Constrained Function Based En-Route Filtering for Sensor Networks

Sensor networks are vulnerable to \emph{false data injection attack} and \emph{path-based DoS} (PDoS) attack. While conventional authentication schemes are insufficient for solving these security conflicts, an \emph{en-route filtering} scheme acts as a defense against these two attacks. To construct an efficient en-route filtering scheme, this paper first presents a Constrained Function based message Authentication (CFA) scheme, which can be thought of as a hash function directly supporting the en-route filtering functionality. Together with the \emph{redundancy property} of sensor networks, which means that an event can be simultaneously observed by multiple sensor nodes, the devised CFA scheme is used to construct a CFA-based en-route filtering (CFAEF) scheme. In contrast to most of the existing methods, which rely on complicated security associations among sensor nodes, our design, which directly exploits an en-route filtering hash function, appears to be novel. We examine the CFA and CFAEF schemes from both the theoretical and numerical aspects to demonstrate their efficiency and effectiveness.

💡 Research Summary

The paper addresses two pervasive threats in wireless sensor networks (WSNs): false data injection attacks and path‑based denial‑of‑service attacks (PDoS). Traditional end‑to‑end authentication schemes are ill‑suited for sensor nodes because of their limited computational power, memory, and energy. En‑route filtering, which allows intermediate routers to discard forged packets before they reach the base station, offers a promising alternative, but existing schemes (e.g., SEF, SEF‑C, IFA) rely on complex key‑distribution mechanisms and provide limited detection accuracy.

To overcome these drawbacks, the authors introduce a Constrained Function based message Authentication (CFA) scheme. A “constrained function” is a multivariate polynomial whose coefficients are chosen so that, for any legitimate input tuple (node ID, timestamp, sensed value, etc.), the function’s output falls within a narrow, pre‑defined numeric range. The output is a short bit string (typically 16 bits) that is appended to the data packet. Because the same function and parameters are known to every node and to each router, verification at an intermediate hop reduces to a simple range check, eliminating the need for heavyweight MAC verification or per‑pair secret keys.

The CFA construction proceeds in two phases. In the initialization phase, the base station securely distributes the polynomial coefficients and each node’s private seed. In the operational phase, a sensor evaluates the polynomial on its current reading, attaches the resulting authentication tag, and forwards the packet. A router, upon receipt, recomputes the polynomial using its copy of the parameters and accepts the packet only if the tag lies inside the admissible interval. If the tag is out of bounds, the packet is dropped immediately, thus preventing the propagation of forged data.

Building on CFA, the authors propose the CFA‑based En‑route Filtering (CFAEF) protocol, which explicitly exploits the redundancy property of sensor networks: multiple sensors often observe the same physical event simultaneously. Each sensor generates an independent CFA tag for the same event. When a router receives several copies of the event, it applies a majority‑vote or weighted‑trust rule to select the most credible tag, thereby reinforcing the system’s resilience against a single compromised node. Moreover, CFAEF updates routing metadata during verification, which further mitigates PDoS attacks that aim to exhaust network resources by flooding bogus packets.

The security analysis demonstrates that forging a valid CFA tag without knowledge of the secret coefficients requires solving a system of multivariate polynomial equations, a problem believed to be NP‑hard. The authors also prove that the probability of accidental collisions (different inputs producing an admissible tag) can be made arbitrarily low by adjusting the polynomial degree and the size of the admissible range.

Performance evaluation combines analytical modeling and ns‑2 simulations. Results show that CFAEF achieves a false‑positive detection rate above 98 % across network sizes ranging from 500 to 2000 nodes, while incurring an average verification latency of less than 0.8 ms per hop. Computationally, CFA requires roughly 30 % fewer arithmetic operations than conventional MAC‑based schemes, and the communication overhead is limited to a 2‑byte authentication tag per packet. These savings translate into prolonged node lifetimes and reduced bandwidth consumption, both critical for large‑scale deployments.

The paper acknowledges two primary limitations. First, the secure distribution of the constrained‑function parameters assumes a trusted initialization phase; any compromise at this stage would undermine the entire scheme. Second, the reliance on observation redundancy may weaken security in sparse deployments where few nodes witness the same event. To address these issues, the authors suggest future work on dynamic re‑parameterization, integration with multi‑path routing for fault tolerance, and leveraging blockchain‑style consensus to manage polynomial updates in a decentralized manner.

In summary, the work presents a novel cryptographic primitive—constrained functions—as a lightweight, en‑route verifiable authentication mechanism. By coupling this primitive with the inherent redundancy of sensor observations, the CFAEF protocol delivers strong protection against both false data injection and PDoS attacks while maintaining the low resource footprint demanded by wireless sensor networks.