Z. RUAN, X. SUN AND W. LIANG
almost all n storage nodes, resulting in a communication complexity of ™ (nk). However, such a high
complexity can be avoid in our scheme because of the following: (i) the source data is divisible into
smaller coding units; (ii) encoding is performed at the data-generating nodes; and (iii) each sensor
node can be each other’s storage node, and information from multiple data source nodes are mix
stored at the sensor nodes.
3. MODELS AND ASSUMPTIONS
In this section, we present the system model, adversary model, assumptions, and preliminaries.
3.1. Network model
We consider a WSN consisting of a network controller, a large number of sensor nodes, and a cer-
tain number of users. The network is divided into certain regions referred to as cells, with each
cell containing N sensor nodes that continuously produce data of interest to many users from both
public and private sectors besides the network controller itself. The network controller is consid-
ered online and trusted. This coincides with the typical assumption about service providers. Such
sensor networks are under construction or planning by many multisponsor programs and projects
such as ORION [28], National Oceanographic Partnership Program (NOPP) [29] and Integrated
Ocean Observing System (IOOS) [30]. These large-scale networked sensor systems are constructed
to adaptively observe the earth–ocean–atmosphere system. The sensed data may be of interest to
numerous users, ranging from individual users to universities, government research centers, and
business companies. The network controller may have to enforce strict access control so that the
sensed data are accessible only by authorized users. There is also a growing requirement for pro-
tecting users’ query privacy [16]. For example, an oil company may be interested in the data of an
ocean sensor network [28–30] and may want to hide its network regions of interest from both the
network controller and other network users that might be potential business competitors [16].
There may or may not be an in-network base station bridging the sensor network to the outside
network. Our scheme can apply to either case for its independence of base station. Each user inter-
ested in sensed data apply to the network controller for a token before entering the sensor network,
and the user can subsequently send a query containing the token to any sensor node. Once vali-
dating the token, the sensor node can provide the user with the requested data. It is reasonable to
assume that each user is much more capable than regular nodes in communication and computation
capabilities and other resources. It is therefore, reasonable to assume that a user can send packets
in one hop to all nodes in its coverage. In contrast, a sensor node may transmit packets in one hop
or multiple hops to a user within or beyond its transmission range. Sensors nodes has mobility, and
we assume they can move in each cell to guarantee optimal area coverage and help solve network
connectivity problems caused by sensor failures. Many networks have been developed to address the
partial data recovery problem [31–34]; the collector can flexibly specify the subset of source nodes
of its interest and recover corresponding partial data. We resort to these approaches for querying
interested data and focus on addressing data storage security and retrieval efficiency. Throughout
this paper, we will denote the network controller with the symbol T . Symbol U and s are used to
represent the user and the sensor nodes, respectively.
3.2. Adversary model
We assume that adversary (A/ can compromise on average N
0
out of N sensor nodes in each
cell. They may modify some of the data after compromising sensor nodes, which is also called
pollution attack. Besides, compromised nodes are internal attackers and may collude to attempt
deducing sensing data of target nodes. There might also be external eavesdroppers outside the sys-
tem. Because external eavesdroppers are fairly easy to defeat using end-to-end encryption, we will
focus on defending against internal attackers hereafter.
Copyright © 2011 John Wiley & Sons, Ltd. Int. J. Commun. Syst. (2011)
DOI: 10.1002/dac