Access Authorization Method And Apparatus For A Wireless Sensor Network

• US 20110084800A1
• Filed: 01/06/2010
• Published: 04/14/2011
• Est. Priority Date: 10/14/2009
• Status: Active Grant

• Current Assignee: Carnegie Mellon University, Industrial Technology Research Institute
• Original Assignee: Carnegie Mellon University, Industrial Technology Research Institute
• Inventors: Lee, Hayan, Gligor, Virgil D., Ko, Lee-Chun
• Granted Patent: US 8,461,963 B2
• Time in Patent Office: Days
• US Class Current: 340/5.74
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

An access authorization method and apparatus for a wireless sensor network comprises at least a base station and a wireless sensor network formed by a plurality of sensor nodes. After having obtained an access authorization of a user, the at least a base station issues a request message to a target sensor node in the wireless sensor network. The target sensor node requests at least a controlling node in the wireless sensor network for sensing data sensed by the at least a controlling node, and checks if the sensing data meets the requirements of the access authorization of the user. Whether the target sensor node responds with the required multimedia or not is based on the checking result.

Claims

1. An access authorization apparatus for wireless sensor network, comprising:

at least a base station; and

a wireless sensor network formed by a plurality of sensor nodes;

wherein said at least a base station obtains an access authorization of a user, issues a request message to a target sensor node in said wireless sensor network, said target sensor node requests at least a controlling node in said wireless sensor network for sensing data sensed by said at least a controlling node, and refers to said sensing data returned by said at least a controlling node to check if said sensing data meets said access authorization of said user, and whether said target sensor node responses with multimedia matching said access authorization is based on the checking result.

2. The apparatus as claimed in claim 1, wherein said at least a controlling node is a wireless sensor node in said wireless sensor network, and provides at least a type of sensing data of physical environment information for returning to said target sensor node.

3. The apparatus as claimed in claim 1, wherein said request message further includes an authentication information, said authentication information is provided to each of intermediate routing nodes between said at least a base station and said target sensor node for using as a parameter in future authenticating reply message.

4. The apparatus as claimed in claim 1, wherein said base station further includes:

a first communication interface and a second communication interface;

a storage unit for storing data; and

a central processing unit (CPU) that transmits said access authorization through said second communication interface to said target sensor node and transmits multimedia data returned by said target sensor node through said first communication interface to a server.

5. The apparatus as claimed in claim 1, wherein each of said at least a controlling node further includes:

at least a sensor that senses at least a type of physical environment information;

a third communication interface that communicates between said base station and said target sensor node; and

a second CPU that instructs said at least a sensor to sense and returns sensing data of said at least a sensor through said third communication interface.

6. The apparatus as claimed in claim 1, wherein said target sensor node further includes:

at least a sensor that captures said multimedia;

a fourth communication interface that communicates between said base station and said at least a controlling node; and

a third CPU, based on said request, that requests said at least a controlling node for sensing data through said fourth communication interface and, based on said sensing data, determines whether to return said multimedia data.

7. The apparatus as claimed in claim 1, wherein said request message further includes authentication information for at least an intermediate routing node between said at least a base station and said target sensor node to use in future authenticating reply message from said target sensor node.

8. The apparatus as claimed in claim 1, wherein said at least a controlling node executes a node-movement detection protocol to determine whether said controlling node has been moved, and uses as a basis to determine whether to return said sensing data.

9. The apparatus as claimed in claim 1, wherein said target sensor node executes a node-movement detection protocol to determine whether said target sensor node has been moved, and uses as a basis to determine whether to return a reply message.

10. The apparatus as claimed in claim 1, wherein said wireless sensor network is a multi-mode wireless sensor network.

11. The apparatus as claimed in claim 1, wherein a plurality of controlling nodes exists in a same region as said target sensor node to provide sensing data to said target sensor node for performing determination of said access authorization of said user, and said same region of said target sensor node represents a region that said target sensor node can communicate with other sensor nodes.

12. An access authorization method for wireless sensor network, said method comprising:

obtaining an access authorization of a user through at least a base station;

selecting at least a controlling node from a plurality of sensor nodes in a wireless sensor network, and selecting at least an intermediate routing node from said at least a base station to a target sensor node;

issuing a request message to said target sensor node through said at least a base station, said request at least having authentication information;

based on said request, said target sensor node requesting said selected at least a controlling node for returning sensing data, and referring to said returned sensing data to determine whether meeting said access authorization of said user, and issuing a corresponding reply message;

based on said authentication information, said at least an intermediate routing node checking said reply message to determine whether to discard or to transfer said reply message; and

authenticating said transferred reply message through said at least a base station.

13. The method as claimed in claim 12, wherein said at least a controlling node is either randomly selected or fixedly selected.

14. The method as claimed in claim 12, wherein a plurality of intermediate routing nodes exists between said at least a base station and said target sensor node, and said at least an intermediate routing nodes are either randomly selected or fixedly selected from said plurality of intermediate routing nodes.

15. The method as claimed in claim 12, said method uses a plurality of neighbor nodes of a node to inform said node whether said node has been moved, wherein said node is either a controlling node or said target sensor node.

16. The method as claimed in claim 12, wherein for a type of sensing data, said method refers to sensing data returned by said at least a controlling node, and computes statistics of said returned sensing data to determine whether matching said access authorization of said user.

17. The method as claimed in claim 12, wherein said request message further includes identity of said request message, an authentication parameter, encrypted access authorization of said user, a random number, sensing data type and computation method of said selected at least a controlling node, and identity and valid range of said sensing data of said selected at least a controlling node.

18. The method as claimed in claim 17, wherein said authentication parameter is provided to said at least an intermediate routing node for use as a parameter in future reply message.

19. The method as claimed in claim 17, wherein when said request message is sent, each of said at least an intermediate routing node stores identity of said request and said authentication parameter and routes said request message to next node.

20. The method as claimed in claim 17, wherein when said target sensor node receives said request message, said target sensor node decrypts to extract access said authorization of said user and determines whether said target sensor node has been moved.

21. The method as claimed in claim 12, wherein when said at least a controlling node receives said request message from said target sensor node, said at least a controlling node determines whether said at least a controlling node has been moved;

if moved, notifying said base node that said at least a controlling node has been moved;

otherwise, returning said sensing data.

22. The method as claimed in claim 19, wherein after said target sensor node receives said sensing data returned by said at least a controlling node, said target sensor node and said at least a controlling node execute following steps of:

said target sensor node computing statistics of said returned sensing data to determine whether matching said access authorization of said user;

if matching, said target sensor node returning encrypted multimedia data to each of said at least a controlling node;

each of said at least a controlling node, upon receiving said encrypted multimedia data, using a corresponding encrypted parameter and a corresponding message authentication code (MAC) to respond to said target sensor node; and

said target sensor node decrypting said encrypted parameter and computing said authentication information of said request message and a multi-mode MAC.

23. The method as claimed in claim 22, wherein said target sensor node returns a reply message to said at least a controlling node, said reply message further includes at least identity of said request, said authentication information, said encrypted multimedia data, said multi-mode MAC, and identity and returned sensing data of each of said at least a controlling node.

24. The method as claimed in claim 19, wherein during the process of returning said reply message, each of said at least an intermediate routing node authenticates, based on said identity of said request message, an encrypted authentication information whether equaling to said authentication parameter;

if not, discarding said reply message;

otherwise, routing said reply message to next node.

25. The method as claimed in claim 22, wherein said at least a base station authenticates an encrypted authentication information whether equaling to said authentication parameter, authenticates sensing data returned by said at least a controlling node whether matching said access authorization of said user and valid range of said sensing data, and authenticates whether said multi-mode MAC is correct;

if all above three are correct, then returns said decrypted multimedia data to provide to said user.