apparatus as claimed in claim 1, wherein said wireless sensor network is a multi-mode wireless sensor network.

10. The apparatus as claimed in claim 1, wherein a plurality of controlling nodes exists in a same region as said target sensor node to provide sensing data to said target sensor node for performing determination of said access authorization of said user, and said same region of said target sensor node represents a region that said target sensor node can communicate with other sensor nodes.

11. An access authorization method for a wireless sensor network, said method comprising the steps of:

receiving a request of an access authorization from a user through at least a base station for accessing multimedia data based on sensing data requirements;

selecting a target sensor node and at least a controlling node from a plurality of sensor nodes in said wireless sensor network, each of said sensor nodes collecting sensing data and multimedia data;

issuing a request message to said target sensor node from said at least a base station, said request message at least having authentication information;

requesting said at least a controlling node for said sensing data collected by said at least a controlling node from said target sensor node based on said request message, and referring to the sensing data returned by said at least a controlling node to determine whether the sensing data returned meet said sensing data requirements; and

returning said multimedia data collected by said target sensor node to said at least a base station if said sensing data returned meet said sensing data requirements.

12. The method as claimed in claim 11, wherein said at least a controlling node is either randomly selected or fixedly selected.

13. The method as claimed in claim 11, wherein said method uses a plurality of neighbor nodes of a node to inform said node whether said node has been moved, wherein said node is either a controlling node or said target sensor node.

14. The method as claimed in claim 11, wherein for a type of sensing data, said method refers to the sensing data returned by said at least a controlling node, and computes statistics of the returned sensing data to determine whether the returned sensing data meet said sensing data requirements.

15. The method as claimed in claim 11, wherein said request message further includes an identity of said request message, an authentication parameter, encrypted access authorization of said user, a random number, a sensing data type and a computation method of said sensing data, and an identity and a valid range of said sensing data.

16. The method as claimed in claim 15, wherein said authentication parameter is provided to at least an intermediate routing node for use as a parameter in a future reply message.

17. The method as claimed in claim 16, wherein when said request message is sent, each of said at least an intermediate routing node stores the identity of said request message and said authentication parameter and routes said request message to a next node.

18. The method as claimed in claim 11, wherein when said target sensor node receives said request message, said target sensor node decrypts said request message to extract said access authorization of said user and determines whether said target sensor node has been moved.

19. The method as claimed in claim 11, wherein when said at least a controlling node receives a request for sensing data from said target sensor node, said at least a controlling node determines whether said at least a controlling node has been moved, notifies said at least a base station that said at least a controlling node has been moved if said at least a controlling node has been moved, and returns said sensing data to said target sensor node if said at least a controlling node has not been moved.

20. The method as claimed in claim 11, wherein after said target sensor node receives the sensing data returned by said at least a controlling node, said target sensor node and said at least a controlling node execute the following steps of:

computing statistics of the returned sensing data in said target sensor node to determine whether the returned sensing data meet said sensing data requirements;

returning a reply message with encrypted multimedia data of said target sensor node from said target sensor node to each of said at least a controlling node if the returned sensing data meet said sensing data requirements;

upon receiving said encrypted multimedia data, using a corresponding encrypted parameter and a corresponding message authentication code (MAC) to respond to said target sensor node from each of said at least a controlling node; and

decrypting said encrypted parameter and computing said authentication information of said request message and a multi-mode MAC in said target sensor node.

21. The method as claimed in claim 20, wherein said target sensor node returns a reply message to said at least a controlling node, said reply message further includes at least an identity of said request message, said authentication information, said multi-mode MAC, and an identity and the returned sensing data of each of said at least a controlling node.

22. The method as claimed in claim 20, wherein said at least a base station authenticates encrypted authentication information to determine whether an authentication parameter, said access authorization of said user, a valid range of said sensing data, and said multi-mode MAC are all correct before returning decrypted multimedia data for said user.

23. The method as claimed in claim 11, further comprising the steps of:

selecting at least an intermediate routing node between said at least a base station and said target sensor node, and issuing a reply message from said target sensor node to said at least an intermediate routing node;

receiving said reply message at said at least an intermediate routing node, and checking said reply message based on said authentication information to determine whether to discard or to transfer said reply message; and

authenticating the transferred reply message through said at least a base station.

24. The method as claimed in claim 23, wherein a plurality of intermediate routing nodes exists between said at least a base station and said target sensor node, and said at least an intermediate routing node is either randomly selected or fixedly selected from said plurality of intermediate routing nodes.

25. The method as claimed in claim 23, wherein said at least an intermediate routing node authenticates encrypted authentication information based on an identity and an authentication parameter of said request message to determine whether to discard or to transfer said reply message.