Mohamed Ali Kandi
email: mohamed-ali.kandi@hds.utc.fr

Hicham Lakhlef
email: hicham.lakhlef@hds.utc.fr

Abdelmadjid Bouabdallah
email: madjid.bouabdallah@hds.utc.fr

Yacine Challal
email: yacine.challal@hds.utc.fr

A Versatile Key Management Protocol for Secure Group and Device-to-Device Communication in the Internet of Things

Keywords: Internet of things, Group Communication, Device-to-Device Communication, Security, Key Management. 1

The Internet of Things (IoT) is a network made up of a large number of devices that collaborate to provide various service for the benefit of society. Two communication modes are required to enable a smooth collaboration. A device can send the same message to several other ones participating in the same service. It may also address a specific device in a Peer-to-Peer manner. The first mode of communication is called Group Communication, while we refer to the second as Deviceto-Device Communication. One of the main challenges facing the IoT is how to secure these two modes of communication. Among all the security issues, the Key Management is one of the most challenging. This is mainly due to the fact that most of the IoT devices have limited resources in terms of storage, calculation, communication and energy. Although different approaches have been proposed to deal with this problem, each of them presents its own limitations and weaknesses. Moreover, they usually consider either the Group or the Device-to-Device Communication. In this paper, we propose a novel versatile Key Management protocol for the Internet of Things. To the best of our knowledge, it is the first protocol that secures both modes of communication at the same time. We then analyze the security and performance of our solution and compare it to the existing schemes. For Group Communication, we show that our solution ensures the forward and backward secrecy and, unlike most of the existing Group Key Management protocols, guarantees the secure coexistence of several services in the network. With regard to Device-to-Device Communication, we prove that our solution is flexible and provides a good level of resilience and network connectivity compared to the existing Peer-to-Peer Key Management schemes. We finally demonstrate that, by balancing the loads between the heterogeneous devices according to their capabilities, our solution is both efficient and scalable.

I. INTRODUCTION

The number of devices connected to Internet is constantly increasing since its appearance. Now that this number far exceeds that of people in the world, we are no longer talking about Internet but about Internet of Things (IoT). This emerging technology gives rise to revolutionary applications such as health care, environment monitoring, smart homes, smart cities, autonomous vehicles...etc. To achieve this, the IoT devices are able to automatically communicate to each other in two different ways: Group Communication and Device-to-Device Communication.

In Group Communication, a device communicates with several other ones at the same time. These devices usually participate in the same service and thereby have a common interest. This same device can address a specific other one in a Peer-to-Peer manner. This is called Device-to-Device Communication [START_REF] Militano | Deviceto-device communications for 5G internet of things[END_REF][START_REF] Pedhadiya | Device to device communication: A survey[END_REF]. An example of Group Communication is the Vehicle-to-Everything Communication. It is a technology that consists of allowing a vehicle to communicate with all the nearby devices (cars, bicycles, public lighting...etc.). The aim is to make the vehicle sense its environment and therefore take the right decision. A Vehicle-to-Vehicle Communication, on the other hand, allows two specific vehicles to exchange information, in a Peer-to-Peer manner, about their speed and position. Thus, they can avoid crashes, ease traffic congestion and improve the environment [START_REF] Chang | V2V QoS guaranteed channel access in IEEE 802.11 p VANETs[END_REF].

One of the main challenges facing the IoT is how to secure communication between its devices. This is considered as a difficult issue mainly because the IoT devices have the particularity of being heterogeneous [START_REF] Kim | SEDA: Secure over-theair code dissemination protocol for the internet of things[END_REF]. They have then different capabilities in terms of storage, calculation, communication and energy. More importantly, some of them are constrained by their small physical size and so have limited capabilities [START_REF] Alaba | Internet of Things security: A survey[END_REF]. Among all the security issues encountered by the IoT, the Key Management (KM ) is one of the most difficult. The KM is the core of secure communication. Its role is to establish secure links between the network members. To achieve this, it provides them with secret cryptographic keys that are used to encrypt and decrypt the exchanged data [START_REF] Zhang | Wireless sensor network key management survey and taxonomy[END_REF]. According to the mode of communication, the KM schemes can be classified into two categories: Group and Peer-to-Peer Key Management.

Group Key Management (GKM ) protocols entail using the same key to encrypt and decrypt the Group Communication (Figure 1a). This key, usually called group key, must be known only by current members [START_REF] Chen | Group key management with efficient rekey mechanism: a semi-stateful approach for out-of-synchronized members[END_REF]. The GKM must then ensure that, when a member leaves the group, it is no longer able to decipher the future messages (forward secrecy). It must also guarantee that a joining node cannot decipher the previous ones (backward secrecy). Backward and forward secrecy are usually guaranteed by rekeying. Thus, when a node joins or leaves the group, the keys are revoked and new ones are distributed to the remaining members.

Peer-to-Peer Key Management (PKM ) schemes can be used to secure the Device-to-Device Communication. It consists of using several keys instead of one. The less communications a compromised device can decipher, the more the PKM is considered as resilient against node capture [START_REF] Yu | A robust group-based key management scheme for wireless sensor networks[END_REF]. A perfect level of resilience can be reached (at the expense of scalability) if a distinct key is used for each pair of devices. This key, usually called Pairwise Key, should be known by the two devices only (Figure 1b). Hence, when a network member is compromised, the communications of others are not jeopardized.

As the IoT requires the two modes of communication, none of these schemes is suitable for it. Indeed, if the same key is used for all Device-to-Device Communication, every network member will be able to decipher them. The GKM schemes are therefore not resilient against node capture. On the other hand, if several keys are used in Group Communication, the same message will be encrypted and sent several times. This will require additional calculation and communication and thereby more energy consumption. Finally, most of the existing schemes suffer from considerable KM overheads and are not suitable for the IoT constrained devices. Implementing two different protocols will then be too heavy for them to handle.

In this work, our aim is to secure the two communication modes of the IoT without loss of efficiency and scalability. To achieve this, we balance the protocol overheads between the heterogeneous devices according to their capabilities. The contributions of our work are as follows:

• We present a state of the art of the different existing KM schemes. We classify them according to the mode of communication into two categories: GKM and PKM . • We propose a versatile KM protocol for the IoT. To the best of our knowledge, it is the first protocol that secures both modes of IoT communication at the same time.

• We analyze the security and performance of our solution and compare it to the existing ones. For Group Communication, we show that it ensures the forward and backward secrecy and, unlike most of the existing GKM schemes, guarantees the secure coexistence of several services in the network. For Device-to-Device Communication, we prove that our solution is resilient, flexible and has a good connectivity compared to the existing PKM schemes. We finally show that, by balancing the loads between the heterogeneous devices according to their capabilities, our solution is efficient and scalable.

The remainder of this paper is organized as follows: related works are discussed in Section II. We detail then our solution in Section III. Section IV presents the security analysis of our protocol. In Section V, we evaluate the performance of our solution. Finally, we conclude our work in Section VI.

II. RELATED WORKS

The Key Management is the core of secure communication. Although different approaches have been proposed, each of them presents its own limitations and weaknesses. More importantly, they are usually intended for one of the modes of the IoT communication. Different classifications and taxonomies of these methods have been proposed in the literature. In [START_REF] Cheikhrouhou | Secure group communication in wireless sensor networks: a survey[END_REF] and [START_REF] Rafaeli | A survey of key management for secure group communication[END_REF], the authors classify the KM schemes according to the network topology: centralized, decentralized and distributed. In the first class, a single entity controls the whole network, while in the second one, the network management is distributed on several entities. In the third category, however, the network members handle the Key Management themselves.

On the other hand, the authors of [START_REF] Zhang | Wireless sensor network key management survey and taxonomy[END_REF] classify the KM schemes according to the encryption technique used: symmetric, asymmetric and hybrid. Symmetric approaches [5, 7-10, 17-23, 25-27, 30-32, 35, 45-48, 51-55] involve the use of the same key for encryption and decryption. On the contrary, asymmetric protocols [START_REF] Alagheband | Dynamic and secure key management model for hierarchical heterogeneous sensor networks[END_REF][START_REF] Ayuso | Optimization of Public Key Cryptography (RSA and ECC) for 16-bits Devices based on 6LoWPAN[END_REF][START_REF] Chatterjee | An improved ID-Based key management scheme in wireless sensor network[END_REF][START_REF] Liu | On emerging family of elliptic curves to secure internet of things: ECC comes of age[END_REF][START_REF] Mall | ECL-EKM: An enhanced Certificateless Effective Key Management protocol for dynamic WSN[END_REF][START_REF] Qin | An efficient identity-based key management scheme for wireless sensor networks using the bloom filter[END_REF][START_REF] Rahman | Private key agreement and secure communication for heterogeneous sensor networks[END_REF][START_REF] Seo | Effective key management in dynamic wireless sensor networks[END_REF][START_REF] Singh | A New Key Management Scheme for Wireless Senm Networks using an Elliptic Curve[END_REF][START_REF] Wan | IBKES: Efficient Identity-Based Key Exchange with Scalability for Wireless Sensor Networks Using Algebraic Signature[END_REF][START_REF] Wang | An Authentication Key Agreement Scheme for Heterogeneous Sensor Network Based on Improved Counting Bloom Filter[END_REF] use two different keys: a public key which may be disseminated widely and a private key which is known only to the owner. Finally, a hybrid approach [START_REF] Azarderakhsh | A key management scheme for cluster based wireless sensor networks[END_REF] consists of combining a symmetric scheme with an asymmetric one. Generally, symmetric schemes require less computation time than the asymmetric ones and are then more suitable for the IoT constrained devices. For this reason, we focus, in this work, on the symmetric approaches.

According to the mode of communication, we classify the existing symmetric Key Management schemes into two categories: the GKM (Figure 1a), for Group Communication, and the PKM (Figure 1b), for Device-to-Device Communication. In the context of the IoT , the GKM protocols must, above all, ensure the backward and forward secrecy. They should also consider the heterogeneous nature of the IoT and the possibility that several services can coexist in the same network. The PKM schemes, on the other hand, must be resilient, flexible and provide a good network connectivity. Finally, both categories must be efficient and scalable.

A. Group Key Management schemes

The Group Key Management schemes' requirements for the IoT that we consider in this paper are: backward and forward secrecy, collusion resistance, heterogeneity, efficiency and scalability. The GKM must, above all, ensure that the group key is known only to the current members. Thus, when a node joins or leaves the network, the key is revoked and new one is distributed to the remaining members. This rekeying ensures that a joining node will not have access to the old keys (backward secrecy) and a leaving member will no longer know the future ones (forward secrecy). The GKM must also prevent multiple evicted nodes to cooperate to regain access to the group key. Such an attack is referred to as collusion attack [START_REF] Tiloca | GREP: A group rekeying protocol based on member join history[END_REF]. Heterogeneity includes the fact that the IoT devices have different capabilities in terms of storage, calculation, communication and energy but also the possibility that they participate in different services. Efficiency implies minimal use of node resources. Finally, if increasing the network size does not significantly degrade its performance, the protocol is scalable. The GKM schemes are usually based on: tree structures, combinatorial optimisation, batch rekeying,...etc.

1) Tree based schemes:

The Logical Key Hierarchy (LKH) [START_REF] Wallner | Key management for multicast: Issues and architectures[END_REF][START_REF] Wong | Secure group communications using key graphs[END_REF] consists of using a tree structure to reduce the communication cost during the process of rekeying. The root of the tree corresponds to the group key, its leaves to the members' secret keys and the other nodes to intermediate keys. Each member stores the keys forming its branch. When a device joins or leaves the group, the server replaces only the keys it knows. In the case of a binary tree, nodes' storage cost will be proportional to O(log 2 (n)) and the size of the rekey message to O(2log 2 (n)). The OFT protocol [START_REF] Mcgrew | Key Establishment in Large Dynamic Groups using One-way Function Trees, TIS Labs at Network Associates[END_REF] uses a One-way Function to reduce the size of the rekey message to O(log 2 (n)). Both CASMA and GROUPIT protocols aim to deal with the dynamicity of IoT environments. While the former divides the network into multiple zones each implementing LKH [START_REF] Harb | Context aware group key management model for internet of things[END_REF], the latter combines LKH with the Chinese Remainder Theorem [START_REF] Kung | GroupIt: Lightweight group key management for dynamic IoT environments[END_REF].

The Tree based schemes are usually secure as they guarantee the backward and forward secrecy and are resistant to collusion attacks. They are also reasonably efficient and provides a good scalability. Nonetheless, these schemes rarely consider the heterogeneous nature of the IoT (Figure 2a).

2) Combinatorial optimisation based schemes:

The Exclusion Basic System (EBS) scheme is based on combinatorial optimization. It aims to make it possible to choose a compromise between the number of keys stored on nodes and that of messages exchanged during the rekeying process. The idea was first introduced in [START_REF] Eltoweissy | Combinatorial optimization of group key management[END_REF]. Other protocols were then proposed to improve the efficiency and the collusion resistance. The protocols GKIP [START_REF] Eltoweissy | Group key management scheme for large-scale sensor networks[END_REF] and SHELL [START_REF] Younis | Location-aware combinatorial key management scheme for clustered sensor networks[END_REF], for example, are based on the nodes deployment knowledge to achieve this, while LOCK [START_REF] Eltoweissy | Dynamic key management in sensor networks[END_REF] uses two layers of EBS.

The EBS based schemes ensure the backward and forward secrecy. They are efficient and scalable. Nevertheless, they are generally vulnerable to collusion attacks and do not consider the heterogeneous nature of the IoT (Figure 2b).

3) Batch rekeying based schemes:

Most of the exiting GKM schemes are based on individual rekeying, i.e. they rekey the group after each join or leave request. For more efficiency, the batch rekeying based schemes [START_REF] Lei | A secure key management scheme for heterogeneous secure vehicular communication systems[END_REF][START_REF] Li | Batch rekeying for secure group communications[END_REF][START_REF] Veltri | A novel batch-based group key management protocol applied to the internet of things[END_REF] were proposed. The main idea is to periodically rekey the group in order to reduce the rekeying overheads.

It is obvious that these schemes are more efficient than those based on individual rekeying. However, a new node has to wait until the next rekeying operation to actually joining the network. Even worse, as long as the group key has not been replaced yet, a leaving or an evicted member can still decipher the communications. Forward secrecy is then not totally guaranteed (Figure 2c).

4) Discussion:

Our literature review shows that the main problem of the existing solutions is that they do not consider the heterogeneous nature of the IoT (Figure 2). They do not balance the loads between devices and impose the same costs on a powerful computer or a weak sensor. Thus, while a negligible part of the former's resources is used, those of the latter may not even be enough. Also, they usually use the same parameters to secure all communications. As the IoT provides various services, communications within a service will be accessible to all nodes even if they did not subscribe to it. Moreover, the capture of a member will jeopardize all services. In previous works [START_REF] Kandi | An Efficient Multi-Group Key Management Protocol for Internet of Things[END_REF][START_REF] Kandi | An Efficient Multi-Group Key Management Protocol for Heterogeneous IoT Devices[END_REF], we proposed algorithms that provide various mechanisms to resolve some of these problems. However, these works do not consider Device-to-Device Communication.

B. Peer-to-Peer Key Management schemes

The PKM schemes requirements for the IoT are: resilience, flexibility, connectivity, efficiency and scalability. A protocol is resilient if the capture of a node does not jeopardize the communications of the other ones. On the other hand, a flexible protocol operates well regardless of the position of nodes and supports their dynamic deployment, i.e. nodes can join and leave the network at any time [START_REF] Cheikhrouhou | Secure group communication in wireless sensor networks: a survey[END_REF]. When network connectivity is low, some neighboring communicators may not share a common key and then relay on intermediate nodes to establish a secure path. Finally, efficiency and sclablilty were presented in the previous section. On this basis, the Peer-to-Peer Key Management schemes can be classified into three subcategories: deterministic, pure probabilistic and deployment knowledge based schemes.

1) Deterministic schemes:

The basic deterministic scheme, also called Pairwise Key protocol, consists of using a distinct pairwise key for each pair of nodes. This technique [START_REF] Choi | The best keying protocol for sensor networks[END_REF], nevertheless, requires a lot of storage as nodes has to store a number of keys proportional to the network size. Other approaches were then proposed. Polynomial-based protocols [START_REF] Baburaj | Polynomial and multivariate mapping-based triplekey approach for secure key distribution in wireless sensor networks[END_REF][START_REF] Blundo | Perfectly-secure key distribution for dynamic conferences[END_REF] use bivariate polynomials, f (x , y) = t (i,j ) a ij x i y j , for which f (x, y) = f (y, x). In each node i is then stored f (i , y). Thus, a pair of nodes (i , j ) can calculate the shared key f (i , j ). Matrix-based schemes [START_REF] Blom | An optimal class of symmetric key generation systems[END_REF][START_REF] Du | A pairwise key predistribution scheme for wireless sensor networks[END_REF][START_REF] Tsai | Key management in Internet of Things via Kronecker product[END_REF], on the other hand, use symmetrical matrices. The main idea is that each node i stores the i th row vector and the i th column vector. Two nodes wishing to communicate exchange their columns and multiply them by their own row to get the shared key. Note that the rows must be kept secret.

Deterministic schemes have the advantage of being resilient since the capture of a node will not jeopardize the other ones. Moreover, they are usually efficient and have a good connectivity. However, they suffer from poor scalability (Figure 3a). Indeed, Pairwise Key schemes require that a node stores as many keys as there are members in the network. On the other hand, the larger is the network, the more vulnerable the Polynomial and Matrix-based approaches are to compromise because captured nodes can collaborate to recover the polynomial or the Matrix. Furthermore, most of these schemes lack flexibility as they are based on key pre-distribution, i.e. the keys are stored in the nodes' memory before their deployment.

2) Pure probabilistic schemes: The first pure probabilistic scheme were introduced in [START_REF] Eschenauer | A scheme for distributed sensor networks[END_REF]. It consists of using a large pool of keys and to distribute some of them (a key ring) to each network member. Thus, two nodes can only communicate if they have a common key. Otherwise, they relay on intermediate nodes to establish a secure path. Other approaches were then proposed to enhance resilience. Using the Q-composite [START_REF] Chan | Random key predistribution schemes for sensor networks[END_REF] scheme, nodes can only communicate if they share Q keys. Polynomial pool based schemes [START_REF] Ruj | Pairwise and triple key distribution in wireless sensor networks with applications[END_REF][START_REF] Zhang | Key establishment scheme for wireless sensor networks based on polynomial and random key predistribution scheme[END_REF] use a pool of polynomials instead of keys.

These schemes are as resilient as the deterministic ones and even more scalable. Nevertheless, they suffer from poor flexibility, efficiency and connectivity. Indeed, they are usually based on key pre-distribution. Moreover, intermediate nodes may be necessary to establish secure paths between two neighbouring nodes (Figure 3b). This requires additional calculation and communication and thereby more energy consumption. Some works tried to enhance the connectivity using the unital design theory [START_REF] Bechkit | A highly scalable key pre-distribution scheme for wireless sensor networks[END_REF], system of equations [START_REF] Zhan | A novel key generation method for wireless sensor networks based on system of equations[END_REF]...etc. However, as long as they are probabilistic, the connectivity is never total.

3) Deployment knowledge based schemes: These schemes are neither deterministic nor purely probabilistic. They are based on deployment knowledge to maximize the network connectivity. Thus, to increase the probability of sharing common keys, nodes are distributed in regional zones. Key pools are then assigned to them so that neighboring nodes share a maximum of keys. Like the other two approaches, the deployment knowledge based schemes can use pairwise keys [START_REF] Choi | Location-based key management strong against insider threats in wireless sensor networks[END_REF][START_REF] Du | A key management scheme for wireless sensor networks using deployment knowledge[END_REF], polynomials [START_REF] Liu | Improving key predistribution with deployment knowledge in static sensor networks[END_REF] or matrices [START_REF] Huang | Location-aware key management scheme for wireless sensor networks[END_REF][START_REF] Yu | A robust group-based key management scheme for wireless sensor networks[END_REF].

These approaches are as resilient as the deterministic schemes. They also have a better network connectivity than the pure probabilistic ones and are then more efficient. However, these methods are not flexible and lose all their interest if the deployment knowledge is not possible (Figure 3c).

4) Discussion:

Our literature review shows that none of the existing solutions meets all the IoT requirements: resilience, efficiency, scalability, connectivity and flexibility (Figure 3). Most of deterministic protocols suffer from poor scalability and flexibility. Although the solution we propose is deterministic, we show that, being scalable and flexible, it provides the best compromise between the IoT requirements.

III. OUR SOLUTION

Our solutions combines the benefits of both Group Key and Peer-to-Peer Key Management schemes without loss of efficiency or network scalability. Thus, it allows to multiply the functionalities of the IoT devices and secures the two modes of communication that they may use: Group and Device-to-Device Communication.

For Group Communication, we prove that our solution guarantees the backward and forward secrecy and resists to collusion attacks. Furthermore, we show that, unlike most of the existing GKM schemes, our solution considers the heterogeneous nature of the IoT. It provides then the best compromise between the GKM requirements for the IoT (Figure 4). To achieve this, the network members are distributed into several groups according to the services to which they subscribe. These groups have independent security parameters so that the compromise of a service has no effect on the others. Each group is in turn divided into logical subgroups having different sizes. The aim is to balance the load between its heterogeneous members according to their capabilities. For Device-to-Device Communication, we prove that our solution provides a level of resilience, against node capture, comparable to that offered by the deterministic schemes. Furthermore, we show that, unlike most of the existing probabilistic approaches, our solution is flexible and has a good network connectivity. Thus, it provides the best compromise between the PKM requirements for the IoT (Figure 5). To achieve this, we take advantage of the grouping and subgrouping previously presented. A device shares then a distinct pairwise key with each member of its subgroup, a unique pairwise subgroup key with the members of each of the subgroups of its group and a single pairwise service key with the other members of each service in which it participates. This will significantly reduce storage costs and make our solution more scalable.

A. Overview

Our solution is organized into three layers (Figure 6). The upper layer divides the network N into multiple groups. Nodes are then assigned to them according to the services to which they subscribe. Current members can be moved from a group to an other when they subscribe to new services or unsubscribe from others. By doing this, the security parameters of services will be independent and the compromise of one of them will have no effect on the others. Each group, G i , is associated with an ID, gid i , which is unique within N .

On the other hand, the middle layer distributes the nodes of each group into subgroups. Note that these subgrouping is logical and transparent to the application layer. The aim is to enhance the protocol efficiency and scalability. Each subgroup requires an overhead proportional to the capability of its members. When a node joins a group, the protocol assigns it to the subgroup that matches its capability. Subgroups are created and can be splitted when it is necessary. Also, when a node leaves a group, the protocol tries to reduce the number of subgroups. It removes then those that become empty and merges the others to the possible extent. Each subgroup, S i j , of the group G i is also associated with a unique ID, sid i j . Finally, the lower layer manages the nodes and the cryptographic keys they hold. Just like groups and subgroups, each node u i,j k of the subgroup S i j is associated with a unique ID, nid i,j k . The keys can be classified into two types: Data Encryption Keys (DEKs), which are used to encrypt the data exchanged between nodes, and Key Encryption Keys (KEKs), which are used to protect the DEKs.

B. Layer 1: Node and key management

The first layer manages the nodes and the keys they store. Each node is first assigned to a subgroup S i j of the group G i . The group is chosen according to the combination of services in which the joining node participates (Section III-D). Also, the choice of the subgroup is made according to the node's capability (Section III-C). The node u i,j k is then associated with an ID, nid i,j k , which is unique within S i j and reflects its members' total order. Given two nodes u i,j k and u i,j k2 , we have nid i,j k < nid i,j k2 if and only if u i,j k has joined S i j before u i,j k2 . Thus, u i,j k is considered as an elder cognate of u i,j k2 whereas u i,j k2 is seen as a junior cognate of u i,j k .

Notation

Definition

G i /G
The i th group of the network / The group of the network if there is only one S i j /S j The j th subgroup of the group G i / The j th subgroup of its group u i,j k /u k The k th node of the subgroup S i j / The k th node of its subgroup A i

The combination of services associated to the group G i n

The number of nodes in the network (or the group if there is only one)

p i /p
The number of subgroups of the group G i / The number of subgroups of the group G m j

The number of nodes in the subgroup S j mc j

The minimum capacity of the subgroup S j c k

The capability of the node

u k K i,j k /K k The node key of the node u i,j k /u k K i,j k ,k 2 /K k ,k 2
The pairwise node key shared by the nodes u i,j k /u k and u i,j

k 2 /u k 2 K i j /K j
The subgroup key of the subgroup S i j /S j K i j ,j 2 /K j ,j 2

The pairwise subgroup key shared by the subgroups S i j /S j and S i j 2 /S j 2 K e

The service key of the e th service K i,i 2

The pairwise service keys shared between the groups G i and

G i 2 ← - K / -→ K The left/right part of the key K K R A refresh key KDF A key derivation function H A hash function lsg
The list of subgroups pcm

The percentage of merging TABLE I: Summary of notations.

1) Classification of Cryptographic Keys:

According to their usage, the keys managed by our solution can be classified into two types: Data Encryption Keys (DEKs) and Key Encryption Keys (KEKs). The DEKs are used by nodes to encrypt the data exchanged between them. These keys may be either group keys (used to secure Group Communication) or pairwise keys (used to secure Deviceto-Device Communication). The KEK , on the other hand, are used to secure the communication between the KM and the nodes in order to protect the DEKs. These keys allow then to ensure the backward and forward secrecy (for Group Communication) and the dynamic deployment of nodes (for Device-to-Device Communication). Thus, nodes can securely join and leave the network at any time. Let us consider a node u i,j k which belongs to the subgroup S i j of the group G i . The node holds the following keys:

• A node key, K i,j
k , which is a KEK known only to u i,j k . It allows the KM to communicate with the node safely.

• A pairwise node key, K i,j k ,k2 , for each of its cognate u i,j k2 . This is a DEK used to secure the Device-to-Device Communication between the node and its cognate u i,j k2 . • A subgroup key, K i j , which is a KEK known by the members of S i j only. It is used to secure the communication between the KM and the subgroup members.

• A pairwise subgroup key, K i j ,j2 , for each subgroup S i j2 . It is a DEK used to secure the Device-to-Device Communication between the node and the members of S i j2 . • A service key, K e , for each service e in which the node participates. This is a DEK used to secure the Group Communication between the service members. • A pairwise service key, K i,i2 , for each group G i2 containing members that participate in the same service. It is a DEK used to secure the Device-to-Device Communication between the node and the members of G i2 .

Service and subgroup keys are used, instead of the node keys, in order to enhance the protocol scalability and efficiency. Table II shows the keys held by the members of the network, presented in Figure 6, in which two services coexist. The groups G 1 and G 2 contain the nodes participating in the first and second service, respectively, while those of G 3 participate in both services. Note that the keys K i,j k ,k2 and K i,j k2 ,k are the same and can be used interchangeably. The same goes for the keys K i j ,j2 and K i j2 ,j as well as K i,i2 and K i2 ,i .

2) Hash Functions:

To reduce the storage cost, nodes can share some pairwise keys. They are then able to decipher some Device-to-Device messages that are not intended for them. To enhance the resilience of our solution without loss of scalabilty, we propose the use of a Hash Function (H ) or two (One-level and Twolevel approach, respectively). The aim is to create different keys from a single pairwise key. Thus, a node will store a single pairwise key without sharing it with the others.

One-level approach: In this approach, instead of storing the pairwise subgroup key, K i j ,j2 , and the pairwise service key, K i,i2 , the node u i,j k stores the (k -1 ) th hash of the former, K i,(j ,j2 ) k , and the (j -1 ) th hash of the latter, K (i,i2 ) j (Formulas 1 and 2, respectively).

K i,(j ,j2 ) k = H (k -1 ) (K i j ,j2 ) (1)
K (i,i2 ) j = H (j -1 ) (K i,i2 ) (2)
Although nodes will have different pairwise keys, one of them can calculate the key known by the other. This is due to the fact that the keys they hold are calculated from the same key and using the same Hash Function. To have a common communication key, the nodes relay on their IDs. Thus, knowing the IDs of each other, the node with the smallest one can use H to calculate the key of the other. 6 ,5

u 3 ,1 1 K 3 ,1 1 - K 3 1 K 3 1 ,2 , K 3 1 ,3 K 1 , K 2 K 3 ,1 , K 3 ,2 u 3 ,2 1 K 3 ,2 1 K 3 ,2 1 ,2 , K 3 ,2 1 ,3 , K 3 ,2 1 ,4 K 3 2 K 3 2 ,1 , K 3 2 ,3 u 3 ,2 2 K 3 ,2 2 K 3 ,2 2 ,1 , K 3 ,2 2 ,3 , K 3 ,2 2 ,4 u 3 ,2 3 K 3 ,2 3 K 3 ,2 3 ,1 , K 3 ,2 3 ,2 , K 3 ,2 3 ,4 u 3 ,2 4 K 3 ,2 4 K 3 ,2 4 ,1 , K 3 ,2 4 ,2 , K 3 ,2 4 ,3 u 3 ,3 1 K 3 ,3 1 K 3 ,3 1 ,2 , K 3 ,3 1 ,3 , K 3 ,3 1 ,4 K 3 3 K 3 3 ,1 , K 3 3 ,2 u 3 ,3 2 K 3 ,3 2 K 3 ,3 2 ,1 , K 3 ,3 2 ,3 , K 3 ,3 2 ,4 u 3 ,3 3 K 3 ,3 3 K 3 ,3 3 ,1 , K 3 ,3 3 ,2 , K 3 ,3 3 ,4 u 3 ,3 4 k 3 ,3 4 K 3 ,3 4 ,1 , K 3 ,3 4 ,2 , K 3 ,3 4 ,3
i,(j ,j2 ) k = H (k -1 ) (K i j ,j2
) and the second knows

K i,(j ,j2 ) k2 = H (k2 -1 ) (K i j ,j2
). If we assume that k < k 2 , u i,j k can calculate the (k 2 -k ) th hash of its key and both nodes will have the same key (Figure 7). Indeed, we have:

K i,(j ,j2 ) k2 = H (k2 -1 ) (K i j ,j2 ) (3)
= H ((k2 -1 )-(k -1 )) (H (k -1 ) (K i j ,j2 )) = H (k2 -k ) (K i,(j ,j2 ) k )
With regard to the pairwise service keys, let us assume that the node u i,j k wishes to communicate with u i2 ,j2 k2 . In this case, the two nodes do not belong to the same group. However, we assume that they participate in the same service and therefore can communicate. The first node stores

K (i,i2 ) j = H (j -1 ) (K i,i2
) and the second

K (i,i2 ) j2 = H (j2 -1 ) (K i,i2 ). If j < j 2 , u i2 ,j
k can calculate the (j 2 -j ) th hash of its key and both nodes will have the same pairwise service key. Indeed, we have:

K (i,i2 ) j2 = H (j2 -1 ) (K i,i2 ) (4) = H ((j2 -1 )-(j -1 )) (H (j -1 ) (K i,i2 )) = H (j2 -j ) (K (i,i2 ) j )
Since Hash Functions are irreversible, the One-level approach ensures that nodes cannot decipher the Device-to-Device messages exchanged between the other nodes that have smaller IDs. Although the resilience is improved, nodes are still able to decrypt the communications of those having bigger IDs. This has led us to propose the Two-level approach. Fig. 7: Example of using One-level approach.

Two-level approach: In this second approach, two different Hash Functions (H and H 2 ) are used. The pairwise subgroup keys are therefore split into two parts ( ← -K and -→ K ), each hashed separately with one of the two functions. The node u i,j k stores then the (k -1 ) th hash (calculated using H ) of the left part of the key and the (m -k ) th hash (calculated using H 2 ) of the right part (Formula 5). Note that || is a concatenation operation and m is the maximum number of the subgroup members.

K i,(j ,j2 ) k = H (k -1 ) ( ← - K i j ,j2 )||H (m-k ) 2 ( - → K i j ,j2 ) (5)
Like the One-level approach, the Hash Functions and the IDs can be used by the nodes to calculate a comman key. Knowing the IDs of each other, the node with the smallest one can apply H on the left part of its key and the other may apply H 2 on the right part of its key. They will then have the same communication key. Let us consider that u i,j k and u i,j2 k2 wish to communicate. If we assume that k < k 2 , u i,j k can use H to calculate the (k 2 -k ) th hash of the left part of the key it knows and u i,j2 k2 may use H 2 to calculate the (k 2 -k ) th hash of the right part of its key (Figure 8). Indeed, we have:

← - K i,(j ,j2 ) k2 = H (k2 -1 ) ( ← - K i j ,j2 ) (6) = H ((k2 -1 )-(k -1 )) (H (k -1 ) ( ← - K i j ,j2 )) = H (k2 -k ) ( ← - K i,(j ,j2 ) k ) and: - → K i,(j ,j2 ) k = H (m-k ) 2 ( - → K i j ,j2 ) (7)
= H

((m-k )-(m-k2 )) 2 (H (m-k2 ) 2 ( - → K i j ,j2 )) = H (k2 -k ) 2 ( - → K i,(j ,j2 ) k2 )
This second approach is more resilient than the first one since it ensures that nodes cannot decipher, in addition to the messages exchanged between the members with smaller IDs, those exchanged by the nodes with larger IDs. This is because two different Hash Functions are used, one in ascending order of IDs and the other in descending order. Note that, in the same way, we can use the Two-level approach with the pairwise service keys. Fig. 8: Example of using Two-level approach.

In the following, we can afford not to put exponents on a notation if there is no risk of ambiguity (For example, we can use u k instead of u i,j k if we now that the node is in S i j ). We also assume that a One-level approach is used.

3) Rekeying upon joining:

We consider a node u k joining the subgroup S j of G i . We assume that G i contains the nodes participating in the set of services A i . The KM starts by determining the node ID. Then, it generates some new keys and updates some of the existing ones to ensure the backward secrecy. Next, the KM provides some nodes with the new keys and sends to others the elements allowing them to update some of their keys. The process of rekeying upon joining consists of the following steps.

Key generation: The KM starts by determining the secret key of the joining node. Next, it generates a pairwise key for each existing member of the subgroup S j . Finally, the KM uses the Hash Function H to generate the (k -1 ) hash of all pairwise subgroup keys associated to S j (Formula 1). Key update: The KM starts by randomly generating a refresh key, K R . Then, using it and a pseudo-random key derivation function, KDF , the KM updates the subgroup and all the service and pairwise service keys associated to A i (Formulas 8, 9 and 10 respectively).

K + j = KDF (K j ||K R ) (8)
K e+ = KDF (K e ||K R ), (∀e ∈ A i ) (9) K + i,i2 = KDF (K i,i2 ||K R ), (∀G i2 ∈ N , A i2 ∩ A i = ∅) (10
) Key distribution: After the keys generation and update are completed, the KM distributes these new keys to the appropriate nodes. Thus, it sends to each current member, u k2 , of S j the unicast message JM1 encrypted by means of the node secret key. The message contains the ID of the joining node, the pairwise key associated to it, the refresh key and the list of the updated pairwise service keys u k2 knows, L k2 . The KM also broadcasts the message JM2 for each other subgroup S j2 (may be in G i or not) that contains members participating in at least one of the services of A i . The message is encrypted using the current subgroup key and contains the list of services A i , the refresh key and the list of the updated pairwise service keys its members know, L k3 . Finally, the KM provides the joining node, via a pre-existing secure channel, with all the keys associated to it and discards K R .

JM1 : KM → u k2 :< {nid k , K k ,k2 , K R , L k2 } K k 2 > JM2 : KM → S j2 :< {A i , K R , L k3 } Kj 2 >
Key installation: When a node u k2 (u k2 ∈ S j ) receives JM1 , it first decrypts the messages, using its secret key, and installs K k ,k2 as the pairwise key to use for encrypting the communication with the joining node. It also uses the KDF and K R to update the subgroup and all the service keys it knows (Formulas 8 and 9, respectively). The node also replaces the compromised pairwise service keys it knows by those contained in the list L k2 . After that, u k2 discards K R . On the other hand, when a node u k3 (u k3 ∈ S j2 ) receives JM2 , it first decrypts the message, using the current subgroup key. Then, it uses K R and the KDF to update, among the service keys it knows, those that are related to A i . The node also replaces the compromised pairwise service keys it knows by those contained in the list L k3 . Finally, u k3 discards K R .

4) Rekeying upon leaving:

A node u k can leave a subgroup S j , of the group G , or be evicted it gets compromised. In both cases, the keys it knows must be revoked. assume that G i contains the nodes participating in the set of services A i . The KM removes then of these keys and updates some others. The aim is to ensure the forward secrecy. Indeed, if these keys are not updated, the leaving node will be able to decipher future messages. Next, the KM provides the remaining nodes with the elements allowing to remove the that must be removed and to update those that must be updated. The process of rekeying upon leaving consists of the following steps.

Key removal: The first step in the rekeying process consists of removing the ID and the secret key of the leaving node as well as all the pairwise keys associated to it.

Key update: The KM starts by randomly generating the refresh key. Then, using the pseudo-random key derivation function, it updates the subgroup and service keys as well as the pairwise service keys related to A i and the pairwise subgroup keys associated to S j (Formulas 8, 9, 10 and 11, respectively).

K + j ,j2 = KDF (K j ,j2 ||K R ), (∀S j2 ∈ G i , S j2 = S j ) (11)
Key distribution: The KM sends to each node u k2 of G i (u k2 = u k ) the unicast message LM1 encrypted by means of the node key. The message contains the ID of the leaving node, that of its subgroup, the list of services A i , the refresh key and the list of the updated pairwise subgroup and service keys u k2 knows, L k2 . The KM also broadcasts the message LM2 for each subgroup S j3 (S j3 / ∈ G i ) that contains members participating in at least one of the services of A i . The message is encrypted using the subgroup key and contains the list of services A i , the refresh key and the list of all the updated pairwise service keys its members know, L k3 . Finally, the KM discards K R .

LM1 : KM → u k2 :< {nid k , sid j , A i , K R , L k2 } K k 2 > LM2 : KM → S j3 :< {A i , K R , L k3 } Kj 3 >
Key installation: When a node u k2 receives LM1 , it first decrypts the message using its secret key ans looks at the leaving member's subgroup ID. If it is its cognate, the node starts by removing the pairwise key which was used for encrypting the messages exchanged with it. Next, the node uses K R and the KDF to update the subgroup key (Formula 8). Furthermore, whether it is the cognate of the leaving member or not, the node u k2 updates all the service keys related to A i (Formula 9). The node also replaces the compromised pairwise subgroup and service keys it knows by those contained in the list L k2 . Then, it discards K R . On the other hand, when a node u k3 (u k3 ∈ S j3 ) receives LM2 , it first decrypts the message using the subgroup key. Then, using the KDF , it updates all the service keys related to A i (Formula 9). The node also replaces the compromised pairwise service it knows by those contained in L k3 and discards K R .

C. Layer 2: Subgroup management

In order to reduce the nodes' storage overhead, each group G i is partitioned into a set of logical subgroups. It is important to note that these subgrouping is logical and transparent to the application layer. Since the number of services is usually negligible compared to that of nodes and as groups are managed independently of each other, only one group (i.e. one service) is considered in this section. Let us denote by G the group in question, by p the number of its subgroups and by m j the number of nodes in each of them, S j . In this case, a node of the subgroup S j will store one secret key, m j -1 pairwise node keys, one subgroup key, p -1 pairwise subgroup keys and one service key. The storage is therefore proportional to the sum p + m j .

Two points come out of this. First, regardless of the subgroup to which a node belongs, the value of p is the same. Thus, if it is minimized, storage overheads are reduced on any node of the group. Moreover, the number of keys held by a node depends on the size of its subgroup. Hence, to balance the loads between the nodes of a heterogeneous network, the most constrained ones must be assigned to the smallest subgroups, and conversely. Indeed, for a node to store fewer keys than a more powerful one, the former must be assigned to a subgroup smaller than the one to which the latter belongs.

We focus in this section on the management of heterogeneous subgroups, i.e. subgroups of different sizes, while minimizing their number, p. Note that this does not mean that we do not allow two subgroups to have the same size. To achieve this, we rely on the fact that the nodes of S j must be able to handle at least p + m j keys. The size of S j is then chosen so that p + m j does not exceed the storage capability of its members or, to put it more simply, the capability mc j of its weakest node. Indeed, as mc j is the minimum capability that a member of S j can have, if its value is greater than p + m j then all the nodes of S j will be able to handle the costs. The problem is, therefore, to choose the minimum capabilities of subgroups and to assign them nodes so as to always satisfy:

min p (12)
under duress: ∀S j , mc j ≥ p + m j (13)

1) Storage Capability Evaluation Function:

Before we introduce the heterogeneous subgroup management, we present the Storage Capability Evaluation Function (SCEF) used to evaluate the number of keys a node can store. The SCEF takes as input the storage capability of a node u k (sc k ), the percentage of memory the protocol can use (pm), and the size of a key (ks). The SCEF takes into account a percentage of the node resources only to balance the cost associated to the KM against other node requirements. This percentage is chosen according to the network and application demands. The SCEF calculates then c k , the number of keys that can be held by u k (Formula 14).

c k = pm. sc k ks (14)
2) Heterogeneous subgrouping:

The heterogeneous subgrouping management consists of manipulating subgroups of different sizes while minimizing their number and that the Constraint 13 is always satisfied. To achieve a capability mc j is attributed to each subgroup S j when created. To satisfy the Constraint 13, mc j -p nodes are assigned to S at most (m j ≤ mc j -p). Note that mc j must always be greater than p for m j to be greater than 0 . Also, the size of subgroup varies according to its minimum capability and the value of p. Thus, greater the capabilities its members, the larger its size.

A node u k , that can handle c k keys, is assigned to S j only if mc j is the nearest value less than c k (mc j ≤ c k < mc + j , while mc + j is the value that follows mc j ). Thus, u k will store p + m j keys, in the worst case. Since the Constraint 13 is satisfied for S j and c k ≥ mc j then c k ≥ p + m j . In other words, u k can always support the storage overheads. Moreover, thanks to this, the loads are well balanced between the nodes according to their capabilities.

After the assignment, depending on whether S j is an existing subgroup or a new one, the value of p or m j increases. It can happen that for a subgroup S j2 (S j2 may be S j or not) the sum p + m j2 exceeds mc j2 and then some of its members may not be able to handle all the keys anymore. In this case, S j2 is splitted into two subgroups having the same minimum capability mc j2 . The size of the resulting subgroups is equal to the half of m j2 and the Constraint 13 is true again for them. However, S j2 cannot be splitted if it contains only one node. It is then removed and its member is revoked.

Considering the Constraint 13 and the fact that S j cannot be empty, any node u k should be able to store at least p + 1 keys. On the other hand, if u k can manage only p + 1 keys then it is the only node of S j and must be revoked when a new subgroup is created. Indeed, if the value of p increases, u k cannot handle all the keys anymore. For simplicity, we assume that u k is authorized to join the group only if it can store at least p keys (i.e. c k ≥ p instead of p + 1 ). Therefore, smaller is p, the more likely it is that more constrained nodes can join the group. This is one of the reasons why p should be minimized. For this purpose, depending on the state of the group, subgroups may be merged to reduce their number.

Finally comes the choice of the minimum capabilities of subgroups. The difficulty lies in the fact that subgroups are created and removed as and when required and that the abilities of nodes are not known a priori. We tried then different increasing sequences and found out that the loads are well balanced and p is minimized when the sequence grows exponentially. Indeed, if the minimum capabilities are close to each other, the subgroups will be well balanced but their number will be too large. However, the aim of the subgrouping is precisely to minimize the number of subgroups and thereby reduce the nodes' storage overhead. We then selected two sequences in particular: powers of two and Fibonacci sequence. Note that other sequences can be used as long as they grow exponentially.

If powers of two are used, the group is partitioned so that a minimum capability is the double of the preceding one (Formula 15). mc(l) = 2.mc(l -1), if l > 0. 1, otherwise.

On the other hand, if a Fibonacci sequence is used, a minimum capability is the sum of the two preceding ones (Formula 16). Note that c 1 and c 2 are arbitrary constants.

mc(l) =    mc(l -1) + mc(l -2), if l > 1. c 2 , if l = 1. c 1 , otherwise. (16)
The heterogeneous subgrouping is based on two algorithms. The Assignment Algorithm is run when nodes join the group and assigns them to the right subgroups. It creates new ones when it is necessary and may split others so that the Constraint 13 remains always satisfied. On the other hand, the Reorder Algorithm is executed after a node leaving to reduce the number of subgroups. It then removes those that become empty and merges others to the possible extent. Figure 9 shows an example of a group partitioned using powers of two. Note that the Constraint 13 is satisfied for all the subgroups and the value of p is minimal. Fig. 9: Example of a group partitioned into three subgroups.

3) Assignment Algorithm:

The Assignment Algorithm (Algorithm 1) is run by the KM when a node u k is authorized to join the group. It takes as input c k , the number of keys that can be stored by u k , and assigns it to a subgroup according to the input value. To achieve this, the algorithm manipulates a list of subgroups, lsg, of size p. Each of its items contains the ID of a subgroup S j , sid j , its minimum capability, mc j , and its size, m j .

Algorithm 1: Assignment Algorithm

Input : c k = capability of the node u k 1 Round down c k to the nearest minimum capability mc k ; 2 Find in lsg a subgroup S j so that mc j = mc k ; 3 if no subgroup is found then Create a new one S j ; 4 Assign u k to S j ; 5 Update lsg; 6 while ∃ S j2 for which mc j2 < p + m j2 do When u k is authorized to join the group, the Assignment Algorithm by determining the minimum capability mc k that matches it. It then rounds down c k to the nearest power of two or term of a Fibonacci sequence. Next, it searches in lsg a subgroup S j such as mc j = mc k . If no subgroup is found (this includes the case where the is empty), new is created. Next, the algorithm assigns u k to S j , updates lsg and renews the group security material following the steps described in section III-B3.

Also, the algorithm checks if the Constraint is still satisfied for all subgroups. It browses then the list lsg and as long as there is a subgroup S j2 for which mc j2 < p + m , it is splitted. The size of the resulting subgroups will then be to the half m j2 and the inequality 13 will be true again for them.

Subgroup creation: Creating a new subgroup S j consists of determining its ID, sid j , its key, K j , and a pairwise subgroup key for every subgroup S j2 of the group. Each of these pairwise subgroup keys, K j ,j2 , is encrypted using the key of the subgroup associated to it and sent to its members (message CM ).

CM : GKM → S j2 :< {sid j , K j ,j2 } Kj 2 >
Subgroup splitting: Splitting S j consists first of creating a new subgroup S j2 (mc j2 = mc j ). The mj 2 last nodes that have joined S j are then moved to S j2 . We denote by S + j the subgroup S j after being splitted and by u f the first node of S j to join S j2 , i.e. ∀u k ∈ S + j , nid k < nid f and ∀u k2 ∈ S j2 , nid k2 ≥ nid f .

The algorithm determines first sid j2 . Next, to ensure the forward secrecy, it randomly generates two refresh keys, K R1 and K R2 . Then, using KDF , it computes K + j and K j2 (Formulas 17 and 18). After that, all the pairwise keys associated to two nodes which no longer belong to the same subgroup are removed. Also, for each subgroup S j3 (including S j ), a pairwise subgroup key K j2 ,j3 is created.

K + j = KDF (K j ||K R1 ) (17)
K j2 = KDF (K j ||K R2 ) (18)
Furthermore, the algorithm sends the unicast message SM1 to each node u k ∈ S j (nid k < nid f ). The message is encrypted by means of the node secret key and contains K R1 as well as the (k -1 ) th hash of the pairwise subgroup key K j ,j2 . It also sends the unicast message SM2 to each node u k2 ∈ S j (nid k2 ≥ nid f ) encrypted using the node secret key. SM2 contains K R2 and L K2 , the list of the (k 2 -1 ) th hashes of the pairwise subgroup keys associated to S j2 . Finally, the unicast message SM3 is sent to each node u k3 of each subgroup S j3 (S j3 = S j and S j3 = S j2 ). It is encrypted by means of the node secret key and contains the (k 3 -1 ) th hash of the pairwise subgroup key K j2 ,j3 .

SM1 : KM → u k :< uid f , K R1 , H k -1 (K j ,j2 ) K k > SM2 : KM → u k2 {uid f , K R2 , L k2 } K k2 > SM3 : KM → u k3 :< H (k3 -1 ) (K j2 ,j3 ) K k3 > 4) Reorder Algorithm:
After a node leaving (Section III-B4), the Reorder Algorithm (Algorithm 2) is run in order to reduce the number of subgroups, p. It takes as input the percentage of merging, pcm, and tries to remove or merge subgroups when it is possible. Thus, when a node leaves a subgroup S j , the algorithm checks the number of the remaining ones. If S j becomes empty, it is removed. On the other hand, if the size of S j falls below a certain threshold, thr , the algorithm searches in lsg a subgroup S j2 to merge with S j . The threshold is the product of the percentage of merging and the maximum size of S j (thr = pcm.(mc j -p)). Furthermore, S j2 must have the same minimum capability as S j and its current size must also be less than the threshold. If it is the case, the two subgroups are merged. Note that pcm must not exceed 50 % so that the size of the resulting subgroup does not exceed mc j -p. Also, the greater is pcm, the more the subgroups are merged. This increases the merging's cost but reduces the value of p.

Algorithm 2: Reorder Algorithm

Input : pcm = percentage of merging 1 foreach subgroup S j that a node has left do 2 if m j = 0 then Remove S j ; Subgroup removal: Removing a subgroup S j consists of deleting its ID, sid j , its key, K j , and all the pairwise subgroup keys associated to it. The message RM , containing the ID of the subgroup, is then sent to each remaining subgroup so that its members can remove the pairwise subgroup key they share with the nodes of S j .

RM : KM → S j2 :< {sid j } Kj 2 >
Subgroup merging: Merging S j and S j2 consists of three steps. A new subgroup is first created. Next, the members of S j and S j2 are moved to the new subgroup. New pairwise keys are then generated for every pair of nodes u k , u k2 (u k ∈ S j and u k2 ∈ S j2 ) and sent to them (Messages MM1 and MM2 ). These messages are encrypted by means of the node keys. They contain, in addition to the new cognate ID and the pairwise key associated to it, the list of the hashes (L k or L k2 , respectively) of the pairwise subgroup keys related to the new subgroup. Finally, the two subgroups S j and S j2 are removed.

MM1 : KM → u k :< {nid k2 , K k ,k2 , L k } K k > MM2 : KM → u k2 :< {nid k , K k ,k2 , L k2 } K k 2 >
D. Layer 3: Service and group management An IoT service a transaction between two entities: a provider and a consumer [START_REF] Chen | Trust-based service management for social internet of things systems[END_REF]. The former measures the state of the latter or initiates actions which will cause a change to it [START_REF] Thoma | On iotservices: Survey, classification and enterprise integration[END_REF]. The provider is usually a device while the consumer can be a human, the environment or an other device. The main role of the KM to establish secure communications the IoT devices. A network can participate to a service as a provider, a consumer or both. It may also participate to different services, at the same time, and subscribe or unsubscribe from at any time. The IoT can then be seen as a set of overlapping classes each gathering nodes which collaborate to provide a service and others that benefit from it (Figure 10). these classes are overlapping, a group of the protocol cannot be associated to a service. Indeed, the independence of the group security parameters will then lose its meaning and the compromise of a node can jeopardize several groups. We propose then the creation of a group for each possible combination of services. A combination A i of a i services, of a finite set A of a services, is a subset of a i elements of A. The number of combinations, nc, is equal to:

nc = a l=1 C l a = 2 a -1 (19)
The network N is then partitioned into groups. Each group G i is associated with a unique ID, gid i . It contains then the nodes participating in the services of the combination A i associated to it. When a current member subscribes or unsubscribes from services, it migrates from a group to another according to its new combination of services. In other words, the node leaves a group (Section III-B4) and joins an other (Section III-B3). Note that repeated operations are done once. The number of groups can reach nc (Formula 19) if there are nodes participating in every possible combination of services. Also, it cannot exceed the number of network nodes, n, because empty groups are not allowed. The maximum number of groups, max g , is therefore equal to:

max g = Min(2 a -1 , n) (20)
Groups are created and removed as and when required and the probability of having only one node in each group is low. Their number can then be much smaller than max g . In Figure 10, two services E 1 and E 2 coexist in N . Three combinations are then possible:

A 1 = {E 1 , E 2 }, A 2 = {E 1 } and A 3 = {E 2 }.
Each group G i contains the nodes participating in the combination of services A i associated to it (Figure 6).

IV. SECURITY ANALYSIS

In this section, we analyze the security of our solution and prove that it secures the two modes of IoT Communication.

A. Threat model

A malicious node can be inside or outside the network [START_REF] Baracaldo | G-sir: an insider attack resilient geo-social access control framework[END_REF] and may jeopardize the security of both modes of Communication (Figure 11). An outsider node can store the messages exchanged between its members, while it is not allowed to join it, and then decipher them later, when it gains access. Furthermore, an evicted member can still pose a threat to the network, if it is still able to decipher the future communications. Also, if a node inside the network is captured, it may try to decrypt the Group Communication of the members of the other services or the Device-to-Device Communication of the other members of the services to which it belongs.

B. Theoretical analysis

The issue is to prove that, for Group Communication, our solution ensures the backward and forward secrecy, resists to collusion attacks and guarantees the secure coexistence of several services in the network. We also show that it is resilient against node capture, for Device-to-Device Communication.

1) Backward secrecy:

We prove that a joining node cannot access the current subgroup and service keys or any previous incarnation of them. The same goes for the pairwise subgroup keys related to its subgroup and the pairwise service keys associated to its group.

Proposition 1: Backward secrecy is guaranteed as the joining node never gets knowledge of the old security material.

Proof: Let us consider a node u k that joins a subgroup S j of the group G i . The KM updates the keys mentioned above. Then, before u k can actually join the group, the KM rekeys all current members of the network, by means of messages JM1 and JM2 . These messages are encrypted by means of their node and subgroup keys, respectively. Since none of these keys are known to u k , the joining node is excluded from the process of rekeying.

2) Forward secrecy and collusion resistance:

We prove that leaving nodes cannot access the new subgroup and service keys or any future incarnation of them. The same goes for the pairwise subgroup keys associated to its subgroup and the service keys related to its group.

Proposition 2: Our solution guarantees the forward secrecy resists to collusion attacks after nodes leaving since they do not have access to the security material.

Proof: Let us consider a node u k that leaves subgroup S j the group G i . The KM rekeys the members of G i and the rest of the nodes by means of the messages LM1 and LM2 , respectively. The former is encrypted by means of the node keys and the latter using the subgroup keys. Since none of these keys are known to k , the leaving node is excluded from the process of rekeying. Furthermore, as these keys are independent of each other, several evicted nodes can not collude to decipher the rekeying messages.

3) Independence of services:

Using our solution, the security parameters of services are independent of each other. This is due, firstly, to the that the members of a group participate in the same and, secondly, because nodes do not share any key they have no service in common.

Proposition 3: Our solution ensures that the compromise of a service has effect on the others.

Proof: Let us consider two groups G i and G i2 associated to the combinations of services A i and A i2 , respectively. When a member of G i gets compromised, only the keys of A i are exposed. If G i and G i2 share some services (A i ∩ A i2 = ∅), the keys of services to which the members of G i2 participate but not those of G i (A i \A i2 ) remain secret. Indeed, the compromised node does not know them. Furthermore, if the groups do not share services (A i ∩ A i2 = ∅), any of the service keys of A i2 gets compromised. In both cases, only the services in which the node participates are exposed and the others remain secret.

4) Resilience against node capture:

We assume that the number of services is negligible and consider then only one group. Although our solution uses a heterogeneous subgrouping, a homogeneous one allows us to evaluate resilience with no significant lack of generality. In this case, the n nodes (n > 1 ) of the group are uniformly distributed in p subgroups of m members each, i.e. p = m = √ n.

Zero-level approach: Without using Hash Functions, a node shares a distinct pairwise key with each cognate and a single pairwise key for each subgroup. It can then decrypt, in addition to messages intended for it, those that are exchanged between its cognates and the other nodes (Figure 12). Fig. 12: An example of communications a node can decrypt.

Lemma 1: The number of links a node can decrypt is:

D 0 = ( √ n -1 )(n + 1 ) (21)
Proof: A node can decrypt the communications linking it to the n -1 other group members as well as those between its √ n -1 cognates and the n -√ n other group members

(D 0 = n -1 + ( √ n -1 )(n - √ n)). Lemma 2:
The number of links in a group of n nodes is:

T = n(n -1 ) 2 (22)
Proof: The total number of links is equal to the number of possible combinations that can be obtained by taking two nodes from n (T = C 2 n ). Proposition 4: The percentage of compromised links is:

P 0 = 2 (n + 1 ) n( √ n + 1 ) (23)
Proof: From Lemmas 1 and 2 and the fact that P 0 = D0 T , we deduce that

P 0 = 2 ( √ n-1 )(n+1 ) n(n-1 )
.

One-level approach: Using a Hash Function ensures that nodes cannot decipher the messages exchanged between the nodes that have smaller IDs.

Lemma 3: The number of links a node u k can decrypt is:

D 1 = ( √ n -1 )(n + 1 -(k -1 ) 2 ) (24)
Proof: A node u k cannot decrypt the links that connect each of its k -1 elder cognates with the k -1 members, that have smaller IDs, of each of the √ n -1 other subgroups

(D 1 = D 0 -( √ n -1 )(k -1 ) 2
). Proposition 5: The new percentage of links a compromised node u k can decipher is:

P 1 = 2 (n + 1 -(k -1 ) 2 ) n( √ n + 1 ) (25)
Proof: From Lemmas 2 and 3 and the fact that P 1 = D1 T , we deduce that

P 1 = 2 ( √ n-1 )(n+1 -(k -1 ) 2 ) n(n-1 )
.

Two-level approach: The Two-level approach makes a member u k unable to decrypt, in addition to the messages exchanged between the nodes with smaller IDs, those exchanged by the members with larger IDs.

Lemma 4: The number of links a node u k can decrypt is:

D 2 = ( √ n -1 )(n + 1 -(k -1 ) 2 -( √ n -k ) 2 ) ( 26
)
Proof: A node u k cannot decrypt the links that connect each of its √ n -k junior cognates with the √ n -k members, that have a larger ID, of each of the √ n -1 other subgroups

(D 2 = D 1 -( √ n -1 )( √ n -k ) 2
). Proposition 6: The percentage of links a compromised node u k can decipher is:

P 2 = 2 (n + 1 -(k -1 ) 2 -( √ n -k ) 2 )) n( √ n + 1 ) (27)
Proof: From Lemmas 2 and 4 and the fact that P 2 = D2 T , we deduce that

P 2 = 2 ( √ n-1 )(n+1 -(k -1 ) 2 -( √ n-k ) 2 ) n(n-1 )
.

C. Comparison

To compare the resilience of the three we consider a group of 10000 members, divided into 100 subgroups of 100 members each. We then compare the variation of the three percentage P 0 , P 1 and P according to the node ID. The results are plotted in Figure 13. They show that the use of Hash Functions reduces indeed the rate of compromised links. If a Zero-level approach is used, the percentage is maximal constant regardless the node ID. This method is still best in terms of calculation cost. On the other hand, if a One-level approach is used, the bigger the ID of the captured node, the the percentage of compromised links. This method is therefore interesting if we trust the old more than new ones. Finally, the Two-level approach provides the best resilience regardless the node ID. Now, we compare the resilience provided by our protocol with the perfect resilience offered by some deterministic schemes (e.g. Pairwise Key protocol [START_REF] Choi | The best keying protocol for sensor networks[END_REF]). Using the Zerolevel approach, this percentage is equal to P 0 (Proportional to ). On the other hand, a perfect resilience is achieved when each pair of nodes share a distinct key. Thus, a captured node can only decipher the n -1 communications it to other network members. The percentage of compromised links is then equal to 2 (n-1 ) n(n-1 ) = 2 n (Proportional to 1 n ). Providing a perfect resilience, none of the existing solutions can do better. Figure 14 shows that the value of P 0 is negligible for large networks (n > 1000 ) such as the IoT. It is even comparable to the rate provided by the perfectly resilient approaches. Our solution offers then a good level of resilience. V. APPLICATION AND PERFORMANCE EVALUATION To give a concrete overview of the performance of our solution, we consider the example of a smart city. This choice is motivated by the fact that a smart city contains a huge number of heterogeneous devices (servers, computers, smartphones, gateways, sensors...etc) spread across the city to provide various services to the benefit of society (healthcare, intelligent transportation system...etc.). These devices can use the two communication modes of the IoT. It is clear that the number of services is generally negligible with respect to the network size. Thus, the number of services does not have a significant influence on the protocol performance compared to that of nodes. For simplicity, we consider then only one group of p subgroups containing m i members each. We also assume that no Hash Function is used. The KM may then broadcast some messages (e.g. LM1 ) to all the subgroup members instead of sending them in a unicast manner.

A. Theoretical analysis

We begin by briefly analyzing the overheads of our solution on the KM before detailing them on the network members.

1) Overheads on the KM :

The KM can be implemented on servers or gateways in a centralized or decentralized manner to secure communication.

Property 1: The communication overhead on the KM is proportional to the sum p + m j .

Proof: Regardless of the rekeying operation performed (node joining S j , node leaving S j ,...etc), the KM sends a unicast message to each of the m j members of S j and broadcasts a message for each of the other p -1 subgroups, in the worst case. The KM sends then a total number of messages proportional to the sum p + m j .

Property 2: The calculation overhead on the KM is proportional to the sum p + m j .

Proof: Regardless of the rekeying operation performed (node joining S j , node leaving S j ,...etc), the KM updates the keys which are or will be known by the node in question. The calculation overhead on the KM is therefore proportional to the storage cost on nodes, which will be proved to be of the order of p + m j in the next Section.

Property 3: The storage overheads on the KM is proportional to O(n).

Proof: It is obvious that the number of nodes is more important than that of subgroups or services. Therefore, if we choose not to store the pairwise node keys (which are used for Device-to-Device Communication between the network members) in the KM 's memory, the largest number of keys to store will then be that of the node secret keys. The KM will then store a total number of keys proportional to O(n).

Discussion: The communication and calculation costs on the KM are proportional to p + m j . The storage, on the other hand, is of the order of O(n). Considering the significant improvement (presented in the next section) that our solution provides on the node side, the costs on the KM are very reasonable. Also, as the KM has usually plentiful of resources, we aimed to make the costs more affordable on the nodes. 2) Overheads on nodes:

After evaluating the costs of our solution on the KM , let us the overheads on the node side.

Property 4: The communication cost on nodes is O(1 ).

Proof: Regardless of the rekeying operation performed (node joining, node leaving,...etc), a node receive a constant number of rekeying messages (e.g. JM1 JM2 upon node joining). The communication on nodes is therefore independent of the network size (i .e.O( 1)). Since communication is the operation that consumes the energy, our solution is efficient and highly scalable.

Property 5: The calculation overhead on nodes is proportional to the sum + m j .

Regardless of the rekeying operation performed (node joining S j , node leaving S j ,...etc), a node can, in the worst case, update all the keys it knows. The calculation cost on nodes is then proportional to the storage, which will be proved to be of the order of p + m j in the following.

Property 6: The storage overhead on nodes is proportional to the sum p + m j .

Proof: Using our protocol, a node u i,j k stores one secret key, m j -1 pairwise node keys, one subgroup key, p i -1 pairwise subgroup keys and a negligible number of service and pairwise service keys. The storage overhead on nodes is therefore proportional to the sum p + m j .

Discussion: The communication cost of our solution is O(1 ), while the calculation and storage overheads are proportional to the sum p + m j . Thus, to reduce these costs as well as those of the KM , we aimed to minimize the number of subgroups, p. We implemented then a simulator to analyze the behaviour of its value according to several parameters.

B. Simulation

The simulator, we implemented in C, randomly generates node capabilities (based on a uniform distribution) and runs the Assignment Algorithm to assign them. It also simulates nodes leaving and runs the Reorder Algorithm. The simulator takes as inputs the subgrouping type (powers of two or Fibonacci sequence), the number of nodes, nodes maximum capability (the maximum value that the simulator can generate), the percentage of merging. It then divides the nodes into subgroups and outputs their number (p), which is represented by the size of lsg. This allows us to analyze the effect of these parameters on the value of p.

Starting with the network size, we set the values of pcm and the maximum capability to 0 .4 and 256000 , respectively, and we vary that of n. The results of the simulations are plotted in Figure 15a. They show that, regardless of the network size and the subgrouping type (powers of two or Fibonacci), by using our method of load balancing the number of subgroups is reasonable. Figure 15a shows that even when the size of the network exceeds one million of nodes, the value of p does not exceed a few dozen. This makes our solution scalable since the constrained nodes manipulate a reasonable number of keys.

Next, we analyze the effect of the maximum capability, that can be generated by the simulator, on the number of subgroups. We then set the values of n and pcm to 1024000 and 0 .4 , respectively, and we vary the maximum capability. The results are plotted in Figure 15b. They show that the more powerful the nodes are, the smaller the value of p is. This is because powerful devices are able to manage more keys and can be assigned to larger subgroups. Note that the larger the subgroups are, the more their number diminishes. Therefore, since the costs of our solution on the constrained nodes mainly depend on the number of subgroups, they are more likely to support the overheads if the network becomes too large. Moreover, even when the maximum capability is small, the value of p remains reasonable for a network containing over a million nodes. To sum up, our solution is scalable regardless of the nodes maximum capabilities but it can become even more if the network contains enough powerful members. Now, we study the effect of pcm. Thus, we set the values of n and the maximum capability to 1024000 and 256000 , respectively, and we vary that of pcm. The results of the simulations are plotted in Figure 15c. They show that the greater the percentage of merging is, the smaller the value of p is. Therefore, the merging operation actually reduces the number of subgroups and makes our solution lighter for the constrained devices and thereby more scalable. Note that most of the overheads imposed by the subgroup merging are at the level of the KM and have no significant influance on the performance of nodes.

Finally, the results of all the simulations performed show that the use of powers of two or a Fibonacci sequence generally gives approximately the same results. However, we noticed that a Fibonacci sequence gives slightly better results for large networks, such as the IoT, and conversely.

C. Comparison

In this section, we show that our solution provides the best compromise between the IoT requirements for both modes of IoT communication (Figures 4 and5).

1) Efficiency and

Both GKM and PKM schemes need to be efficient and scalable. The communication cost of our solution is O(1 ) and therefore does not need to be discussed anymore. On the other hand, the calculation cost on is proportional storage. For these reasons, we only need analyze the storage costs to compare the efficiency and scalability of our solution to those of the existing schemes. We then take as example a sensor node and compare the storage cost our solution to different existent GKM (MGKMP [START_REF] Kandi | An Efficient Multi-Group Key Management Protocol for Internet of Things[END_REF] and GREP [START_REF] Tiloca | GREP: A group rekeying protocol based on member join history[END_REF] ) and PKM (Pairwise Key scheme [START_REF] Choi | The best keying protocol for sensor networks[END_REF], Trades [START_REF] Ruj | Pairwise and triple key distribution in wireless sensor networks with applications[END_REF] and Kronecker [START_REF] Tsai | Key management in Internet of Things via Kronecker product[END_REF]) schemes. We consider keys of 256 bits (using AES-256 for example). Featuring 48 Kbytes, a TmoteSky can store up to 1536 keys (ignoring the other node's memory requirements).

For the node to support the storage cost of our solution, it is enough if it can store at least p keys. The percentage of storage capability to indicate to the SCEF must then be greater or equal to P o = p 1536 . On the other hand, the authors of GREP, MGKMP, Trades and Kronecker show that the storage cost of their solutions are proportional to O( √ n). The memory rate required to store these √ n keys is therefore P r = √ n 1536 . Finally, as the Pairwise Key scheme do not divide the network members into subgroups, the nodes storage cost is of the order of n. The percentage of memory required is P n = n 1536 . We compare then the variation of the three values according to n.

Figure 16a shows that our solution requires less storage on a TmoteSky than the other protocols. Indeed, the value of P o is smaller than P r and P n , no matter the group size. More importantly, if the group contains more than 1536 nodes, the memory of the TmoteSky will not be enough to store all the keys of a Pairwise Key scheme. On the other hand, under the conditions of the simulations, less than 1 % of its storage capability is enough if a our solution is used. This is because storage cost is well balanced between the group members according to their capabilities. Thus, by using a bit more of the resources of powerful devices, our solution becomes much lighter for the constrained ones. It can then operate on much larger heterogeneous networks such as the IoT.

2) Heterogeneity for Group Communication:

Unlike most of the existing GKM schemes, our solution balances the loads between the heterogeneous devices of the network according to their capabilities. To illustrate this difference, we consider the protocols MGKMP [START_REF] Kandi | An Efficient Multi-Group Key Management Protocol for Internet of Things[END_REF] and GREP [START_REF] Tiloca | GREP: A group rekeying protocol based on member join history[END_REF]. The authors show that their calculation and storage costs are proportional to O( √ n) for all the network members, while they are both proportional to the nodes' storage capability, using our solution. We consider then a network of 10000 nodes and analyze the variation of the calculation and storage cost according to the node's storage capability (number of keys it can store), for the three protocols. Note that the percentage of storage capability that we choose to indicate to the SCEF is 10 % (i.e. only 10 % of the real capability of the node is used). The results are plotted in Figures 16b.

We take as example two nodes u 1 and u 2 that can store 200 and 1800 keys, respectively. For both nodes, 10% of their memory is used by our solution, in the worst case. MGKMP and GREP, on the other hand, use 50% of the former and 5% of the latter. As the calculation overhead on node depends on the storage, these protocols quickly exhausts the resources of u 1 while u 2 has much more. More importantly, the nodes having a capability lower than 100 can not even store all the keys, while our solution uses 10% of their memory only. Thus, although the overheads imposed by MGKMP and GREP are lower than that of our solution for powerful devices (capability greater than 1000 ), they are much greater for the weak ones.

3) Connectivity and flexibility for Device-to-Device Communication:

Unlike most of the existing PKM schemes, our solution ensures a total connectivity coverage. While the probability that two neighboring nodes share a common key does not exceed 0 .25 in [START_REF] Ruj | Pairwise and triple key distribution in wireless sensor networks with applications[END_REF] and is approximately lower bounded by 0 .632 in [START_REF] Bechkit | A highly scalable key pre-distribution scheme for wireless sensor networks[END_REF], this probability is always equal to 1 using our solution. Indeed, each pair of communicators share a pairwise node or subgroup key and can establish a direct secure link. It provides then a good connectivity. Note that when network connectivity is low, some neighboring relay on intermediate nodes to establish a secure link. The path length represents the number of nodes separating two communicators, which is always equal to zero using our solution. The results presented in [START_REF] Eschenauer | A scheme for distributed sensor networks[END_REF] give an overview about the average path length between two nodes using a probabilistic scheme. Figure 16c shows the large gap between value of this parameter using a probabilistic scheme [START_REF] Choi | The best keying protocol for sensor networks[END_REF] and our solution, regardless of the group size. It is important to note that the longer the path, the more the between nodes requires calculation and energy. This reduces the efficiency of the protocol.

Some PKM schemes [START_REF] Choi | Location-based key management strong against insider threats in wireless sensor networks[END_REF][START_REF] Liu | Improving key predistribution with deployment knowledge in static sensor networks[END_REF][START_REF] Yu | A robust group-based key management scheme for wireless sensor networks[END_REF] are based on the deployment knowledge to maximize the network connectivity. The application of this method is, nevertheless, if the knowledge is not possible. is therefore clear that the KM we propose is more flexible as it is based on a logical subgrouping and operates well regardless of the position of nodes. Furthermore, regardless of their category, most of the existing PKM schemes are based on key predistribution. These schemes suffer from poor flexibility as it is hard to add new nodes to the network. Our solution, on the other hand, supports the dynamic deployment of nodes thanks to its rekeying mechanism. Indeed, we previously showed that nodes can join and leave the network at any time without jeopardizing the security of the network. Our solution is therefore more flexible.

VI. CONCLUSION

In this paper, we presented a novel versatile Key Management protocol for the Internet of Things, which secures both Group and Device-to-Device Communication. For this purpose, our solution is organized into three layers. The upper layer divides the network into multiple groups. Nodes are then assigned to them according to the services to which they subscribe. The middle layer distributes the nodes of each group into logical subgroups. Each of them requires an overhead proportional to the capability of its members. The aim is to balance the loads between the heterogeneous devices according to their capabilities. The lower layer manages the network members and the keys they hold. Keys are classified in two types: Data Encryption Keys (DEKs) and Key Encryption Keys (KEKs). The DEKs are used to encrypt the data exchanged between nodes. These keys may be either group keys (used to secure Group Communications) or pairwise keys (used to secure Device-to-Device Communication). The KEKs, on the other hand, are used to protect the DEKs. The aim is to ensure the backward and forward secrecy (for Group Communication) and the dynamic deployment of nodes (for Device-to-Device Communication).

We then analyze the security and performance of our solution and compare it to the existing schemes. For Group Communication, we show that our solution ensures the forward and backward secrecy and, unlike most of the existing GKM protocols, guarantees the secure coexistence of several services in the network. With regard to Device-to-Device Communication, we prove that our solution provides a good level of resilience compared to the existing PKM schemes. We finally demonstrate that, by balancing the loads between the heterogeneous devices according to their capabilities, our solution is both efficient and scalable. It provides then the best compromise between the IoT requirements.

In future works, we intend to decentralize the protocol. Cryptographic material will then be spread across more than one entity in order not to have a single point of failure and to make it more difficult to access or modify this secret material.

  (a) Group Key Management.(b) Peer-to-Peer Key Management.

Fig. 1 :

 1 Fig. 1: Key Management.

  (a) Tree based schemes. (b) Combinatorial optimisation schemes. (c) Batch rekeying based schemes.

Fig. 2 :

 2 Fig. 2: Group Key Management approaches.

  (a) Deterministic schemes. (b) Pure probabilistic schemes. (c) Deployment knowledge schemes.

Fig. 3 :

 3 Fig. 3: Peer-to-Peer Key Management approaches.

Fig. 4 :

 4 Fig. 4: Group Key Management.

Fig. 5 :

 5 Fig. 5: Peer-to-Peer Key Management.

Fig. 6 :

 6 Fig. 6: Example of a network partitioning.

3 else 4 thr 5 if m j < thr then 6 Find

 3456 ← pcm.(mc j -p); S j2 such as m j2 < thr and mc j2 = mc j ; 7 if a subgroup S j2 is found in lsg then 8 Merge S j and S j2 ;

Fig. 10 :

 10 Fig. 10: Network partitioning according to services.

Fig. 11 :

 11 Fig. 11: Threat model and countermeasures

Fig. 13 :

 13 Fig. 13: Variation of the percentage of compromised links according to the node ID.

Fig. 14 :

 14 Fig. 14: Variation of the percentage of compromised links according to n.

  (a) Effect of the number of nodes. (b) Effect of the nodes maximum (c) Effect of pcm.

Fig. 15 :

 15 Fig. 15: Effect of the algorithm parameters on p.

Fig. Comparison.

  Fig. Comparison.

TABLE II :

 II Example of keys held by a network members.

	For pairwise subgroup keys, let us consider that the
	nodes u i,j k	and u i,j2 k2	wish to communicate. The first one
	stores K

Split S j2 ;

ACKNOWLEDGMENTS

This work was carried out and funded by the INS2I STFOC project, Heudiasyc UMR CNRS 7253 and the Labex MS2T.