Privacy-preserving Top-K Query in Two-tiered Wireless Sensor Networks

Transcription

1 Prvacy-preservng Top-K Query n Two-ered Wreless Sensor Neworks 1,2 Yongle Yao, 1,2 L Ma, 1,2 Jnga Lu 1 Jangsu Engneerng Cener o Nework Monorng, Nanjng Unversy o Inormaon Scence & Technology, Nanjng, Chna 2 School o Compuer and Soware, Nanjng Unversy o Inormaon Scence & Technology, Nanjng, Chna {ylyao, mal, jlu}@nus.edu.cn Absrac In a wo-ered wreless sensor nework, sorage nodes ac as an nermedae er beween sensors and he snk or sorng daa and processng queres. Ths archecure has been wdely adoped because o he benes o power and sorage savng or sensors as well as he ecency o query processng. On he oher hand, he mporance o sorage nodes also makes hem aracve arges or compromse. A compromsed sorage node may leak sensve normaon and breach daa prvacy. In hs paper, we propose a prvacy-preservng proocol specalzng or op-k queres ha prevens aackers rom ganng sensve normaon rom sensor colleced daa. To preserve prvacy, an orderpreservng encrypon s employed o encryp sensor daa such ha a sorage node can correcly process op-k queres over encryped daa whou knowng her acual values. Dealed heorecal and quanave resuls conrm he hgh ecacy and ecency o he proposed scheme. 1. Inroducon Keywords: Two-ered WSNs, Sorage node, Prvacy, Top-k query Wreless sensor neworks (WSNs) have been deployed or varous applcaons such as mlary arge rackng, envronmen sensng, and healh monorng, ec.. In hs paper, we consder a woered sensor nework archecure [1], as shown n Fg. 1. The lower er comprses a large number o resource-consraned sensor nodes, whle he upper er conans ewer relavely resource-rch sorage nodes. Sensor nodes are manly responsble or sensng asks, whle sorage nodes gaher daa rom nearby sensor nodes, sore he daa and answer queres rom he snk o he nework. The ncluson o sorage nodes n hs wo-ered archecure brngs hree man benes. Frs, sensors save power by sendng colleced daa o her closes sorage node nsead o sendng hem o he long-roued snk. Second, sensors can be memory lmed because daa are manly sored on sorage nodes. Thrd, query processng becomes more ecen because he snk only communcaes wh sorage nodes or queres. Fgure 1. A wo-ered sensor archecure However, he ncluson o and relance on sorage nodes or daa sorage and query processng also brngs serous secury challenges. A compromsed sorage node mposes sgncan hreas o a sensor Inernaonal Journal o Advancemens n Compung Technology(IJACT) Volume4, Number6, Aprl 2012 do: /jac.vol4.ssue

2 nework. For example, a compromsed sorage node n a healh monorng WSN may leak normaon abou people o an unauhorzed pary and breach daa prvacy. Query processng becomes problemac end-o-end prvacy beween sensors and he snk s requred. A WSN may need o suppor many ypes o daa queres, and secure query processng n wo-ered sensor neworks has receved aenon only recenly. Prvacy-preservng range queres [4,5,6] have been well addressed. However, remans an open challenge o proec prvacy o oher mporan ypes o daa queres commonly seen n sensor neworks, e.g., op-k queres [8]. A op-k query asks or daa ems whose numerc arbues are among he k hghes. An example s Reurn he paen daa whose blood pressure s among he 5 hghes beween 4pm and 5pm. Provdng prvacy proecon or op-k queres n a wo-ered sensor nework s a challengng ask. Answerng any op-k query requres global normaon o all he daa generaed n he query regon. However, he only eny wh access o such normaon s he maser node, whch mgh have been compromsed and wll leak sensve normaon. In hs paper, we propose a novel prvacy-preservng op-k query proocol or wo-ered sensor neworks. The basc buldng block o our prvacy preservng scheme s an order preservng encrypon scheme, named OPES[9], whch was proposed by Agrawal, e al. or daabase encrypon. To preserve prvacy, daa colleced by sensors are encryped by OPES, such ha a sorage node can correcly process op-k queres,.e., compare encryped daa, whou knowng her acual values. An aacker can oban sensve daa sored n he sorage node, even he sorage node s compromsed. Fnally, we evaluae our soluons by comprehensve smulaon, whch conrms ha OPES acheves he energy benes when used o suppor secure comparson operaons over he encryped values. The res o hs paper s srucured as ollows. Secon Ⅱ gves a bre revew o he relaed work. Secon III descrbes he sysem model and he secury model, and Secon IV nroduces he reerence order preservng encrypon scheme, OPES, proposed n [9]. In secon V, we presen our prvacypreservng daa sorage scheme and query proocol. We evaluae he perormance o our approach n Secon VI and conclude hs paper n Secon VII. 2. Relaed work Prvacy and negry preservng range queres n wo-ered WSNs have drawn aenon recenly [4,5,6]. In [4], Sheng and L propose a scheme whch s based on he buckeng echnque [10] o preserve he prvacy o range queres n sensor neworks. Ths approach may ncur unnecessarly communcaon overhead n even-drven WSN applcaons. So Sh e al. propose an opmzed verson o reduce he communcaon cos beween sensors and sorage nodes [5]. In her approach, each sensor uses a b map o represen whch buckes have daa and broadcass s b map o he nearby sensors. Each sensor aaches he b maps receved rom ohers o s own daa ems and encryps hem ogeher. The snk veres query resul compleeness or a sensor by exang he b maps rom s nearby sensors. However, he bucke paronng echnque employed n [4, 5]allows compromsed sorage nodes o oban a reasonable esmaon on he acual value o boh daa ems and queres [11]. Chen e al. propose SaeQ, a secure and ecen query processng proocol [6]. They use prex membershp vercaon scheme o encode boh daa and queres such ha a sorage node can correcly process encoded queres over encoded daa whou knowng her values. However, SaeQ ocuses on range queres, whle our approach specalzes or Top-k queres. In [7], Zhang e al. presen hree schemes wh whch he nework owner can very he auhency and compleeness o ne-graned op-k query resul reurned by a sorage node. However, prvacy-preservng ssue s no addressed. In conras, proecng he prvacy o sensve daa when queres are processed a sorage nodes s our man desgn goal. In sensor neworks, secure daa aggregaon [3, 12-17] s a smlar opc o our work. Daa aggregaon has been pu orward as an essenal paradgm n sensor neworks o reduce communcaon overhead. However, whou prvacy proecon measures, adversares can monor and njec alse daa no he nework. Many schemes, ncludng schemes based on algebrac properes o polynomals and addon [12], secre perurbaon-based schemes[13], Hop-by-Hop encrypon[14], and Homomorphc encrypon [3, 16, 17], have been proposed o address he prvacy problem n daa aggregaon. However, hese works manly ocus on daa aggregaon or lnear aggregaon uncons, such as addon and average. Research eors on 227

3 more general nonlnear aggregaon uncons have been lmed, wh he excepon o work n [15], whch ocuses on Max/Mn aggregaon uncon, whle we address he prvacy ssue or op-k query. Oher secury measures, such as proecon o acual sensed daa [2], are proposed by researchers. However, hese measures address deren problems, as we address he prvacy proecon ssue n op-k query n ered WSNs. 3. Models 3.1. Nework model We consder a wo-ered sensor nework as shown n Fg. 1, whch consss o hree ypes o nodes: sensors, sorage nodes, and a snk. The nework regon s paroned no physcal cells, each conanng a sorage node n charge o mulple sensor nodes n ha cell. We assume ha a cell conans a mos N sensor nodes. Sensors are nexpensve sensng devces wh lmed sorage, compuaon, and power. Every sensor collecs envronmenal daa values n a xed rae and perodcally subms he daa o a sorage node whch s n charge o he cell ha he sensor les n. Sorage nodes are assumed o have abundan resources n sorage, energy and compuaon. The snk s he pon o conac or users o he sensor nework. I ranslaes a queson rom a user no mulple queres and hen dsseaes he queres o he correspondng sorage nodes, whch process he queres based on her daa and reurn he query resuls o he snk. The snk unes he query resuls rom mulple sorage nodes no he nal answer and sends back o he user. We assume ha all sensor nodes and sorage nodes are loosely synchronzed wh he snk, and dene a me slo as he xed nerval me beween wo daa submssons, n whch a sensor wll collec l daa ems. As all sensors are synchronzed, The daa messages rom sensor s o a sorage node s a 3-uple (,, {d 1, d 2, d l }), where s he sensor ID, s he sequence number o he me slo, and {d 1, d 2, d l } are he l daa ems colleced by sensor s n me slo. In addon, we assume ha all sensor nodes are assumed o ollow he same dsrbuon over he sensed values. Whou loss o generaly, we assume ha each sensor daa em s an neger ha alls whn a lmed range. Noe ha, even hough some daa (e.g., emperaure, blood pressure, nosness, ec.) may no be neger n s orgnal orm, hey can be ransormed o negers. We urher assume ha he queres sen by he snk o sorage nodes are op-k queres. A query ndng he op-k daa ems colleced a me slo s denoed as: (Slo=) (Num=k) 3.2. Adversary Model We assume ha he adversary wans o oban he sensve daa normaon rom he sensor nework, whch volaes daa prvacy. Leakng valuable daa s a crcal hrea n many applcaons, such as healh monorng applcaons. We also assume ha he sensors and he snk are rused bu he sorage nodes are no. For example, n a healh monorng sensor nework, sensor nodes are under he conrol o paens and he snk s under conrol o a docor, whle sorage nodes are unaended. As a resul, sorage nodes could be easly compromsed by an adversary, or example, a people who sells medcne, o oban sensve daa or he sake o medcne sellng. In addon, we use he hones bu curous [18] hrea model, where a sorage node may aemp o break prvacy bu ahully ollows he proocol speccaon durng daa sorage and query processng. Ths hrea model s approprae because sensors deployed by a common auhory can collaborae o ulll a ceran ask and be rused o ollow he proocol. Our mehod ams o preserve prvacy under he hones bu curous aack model so ha even sorage nodes canno easly oban sensor nodes sensve daa. 4. An order preservng encrypon scheme R. Agrawal e al. propose OPES[9], an order preservng encrypon scheme ha allows comparson operaons o be drecly appled on encryped daa. The basc dea o OPES s o ake as npu a user- 228

4 provded arge dsrbuon, T, and ransorm he planex values n such a way ha he ransormaon preserves he order whle he ransormed values ollow he arge dsrbuon. Even hough he npu dsrbuons were very deren, he dsrbuon o encryped values looks dencal. As a resul, he naure o he planex dsrbuon, P, can no be nerred rom he encryped values. So OPES s secure agans gh esmaon exposure aack. As descrbed n [9], OPES works n hree sages: Model: The npu dsrbuon P and he arge dsrbuons T are modeled as pecewse lnear splnes. Flaen: The planex dsrbuon P s ransormed no a la dsrbuon F such ha he values n F are unormly dsrbued. Transorm: The la dsrbuon F s ransormed no he cpher dsrbuon C such ha he values n C are dsrbued accordng o he chosen arge dsrbuon. In he modelng phase, daa values are rs paroned no buckes, wh each bucke represened by he bucke boundares [p l, p h ). Then he dsrbuon whn each bucke s modeled as a lnear splne, whch s smply he lne connecng he denses a he wo end-pons o he bucke. Obvously, we have m buckes, we need o sore m + 1 boundares. In he Flaenng phase, a planex bucke B s mapped no a bucke B n he laened space n such a way ha he densy n he laened bucke and over all buckes wll be unorm. OPES noces ha a dsrbuon over [0, p h ) has he densy uncon qp + r, where p [0, p h ), hen or any consan z > 0, he mappng uncon q 2 M ( p) z( p p) (1) 2r wll yeld a unormly dsrbued se o values. S = q/2r s called he quadrac coecen, one or each bucke. A deren scale acor z s used or deren buckes, o make he ner-bucke densy unorm as well. 2 z n/( sw w) (2) W s he wdh o he bucke, n s he number o pons n he bucke, and λ s he maxmum o mum o he predced laened bucke wdhs. The m + 1 bucke boundares, he m quadrac coecens, and he m scale acors are sored n a daa srucure K, whch s used o laen new planex values, and also o unlaen a laened value. Thus K serves he uncon o he encrypon key. Represen he domans o he planex dsrbuon P and he dsrbuon F as [p, p max ) and [, m max ) respecvely. Noe ha max w 1, where w M( w). W s he lengh o planex bucke B and w s he lengh o correspondng la bucke. For a planex value p B, s mapped no he la value usng he equaon: 1 1 j j j 1 j 1 (3) w M ( p p w ) The nverse mappng o la value o planex s accomplshed by j j j 1 j 1 (4) p p w M ( w ) 1 2 M ( ) ( z ( z 4 zs ))/2zs (5) Ou o he wo possble values orm M -1, only one wll be whn he bucke boundary. In he ransorg phase, a unormly dsrbued se o laened values s mapped no he arge dsrbuon T. An equvalen way o hnkng abou he problem s ha we wan o laen he arge dsrbuon no a unorm dsrbuon, whle ensurng ha he obaned dsrbuon lnes-up wh he unorm dsrbuon yelded by laenng he planex dsrbuon. 229

5 The arge dsrbuon s buckezed no a se o buckes, { B1, B2..., B u}, ndependen o he buckezaon o he planex dsrbuon. For every bucke B o lengh w, we also ge he mappng uncon M and he assocaed parameers s and z. 2 z n /( s ( w ) w ) (6) s smlar o n he prevous case. Le B ˆ be he bucke n he la space correspondng o he bucke B,wh lengh w ˆ. We also have buckes { B1, B2,... B m} rom laenng he planex dsrbuon, and B has lengh w. We wan he range o he wo la dsrbuons o be equal. To algn he laened planex dsrbuon and he laened arge dsrbuon, a scalng acor L s compued: m 1 1 L ( w )/( wˆ ) (7) So he lengh o he cpher bucke B c correspondng o he arge bucke B s gven by w c Lw and he lengh o he scaled laened arge bucke B s gven by w Lwˆ. Fnally, he mappng uncon M c or mappng values rom he bucke B c o he la bucke B s c c dened by quadrac coecen s s / L and scale acor z z.the bucke boundares, and or each bucke he quadrac coecen z c and he scale acor sc are sored n he daa srucure K c. I [c, c max ) s he doman o cpherexs, hen a la value rom he bucke mapped no cpher value c usng he equaon: Where 1 1 c c 1 j j 1 j 1 c c w ( M ) ( w ) B can now be (8) c 1 2 ( ) ( ) ( 4 )/2 M z z sz zs (9) Only one o he wo possble values wll le whn he cpher bucke. A cpher value c rom he bucke s mapped no a la value usng he equaon: 5. Sorage scheme and query proocol 1 1 c c j j j 1 j 1 (10) w M ( c c w ) In presence o he prevously nroduced passve aacker model, we propose applyng OPES o proec daa prvacy n op-k query processng. Beore submng daa o a sorage node, a sensor wll encryp s daa usng OPES. Because OPES s an order-preservng encrypon scheme and allows comparson operaon o be drecly appled on encryped daa, sorage nodes can process op-k queres whou decrypon. As a resul, prvacy s preserved n an end-o-end manner Nework Predeploymen Durng he predeploymen sage o a sensor nework, he snk wll compue varous o parameers o OPES. Beore he deploymen o he sensors, he snk wll have access o a sample o P sensed values, p 1 <p 2 < <p p, whch s called he npu dsrbuon. The npu dsrbuon s paroned no m buckes, and he dsrbuon whn each bucke s modeled as a lnear splne. Then each planex bucke B s mapped o a laened bucke B. The snk sores he m + 1 bucke boundares, he m quadrac coecens, and he m scale acors n he daa srucure K. 230

6 Then he snk chooses a arge dsrbuon, and buckezes he arge dsrbuon no u buckes, n a manner ha s ndependen o he buckezaon o he planex dsrbuon. Each arge bucke B s also mapped o a laen bucke B ˆ.Then he arge dsrbuon and he laened arge dsrbuon are scaled n such a way ha, he wdh o he unorm dsrbuon generaed by laenng he scaled arge dsrbuon becomes equal o he wdh o he unorm dsrbuon generaed by laenng he planex dsrbuon. The snk sores he u + 1 bucke boundares, he u quadrac coecens, and he u scale acors n he daa srucure K c. As he nal sep, he snk uploads wo keys, K and K c, ono each sensor, whch wll ncur some exra space overhead. Perormance analyss: In he prdeploymen phase, he snk wll model he planex and arge dsrbuon, compue laened bucke boundares, and compue he scale acor and quadrac coecen or each bucke. These asks nvolve some compuaonally nensve operaons. In [9], he overhead s measured. Forunaely, hese cosly operaons are perormed only once durng he predeploymen sage by he snk, whch has vrually unlmed power and compuaon. The encrypon key wll be uploaded ono each sensor nodes, whch conans a se o bucke boundares, a quadrac coecen and a scale acor or each bucke. So he sze o he encrypon key depends on he number o buckes, and he memory overhead would be (3m + 1) 32, assug oally m buckes and 32 bs or each o hese values. As shown n [9], even or a daase wh 10 mllon values, he number o buckes requred s no more han 200; or Unorm dsrbuon, he number o buckes needed was less han 10. Even wh 200 buckes, he encrypon key can be jus a ew KB n sze, whch s aordable or sensor nodes. Because o he laenng operaons, he sze o cpherex wll depend on skew n he p planex and arge dsrbuons. Dene g o be he smalles gap beween sored values n p he planex, and g max as he larges gap. In he laenng sage, he gap beween all he values need o be unormed. As a resul, smaller gaps need o be expanded o he larges one, resulng p p p p n a ncrease o gmax / g n sze or log( gmax / g ) exra bs. Smlarly, le g and g max be he smalles and larges gaps n he arge dsrbuon, here s a mos p p p log( gmax / g ) ncrease n bs. Le G denoes gmax / g and G g max / g, hen he exra number o bs needed by he cpherex n he wors case can be approxmaed as p log G log G. Even hough he maxmum gap s 2 16 mes more han he mum gap or each dsrbuon, he resulng ncrease n cpherex sze wll be only 4 byes, whch s a moderae ncrease n sze Prvacy-Preservng Sorage To proec sensve normaon, sensor daa can be dsclosed o sorage nodes. For hs purpose, sorng planex daa on sorage nodes s no desrable. Insead, each sensor mus encryp he daa usng OPES beore submng hem o he sorage nodes. In a me slo, a sensor nodes colleed a mos l daa ems. Frsly, or each planex daa em, he sensor perorms a search over he m + 1 bucke boundares sored n K o deere he bucke or, and convers o s correspondng la value usng equaon (1) and (3). Then, he la value s convered no a cpher value usng equaon (9) and (8). Fnally, he sensor node subms all encryped values, c 1, c 2, c l, o a sorage node. Perormance analyss: Encrypon wll ncur some exra compuaon overhead compared o sendng planex daa whou prvacy preservng. To nd whch bucke a planex value alls, a sensor perorms a search operaon, whch nvolves log(m+1) comparsons. For he mappng uncon descrbed n equaon (1), as z and s are sored n he encrypon key, he compuaon cos or mappng nvolves 3 mulplcaons and 1 231

7 addon. For he encrypon uncon as s descrbed n equaon (3), by precompung 1 1 ( w ) and ( p w ), he compuaon cos or encrypon nvolves 2 j 1 j j 1 j mulplcaons and 2 addons. For he mappng uncon descrbed n equaon (9), by precompung zs and z 2, he compuaon cos or nvolves 1 mulplcaon, 2 addons, 1 square-roo and 1 dvson. The compuaon cos or equaon (9) s he same as equaon (3). So he oal cos o encrypon or one daa em nvolves 8 mulplcaons, 7 addons, 1 square-roo, 1 dvson and log(m+1) comparsons. Wh prvacy proecon, exra communcaon cos s also ncurred n daa submsson. The cos o sensor IDs and slo me number are no consdered, because hey have o be submed even whou our scheme. In our approach, exra coss manly arse rom he ncrease n cpherex sze, whch s p p approxmaed as (log( g max / g ) log( g max / g )) * l bs n he wors case, where l denoes he number o daa ems Query processng When recevng query <, k>, a sorage node wll process hs query based on N messages receved rom all sensors n s cell a me slo, wh l encryped daa ems n each message. As daa ems are encryped usng OPES, an order preservng encrypon scheme, decrypon s no requred. All ha he sorage node needs o do s o sor all he encryped Nl daa ems and reurn he op-k ones o he snk. Perormance analyss: Wh a ecen sor algorhm, a sorage node needs o perorm 2*(Nl)log(Nl) comparsons n he wors case. Exra communcaon cos wll be ncurred because o recevng cpherex daa rom sensor nods and sendng query resul o he snk, compared o recevng and sendng planex daa n a scheme p p whou prvacy proecon. There are approxmaely (log( g / g ) log( g / g )) * Nl bs wll be p p max max max max receved and (log( g / g ) log( g / g )) * k bs sen, n he wors case Query resul processng When recevng a query resul rom a sorage node, he snk needs o decryp all he k daa ems usng equaon (4) and (10), whch nvolves some compuaonally nensve operaons. However, as he snk has vrually unlmed power and compuaon, hese operaons have no mpac on he leme o he sensor nework. 6. Perormance evaluaon In hs secon, we use numercal resuls o evaluae he perormance o he proposed prvacy proecon schemes. As no pror work ocused on he prvacy ssue or op-k query n ered sensor neworks, we compare our scheme wh a scheme whou prvacy proecon, whch represens he sae-o-he-ar, o evaluae he mpac o our scheme on a sensor nework. Communcaon and compuaon consumpons are measured or boh sensor daa submsson and query processng a sorage nodes. We don measure he exra cos consumed by he snk, as he snk s resource-rch such ha has no mpac on leme o he sensor nework. We conduc he expermens on he sensor MICAz, wh 16 bs planex values. We assume ha a cell conans a sorage node and 10 sensor nodes, and he average dsance beween a sensor node and he maser node s 1 hop, or smplcy. 232

8 6.1. Compuaon cos We measure he compuaon cos n erms o energy consumpon. Two exra compuaon coss are ncurred by our proecon scheme. Frs, durng he perodcal daa repor, sensors need o encryp daa ems, whch wll ncur exra compuaon cos compared o a scheme whou prvacy proecon. In hs smulaon, we vary he number o buckes, m, rom 10 o 200, o es he mpac o m on perormance o sensor nodes when encrypng one daa em. Fg. 2(a) shows how m nluences he compuaon cos o a sensor node n erms o energy consumpon. As shown n he gure, power consumpon ncreases when m s ncreasng. Ths s due o he ac ha he ncreasng number o buckes wll resul n he ncrease n comparson when searchng or whch bucke a value alls n. However, even wh 200 buckes, he ncrease n power consumpon ncurred by encrypon s relavely small (less han 10 uj), whch has lle mpac on he leme o a sensor node. Power consumpon(uj) m (a) Daa submsson Power consumpon(uj) Fgure 2. Compuaon cos Processng Planex Processng OPES clpherex G p G (b) Query processng Second, durng query process, n order o search or he op-k daa em, sorage nodes need o sor all he Nl daa ems receved rom N sensor nodes. Because he sze o cpherex s larger han planex, cpherex sorng also ncur some exra coss. In hs evaluaon, we x N and l, boh o be 10, and vary G p G rom 2 0 o 2 32, o compare he power consumpon o processng planex and cpherex. As Fg. 2(b) shows, n a scheme whou prvacy proecon, he sorage node only need o compare 32-b planex daa ems, whch consumes abou 19 uj energy. In conras, he ncrease o G p G rom 2 0 o 2 32 resuls n exra cos n cpherex processng. However, he exra cos n erm o power consumpon s small. Even G p G reaches o 2 32, he exra cos s less han 20 uj Communcaon Cos We also measure he communcaon cos n erms o energy consumpon. In he daa submsson process, sensor nodes need o send cpherex daa, nsead o planex daa n a scheme whou prvacy proecon, whch wll ncur exra communcaon cos, because o he ncrease n he sze o cpherex. Fg. 3(a) shows he derence n power consumpon beween sendng a planex daa em and a cpherex daa em, varyng G p G rom 2 0 o As G p G grows, he power consumpon o a sensor node or sendng a planex daa s consan, whch s less han 200 uj, whle ha or sendng a cpherex daa em ncreases. Ths s undersandable, because when G p G ncreases, he number o bs n a cpherex daa em also ncreases accordngly. The resul shown n Fg. 3(a) s conssen wh he prevous analyss ha OPES encrypon brngs O(LOG(G p G )) exra bs n cpherex sze. Bu he exra cos ncurred by our scheme s relavely small, whch s abou 200 uj a mos. Whn a cell, a he end o each me slo, he sorage node wll receve l encryped daa ems rom each sensor. In addon, aer he query processng s nshed, he sorage node wll send o he snk he query resul, k encryped daa ems. As he sze o cpherex daa s larger han planex daa, hs

9 daa recevng and sendng process a sorage nodes wll ncur some exra communcaon coss. In hs evaluaon, we x k o be 5 and assume he number o hops beween a sensor node and a sorage node s 1, o es how he OPES encrypon wll aec he power consumpon on communcaon or sorage nodes. Fg. 3(b) shows he numercal resul. The power consumpon n a scheme whou prvacy scheme s consan, whch s abou 2200 uj. However, wh he ncrease o G p G, he sze o cpherex become larger. As a resul, he power consumpon n ransmng hese cpherex wll grow. The exra cos s a lle large, approxmaely 2000 o 5000 uj, because a sorage receves daa ems rom all sensors whn he cell. However, snce sorage nodes are usually resource-rch, hs wll no hrea he leme o he sensor nework. Power Consumpon(uj) Sendng planex Sendng OPES cpherex Power consumpon(uj) Transmng Planex Transmng OPES clpherex G p G (a) Daa submsson 2000 Fgure 3. Communcaon cos G p G (b) Sorage communcaon 6.3. Resul summary The expermenal resuls show ha, or sensor nodes, he compuaon and communcaon coss o our scheme only ncrease moderaely compared o a scheme whou prvacy proecon, even wh a large number o buckes and a bg derence beween he smalles gap and he larges gap n boh planex and arge dsrbuon. In addon, he absolue amoun o power consumpon s relavely small. Ths ndcaes ha OPES-based prvacy proecon scheme has lle mpac on he leme o sensor baeres. For sorage nodes, n query processng, he power consumpon or compuaon cos s relavely small, whle ha or communcaon cos s large. However, snce sorage nodes are usually resourcerch, our scheme wll no hrea he leme o he sensor nework. The resul s undersandable. In OPES, mos o he compuaonally nensve operaons are perormed a he snk node, whch has vrually unlmed power and compuaon. When he sensor neworks are deployed, he memory, compuaon and communcaon overhead on sensor nodes s reasonable. 7. Concluson Preservng he prvacy o sensve daa n n-nework query processng s an mporan problem n sensor nework applcaon. In hs paper, we propose a novel scheme or handlng op-k queres n wo-ered sensor neworks n a prvacy-preservng manner. An order preservng encrypon scheme, namely OPES, s employed o encryp daa ems beore submng o sorage nodes. Because OPES allows comparson operaon o be drecly appled on encryped daa, sorage nodes can process op-k queres whou decrypon. As a resul, prvacy s preserved n an end-o-end manner. We also presen he algorhm, analyss, and smulaon resuls on our scheme. As he uure work, we nend o exend our scheme o suppor boh prvacy and negry proecon. 234

10 8. Acknowledgmen Ths work was suppored n par by he Naural Scence Foundaon o he Jangsu Hgher Educaon Insuons o Chna under grans 09KJB520008, and A Projec Funded by he Prory Academc Program Developmen o Jangsu Hger Educaon Insuons (PAPD). We would also lke o hank anonymous revewers or her consrucve commens and helpul advce. 9. Reerences [1] O. Gnawal, K.-Y. Jang, J. Paek, M. Vera, R. Govndan, B. Greensen, A. Jok, D. Esrn, and E. Kohler, The ene archecure or ered sensor neworks, n ACM SenSys 06, pp , 2006 [2] Imanshmwe Jean de Deu, Jn Wang, Muhammad Fahm, Sungyoung Lee, Young-Koo Lee, "E- EDPPS: Enhanced an Energy-ecen Daa Prvacy Proecon Scheme or Wreless Sensor Neworks", Journal o IJACT, AICIT, Vol. 3, No. 5, pp. 8 ~ 19, 2011 [3] Vvaksha Jarwala, Devesh Jnwala, "Evaluang Homomorphc Encrypon Algorhms or Prvacy n Wreless Sensor Neworks", Journal o IJACT, AICIT, Vol. 3, No. 6, pp. 215 ~ 223, 2011 [4] B. Sheng and Q. L, Verable prvacy-preservng range query n wo-ered sensor neworks, n Proc. IEEE INFOCOM, pp , [5] J.Sh, R. Zhang, and Y. Zhang, A Spaoemporal Approach or Secure Range Queres n Tered Sensor Neworks, IEEE Trans. Wreless Communcaons, 10(1), pp , 2011 [6] F. Chen, Alex X. Lu, SaeQ: Secure and Ecen Query Processng n Sensor Neworks, n Proc. IEEE INFOCOM, pp , 2010 [7] R. Zhang, J. Sh, Y. Lu, and Y. Zhang, Verable Fne-Graned Top-k Queres n Tered Sensor Neworks, n Proc. IEEE INFOCOM, pp , 2010 [8] A. S. Slbersen, R. Braynard, C. Ells, K. Munagala, and J. Yang, A samplng-based approach o opmzng op-k queres n sensor neworks, n Proc. ICDE, p. 68, 2006 [9] R. Agrawal, J. Kernan, R. Srkan, and Y. Xu. Order preservng encrypon or numerc daa. In proc. ACM SIGMOD, pp , [10] H. Hacgumus, B. R. Iyer, C. L, and S. Mehrora, Execung SQL over encryped daa n he daabase servce provder model, n Proc. ACM SIGMOD, pp , 2002 [11] B. Hore, S. Mehrora, and G. Tsudk, A prvacy-preservng ndex or range queres, n Proc. 30h VLDB, pp , 2004 [12] W. He, X. Lu, H. Nguyen, K. Nahrsed, and T. Abdelzaher, PDA: Prvacy-preservng daa aggregaon n wreless sensor neworks, n Proc. IEEE INFOCOM, 2007 [13] T. Feng, C. Wang, W. Zhang, and L. Ruan, Condenaly proecon schemes or daa aggregaon n sensor neworks, n Proc. IEEE INFOCOM, pp , 2008 [14] Y. Yang, X. Wang, S. Zhu, and G. Cao, SDAP: A secure hop-by-hop daa aggregaon proocol or sensor neworks, ACM Trans. In. Sys. Secur., vol. 11, pp. 18:1 18:43, [15] Mchael M. Groa, Wenbo Hey and Sephane Forres, "KIPDA: k-indsngushable Prvacypreservng Daa Aggregaon n Wreless Sensor Neworks", n Proc. IEEE INFOCOM, pp , [16] C. Casellucca, E. Mykleun, and G. Tsudk, Ecen aggregaon o encryped daa n wreless sensor neworks. In Proc. MobQuous, pp , 2005 [17] D. Wesho, J. Grao, and M. Acharya, Concealed Daa Aggregaon or Reverse Mulcas Trac n Sensor Neworks: Encrypon, Key Dsrbuon, and Roung Adapaon, IEEE Trans. Moble Compung, 5(10), pp , [18] O. Goldrech, Foundaons o Crypography: Volume 2, Basc Applcaons. New York, NY, USA: Cambrdge Unversy Press,