11institutetext:  Internet Interdisciplinary Institute (IN3), Universitat
Oberta de Catalunya (UOC), CYBERCAT-Center for Cybersecurity Research of
Catalonia, Barcelona, Spain 22institutetext: SAMOVAR, Télécom SudParis,
Institut Polytechnique de Paris, Palaiseau, France.

# ZIRCON: Zero-watermarking-based approach for data integrity and secure
provenance in IoT networks

Omair Faraj 1122 David Megías 11 Joaquin Garcia-Alfaro 22

###### Abstract

The Internet of Things (IoT) is integrating the Internet and smart devices in
almost every domain such as home automation, e-healthcare systems, vehicular
networks, industrial control and military applications. In these sectors,
sensory data, which is collected from multiple sources and managed through
intermediate processing by multiple nodes, is used for decision-making
processes. Ensuring data integrity and keeping track of data provenance is a
core requirement in such a highly dynamic context, since data provenance is an
important tool for the assurance of data trustworthiness. Dealing with such
requirements is challenging due to the limited computational and energy
resources in IoT networks. This requires addressing several challenges such as
processing overhead, secure provenance, bandwidth consumption and storage
efficiency. In this paper, we propose ZIRCON, a novel zero-watermarking
approach to establish end-to-end data trustworthiness in an IoT network. In
ZIRCON, provenance information is stored in a tamper-proof centralized network
database through watermarks, generated at source node before transmission. We
provide an extensive security analysis showing the resilience of our scheme
against passive and active attacks. We also compare our scheme with existing
works based on performance metrics such as computational time, energy
utilization and cost analysis. The results show that ZIRCON is robust against
several attacks, lightweight, storage efficient, and better in energy
utilization and bandwidth consumption, compared to prior art.

Keywords: Data Integrity; Data Provenance; Internet of Things; Intrusion
Detection; Cryptography; Zero-Watermarking.

##  1 Introduction

The IoT is an intelligent system composed of physical objects interconnected
in a dynamic network infrastructure, which allows it to collect and exchange
data between different sources and destinations [1, 2]. These objects route
data being captured from the environment to the unsafe Internet to be managed,
processed and analyzed using different technologies. This makes it easier for
an attacker to access the network and, thus, the system becomes vulnerable to
intrusions [3]. Such intelligent systems are being used in various
applications, such as healthcare systems, home appliances, car automation,
industrial control, or environmental monitoring, among others [4, 5]. For
these reasons, and for more than two decades, protecting and securing networks
and information systems have been delivered through Intrusion Detection
Systems (IDSs). It is difficult to apply traditional protection techniques (e.
g., cryptography, signature-based techniques, etc.) to IoT networks due to
some characteristics such as specific protocol stacks, constrained-resource
devices, computational and power capabilities, storage limitations and network
standards [6]. At first, processing capabilities and storage limitations of
network devices that host Intrusion Detection System (IDS) algorithms is a
critical issue. In conventional networks, IDS agents are deployed by network
administrator in intermediate nodes that have high computing capacity [7]. On
the other hand, network nodes in IoT environments are resource-constrained.
Therefore, finding nodes with the ability to support IDS agents is difficult
in such systems.

Another major issue is the network architecture. Specific nodes, such as
routers and switches, are responsible for forwarding packets to final
destinations that are directly connected to end systems in traditional
networks. IoT networks are generally multi-hop. In this case, network nodes
forward packets simultaneously and act as end systems. Hence, for the sensed
data packets to reach the final destination (e. g., gateway, central
processing unit, etc.) it will be forwarded through a path of sensor nodes
placed on different light poles [7]. Sharing these data packets through the
shared wireless medium expose the network to be vulnerable to several types of
security attacks, such as data forgery, packet replay, data modification, data
insertion, or packet drop attack [8, 9].

Consequently, there is a need for a lightweight IDS scheme that maintains data
integrity, trustworthiness and the ability to secure provenance to ensure that
data is forwarded safely. Data provenance provides history of the data origin
and how it is routed over time, which makes it an important tool for the
assurance of data trustworthiness [10, 11]. Most of the previous research on
provenance considered studying modeling, collecting and querying data
provenance without focusing on its security. Moreover, very few approaches
considered provenance in sensor networks. In such networks, there is a set of
challenges to deploy provenance solutions. These challenges are (i) manage
processing overhead of each individual node, (ii) efficiently transmit
provenance while minimizing the additional bandwidth consumption, and (iii)
transmit provenance securely from source to destination with the prompt react
to any attack [10].

In this paper, we provide a complete framework that deals with the above
mentioned provenance challenges while ensuring data integrity in an IoT
network. These requirements can be achieved through watermarking techniques
that are lightweight and require less computational and storage capabilities.
Scalability is also an important requirement, since the size of provenance
increases proportionally as the number of nodes engaged in the forwarding
process increases. To address this issue, we introduce a centralized network
database, connected to all nodes and gateway, that stores the provenance
information at each hop. In this paper, we propose a zero-watermarking
approach that securely communicates provenance information through a tamper-
proof database and provides data integrity for real-time systems. A watermark
is generated at the source IoT device from the provenance information (IP
address, data packet sensed time or received time) and a hash value of the
data payload. The node stores this watermark in a tamper-proof centralized
database and embeds it with the data packet to be sent through transmission
channel. At intermediate nodes, the watermark is re-generated from original
data for verification procedure. Finally, at the gateway, data integrity is
verified through watermark re-generation process and the stored watermarks
forming the complete provenance information are queried for validating
provenance of data and constructing the data path. Hence, the proposed
framework provides secure provenance transmission, scalability, secure
transmission of watermarks and an in-route data integrity at each point in the
network.

The main contributions of this paper are summarized below:

  * •

We propose a novel zero-watermarking scheme for IoT networks to ensure data
integrity in single- and multi-hop scenarios.

  * •

We provide a solution for the problem of secure provenance transmission in IoT
networks that is based on a zero-watermarking approach with a tamper-proof
network database.

  * •

We analyze the security of our approach under two main adversary models:
passive and external adversary.

  * •

We evaluate the performance of our approach with respect to some related
techniques reported in the related literature.

Paper Organization — Section 2 provides some preliminary background and
surveys related work. Section 3 presents the proposed zero-watermarking
approach and solutions. Section 4 analyzes the security of the proposed
scheme. Section 5 describes simulation results and analysis to validate our
approach. Section 6 provides discussion suggests some directions for future
research. Finally, Section 7 concludes the paper.

##  2 Background and Related Work

Digital watermarking is one of the well known advances in Wireless Sensor
Network (WSN) security. It can detect if sensory data have been modified in a
precise way, and prevents the interception of this data effectively.
Additionally, it can be used for protecting content integrity of multimedia
digital works as images, audio and video, and copyright information [12].
Digital watermarking has many advantages over other security techniques such
as:

  1. 1.

The three watermarking processes (generation, embedding and extraction)
requires less energy than traditional encryption due to its lightweight
calculations.

  2. 2.

Carrier data directly holds watermark information without adding any network
communication overhead [13].

  3. 3.

Digital-watermarking reduces end-to-end delay (due to lightweight watermark
generation process) in a significant way compared to traditional security
techniques with high complexity.

There are two main types of digital watermarking: fragile watermarking and
robust watermarking (based on anti-attack properties: fragile watermark
becomes undetectable after data being modified, while robust watermarks can
survive many forms of distortion) [14, 15]. Robust watermarking is mainly used
for copyright protection and is not sensitive to tampering. On the other hand,
fragile watermarking is greatly sensitive to altering, and any change in the
carrier leads to a failure in the extraction of watermark, that is used in
verification of data integrity [16].

Watermarking algorithms consist mainly from three processes: watermark
generation, watermark embedding and watermark extraction and verification.
Based on fragile watermarking algorithms, the source nodes collect data and
generate a watermark. Then, this watermark is embedded in the original data
using a predefined rule to construct a watermarked data packet that will be
transferred to the destination node through the network. Through the
transmission channel, the packet may be subject to many types of attacks and
unauthorized access. The destination node receives the packet to extract the
digital watermark and separates the original data based on the defined rule
used at the source node. The restored data is then used to re-generate a
watermark using the generation algorithm applied at the sensing node. Finally,
the extracted watermark and the re-generated watermark will be compared to
verify data integrity [17].

In this paper, we focus on securely transmitting captured data and provenance
using zero-watermarking approach based on fragile watermarking. The works that
are related to the proposed scheme fall into two classes: data integrity using
watermarking and provenance security. The notation and their description used
in this paper are listed in Table 1. Below, we discuss fragile watermarking-
based approaches and provenance security methods.

###  2.1 Data Integrity using Digital Watermarking in WSN and IoT Networks

The literature includes relevant watermarking algorithms used for data
integrity and secure transmission in WSN and IoT environments. Existing
watermarking schemes can be classified into two main methods: regular
watermarking schemes and zero-watermarking schemes.

####  2.1.1 Regular Watermarking Schemes

In [18], Guo et al. propose a fragile digital watermarking algorithm called
SinGle chaining Watermark (SGW), which verifies data integrity from the
application layer of the data stream. The algorithm groups data based on the
key and, then, the hash value of the data from the groups is calculated to be
used as a watermark. To save bandwidth, the watermark is then embedded into
the Least Significant Bit (LSB) of the data found in all groups. In this
method, the watermark is used to link all groups and thus detect any deletion
of data. Kamel et al. in [19] optimized Guo et al.’s method by proposing a
Lightweight Chained Watermarking (LWC) scheme. In LWC, a dynamic group size is
used and the watermark is generated by calculating the hash value of two
consecutive groups of data. This leads to less computational overhead, which
is an improvement from SGW that calculates the hash value of each data element
in the group. The security vulnerabilities of SGW and LWC are addressed in
[20], by proposing a lightweight fragile watermarking scheme (FWC-D). In this
scheme, the algorithm uses a serial number (SN) that is attached to each group
to detect how many group insertions or deletions have occurred in case of any
insertion or deletion attack. The watermark is generated using a hash function
and a group serial number. All groups are chained with a digital watermark
after embedding the watermark of the current group into the previous group in
order to bypass any replay attack. To solve the issue of synchronization
between sender and receiver nodes in single chaining techniques, a dual-
chaining technique is proposed in [21]. It generates and embeds fragile
watermarks into data using dynamic groups. A reversible watermarking-based
algorithm for data integrity authentication is proposed in [22]. It applies
prediction-error expansion for avoiding any loss in sensory data. Every two
adjacent data items are grouped together, and the algorithm uses the first one
to generate the watermark, and the other as a carrier for the watermark. Sun
et al. [23] propose a lossless digital watermarking approach which embeds the
generated watermark in the redundant space of data fields. The method does not
increase data storage space due to the fixed size of redundant space. However,
data integrity is only checked at the base station side. Guoyin et al. [17]
propose a watermarking scheme for data integrity based on fragile watermarking
in order to solve the problem of resource restrictions in the perception layer
of an IoT network. They design a position random watermark (PRW) that
calculates the embedding positions for watermarks. The watermarks are
generated using the SHA-1 one-way hash function, which is then embedded to the
dynamic computed position. This scheme ensures the data integrity at the sink
node. It cannot verify integrity along the route of the communication. The
drawback of these solutions is that they only provide an end-to-end
verification, since watermark generation and verification is based on a group
of data packets. Hence, we consider our approach as a better alternative to
serve hop by hop data integrity verification between source and final
destination of data packets.

Zhou et al. [24] propose a secure data transmission scheme using digital
watermarking technique in a WSN. In this scheme, the hash value of two time-
adjacent sensitive data is calculated at the source node using a one-way hash
function. Then, according to a digital watermarking algorithm, the sensitive
data will be embedded into part of the hash sequence as watermark information.
The scheme lacks any proof of concept and security analysis to check its
robustness against different type of attacks. Another solution for attack
detection presented in [25]. The method develops a Randomized Watermarking
Filtering Scheme (RWFS) for IoT applications by deploying an en-route
filtering that removes injected data at early stage communication based on
randomly embedding a watermark in the payload of the packet. The scheme
encrypts the data packet before transmission, which encounters additional
computation overhead for sensor nodes. In our proposed scheme, only some
extracted data features are encrypted to form a sub-watermark that is
concatenated to the data packet. To minimize energy consumption, Lalem et al.
[26] propose a distributed watermarking technique for data integrity in a WSN
using linear interpolation for watermark embedding. The technique allows each
node to check the integrity of the received data locally by extracting the
watermarked data and generating a new watermark for verification. This method
is based on a fixed watermark parameter for all sensor nodes in the network
that can be vulnerable to many attacks.

####  2.1.2 Zero-watermarking Schemes

Zero-watermarking is a relatively new digital watermarking method. Each
watermarking scheme has a different watermark generation, embedding and
extraction process such as unique code (embedded in information hiding
schemes), changing position of bits and hash functions (cryptographic schemes)
[27]. In zero-watermarking schemes, watermarks are generated by source node
from the extraction of important data features of original data without
amendment to the data of these features. Different generation functions can be
applied in zero-watermarking. The generated watermarks are not embedded in the
data payload, but it is invisibly integrated in the data packet and the data
remain unmodified.

Although several zero-watermarking techniques exist in the related literature,
few methods are proposed to protect data integrity in IoT environments. In
[28], a secure data aggregation watermarking-based scheme in homogeneous WSN
(SDAW) is presented as a new security technique to protect data aggregation.
In this mechanism, watermarks are generated using the Medium Access Control
(MAC) address of sensor nodes and collected data by a one way hash function
(SHA-1). The proposed scheme guarantees secure communication between the
aggregation nodes and the base station. However, authors do not provide any
security analysis to check the resistance of this scheme against different
type of attacks. In our model, we use SHA-2 as a one-way hash function for
generating a sub-watermark and provide a detailed security analysis to prove
the resistance of our scheme against several attacks. To ensure
trustworthiness and data integrity in an IoT network, Hameed et al. [27]
propose a zero-watermarking technique which generates and constructs a
watermark in the original data before being transmitted. The generation
process of the watermark is based on the original data features (data length,
data occurrence frequency and data capturing time). This scheme is shown to be
more computationally efficient and requires less energy compared to
cryptographic techniques or reversible watermarking schemes. The proposed
approach is vulnerable to modification attack, since it only uses data length,
data occurrence frequency and data capturing time to generate the watermark.
Hence, if data is modified by changing position of data values, the attack
will not be detected.

###  2.2 Data Provenance IoT Networks

The concept of data provenance is used in many fields of study. Each
application domain defines provenance in a different way [29]. In IoT
networks, we define data provenance as information about the origin of data
and how it is routed by forwarding nodes from the source node towards the base
station [30]. Data provenance guarantees that the data received at the final
destination is trusted by the user, verifying that the data is captured by the
authorized specific IoT node at the stated time and location [31]. Provenance
can be represented as a path of nodes from source to destination as shown in
Figure 2.

Several researchers used the concept of data provenance to identify the origin
of data, track the ownership to serve the authenticity of data and assess
trustworthiness. Aman et al. [32] propose a lightweight protocol for data
provenance in IoT networks. It uses physical unclonable functions (PUFs) to
identify IoT devices and establishing physical security. Wireless links
between IoT devices and servers are identified using the wireless channel
characteristics. The proposed approach only considers single hop scenarios
between IoT devices and the server. Kamal et al. [33] present a lightweight
protocol for a multi-hop IoT network to provide security for data and achieve
data provenance. The protocol uses link fingerprints generated from the
Received Signal Strength Indicator (RSSI) of IoT nodes in the network. Data
provenance is achieved by attaching the encoded link fingerprint to the header
of data packet at each hop. The packet header is then decoded in sequence at
the server. Ragib et al. [34] propose a provenance aware system that ensures
integrity and confidentiality. The scheme implements provenance tracking of
data at the application layer through encryption and incremental chained
signature. Similarly, Syalim et al. [35] extend the same method to a directed
acyclic graph (DAG) model of provenance database. The approach preserves
integrity and confidentiality of nodes by using digital signatures and double
encryption. These solutions do not consider the characteristics of sensor
networks. Provenance information grows very fast, which requires transmitting
large amount of provenance information with data packets (i. e., increasing
the bandwidth overhead).

Sultana et al. [36] establish a data provenance mechanism to detect malicious
packet dropping attacks. The method relies on the inter-packet timing
characteristics after embedding provenance information. It detects the packet
loss based on the distribution of the inter-packet delays and then identifies
the presence of an attack to finally localize the malicious node or link. Lim
et al. [30] assess the trustworthiness of data items in a sensor network. They
use data provenance and their values to compute trust scores for data items
and nodes in the network. These scores are used to provide the level of
trustworthiness of a data item as well as nodes. These schemes provide
security and trustworthiness for sensor networks, but do not consider the
retrieval of data provenance against different types of attacks. In this
paper, we propose a strategy to securely transmit provenance using a tamper-
proof database. In our approach, the IP address is used as the identity of a
node and thus encoded in the provenance. At the gateway, after data integrity
verification, the set of watermarks stored in the database is queried and the
list of nodes is extracted, so that the gateway can easily and securely
construct the provenance (i. e., data path).

Figure 1: Single hop network model. Table 1: System Notation and Parameters Notation |  Description
---|---
$d_{n,k}$ |  Captured data packet $k$ from node $n$
$N$ |  Number of nodes in the network
$H$ |  Number of hops the data packet $d_{n,k}$ routed through
$w_{ip}$ |  IoT Device $n$ IP Address
$w_{t}$ |  Sensed data ($d_{n}$) capturing time
$sw_{f_{n,k,i}}$ |  Sub-watermark $i$ generated using data features of $d_{n,k}$
$sw_{h_{n,k,i}}$ |  Sub-watermark $i$ generated using hash function for $d_{n,k}$
$E(sw_{f_{n,k,i}})$ |  Encrypted sub-watermark $sw_{f_{n,k,i}}$
$W_{F_{n,k,i}}$ |  Final generated watermark $i$ of data packet $k$ from node $n$
$d_{(n,k)W_{F_{n,k,i}}}$ |  Watermarked data
$R(W_{F_{n,k,i}}$ |  Re-generated watermark
$R(sw_{f_{n,k}})$ |  Re-generated sub-watermark from data features
$R(sw_{h_{n,k,i}})$ |  Re-generated sub-watermark from hash function
$p_{n,k,i}$ |  provenance record $i$ of data packet $k$ from node $n$
$P_{n,k}$ |  set of provenance records of data packet $k$ from node $n$
$||$ |  Concatenation
$ENC()$ |  Encryption function
$DEC()$ |  Decryption function
$H()$ |  One-way hash function
$K_{j}$ |  $j^{th}$ generated and distributed secret key for encryption/decryption
$QRY()$ |  Query function from network database
$STR()$ |  Store function to network database
$I_{l}$ |  Intermediate node $l$
$S_{n}$ |  Source node $n$
$G$ |  Base station or Gateway
$q$ |  Number of bits to be deleted by an attacker

##  3 Proposed Construction

In this paper, we propose a zero-watermarking approach to verify data
integrity at each hop of an IoT environment (i. e., from source node to
gateway). Additionally, we ensure secure provenance of sensory data using a
tamper-proof database connected to the gateway and to each node in the
network. Data provenance information is used in the watermarking generation
process and embedded with captured data packets to be used in the data
integrity and secure provenance verification. The system is composed of the
following entities:

  * •

IoT Source Node: a small sensing device that collects data from surrounding
environment. At each node, watermarking generation and embedding processes are
applied to each data packet captured. The device performs some operations and
communication procedures in the network.

  * •

IoT Intermediate Node: an advanced sensing device with more power and
computation capabilities, responsible for forwarding data packets from source
nodes to the base station. It also performs watermark generation, embedding
and storing on the received data packets. Data integrity will be checked for
each data packet forwarded at this stage.

  * •

Base Station or gateway: receive the forwarded data packets for data
processing. Checks data integrity and provenance recovery, and applies the
attack detection procedure.

  * •

Network Database: a secure network database which is connected to the network
nodes and gateway. It stores provenance information at each hop of the data
path.

###  3.1 Zero-Watermarking for Data Integrity and Provenance Network Model

In the proposed network model, the network is assumed to consist of $N$ IoT
devices that are distributed in an IoT network. The network is deployed in an
$L\times W$ area. Devices are connected to a gateway or base-station that is
the management and controller unit. Nodes are of two types: normal sensor
nodes and intermediate sensor nodes. Sensory data is routed from normal source
nodes to the gateway through intermediate nodes. This implies that
intermediate nodes have $m$ times more energy than normal nodes (i. e., energy
of a normal node = $E_{0}$, energy of intermediate node = $E_{0}+m\times
E_{0}$). Furthermore, a tamper-proof database is connected to the gateway and
to each node. It is assumed that the database cannot be compromised by the
attacker. The model consists of two main scenarios: single-hop and multi-hop.
In the single-hop scenario, IoT devices transmits sensory data directly to the
gateway through the transmission channel, as shown in Figure 1. However, in
the multi-hop scenario, sensory data is routed from the source node to the
gateway through intermediate nodes as shown in Figure 2.

Figure 2: Multi hop network model.

####  3.1.1 Single Hop Model

In this scenario, the process of data integrity and secure provenance is
composed of different units that form the overall system model as described in
Figure 3. Sensor nodes capture data from the surrounding environment and send
it to the feature extraction unit. The IP address of the IoT device and data
capturing time are extracted and encrypted to generate a sub-watermark in the
first sub-watermark generation unit. This sub-watermark forms the provenance
record of a particular data packet. A hash function is used to generate
another sub-watermark that is concatenated with the first one to generate a
final watermark. The generated final watermark is then stored in a tamper-
proof database. The data packet is then sent to the gateway through the
transmission channel. At the gateway, data is received and forwarded to the
zero-watermark re-generation unit. After the re-generation process, the stored
watermark is queried from the database to be compared with the re-generated
watermark in the watermark verification unit for provenance integrity check. A
double verification procedure is applied for both integrity and provenance. At
this stage, the gateway detects whether data and provenance is altered or not
and performs either attack procedure or validates the origin of data received.

Figure 3: Zero-watermark generation, storing and verification block diagram in
single hop scenario.

####  3.1.2 Multi Hop Model

The watermark generation, embedding, extraction and verification processes of
the multi-hop scenario are shown in Figure 4. In this model, the data
capturing time and IP address are extracted from sensed data packets to
generate a sub-watermark, which is then encrypted using a secret key and
concatenated with a generated hash value of data payload to construct the
final watermark. The first sub-watermark or provenance record is stored in the
network database and the final watermark is concatenated with the sensed data
$d_{n,k}$ to be forwarded to the next intermediate node through the
transmission channel. At the next hop node, the watermarked data is received.
The watermark is then extracted from the received data packet. The received
data is then used to re-generate a new sub-watermark that will be forwarded to
the verification unit along with the extracted watermark and a queried
provenance record. The intermediate node takes a decision whether an attack is
detected or not. Based on this decision, it performs an attack detection
procedure or generates the next-hop watermark that undergoes the same
procedure of the source node (generation, embedding and storing); it uses new
extracted features and provenance information. The watermarked data reaches
the final destination (i. e., gateway) through transmission channel. The last
embedded watermark is separated from the watermarked data and a final sub-
watermark is re-generated. The data integrity unit accepts extracted
watermark, re-generated sub-watermark and queried provenance record as input
values to check whether data or provenance is modified or not. After that, the
gateway performs two procedures based on the verification result: attack
detection procedure or provenance validation.

Figure 4: Zero-watermark generation, storing and verification block diagram in
multi-hop scenario.

###  3.2 Security Assumptions

We consider a set of security assumptions for our proposed system as follows:

  * •

Nodes in the network are not trusted entities, i. e., , these nodes may be
malicious. The protocols provided to guarantee the secure transfer of
provenance information that is applied in intermediate nodes and gateway are
proven to work properly in the presence of malicious nodes.

  * •

The network database is a trusted and secure entity, it cannot be compromised
by an external attacker to access or use its content.

  * •

To allow only authorized gateways to access the network database and query
provenance information, only registered gateways are authorized and the query
is applied after checking the integrity of the data received from the last hop
of the data path.

  * •

The database temporarily stores provenance information of a data packet at
each hop from source to destination, only after being proved as trusted data.
This linage can be retrieved once (by authorized gateway) and then it is
removed from the database.

  * •

The hashing functions used in the system are secure and cannot be inverted.

  * •

The communication of extracted data features and provenance information (sub-
watermarks) between source nodes and intermediate nodes, and between
intermediate nodes and gateway, must be secure. Provenance information is
encrypted using symmetric cryptography and selected data (for integrity check)
is hashed using a one-way hash function.

  * •

Symmetric cryptography is restricted to the encryption of short binary strings
forming the extracted data feature sub-watermark. Source node, intermediate
node and gateway share secret-keys to be used in different steps of the
algorithms (encryption/decryption).

  * •

Secret keys are changed and redistributed after a short random number of
watermark generation processes.

  * •

The zero-watermarking method used to embed provenance information is
transparent, fragile and secure enough for IoT network applications.

###  3.3 Threat Model

There is a number of different attacks that may be applied against the
proposed system. Attack models to deceive and perform security breaching on
different network entities require another party to obtain secret information
or access network database. A threat model similar to the one used in [37] is
applied in our scheme. The attacker can perform two types of attacks: passive
and active attacks (e. g., external attacks).

  1. 1.

Passive attack: An attacker observes secret information by passively
eavesdropping data. The attacker performs an eavesdropping attack that aims to
obtain data information through listening to data transmission line in the
wireless medium.

  2. 2.

Active or External attack: A malicious attack aiming to destroy information by
modifying data packets through launching different kinds of operations. An
external or active adversary can launch three main attacks:

    1. (a)

Replay attack: Data packets are captured by an adversary and then resent in
the future at a different time interval to deceive intermediate nodes or the
gateway.

    2. (b)

Integrity attack: An attacker inserts false value(s) into the data packet at
the transmission channel to deceive the gateway. Also, the attacker may delete
elements of the data packet.

    3. (c)

Modification attack: In this attack, data is modified by an attacker without
knowledge of the data content.

    4. (d)

Database authentication attack: An attacker aims to detect and retrieve
provenance information stored in the network database.

###  3.4 Proposed Algorithms

In this section, a precise algorithmic presentation of ZIRCON to conduct the
zero-watermarking scheme is described in details.

Algorithm 1 Watermark generation and storing

1:procedure Watermark generation and storing

2: $w_{ip}\leftarrow$ IoT Device $n$ IP Address

3: $w_{t}\leftarrow$ captured data.sensing time ($d_{n,k}$)

4: $sw_{f_{n,k}}\leftarrow w_{ip}$ $||$ $w_{t}$

5: $p_{n,k}$ $\leftarrow$ $E(sw_{f_{n,k}})\leftarrow$
ENC($K_{j}$,$sw_{f_{n,k}}$)

6: $sw_{h_{n,k}}\leftarrow H(d_{n,k})$ $\triangleright$ Select first 8 bytes
of hash output

7: $W_{F_{n,k}}\leftarrow E(sw_{f_{n,k}})$ $||$ $sw_{h_{n,k}}$

8: $STR(W_{F_{n,k}})$

9: $Send(d_{n,k})$

10:end procedure

####  3.4.1 Single hop scenario.

In this scenario, two algorithms are proposed: watermark generation and
storing, and watermark verification.

  1. 1.

Watermark generation and storing: Algorithm 1 shows the process of generating
and storing a watermark in a single-hop scenario. It accepts sensed data from
the IoT device to produce a final watermark. The algorithm extracts the IP
address and the data capturing time from the source node and combines it to
generate a sub-watermark $sw_{f_{n,k}}$ as shown in Lines 2-4 of Algorithm 1.
The sub-watermark is then encrypted using the secret key $K_{j}$ to obtain a
provenance record $p_{n,k}=E(sw_{f_{n,k}},K_{j})$. Another sub-watermark
$sw_{h_{n,k}}$ is generated from the hash value of data payload using a one-
way hash function. These two generated sub-watermarks are concatenated to form
a final watermark $W_{F_{n,k}}$ as:

$W_{F_{n,k}}=E(w_{ip}\,||\,w_{t}\,,K_{j})\,||\,H(d_{n,k})=E(sw_{f_{n,k}},K_{j})\,||\,sw_{h_{n,k}}$
(1)

Here, $||$ is the concatenation operator, $W_{F_{n,k}}$ $(1\leq n\leq N,$
where $N$ is the number of nodes in the network$)$ is the final watermark, $H$
is a lightweight, secure hash function, and $n$ is the particular node number.
The watermark generation algorithm uses the SHA-2 hash function to calculate
the hash value. The advantage of using the SHA-2 hash function over other hash
algorithms is that SHA-2 has a lightweight feature that uses 65% less memory
than other algorithms, such as the MD5 hash function (which has several
vulnerability issues), which is needed in resource-constrained networks [38].
After the generation procedure, the final watermark is stored in the network
database and the data packet is sent to the base station as shown in Lines
7-9.

Algorithm 2 Watermark verification

input: $d^{{}^{\prime}}_{n,k}$
output: verified/not verified

1:procedure Watermark querying and verification

2: $Receive(d^{{}^{\prime}}_{n,k})$

3: $R(W^{{}^{\prime}}_{n,k})\leftarrow$ REDO Algorithm 1 $\triangleright$ Re-
generate watermark

4: $R(sw^{{}^{\prime}}_{h_{n,k}})\leftarrow$
$EXTRACT(R(W^{{}^{\prime}}_{n,k}))$

5: $W_{F_{n,k}}\leftarrow$ $QRY(W_{F_{n,k}})$ $\triangleright$ Query zero-
watermark from database

6: $sw_{h_{n,k}}\leftarrow$ $EXTRACT(W_{F_{n,k}})$

7: if ($R(sw^{{}^{\prime}}_{h_{n,k}})=sw_{h_{n,k}}$) then

8: Data Integrity Verified

9: $E(sw_{f_{n,k}})\leftarrow$ $EXTRACT(W_{F_{n,k}})$

10: $E(R(sw^{{}^{\prime}}_{f_{n,k}}))\leftarrow$
$EXTRACT(R(W^{{}^{\prime}}_{n,k}))$

11: if ($E(R(sw^{{}^{\prime}}_{f_{n,k}}))=E(sw_{f_{n,k}})$) then

12: Provenance Verified

13: $p_{n,k}\leftarrow$ $DEC(E(sw_{f_{n,k}}),K_{j})$ $\triangleright$ Sub-
watermark decryption

14: Extract IoT device ($n$) IP address

15: Check origin of data packet ($d^{{}^{\prime}}_{n,k}$)

16: Process data ($d^{{}^{\prime}}_{n,k}$)

17: else

18: Provenance Not Verified

19: Discard data ($d^{{}^{\prime}}_{n,k}$)

20: Perform attack procedure

21: Delete $W_{F_{n,k}}$ from network database

22: end if

23: else

24: Integrity Not Verified

25: Discard data ($d^{{}^{\prime}}_{n,k}$)

26: Perform attack procedure

27: Delete $W_{F_{n,k}}$ from network database

28: end if

29:end procedure

  2. 2.

Watermark verification: The process of verifying data integrity and validating
data provenance in a single-hop scenario is shown in Algorithm 2, which takes
the received data $d^{{}^{\prime}}_{n,k}$ as an input. Then, a re-generation
procedure is performed to re-generate the watermark $R(W^{{}^{\prime}}_{n,k})$
and the stored watermark $W_{F_{n,k}}$ is queried from the database. A
comparison operation is then applied on the re-generated sub-watermark
$R(sw^{{}^{\prime}}_{h_{n,k}})$ and the queried sub-watermark $sw_{h_{n,k}}$.
If the sub-watermarks are the same, data integrity is verified. Then, another
comparison operation is performed that compares the re-generated sub-watermark
$E(R(sw^{{}^{\prime}}_{f_{n,k}}))$ and the second queried sub-watermark
$E(sw_{f_{n,k}})$, for provenance integrity check, as shown in Line 11. If
these two sub-watermarks are the same, provenance integrity is verified and
the provenance record $p_{n,k}$ that contains provenance information is
decrypted using the secret key $K_{j}$. The IP address and data capturing time
are obtained from $p_{n,k}$. Provenance is then validated and data is ready
for processing. After that, the stored provenance record $p_{n,k}$ of received
data packet $d^{{}^{\prime}}_{n,k}$ may be deleted from the database, after
being used for security analysis. Whereas, if sub-watermarks were not the
same, data $d^{{}^{\prime}}_{n,k}$ will be discarded and an attack procedure
is performed (check the type of attack or origin of data is being altered).
The stored provenance $p_{n,k}$ of the discarded data, after attack detection,
will be deleted from the database.

Algorithm 3 Watermark generation and embedding

input: $d_{n,k}$
output: $d_{(n,k)W_{F_{n,k,i}}}$

1:procedure Watermark generation and storing

2: $w_{ip}\leftarrow$ IoT Device ($n$) IP Address

3: $w_{t}\leftarrow$ captured data.sensing time ($d_{n,k}$)

4: $sw_{f_{n,k,i}}\leftarrow w_{ip}$ $||$ $w_{t}$

5: $p_{n,k,i}\leftarrow$ $E(sw_{f_{n,k,i}})\leftarrow$
$ENC(sw_{f_{n,k,i}},K_{j})$

6: $sw_{h_{n,k,i}}\leftarrow H(d_{n,k})$ $\triangleright$ Select first 8 bytes
of hash output

7: $W_{F_{n,k,i}}\leftarrow p_{n,k,i}$ $||$ $sw_{h_{n,k,i}}$

8: $STR(p_{n,k,i})$

9:end procedure

10:procedure Watermark Embedding

11: $d_{(n,k)W_{F_{n,k,i}}}$ $\leftarrow$ $d_{n,k}$ $||$ $W_{F_{n,k,i}}$

12: $Send(d_{(n,k)W_{F_{n,k,i}}})$

13:end procedure

Algorithm 4 Watermark verification and re-embedding

input: $d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}}$
output: verified/not verified, $W_{F_{n,k,i}}$,
$d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}}$

1:procedure Watermark verification and re-embedding

2: $Receive(d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}})$

3: Extract Watermarked Data into $d^{{}^{\prime}}_{n,k}$ and
$W^{{}^{\prime}}_{F_{n,k,i}}$

4: $R(sw_{h_{n,k,i}})\leftarrow$ REDO Algorithm 1 $\triangleright$ Re-generate
sub-watermark

5: $sw^{{}^{\prime}}_{h_{n,k,i}}\leftarrow$
$EXTRACT(W^{{}^{\prime}}_{F_{n,k,i}})$

6: if ($R(sw_{h_{n,k,i}})=sw^{{}^{\prime}}_{h_{n,k,i}}$) then

7: Integrity Verified

8: $E(sw_{f_{n,k,i}})\leftarrow$ $QRY(p_{n,k,i})$ $\triangleright$ Query
provenance record

9: $E(sw^{{}^{\prime}}_{f_{n,k,i}})\leftarrow$
$EXTRACT(W^{{}^{\prime}}_{F_{n,k,i}})$

10: if ($E(sw^{{}^{\prime}}_{f_{n,k,i}})=E(sw_{f_{n,k,i}})$) then

11: Provenance Integrity Verified

12: Generate next hop watermark{

13: $w_{ip}\leftarrow$ next hop device IP Address

14: $w_{t}\leftarrow$ time watermarked data packet
($d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}}$) received

15: $i++$ $\triangleright$ update next hop watermark index

16: $sw_{f_{n,k,i}}\leftarrow w_{ip}$ $||$ $w_{t}$

17: $p_{n,k,i}\leftarrow$ $E(sw_{f_{n,k,i}})\leftarrow$
$ENC(sw_{f_{n,k,i}},K_{j})$

18: $sw_{h_{n,k,i}}\leftarrow$ Hash value from $R(sw_{h_{n,k,i}})$

19: $W_{F_{n,k,i}}\leftarrow E(sw_{f_{n,k,i}})$ $||$ $sw_{h_{n,k,i}}$}

20: $d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}}$ $\leftarrow$
$d^{{}^{\prime}}_{n,k}$ $||$ $W_{F_{n,k,i}}$ $\triangleright$ Embedding next
hop watermark

21: $STR(p_{n,k,i})$ $\triangleright$ Sub-watermark storing

22: $Send(d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}})$

23: else

24: Provenance no verified/attack detection

25: Discard data $d^{{}^{\prime}}_{n,k}$ & Perform attack procedure

26: Delete $P_{n,k}$ from network database

27: end if

28: else

29: Not verified/attack detection

30: Discard data $d^{{}^{\prime}}_{n,k}$

31: Perform attack procedure

32: Delete $P_{n,k}$ from network database

33: end if

34:end procedure

####  3.4.2 Multi hop scenario.

Three algorithms are proposed in this scenario: watermark generation and
embedding, watermark verification and re-embedding, and data integrity
verification and provenance reconstruction.

  1. 1.

Watermark generation and embedding Algorithm 3 describes the working process
of two procedures: watermark generation and storing, and watermark embedding
in the multi-hop scenario. The algorithm accepts the captured data $d_{n,k}$
as an input obtained from the source node that is sensing data from the
surrounding environment. In the first procedure, two inputs are used for
generating the first sub-watermark such as the IoT device IP address $w_{ip}$
and the data sensing time $w_{t}$. The sub-watermark $sw_{f_{n,k,i}}$ is
formed by appending these values. To secure the provenance information,
$sw_{f_{n,k,i}}$ is encrypted using secret key $K_{j}$. The encrypted value
forms the provenance record $p_{n,k,i}$. Another sub-watermark
$sw_{h_{n,k,i}}$ is generated from the hash value of the data payload.
Finally, the final watermark $W_{F_{n,k,i}}$ is produced by concatenating the
two sub-watermarks $sw_{f_{n,k,i}}$ and $sw_{h_{n,k,i}}$ as in Equation (2).
Provenance record $p_{n,k,i}$ is then stored in the network database as shown
in Line 8. In the second procedure, the watermarked data
$d_{(n,k)W_{F_{n,k,i}}}$ is produced by concatenating the final watermark
$W_{F_{n,k,i}}$ with the captured data packet $d_{n,k}$ as shown in Equation
(3).

$W_{F_{n,k,i}}=E(w_{ip}\,||\,w_{t}\,,K_{j})\,||\,H(d_{n,k})=E(sw_{f_{n,k,i}},K_{j})\,||\,sw_{h_{n,k,i}}$
(2)

$d_{(n,k)W_{F_{n,k,i}}}=d_{n,k}\,||\,W_{F_{n,k,i}}$ (3)

Algorithm 5 Data integrity verification and provenance reconstruction

input: $d^{{}^{\prime\prime}}_{(n,k)W_{F_{n,k,i}}}$
output: verified/not verified, provenance construction

1:procedure Watermark restoring and verification

2: $Receive(d^{{}^{\prime\prime}}_{(n,k)W_{F_{n,k,i}}})$

3: Extract Watermarked Data into $d^{{}^{\prime\prime}}_{n,k}$ and
$W^{{}^{\prime\prime}}_{F_{n,k,i}}$

4: $R(sw_{h_{n,k,i}})\leftarrow$ REDO Algorithm 3 $\triangleright$ Only sub-
watermark generation procedure

5: $sw^{{}^{\prime\prime}}_{h_{n,k,i}}\leftarrow$
$EXTRACT(W^{{}^{\prime\prime}}_{F_{n,k,i}})$

6: if ($R(sw_{h_{n,k,i}})=sw^{{}^{\prime\prime}}_{h_{n,k,i}}$) then

7: Data integrity verified

8: $E(sw_{f_{n,k,i}})\leftarrow$ $QRY(p_{n,k,i})$ $\triangleright$ Query last
provenance record

9: $E(sw^{{}^{\prime\prime}}_{f_{n,k,i}})\leftarrow$
$EXTRACT(W^{{}^{\prime\prime}}_{F_{n,k,i}})$

10: if ($E(sw_{f_{n,k,i}})=E(sw^{{}^{\prime\prime}}_{f_{n,k,i}})$) then

11: Provenance integrity verified

12: $P_{n,k}\leftarrow QRY(P_{n,k})$ $\triangleright$ Query stored set of
provenance records

13: for (index $i$, $1\leq i\leq H$, $i++$) do

14: Extract $E(sw_{f_{n,k,i}})$ of each $p_{n,k,i}$ from $P_{n,k}$

15: $sw_{f_{n,k,i}}=DEC(E(sw_{f_{n,k,i}}),K_{j})$

16: Extract provenance information from each sub-watermark

17: end for

18: Construct data path of $d^{{}^{\prime\prime}}_{n,k}$

19: else

20: Provenance integrity is not verified/ attack detected

21: Discard data $d^{{}^{\prime\prime}}_{n,k}$

22: Perform attack procedure

23: Delete $P_{n,k}$ from network database

24: end if

25: else

26: Data integrity not verified/ attack detected

27: Discard data $d^{{}^{\prime\prime}}_{n,k}$

28: Perform attack procedure

29: Delete $P_{n,k}$ from network database

30: end if

31:end procedure

  2. 2.

Watermark verification and re-embedding: At the next hop, a watermark
verification and re-embedding algorithm is applied as shown in Algorithm 4. To
verify data integrity at the next node, the algorithm accepts the watermarked
data $d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}}$ as an input. The captured data
$d^{{}^{\prime}}_{n,k}$ and watermark $W^{{}^{\prime}}_{F_{n,k,i}}$ are
extracted from $d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}}$. A new sub-watermark
$R(sw_{h_{n,k,i}})$ is re-generated from $d^{{}^{\prime}}_{n,k}$ by using the
first procedure of Algorithm 3 and $sw^{{}^{\prime}}_{h_{n,k,i}}$ is extracted
from $W^{{}^{\prime}}_{F_{n,k,i}}$. Then a comparison operation is applied on
the sub-watermark values of $R(sw_{h_{n,k,i}})$ and
$sw^{{}^{\prime}}_{h_{n,k,i}}$ to check whether data is altered or not. If
data integrity is verified, $E(sw_{f_{n,k,i}})$ is obtained from querying the
provenance record $p_{n,k,i}$ from the network database. Another sub-watermark
$E(sw^{{}^{\prime}}_{f_{n,k,i}})$ is extracted from
$W^{{}^{\prime}}_{F_{n,k,i}}$ for provenance validation. Then, a comparison
operation is applied on $E(sw_{f_{n,k,i}})$ and
$E(sw^{{}^{\prime}}_{f_{n,k,i}})$. If both sub-watermarks are the same,
provenance integrity is verified and a new watermark is generated using the
same procedure of Algorithm 3 as shown in Lines 12-19. The new generated
watermark $W_{F_{n,k,i}}$ is formed of the next hop node IP address and the
watermarked data packet receiving time, and the same hash value of the data
packet obtained from the re-generated sub-watermark $R(sw_{h_{n,k,i}})$ using
Equation (2). The watermark $W_{F_{n,k,i}}$ is concatenated with data
$d^{{}^{\prime}}_{n,k}$ to form a watermarked data packet as shown using
Equation (3). Then, the new generated sub-watermark $E(sw_{f_{n,k,i}})$ or
provenance record $p_{n,k,i}$ is stored in the network database as shown in
Line 20. However, if $E(sw_{f_{n,k,i}})$ and $E(sw^{{}^{\prime}}_{f_{n,k,i}})$
are not the same, the provenance is not verified and the data is discarded.
Also, $P_{n,k}$ of received watermarked data packet
$d^{{}^{\prime}}_{(n,k)W_{F_{n,k,i}}}$ is deleted from the database and an
attack procedure is applied. If data integrity is not verified, data will be
also discarded and an attack procedure will be applied. Also, all stored
provenance records of $P_{n,k}$ related to this data packet will be deleted
from the database.

  3. 3.

Data integrity verification and provenance reconstruction: The process of data
integrity verification and provenance reconstruction at the gateway is shown
in Algorithm 5. The verification procedure relies on four main conditions:

    1. (a)

The origin of data packet based on the source IP $address$.

    2. (b)

The freshness of the timestamp $w_{t}$ included in the watermark.

    3. (c)

The hop by hop integrity and provenance validation.

    4. (d)

Verifying the data measurement using the hash value.

The received watermarked data $d^{{}^{\prime\prime}}_{(n,k)W_{F_{n,k,i}}}$ is
extracted into $d^{{}^{\prime\prime}}_{n,k}$ and
$W^{{}^{\prime\prime}}_{F_{n,k,i}}$. The gateway re-generates the sub-
watermark $R(sw_{h_{n,k,i}})$ by performing the generation process of
Algorithm 3 as shown in Line 4 and $sw^{{}^{\prime\prime}}_{h_{n,k,i}}$ is
extracted from $W^{{}^{\prime\prime}}_{F_{n,k,i}}$. The extracted sub-
watermark $sw^{{}^{\prime\prime}}_{h_{n,k,i}}$ and the re-generated sub-
watermark $R(sw_{h_{n,k,i}})$ will be compared using a comparison operation to
check data integrity. If data is not altered, the gateway queries the last
provenance record $p_{n,k,i}$ of the received watermarked data packet
$d^{{}^{\prime\prime}}_{(n,k)W_{F_{n,k,i}}}$ from the database. Then,
$E(sw^{{}^{\prime\prime}}_{f_{n,k,i}})$ is extracted from
$W^{{}^{\prime\prime}}_{F_{n,k,i}}$. The gateway performs a comparison
operation for $E(sw^{{}^{\prime\prime}}_{f_{n,k,i}})$ and $E(sw_{f_{n,k,i}})$
(i.e. last stored provenance record). If both values are the same, provenance
is verified, the gateway queries the set of stored provenance records
$P_{n,k}$ from the database and extracts the encrypted sub-watermarks
$E(sw_{f_{n,k,i}})$ of each $p_{n,k,i}$. At Line 15, the secret key $K_{j}$ is
used to decrypt $E(sw_{f_{n,k,i}})$ and obtain the sub-watermarks
$sw_{f_{n,k,i}}$ containing provenance information of the received data
packet. The gateway constructs the data path from provenance information
obtained. If data integrity or provenance is not verified, data will be
discarded and an attack procedure is performed and $P_{n,k}$ of received
watermarked data packet $d^{{}^{\prime\prime}}_{(n,k)W_{F_{n,k,i}}}$ is
deleted from the database.

###  3.5 Managing Internal Datagrams

In this section, we propose the idea of labeling IP datagrams that are used
internally for network management. These datagrams should not be analyzed by
the IDS and will undergo an internal security procedure. This optimizes the
scheme by minimizing the number of IDS operations on data packets. The
advantage of this protocol is the use of the Identification field, flags and
fragment offset as the embedding positions in the IP datagram header which
will appear random-like and will not show an evident pattern that an attacker
may try to exploit (cf. Section 3.3). The algorithm for managing IP datagrams
by network nodes is as follows:

Algorithm 6 (Internal managing algorithm at source node):

input: IP datagram $d_{IP}$
output: Embedding hash value

1:procedure Internal managing embedding process:

2: if($d_{IP}$ = internal managing packet) then

3: Compute H(Destination IP $||$ First 20 bytes of $d_{IP}$)

4: $d_{IP}$(header) $\leftarrow$ H(Destination IP $||$ First 20 bytes of
$d_{IP}$)

5: else

6: perform watermark generation and embedding procedure

7: end if

8:end procedure

Algorithm 7 (Internal managing algorithm at destination node):

input: IP datagram $d_{IP}$
output: Require IDS/internal-managing

1:procedure Internal managing process:

2: Receive ($d_{IP}$)

3: if(IP datagram $\leftarrow$ ($IP_{src.addr}$,$IP_{dest.addr}$)) then

4: if(($IP_{src.addr}$, $IP_{dest.addr}$ = internal) & L($R_{D}$) = L($D$))
then

5: Compute H(Destination IP $||$ First 20 bytes of $d_{IP}$)

6: Extracted H $\leftarrow$ $d_{IP}$(Identification+Flags+Offset)

7: if(Computed H = Extracted H) then

8: $d_{IP}$ is authenticated as “internal-managing data packet”

9: $d_{IP}$ is is not examined by IDS

10: else

11: attack detection

12: $d_{IP}$ is discarded

13: end if

14: else

15: $d_{IP}$ must be examined by the IDS

16: end if

17: else

18: $d_{IP}$ must be examined by the IDS

19: end if

20:end procedure

Figure 5: Embedding hash value in Internal Managing Protocol.

At each node or gateway, internal managing packets are labeled with a hash
value that is computed and embedded before the packet is sent. The hash value
is computed as H(Destination IP $||$ First 20 bytes of the datagram content),
where “$||$” concatenation. The value is then embedded in the IP datagram
header as shown in Algorithm 6 and Figure 5. We use the Identification field
(16 bits), Flags(3 bits) and Fragment offset(13 bits) to embed the selected 32
bit from the hash value. After receiving any IP Datagram at the Gateway or any
node in the internal network, an internal managing protocol is performed
(before any IDS procedure) as shown in Algorithm 7. The datagram is subjected
to a first condition that checks whether these datagrams have both a source
and a destination address in our local network, since this is a first
condition (filter). Then it checks if both the source and the destination
address are internal and the size of the received data packet is equal to an
internal managing packet size. Sensed data packets by sensor nodes are
watermarked and have different size (data packet + watermark) as shown in 3.
If it is not the case, the datagram must be examined by the IDS (it is not an
internal data packet). However, if both IP addresses are internal and the size
is confirmed, the device computes $H$(Destination IP address $||$ First 20
bytes of the datagram content) and extracts the hash value embedded in the
header of the data packet. Then the node compares these two hash values. If
these values are the same, the datagram is authenticated as “authorized
internal-managing packet”. Otherwise, an attack is detected and the datagram
is discarded.

The hash function used in obtaining the IP datagram label is SHA-2. SHA-2
takes an input of any size and produces a 256-bit hash value. Since the
Identification field is 16 bit long and the size of Flags and offset take
another 16 bits, making a total of 32 bits, the device selects 32 LSB bits
from the hash value as shown in Figure 5. We can also randomize the selection
of these 32 bits by using pseudo-random number generator and obtain randomized
bit positions that can be selected. This randomization would add another level
of security for the system.

##  4 Security Analysis

The IoT network can be subject to two main security breaches in the
transmission phase: passive and active attacks on both data and watermark. An
adversary can launch various attacks based on the threat model described in
Section 3.3. In this section, we provide an analysis for the security of our
proposed scheme against the attacks detailed in Section 3.3. We assume that
the network gateway and database are trusted and cannot be compromised by an
attacker.

###### Theorem 4.1

An unauthorized party cannot access or obtain the secret information generated
by the source node $S_{n}$.

###### Proof

The source node $S_{n}$ generates a final watermark $W_{F_{n,k,i}}$ by
concatenating two sub-watermarks $sw_{f_{n,k,i}}$ and $sw_{h_{n,k,i}}$. The
first sub-watermark $sw_{f_{n,k,i}}$ is obtained from extracted data features
as follows: IP address $w_{ip}$ and sensed data capturing time $w_{t}$. These
data features are encrypted using Advanced Encryption Standard (AES) algorithm
using a symmetric secret key $K_{j}$. $sw_{f_{n,k,i}}$ is generated and
encrypted as $E(sw_{f_{n,k,i}})=ENC(sw_{f_{n,k,i}},K_{j})$. Thus, an attacker
being unaware of $K_{j}$ cannot decrypt $sw_{f_{n,k,i}}$ (only authorized
parties are aware of $K_{j}$, i. e., intermediate nodes and gateway). Note
that $K_{j}$ is changed and redistributed after a short random number of
watermark generation sessions (see Section 3.3). For the second sub-watermark
$sw_{h_{n,k,i}}$, a source node uses a one-way cryptographic hash function
$H()$ to obtain $sw_{h_{n,k,i}}$ used for data integrity check. It is
computationally infeasible to to find a pair $(x,y)$ such that $h(x)=h(y)$,
which make the function secure and cannot be inverted as assumed in Section
3.3. Additionally, we use SHA-2 hash function in our scheme with 256 bit hash
value, which make it computationally infeasible for an attacker to carry out
$2^{128}$ calculations to find the second sub-watermark. The generated
watermark is computed as $W_{F_{n,k,i}}=E(sw_{f_{n,k,i}})$ $||$
$sw_{h_{n,k,i}}$ for each captured data. Thus, an adversary cannot access
watermark information generated by source nodes.

###### Theorem 4.2

An attacker, cannot successfully deceive an intermediate node $I_{l}$ or
gateway $G$ by inserting fake data or deleting data from the data flow
generated by a legitimate node $S_{n}$ and transmitted to $I_{l}$ or $G$.

###### Proof

In case an attacker inserts fake data into a watermarked data-packet
$d_{(n,k)W_{F_{n,k,i}}}$ being transmitted to $I_{l}$ or $G$, the destination
node extracts $d_{(n,k)W_{F_{n,k,i}}}$ into sensed data $d_{n,k}$ and
watermark $W_{F_{n,k,i}}$. Then, a re-generated sub-watermark
$R(sw_{h_{n,k,i}})$ is computed from the received captured data $d_{n,k}$ and
compared to the extracted watermark $sw^{{}^{\prime}}_{h_{n,k,i}}$ from
$W_{F_{n,k,i}}$. The process of re-generation is based on the previously
mentioned generation process (i. e., SHA-2 hash function for
$sw_{h_{n,k,i}}$). Hence, any change in $d_{n,k}$ content produces an altered
re-generated sub-watermark. The assumption of secure communication of
extracted data features and provenance information using symmetric
cryptography and a one-way hash function applies (Section 3.3). Then, even if
an attacker inserts fake data into $W_{F_{n,k,i}}$ without altering $d_{n,k}$,
$R(sw_{h_{n,k,i}})$ will not match $sw^{{}^{\prime}}_{h_{n,k,i}}$ in the
comparison process. Also, if the attacker inserts fake data to the second sub-
watermark $E(sw^{{}^{\prime}}_{f_{n,k,i}})$ the next hop intermediate node or
gateway queries the stored provenance record $p_{n,k,i}=E(sw_{f_{n,k,i}}$ from
the data base and compares it with the extracted sub-watermark
$E(sw^{{}^{\prime}}_{f_{n,k,i}})$. Any change in
$E(sw^{{}^{\prime}}_{f_{n,k,i}})$ yields to alternation in the provenance
information.

In the second case, the attacker aims to delete data content from $d_{n,k}$ or
$W_{F_{n,k,i}}$, or drop an entire data-packet $d_{(n,k)W_{F_{n,k,i}}}$ being
routed from $S_{n}$ to $I_{l}$ or from $I_{l}$ to $G$. The deletion of $q$
bits from $d_{n,k}$ results in the modification of $R(sw_{h_{n,k,i}})$ and
thus $sw^{{}^{\prime}}_{h_{n,k,i}}$ will not match $R(sw_{h_{n,k,i}})$. Again,
the previously mentioned assumption of secure communication of $W_{F_{n,k,i}}$
applies. Furthermore, if the attacker deletes $q$ bits from $W_{F_{n,k,i}}$ it
will be detected in the comparison process of the two sub-watermarks
$R(sw_{h_{n,k,i}})$ and $sw^{{}^{\prime}}_{h_{n,k,i}}$ or between the queried
sub-watermark $E(sw_{f_{n,k,i}})$ and the extracted one
$E(sw^{{}^{\prime}}_{f_{n,k,i}})$. Obviously, such an adversary may drop
$d_{(n,k)W_{F_{n,k,i}}}$ routed through $I_{l}$. This attack can be detected
at $G$ by accessing the tamper-proof database and querying the provenance
records of $d_{n,k}$, and detecting where the packet drop attack occurred. The
database stores provenance records securely, which cannot be accessed by an
attacker (as described in Section 3.3).

###### Theorem 4.3

An attacker, attempting to alter provenance information: $(i)$ cannot add
legitimate nodes to the provenance of data generated by an unauthorized node,
$(ii)$ cannot successfully add or remove nodes from the provenance of data
generated by legitimate nodes.

###### Proof

$I_{l}$ stores a provenance record $W_{F_{n,k,i}}$ after checking data
integrity and provenance of the received data-packet $d_{(n,k)W_{F_{n,k,i}}}$.
The symmetric secret key $K_{j}$ shared between legitimate nodes is used to
obtain the generated watermark $W_{F_{n,k,i}}$ used in data integrity and
provenance validation. An unauthorized node generates watermarks using its own
secret key that cannot match a generated watermark at $I_{l}$ using $K_{j}$.
As stated in Section 3.3, the source node, the intermediate node and the
gateway share secret-keys to be used in different steps of the algorithms
(encryption/decryption). These keys are changed and redistributed between
legitimate nodes after a random number of sessions. Thus, in order to add a
legitimate node, an attacker needs to obtain the same symmetric secret key
that is only shared within legitimate network nodes of internal registered IP
addresses. In the case of two malicious nodes $I_{m}$ and $I_{v}$ attempting
to execute an attack, a captured data-packet $d_{n,k}$ by a legitimate source
node $S_{n}$ is routed through $S_{m}$. $d_{n,k}$ has a provenance record of
($I_{1}$, $I_{2}$, $I_{4}$). The malicious node $I_{m}$ aims to remove $I_{2}$
and replace it with $I_{v}$. To add $I_{v}$ as a provenance record to the
database, the malicious node needs to compute the next-hop watermark which
requires, as mentioned above, the knowledge of $K_{j}$ and hash function
variables. Hence, the provenance integrity check at the next $I_{j}$ will fail
and an attack is detected. Thus, $I_{m}$ will fail to add or remove any
provenance record from network database. Moreover, provenance records
($W_{F_{n,k,1}}$, $W_{F_{n,k,2}}$, …, $W_{F_{n,k,i}}$) of a data-packet
$d_{n,k}$ are stored in a tamper-proof database that is assumed to be
resistant to any alternation of its entities, attackers cannot alter any
record stored in it (see Section 3.3).

###### Theorem 4.4

It is impossible for an attacker, whether acting alone or in collaboration
with others, to add or authenticate nodes to the provenance of data produced
by a compromised node.

###### Proof

An attacker may generate fake data and store provenance information in the
database as a legitimate node with its secret key. The packet is then
forwarded to the next hop intermediate node to store the next hop provenance
information in the set of provenance records $P_{n,k}$ for this data packet in
the database. The attacker’s aim is to construct the provenance from innocent
forwarding nodes and make them responsible for false data forwarding, thus
marking them as untrustworthy nodes. However, there is an integrity and
provenance validation procedure at the next hop node, which includes a
watermark re-generation process $W_{F_{(n,k,i)}}$ using the secret key
$K_{j}$, the attacker do not know the key for legitimate nodes. Thus, this
attack will fail at the first hop.

###### Theorem 4.5

Any unauthorized attempt to modify data content through transmission channel
would be detected.

###### Proof

An adversary may perform a modification to the embedded watermark (computed as
$W_{F_{n,k,i}}=E(sw_{f_{n,k,i}})$ $||$ $sw_{h_{n,k,i}}$) or data elements
$d_{(n,k)W_{F_{n,k,i}}}$. If data elements are modified and $W_{F_{n,k,i}}$
remains unchanged, a different watermark is obtained based on a wrong hash
value at an intermediate node or gateway. Since the first generated sub-
watermark at source node $sw_{h_{n,k,i}}$ is the output of a hash function
SHA-2 obtained as $sw_{h_{n,k,i}}=H(d_{n,k})$. Again, the assumption of hash
functions used in the system (Section 3.3) applies. The wrong re-generated
sub-watermark $R(sw_{h_{n,k,i}})$ will not match the extracted sub-watermark
$sw^{{}^{\prime}}_{h_{n,k,i}}$. The intermediate node or gateway detects the
modification attack and discards the data. Furthermore, if the attacker
modifies $W_{F_{n,k,i}}$ and the data payload remains unchanged, the
intermediate node or gateway re-generates the right sub-watermark, extract the
modified watermark from the received data packet and queries the provenance
record $p_{n,k,i}$ from the database. This results in a failed comparison
operation for data integrity or for provenance validation and data will be
discarded.

###### Theorem 4.6

By including a timestamp in the generation process of watermarks, any fraud
transmission of previously captured data packets will be discovered.

###### Proof

An attacker may provide a false idea about the sensing environment by
fraudulently transmitting previously heard data packets that are captured and
transmitted by a legitimate source node [39]. The attacker also detects the
timing characteristics to be used later during the packet replay attack. To
deceive an intermediate node or gateway, the attacker updates the timestamp
$w_{t}$ of the heard data packet $d_{n,k}$, based on timing characteristics,
to a new recent time value. In the proposed scheme, a source node generates a
watermark $W_{F_{n,k,i}}$ for each data packet captured ($d_{n,k}$). The
generation process is based on provenance information, a timestamp and a hash
value as described in Equation (1). Provenance information and timestamp will
be encrypted using a secret key $K_{j}$ to form the first sub-watermark (i.
e., encrypting $sw_{f_{n,k,i}}=w_{ip}$ $||$ $w_{t}$ as $E(sw_{f_{n,k,i}})=$
$ENC(sw_{f_{n,k,i}}$,$K_{j})$). At next hop $I_{l}$ or $G$, a new sub-
watermark is generated from the replayed packet that will be compared to the
extracted sub-watermark. If the attacker changed the timestamp of the data
packet $d_{n,k}$ the comparison operation will fail. Since timestamps are
different the new re-generated sub-watermark will not match the extracted one.
Note that the attacker cannot modify the timestamp $w_{t}$ embedded in the
watermark $W_{F_{n,k,i}}$, due to the encryption process performed on the
generated sub-watermark $sw_{f_{n,k,i}}$. The sub-watermark is encrypted using
the source secret key $K_{j}$, which is only shared with legitimate entities
(intermediate node and gateway) where an attacker uses a different secret key
as stated in Section 3.3. Hence, replaying an old packet with an updated
timestamp will lead to a failed authentication procedure.

###### Theorem 4.7

In Algorithm 7, an attacker trying to deceive network devices to accept
malicious datagrams as trusted internal managing datagrams will be detected
and examined by implemented security algorithms.

###### Proof

If an attacker succeeds to modify an internal managing datagram, the datagram
will be forwarded to the next hop node. At the receiving node, a hash value is
computed from the content of the datagram using a one way hash function as
detailed in Section 3.5. It also extracts the hash value embedded by the
source node from the identification field of the IP header. Both hash values
are then compared to detect any attempt of forgery attack. If the values do
not match, the device applies the implemented security algorithms to the
received IP datagram and an attack procedure is performed. Note that a source
node uses a one-way cryptographic hash function $H()$ using SHA-2 to obtain
the hash value (embedded in internal managing IP datagram’s header) so that it
is computationally infeasible to find a pair $(x,y)$ such that $h(x)=h(y)$,
making it impossible for an attacker to invert the hash value and embed it to
deceive the system (Section 3.3). Hence, a malicious entity trying to deceive
the forwarding nodes using internal managing datagrams will be detected and
discarded.

Based on the above security analysis, the proposed scheme is proven to be
resistant against various malicious attacks of IoT networks, such as
modification attack, integrity attack, packet replay, database authentication
attack and passive attacks. It guarantees the integrity of data and ensures
security against identifying and retrieving provenance information in IoT
networks.

##  5 Simulation Results and Analysis

In this section, we evaluate the performance of the proposed scheme based on
two features: data integrity and data provenance. For data integrity, the
proposed scheme is evaluated based on watermark generation, embedding and
verification time. Also, we have measured how this scheme performs in terms of
energy utilization. The results are then compared to three state of the art
techniques: RWFS [25], Asymmetric Cryptography Technique (ACT) [23] and Zero-
Watermarking Scheme (ZWT) [27] based methods. We selected these three state-
of-the-art methods to assess the performance of our new security technique
based on their use of different security techniques deployed in a similar
network model. For data provenance, we compare our scheme with MAC-based
provenance scheme (MP) in terms of cost analysis. The algorithms were
implemented in MATLAB™ on Intel core i7 processor with a 2.59 GHz clock cycle
and 16 GB of memory. Sensor data is represented as an integer data type, since
most sensor readings are of numeric form such as temperature, humidity, motion
and intensity.

In our algorithm, we use AES with 128 bit key size for encryption of generated
watermarks. Despite the fact that AES has a larger key size than Data
Encryption Standard (DES), AES is a more secure and advanced encryption
algorithm compared to DES, which makes it more resistant to cryptanalysis
attacks. Another reason for using AES is its performance and efficiency. AES
is a fast and efficient algorithm. We provide, in Figures 6a, 6b, 7a and 7b, a
comparison of using AES and DES algorithms in the generation and verification
processes at each sensor node in our proposed model. The results show the
better performance of our scheme when applying AES algorithm (approximately 10
times faster) in both watermark generation and verification. The use of
substitution-permutation network (SPN) structure, which is optimized for
hardware implementation and allows for parallel processing in AES shows a
faster performance than DES, which uses a Feistel network structure. Regarding
the hash function, we use a one way hash function SHA-2, specifically SHA-256,
for generating the second sub-watermark $sw_{h}$. Although SHA-1 is faster
than SHA-2 functions since it uses a smaller block size and has a simpler
construction, however it is important to note that the slower performance of
SHA-2 functions is outweighed by their improved security compared to SHA-1. We
compared the generation and verification time of our proposed model using
different hash functions in Figures 8a and 8b. The results shows that SHA-1 is
faster than SHA-2 functions and SHA-2(256) function requires less processing
time than SHA-2(384) and SHA-2(512). Hence, we use SHA-2(256), which provides
the best performance in SHA-2 functions, as our hash function in the
generation of watermarks.

(a)

(b)

Figure 6: Computational time. (a) Watermark generation and embedding time
using AES. (b) Watermark verification time using AES.

(a)

(b)

Figure 7: Computational time. (a) Watermark generation and embedding time
using DES. (b) Watermark verification time using DES.

(a)

(b)

Figure 8: SHA Comparison. (a) Watermark generation and embedding time using
different SHA functions. (b) Watermark verification time using different SHA
functions.

###  5.1 Performance Evaluation

To evaluate the performance, we measure the computational time such as
watermark generation, embedding, and watermark verification time of our
proposed scheme, RWFS [25], ACT [23] and ZWT [27]. Additionally, we used
energy utilization as another performance metrics and compared the results
with existing methods [25, 23, 27]. We select these three works from the
literature to compare our model with a regular watermarking technique,
asymmetric cryptography technique and a zero-watermarking technique. From our
research work, these papers provide these three methods and deploys it in a
scenario similar to what we are analyzing and studying. Note that a confidence
interval is added to show the average generation and verification time after a
100 simulation runs.

####  5.1.1 Computational time

Computational time is described as the time required to complete the following
processes: watermark generation, embedding and verification at sensor nodes
and gateway.

  1. 1.

Watermark generation and embedding time: It is the time taken by a source node
or intermediate node to generate a watermark and embed it in the data packet.
The existing RWFS [25] generates a watermark by encrypting the sensed data
with a homomorphic encryption algorithm proposed by Castelluccia et al. [40]
and passing it as an input to a keyed-hash message authentication code (HMAC).
The watermark is then embedded randomly by computing each position of
watermark bits using a pseudo-random number generator (PRNG) for each captured
data at source node. In ACT [23], the watermark generation is based on an
asymmetric cryptography function and uses group hashing for a set of data
values that need to be captured in different time intervals before generating
the watermark. Additionally, ZWT [27] uses DES for watermark encryption in the
watermark generation process. Comparing these approaches [25, 23, 27], our
proposed scheme uses a zero-watermarking technique that generates a fixed size
watermark from provenance information and data features. It applies a one-way
hash function to extracted data features and symmetric encryption (i. e., AES)
for provenance information. Simulation results shows that the proposed scheme
requires less watermark generation and embedding time than existing approaches
[25, 23, 27] as observed in Figure 9a. Using AES as an encryption and SHA-2 to
generate watermarks shows a significant improvement in the performance of
sensor nodes. This results in decreasing the end-to-end time from capturing
data to processing it at the destination gateway.

  2. 2.

Watermark verification time: The verification algorithm is used to extract
watermark and verify data integrity at the destination node. This procedure is
performed at an intermediate node or gateway which have more computational and
power capabilities than source nodes. In the proposed approach, the watermark
is concatenated to the data payload and each watermark is generated using AES
and SHA-2 for each data packet which requires less extraction and verification
time than RWFS [25], ACT [23] and ZWT [27]. The time for extracting and
verifying data integrity in [25] depends on computing each watermark bit
position and computing a hash value after re-encrypting the extracted data. In
[23], the intermediate node or gateway requires receiving several data packets
to perform watermark extraction and re-calculating the watermark based on
asymmetric encryption to perform verification. Moreover, in ZWT [27], the
intermediate node or gateway needs to extract data features from the received
data packet and encrypt these features using DES algorithm to re-generate the
watermark for verification. Figure 9b shows that the proposed zero-watermark
approach requires less time to extract and verify data integrity than existing
schemes [25, 23, 27]. It is worth pointing out that the proposed approach
provides both data integrity and data provenance. The time shown in Figure 9b
for our proposed scheme includes also the time needed for querying the stored
watermarks from the database.

(a)

(b)

Figure 9: Computational time. (a) Watermark generation and embedding time. (b)
Watermark verification time.

####  5.1.2 Energy consumption

Energy consumption evaluates the energy consumed by a sensor node from the
power utilized by each node and the total time consumed in the sensor node
operation steps as shown in Figure 10. The energy consumed by a sensor node
varies based on several basic energy consumption sources: processing time
cost, radio transmission, sensor sensing, transient energy, and sleeping time
cost [41, 42, 43]. It is crucial to utilize less energy-consuming security
mechanisms for IoT networks due to the limited computation and power
capabilities of sensor nodes. In the proposed scheme, we made our assumptions
regarding energy consumption due to the fixed space required for watermark
embedding. The phases that affect energy consumption in a sensor node are
sensor node activation cost, watermark generation and embedding cost, data
capturing cost, data transmission cost and cost for going to sleeping mode.
The energy ($E_{n}$) of each sensor node in the network is computed according
to Equation (3). The power ($P_{n}$) utilized by each node is determined by
node’s hardware components, the network’s data rate, and the communication
protocols used by the network. In order to estimate the power consumption of
the sensor node for numerical simulation we use the energy model in [44] based
on Mica2 Motes. The time to complete a round of a sensor node operation
specified in Figure 10 is $T_{n}$ which varies according to the data
processing method and functionality of this node as shown in the figure. We
assume, as in [44], that the parameters used in the energy calculation are as
follows: $T_{A}$ = 1ms (Active time cost), $T_{S}$ = 0.5 ms (Data sensing
time), $T_{C}$ (Computation and processing time), $T_{TR}$ = 300 ms (Data
transmission time), $T_{SL}$ = 299 ms (sleeping time cost), and $P_{n}$ = 30mW
(Average power consumption of a single sensor node). Using Equation (5) we
compute the energy of sensor nodes based on the previously specified
parameters.

$E_{n}=P_{n}\times T_{n}$ (4)

$E_{n}=P_{n}\times(T_{A}+T_{S}+T_{C}+T_{TR}+T_{SL})$ (5)

The analysis of the energy consumption of ZIRCON scheme compared to RWFS [25],
ACT [23] and ZWT [27] shows that our approach requires less energy for each
operating node. This results in an increase in life time of our network
compared to other networks. The higher energy consumption in RWFS [25] is
based on the computation of bit positions for watermark embedding and the
encryption of captured data (that is used as an input to an HMAC function to
obtain a final watermark) using homomophic encryption algorithm. This method
is slower than conventional symmetric encryption methods because of the
complex mathematics it requires. In comparison to homomorphic encryption,
symmetric encryption is quicker and easier to use because uses a single key to
encrypt and decrypt data. Also, in ACT [23] the use of asymmetric cryptography
functions and group hashing requires more energy at each sensor node due to
the additional computational overhead required for the public and private key
operations. The existing scheme ZWT [27], which uses DES for watermark
encryption, dissipates higher energy than our proposed scheme which uses AES
for sub-watermark encryption. Figures 11 and 12 shows the energy consumption
of our proposed scheme compared to existing state-of-the-art methods RWFS
[25], ACT [23] and ZWT [27], for a single source node and an intermediate node
respectively. It is clearly shown that ZIRCON requires less energy consumption
at each node of the network.

Figure 10: Sensor node operation cycle.

Figure 11: Energy consumption cost per single source node.

Figure 12: Energy consumption cost per single intermediate node.

###  5.2 Cost Analysis

Regarding cost analysis, we compare ZIRCON with three state-of-the-art methods
in terms of transmission data size and data packet length. These approaches
are as follows:

  1. 1.

The secure provenance framework $SProv$ [45] that is adapted to sensor
networks by [46]. The provenance record at a node $n_{i}$ is
$p_{i}=<n_{i},\mathrm{hash}(D_{i}),C_{i}>$, where $\mathrm{hash}(D_{i})$ is a
one way hash function of the updated data and
$C_{i}=\mathrm{sign}(\mathrm{hash}(n_{i},\mathrm{hash}(D_{i})|C_{i-1})$ is an
integrity checksum. This method is referred to as SSP.

  2. 2.

The MAC-based provenance scheme which computes a MAC value and send it with
the node ID as the provenance record. This method is referred to as MP [46].

  3. 3.

A lightweight secure scheme BFP [46] that uses Bloom Filters to encode
provenance information, which is sent along the data path with the data
packet.

In our proposed scheme, a sensor node transmits both provenance information
(IP address and timestamp) and a hash value as a zero-watermark. The IP
address and the timestamp both have a size of 4 bytes. The source node
encrypts the sub-watermark $sw_{f_{n,k,i}}$ and produce an encrypted sub-
watermark of 16 bytes. Also, the source node computes the hash value from the
extracted data payload, as shown in Algorithm 1, and selects the first 8
bytes. This implies that the generated zero-watermark including the provenance
record is 24 bytes. The provenance record is stored in a tamper-proof network
database at each hop. Hence, each data packet holds only one generated zero-
watermark in each hop. For SSP, to perform cryptographic hash operations, they
utilize SHA-1 with a bit length of 160, and for generating digital signatures
of 160 bits (ECDSA), they make use of the TinyECC library [47]. The node ID,
which is 2 bytes long, results in each provenance record being 42 bytes in
length. To implement MP, the provenance record is formed of node ID and a MAC
value computed on each source node. It uses the TinySec library [48] to
compute the sensor CBC-MAC of size 4 bytes. Thus, the provenance record is of
6-byte size. In both schemes, SSP and MP, each node embeds its provenance
information as a record with data packet, as the path length increases the
provenance size increases linearly. This increase in provenance leads to an
increase in the transmitted data packet size. In a multi-hop scenario, the
provenance is $6\times H$ bytes (i. e., the path is formed of $H$ hops) for MP
and $42\times H$ bytes for SSP. However, in BFP, the provenance length depends
on parameter selection of the Bloom Filter. For a given $H$ and a false
positive probability $P_{fp}=0.02$, the number of required bits to encode the
provenance information is $m=(-H\cdot\ln(P_{fp}))/(\ln 2)^{2}$. In this case
the length of a BF grows with the number of nodes. Figure 13a shows a
comparison between ZIRCON, SSP, MP and BFP approaches in-terms of transmission
data size in a single hop scenario. Similarly, the results for data packet
length in a Multi-hop scenario for both schemes is shown in Figure 13b. In
resource constrained networks, energy is mainly affected by data transmission,
which increases as the data packet increase. The results show that ZIRCON
performs better than SSP and MP as the number of hops increases in the sensor
network. Also, our algorithm outperforms BFP in terms of provenance length and
scalability as the size of the network increases, and as the number of hops
exceeds 11. Our proposed model only encodes one provenance record $p_{n,k,i}$
with each data packet $d_{n,k}$ during transmission.

(a)

(b)

Figure 13: Cost comparison. (a) Transmission data size in single hop scenario.
(b) Provenance length in Multi-hop scenario.

##  6 Discussion

The related literature includes many proposed schemes for ensuring data
integrity and secure provenance transmission in WSN s using digital
watermarking. These models are elaborated in section 2. The limitations of
such solutions were addressed in our proposed scheme. In this scheme we
combine both data integrity and secure provenance transmission, taking into
consideration the computational capabilities of sensor nodes in IoT networks,
while maintaining security standards. IoT networks are vulnerable to many type
of attacks. These networks are used in decision making processes that require
high level of security. Moreover, it is essential in many situations to keep
track of the data captured from sensor nodes to identify any malicious traffic
in the context of intrusion detection systems. For this, it requires to
overcome a set of challenges in order to securely transmit provenance
information. The difficulties involve handling processing overhead of each
network node, transmitting information about the origin of data in an
efficient way without using extra bandwidth and quickly responding to any
security breaches. Provenance information grows very fast, which requires
transmitting large amount of provenance information with data packets. In
fact, building the lineage of each data-packet requires storing the
information of the data-packet including the complete set of nodes that were
covered from source to destination. Embedding such vast amount of information
with the data packet will result in a massive network overhead. This requires
a solution for handling this amount of provenance information. This critical
problem was not addressed in the related literature. In this context, we
propose the use of a tamper-proof database to store these information that are
embedded in watermarks at each node covered in the network. Hence, to obtain
the required security standards, the proposed zero-watermarking approach
generates two sub-watermarks that are used for integrity verification and
secure provenance transmission. The sub-watermarks are based on one-way hash
function (i. e., SHA-2) and symmetric encryption (i. e., AES). In our work, we
provide an efficient and secure way to keep track of the whole network route
that a piece of information has taken despite bandwidth overhead, storage
limitations and computational overhead, while ensuring data integrity.

Managing internal data packets is a key component of improving IDS efficiency.
Analyzing each data packet by the IDS at each node implies additional
computational overhead. This issue was not addressed in the related
literature, which only focus on data packets that are specified for sensed
data. In our model, we propose a protocol for labeling internal managing data
packets which allows to check for any attack at the level of these packets
without the need to analyze it by IDS. In our work, we validate our zero-
watermarking algorithm through a security analysis that shows our approach is
robust to many attacks based on an attack model. Additionally, we provide a
performance evaluation to analyze computational time, energy consumption and
cost analysis in comparison with related literature.

As a result of our security scheme outlined and proposed in this paper, there
are several areas for future study and improvement. The fast evolution of
security attacks against IoT networks, such as Distributed Denial of Service
(DDoS), Botnets, Privacy invasion and Physical attack, requires the
advancement in security measures to protect against these types of attacks and
to ensure the security of IoT networks. This presents an important call to
discover ways to tackle the vast number of security attacks that are not yet
studied in the area of securing data provenance in integrity in IoT networks.
Another issue is that large-scale IoT networks that introduce the problem of
large-scale provenance need to be analyzed. How to handle the huge lineage of
data being transmitted over long data-path. Even in the presence of a
database, how to manage methods to efficiently overseeing a large quantity of
sensor nodes and the data they collect, along with information about its
origin and the path it covers.

##  7 Conclusion

This paper addresses the problem of data integrity and secure transmission of
provenance information for IoT networks. We propose a zero-watermarking
approach that embeds provenance information and data features with data
packets and stores these watermarks in a tamper-proof network database. The
security capabilities of ZIRCON makes it secure against different type of
sensor network attacks, as proved using a formal security analysis. We have
validated our findings by conducting representative simulations and compared
our results with existing schemes based on different performance parameters.
The results show that the proposed scheme is lightweight, has better
computational efficiency and consumes less energy, compared to prior art.
Perspectives for future work include testing this scheme to various attacks
that are not included in our threat model and study the possibility of using
this method for large-scaled provenance.

## References

  * [1] M. Ammar, G. Russello, and B. Crispo, “Internet of things: A survey on the security of iot frameworks,” _Journal of Information Security and Applications_ , vol. 38, pp. 8–27, 2018.
  * [2] A. Botta, W. de Donato, V. Persico, and A. Pescapé, “Integration of cloud computing and internet of things: A survey,” _Future Generation Computer Systems_ , vol. 56, pp. 684–700, 2016.
  * [3] J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, “Internet of things (iot): A vision, architectural elements, and future directions,” _Future Generation Computer Systems_ , vol. 29, no. 7, pp. 1645–1660, 2013.
  * [4] M. T. Lazarescu, _Wireless Sensor Networks for the Internet of Things: Barriers and Synergies_. Springer International Publishing, 2017, pp. 155–186.
  * [5] N. Manikandan and S. Subha, “Parallel aes algorithm for performance improvement in data analytics security for iot,” _International Journal of Networking and Virtual Organisations_ , vol. 18, no. 2, pp. 112–129, 2018.
  * [6] S. Sicari, A. Rizzardi, L. Grieco, and A. Coen-Porisini, “Security, privacy and trust in internet of things: The road ahead,” _Computer Networks_ , vol. 76, pp. 146–164, 2015.
  * [7] B. B. Zarpelão, R. S. Miani, C. T. Kawakani, and S. C. de Alvarenga, “A survey of intrusion detection in Internet of Things,” _Journal of Network and Computer Applications_ , vol. 84, pp. 25–37, 2017.
  * [8] K. Ren, W. Lou, and Y. Zhang, “Leds: Providing location-aware end-to-end data security in wireless sensor networks,” _IEEE Transactions on Mobile Computing_ , vol. 7, no. 5, pp. 585–598, 2008.
  * [9] M. A. Khan and K. Salah, “Iot security: Review, blockchain solutions, and open challenges,” _Future Generation Computer Systems_ , vol. 82, pp. 395–411, 2018.
  * [10] S. Sultana, M. Shehab, and E. Bertino, “Secure provenance transmission for streaming data,” _IEEE Transactions on Knowledge and Data Engineering_ , vol. 25, no. 8, pp. 1890–1903, 2013.
  * [11] C. Dai, D. Lin, E. Bertino, and M. Kantarcioglu, “An approach to evaluate data trustworthiness based on data provenance,” in _Secure Data Management_ , W. Jonker and M. Petković, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2008, pp. 82–98.
  * [12] R. G. Van Schyndel, A. Z. Tirkel, and C. F. Osborne, “A digital watermark,” in _Proceedings of 1st international conference on image processing_ , vol. 2. IEEE, 1994, pp. 86–90.
  * [13] C. Fei, D. Kundur, and R. H. Kwong, “Analysis and design of secure watermark-based authentication systems,” _IEEE transactions on information forensics and security_ , vol. 1, no. 1, pp. 43–55, 2006.
  * [14] I. Cox, M. Miller, J. Bloom, J. Fridrich, and T. Kalker, _Digital Watermarking and Steganography_. Morgan Kaufmann Publishers Inc., 2007.
  * [15] D. Megías, “Data hiding: New opportunities for security and privacy?” in _Proceedings of the European Interdisciplinary Cybersecurity Conference_ , ser. EICC 2020, 2021, pp. 1–6.
  * [16] L. Perez-Freire, P. Comesana, J. R. Troncoso-Pastoriza, and F. Perez-Gonzalez, “Watermarking Security: a Survey,” in _Transactions on data hiding and multimedia security I_. Springer, 2006, pp. 41–72. [Online]. Available: https://dl.acm.org/doi/10.5555/2172238.2172240
  * [17] G. Zhang, L. Kou, L. Zhang, C. Liu, Q. Da, and J. Sun, “A new digital watermarking method for data integrity protection in the perception layer of iot,” _Security and Communication Networks_ , vol. 2017, 2017.
  * [18] H. Guo, Y. Li, and S. Jajodia, “Chaining watermarks for detecting malicious modifications to streaming data,” _Information Sciences_ , vol. 177, no. 1, pp. 281–298, 2007.
  * [19] I. Kamel and H. Juma, “Simplified watermarking scheme for sensor networks,” _International Journal of Internet Protocol Technology_ , vol. 5, no. 1/2, p. 101–111, 2010.
  * [20] ——, “A lightweight data integrity scheme for sensor networks,” _Sensors (Basel, Switzerland)_ , vol. 11, pp. 4118–4136, 12 2011.
  * [21] B. Wang, W. Kong, and N. Xiong, “A dual-chaining watermark scheme for data integrity protection in internet of things,” _Computers, Materials and Continua_ , vol. 58, pp. 679–695, 01 2019.
  * [22] X. Shi and D. Xiao, “A reversible watermarking authentication scheme for wireless sensor networks,” _Information Sciences_ , vol. 240, pp. 173––183, 2013.
  * [23] X. Sun, J. Su, B. Wang, and Q. Liu, “Digital watermarking method for data integrity protection in wireless sensor networks,” _International Journal of Security and Its Applications_ , vol. 7, no. 4, pp. 407–416, 2013.
  * [24] L. Zhou and Z. Zhang, “A secure data transmission scheme for wireless sensor networks based on digital watermarking,” in _2012 9th International Conference on Fuzzy Systems and Knowledge Discovery_ , 2012, pp. 2097–2101.
  * [25] A. Alromih, M. Al-Rodhaan, and Y. Tian, “A randomized watermarking technique for detecting malicious data injection attacks in heterogeneous wireless sensor networks for internet of things applications,” _Sensors (Basel, Switzerland)_ , vol. 18, no. 12, Dec 2018.
  * [26] F. Lalem, A. Muath, A. Bounceur, R. Euler, L. Laouamer, L. T. Nana, and A. C. Pascu, “Data Authenticity and Integrity in Wireless Sensor Networks Based on a Watermarking Approach,” in _The 29th International Florida Artificial Intelligence Research Society_ , ser. FLAIRS-29, Key Largo, Florida, United States, May 2016, pp. 276–281. [Online]. Available: https://hal.univ-brest.fr/hal-01294146
  * [27] K. Hameed, A. Khan, M. Ahmed, A. G. Reddy, and M. M. Rathore, “Towards a formally verified zero watermarking scheme for data integrity in the internet of things based-wireless sensor networks,” _Future Generation Computer Systems_ , vol. 82, pp. 274–289, 2018.
  * [28] D. Boubiche, S. Boubiche, H. Toral-Cruz, A.-S. K. Pathan, A. Bilami, and S. Athmani, “Sdaw: Secure data aggregation watermarking-based scheme in homogeneous wsns,” _Telecommunication Systems_ , vol. 59, pp. 277–288, 04 2015.
  * [29] U. Park and J. Heidemann, _Provenance in Sensornet Republishing_. Berlin, Heidelberg: Springer-Verlag, 2008, p. 280–292. [Online]. Available: https://doi.org/10.1007/978-3-540-89965-5_28
  * [30] H.-S. Lim, Y.-S. Moon, and E. Bertino, “Provenance-based trustworthiness assessment in sensor networks,” in _Proceedings of the Seventh International Workshop on Data Management for Sensor Networks_ , ser. DMSN ’10. New York, NY, USA: Association for Computing Machinery, 2010, p. 2–7.
  * [31] E. Bertino, _Security and Privacy in the IoT_. Springer, Cham, 01 2018, pp. 3–10.
  * [32] M. N. Aman, K. C. Chua, and B. Sikdar, “Secure data provenance for the internet of things,” in _Proceedings of the 3rd ACM International Workshop on IoT Privacy, Trust, and Security_ , ser. IoTPTS ’17. New York, NY, USA: Association for Computing Machinery, 2017, p. 11–14.
  * [33] M. Kamal and s. Tariq, “Light-weight security and data provenance for multi-hop internet of things,” _IEEE Access_ , vol. 6, pp. 34 439–34 448, 2018.
  * [34] R. Hasan, R. Sion, and M. Winslett, “The case of the fake picasso: Preventing history forgery with secure provenance,” in _7th USENIX Conference on File and Storage Technologies (FAST 09)_. USENIX Association, Feb. 2009, pp. 1–14. [Online]. Available: http://usenix.org/event/fast09/tech/full_papers/hasan/hasan.pdf
  * [35] A. Syalim, T. Nishide, and K. Sakurai, “Preserving Integrity and Confidentiality of a Directed Acyclic Graph Model of Provenance,” in _24th Annual IFIP WG 11.3 Working Conference on Data and Applications Security and Privacy (DBSEC)_ , vol. LNCS-6166, Jun. 2010, pp. 311–318.
  * [36] S. Sultana, E. Bertino, and M. Shehab, “A provenance based mechanism to identify malicious packet dropping adversaries in sensor networks,” in _2011 31st International Conference on Distributed Computing Systems Workshops_ , 2011, pp. 332–338.
  * [37] J. Cui, L. Shao, H. Zhong, Y. Xu, and L. Liu, “Data aggregation with end-to-end confidentiality and integrity for large-scale wireless sensor networks,” _Peer-to-Peer Networking and Applications_ , vol. 11, no. 5, pp. 1022–1037, sep 2018.
  * [38] P. Ganesan, R. Venugopalan, P. Peddabachagari, A. Dean, F. Mueller, and M. Sichitiu, “Analyzing and modeling encryption overhead for sensor network nodes,” in _Proceedings of the 2nd ACM International Conference on Wireless Sensor Networks and Applications_ , ser. WSNA ’03. New York, NY, USA: Association for Computing Machinery, 2003, p. 151–159.
  * [39] T. G. Roosta, “Attacks and defenses of ubiquitous sensor networks,” Ph.D. dissertation, University of California at Berkeley, USA, 2008, aAI3331772. [Online]. Available: https://dl.acm.org/doi/book/10.5555/1559508
  * [40] C. Castelluccia, A. C.-F. Chan, E. Mykletun, and G. Tsudik, “Efficient and provably secure aggregation of encrypted data in wireless sensor networks,” _ACM Trans. Sen. Netw._ , vol. 5, no. 3, jun 2009.
  * [41] M. N. Halgamuge, M. Zukerman, K. Ramamohanarao, and H. Vu, “An estimation of sensor energy consumption,” _Progress In Electromagnetics Research B_ , vol. 12, no. 12, p. 259 – 295, 2009.
  * [42] C. Fu, Z. Jiang, W. Wei, and A. Wei, “An energy balanced algorithm of leach protocol in wsn,” _IJCS_ , vol. 10, no. 1, p. 354 – 359, 2013. [Online]. Available: https://www.proquest.com/scholarly-journals/energy-balanced-algorithm-leach-protocol-wsn/docview/1441692218/se-2
  * [43] M. N. Halgamuge, M. Zukerman, K. Ramamohanarao, and H. L. Vu, “An estimation of sensor energy consumption,” _Progress In Electromagnetics Research B_ , vol. 12, pp. 259–295, 2009.
  * [44] M. Miller and N. Vaidya, “A mac protocol to reduce sensor network energy consumption using a wakeup radio,” _IEEE Transactions on Mobile Computing_ , vol. 4, no. 3, pp. 228–242, 2005.
  * [45] R. Hasan, R. Sion, and M. Winslett, “The case of the fake picasso: Preventing history forgery with secure provenance,” in _7th USENIX Conference on File and Storage Technologies (FAST 09)_. San Francisco, CA: USENIX Association, Feb. 2009. [Online]. Available: https://www.usenix.org/conference/fast09/technical-sessions/presentation/hasan
  * [46] S. Sultana, G. Ghinita, E. Bertino, and M. Shehab, “A lightweight secure scheme for detecting provenance forgery and packet dropattacks in wireless sensor networks,” _IEEE Transactions on Dependable and Secure Computing_ , vol. 12, no. 3, pp. 256–269, 2015.
  * [47] A. Liu and P. Ning, “Tinyecc: A configurable library for elliptic curve cryptography in wireless sensor networks,” in _2008 International Conference on Information Processing in Sensor Networks (ipsn 2008)_ , 2008, pp. 245–256.
  * [48] C. Karlof, N. Sastry, and D. Wagner, “Tinysec: A link layer security architecture for wireless sensor networks,” in _Proceedings of the 2nd International Conference on Embedded Networked Sensor Systems_ , ser. SenSys ’04. New York, NY, USA: Association for Computing Machinery, 2004, pp. 162–175.