NNFDA: A Digest-Based Integrity Verification Scheme for Enhancing Secure Queries in Loss-Tolerant TMWSNs

Abstract

Tiered Mobile Wireless Sensor Networks (TMWSNs), consisting of mobile sensor nodes and storage nodes, are widely used in various fields due to their scalability, energy efficiency, and flexibility. Most existing secure query algorithms assume that data packets generated by sensor nodes can always be delivered to storage nodes. This assumption does not hold in practice, where packets may be lost due to attacks or adverse communication conditions. This paper proposes a loss-tolerant wireless network model for TMWSNs and a novel threat model tailored to this scenario, in which packet-dropping attacks compromise the integrity of query results. To counter these attacks, we present a baseline integrity verification algorithm, the Neighbor Node-Forwarding Digest Algorithm (NNFDA). Each sensor generates a digest of its data and forwards it to neighboring nodes. These digests are then transmitted to storage nodes together with the neighbors’ data, thereby establishing a chained relationship among sensor data. The base station verifies query results using this relationship. The baseline algorithm, however, causes high communication overhead. To reduce this cost, we propose an improved version, NNFDA-BM (NNFDA with Bitmap), which optimizes digest generation and transmission. Experimental results show that NNFDA-BM verifies query result integrity effectively while achieving a significant reduction in communication overhead compared with the baseline algorithm.

1. Introduction

Wireless Sensor Networks (WSNs) are distributed networks consisting of a large number of sensor nodes. By integrating wireless communication technologies with advanced sensing techniques, WSNs can be deployed in diverse scenarios to accomplish specific tasks. In WSNs, sensor nodes form a self-organizing network through multi-hop wireless routing and periodically or event-driven transmit sensing data to the base station [1]. These data enable users to analyze environmental conditions without the need for on-site observation. However, since sensor nodes are battery-powered, limited energy supply restricts the network lifetime and communication performance of WSNs. Nodes located near communication hotspots are subject to heavier traffic loads, leading to faster energy depletion and earlier failures. Consequently, reducing the computational and communication overhead of sensor nodes to prolong network lifetime has become a major research focus.

To address these challenges, a network architecture known as the Tiered Mobile Wireless Sensor Network (TMWSN) has been introduced in practice [2]. As shown in Figure 1, a monitored region is divided into multiple disjointed subregions, each containing numerous mobile sensor nodes and one storage node. Sensor nodes, constrained by energy and computational resources, are mainly responsible for sensing the environment and generating data, which are then transmitted to the corresponding storage node. In contrast, storage nodes are equipped with higher storage and processing capacities as well as greater energy resources, enabling them to perform more complex tasks. They are responsible for collecting and storing sensor data and for processing queries issued by users via the base station.

Compared with traditional WSNs, TMWSNs offer several advantages: (1) Mobile sensor nodes enable load balancing across the network. (2) Query processing is performed by storage nodes without requiring sensor node participation, thereby improving query efficiency. (3) Storage nodes, with richer resources, take over more tasks, reducing the workload of sensor nodes and extending the overall network lifetime. These advantages have facilitated the wide adoption of TMWSNs in military, healthcare, and environmental monitoring applications [2,3].

However, the tiered architecture of TMWSNs also introduces new security risks—specifically, a higher likelihood of being targeted by adversaries. Since storage nodes concentrate more resources, they become more high-value targets for adversaries. Once a storage node is compromised, an attacker can: (1) Illegally access the data stored on the compromised node, resulting in sensitive information leakage; (2) Tamper with or discard stored data, mislead users who rely on query results, and ultimately cause erroneous decision-making.

The above scenario highlights two main security objectives in TMWSN queries: privacy protection and integrity protection. Privacy protection ensures that attackers cannot obtain sensitive data in plaintext during the query process, while integrity protection requires that query results accurately include all data satisfying the query conditions without omission. Most existing studies on secure query processing in TMWSNs focus on attacks against storage nodes, assuming that data packets are always safely delivered to storage nodes. However, packet loss and malicious packet dropping by sensor nodes have been largely overlooked in these studies. Factors such as node mobility, electromagnetic interference, or device malfunctions may cause path failures, data corruption, or packet loss [4]. Under such harsh communication conditions, TMWSNs are designed to tolerate a certain level of packet loss to maintain network robustness. Excessive tolerance of packet loss, however, may mask malicious behavior by compromised nodes, leading to persistent violations of query result integrity.

In this paper, we propose a loss-tolerant TMWSN model and establish a threat model tailored to this scenario. The key insight is that in loss-tolerant networks, a compromised storage node or sensor node can intentionally drop packets while disguising the malicious behavior as legitimate packet loss—since a certain degree of loss is inherently tolerated, such attacks can persistently compromise query result integrity without being easily detected.

To address this issue, we propose a baseline integrity verification algorithm, the Neighbor Node-Forwarding Digest Algorithm (NNFDA), which leverages data digests to enable secondary verification of query results at the storage node level. In TMWSNs, each sensor node generates both sensed data and corresponding digests; it sends its sensed data to one neighbor node, while distributing its digest to other neighboring nodes. These sensed data and digests are eventually forwarded to their respective storage nodes via multi-hop transmission. When the base station issues a query, the storage node returns the corresponding query results along with relevant digests to the base station. The base station then uses the digests to determine whether any sensor data within the query range have been omitted. For any missing data detected, the base station initiates a secondary verification process with the corresponding storage node. The NNFDA is specifically designed for the proposed threat model and can be integrated with existing secure query schemes to enhance the overall security level. However, the NNFDA introduces considerable communication overhead. To mitigate such redundancy and reduce overhead, we further propose an improved version of the algorithm, NNFDA-BM (NNFDA with Bitmap), which optimizes digest generation and transmission to lower communication costs.

In summary, the main contributions of this paper are as follows:

• We analyze how existing packet-dropping attacks manifest in loss-tolerant TMWSNs and establish a new threat model tailored for this scenario.
• We propose a baseline integrity verification algorithm, the NNFDA, which ensures query result integrity in TMWSNs.
• We present an improved algorithm, NNFDA-BM, that reduces communication costs through optimized digest generation and transmission.
• We evaluate the NNFDA under various conditions in simulation, measuring integrity verification success rates as well as communication overhead of both algorithms. Results show that the NNFDA effectively detects compromised query results, while NNFDA-BM achieves lower communication costs than the NNFDA.

The remainder of this paper is organized as follows. Section 2 reviews related work. Section 3 first introduces the network model and threat model, then presents the baseline integrity verification algorithm the NNFDA, and finally details the improved algorithm NNFDA-BM. Section 4 focuses on experimental evaluations, including the description of the experimental setup and the analysis of experimental results. Section 5 presents the conclusions of this study.

2. Related Work

In wireless sensor networks (WSNs), deployed sensor nodes perceive the surrounding environment and generate sensing data according to predefined programs. A large volume of such sensing data is transmitted, processed, and stored by network nodes, which await query requests initiated by users. Given the limited resources of WSNs, the design of each key step—including data routing, data aggregation, and data querying—must take energy consumption into full consideration.

In WSNs, sensor nodes are usually organized into a network in a multi-hop manner. The goal of data routing is to adjust transmission paths to reduce the communication cost during data delivery. Many researchers have employed hierarchical structures and clustering algorithms to reduce the energy consumption of sensor nodes and thereby prolong network lifetime [5,6,7]. However, these methods are not entirely suitable for mobile WSNs (MWSNs). While node mobility is beneficial for network load balancing, it also increases the risk of communication link disruptions. To address the challenges in MWSNs, the proposed method in [8] integrates hierarchical structures with weighted clustering algorithms, aiming to mitigate the risk of link disruptions and reduce the overhead caused by complex routing, frequent cluster head re-selection, and frequent updates to dominant sets in MWSNs. Meanwhile, V.A. et al. designed an energy-efficient (EE) routing mechanism that leverages unmanned aerial vehicles (UAVs) to enhance the operational performance of MWSNs [9]. For smart agriculture applications, the study in [10] introduced a three-level K-means clustering and chain-based routing method to optimize information transmission efficiency. The work in [11] uses intelligent monitoring and adaptive clustering to optimize data routing and extend network lifetime. These approaches demonstrate diverse strategies for balancing energy consumption and improving routing reliability in both static and mobile WSNs.

It is worth noting that the hierarchical organization of nodes is not a new concept in WSNs. Classic clustering protocols such as LEACH [12] and TEEN [13] partition the network into clusters to improve energy efficiency and extend network lifetime. TMWSN inherits this idea of hierarchical node organization; however, its primary motivation is fundamentally different: rather than optimizing routing or energy-efficient communication, TMWSN introduces the tiered structure to support secure query processing—by centralizing storage and query computation at resource-richer storage nodes, it establishes an architectural foundation for security mechanism design.

Data aggregation focuses on analyzing and processing sensing data to reduce subsequent transmission and storage costs. In [14,15], tree-based structures are employed to optimize the aggregation process, thereby reducing the energy consumption of sensor nodes. In MWSNs, the studies in [16,17] improve the efficiency of data aggregation and routing by planning optimal routes for mobile agents. Considering node failures, energy constraints, and mobile node mobility, the work in [18] applies hybrid optimization algorithms to enhance network reliability. Such studies illustrate the importance of data aggregation in reducing communication costs and improving overall efficiency in both WSNs and MWSNs.

The objective of data querying is to return results that satisfy user requests. Data query schemes typically integrate the design of data routing, data aggregation, and data storage. From the perspective of data storage, most query models in WSNs are based on data-center storage. In this approach, a subset of nodes is selected as data centers, to which sensor nodes transmit their sensing data. This method not only enables users to access data efficiently but also reduces the volume of communication required during the query process. From the perspective of query types, existing approaches include aggregation queries, range queries, Top-k queries, and K-nearest neighbor (KNN) queries, among others. Selecting appropriate query schemes for different application scenarios to achieve efficient resource utilization and secure data management remains a critical research direction in WSNs.

Aggregation queries are among the most critical query types in WSNs. By leveraging operations such as MAX, MIN, COUNT, and AVERAGE, multiple sensing data items are consolidated into a single result—this not only meets user requirements but also reduces the overhead associated with transmitting redundant raw data. TAG [19] is a representative tree-based aggregation scheme: intermediate nodes aggregate data from their child nodes and forward the aggregated results to their parent nodes, while the root node computes the final query result. In [20], distinct routing structures are deployed in different network regions, integrating the efficiency of tree structures with the accuracy of multipath aggregation. The TiNA framework [21] groups sensor nodes along the same transmission path and employs differential computation to reduce redundant data transmission, which ensures query accuracy while optimizing communication costs. Additionally, several other studies [22,23,24] design heuristic routing-tree construction algorithms by incorporating information such as the residual energy of sensor nodes.

Through Top-k queries, users can obtain the k data items with the highest scores, where the scoring criteria are user-defined. KNN queries can be regarded as a special case of Top-k queries, in which the reciprocal of the distance to the query point is used as the score. In [25], an approximate Top-k query approach is proposed that leverages historical sensor data samples. After a user specifies a precision tolerance, nodes only need to return results within the required accuracy, thus reducing query costs. FILA [26] exploits the fact that Top-k queries only require a small number of top-ranked results: it maintains a potential result range for sensor nodes, ensuring that only data within this range are transmitted to the base station, which reduces unnecessary transmissions. In [27], a locally ordered tree structure is introduced to memorize network hotspots, thereby reducing the number of participating sensor nodes and conserving energy.

Most of the aforementioned WSN query schemes primarily focus on energy efficiency, with relatively little attention paid to security issues. In TMWSNs, the integration of mobile sensor nodes and a two-tier architecture gives rise to more complex security challenges. Below, we review the state-of-the-art techniques for secure range queries in such networks.

Range queries are another critical query type in WSNs, enabling event monitoring tasks such as detecting anomalous high-temperature regions or locating areas with suitable environmental conditions. During query execution, the transmitted data must be protected against capture or eavesdropping by malicious attackers. Privacy protection and integrity protection are two primary objectives of secure query processing.

Some secure query algorithms focus on privacy protection for range queries [28,29,30]. For instance, the work in [31] presents a general information and query protection protocol based on onion routing. In [32], a secure and efficient cluster-based query processing scheme was introduced for WSNs. Lin et al. [33] proposed a secure query protocol for large-scale, multi-layer IoT-based sensor networks, which provides protection against attacks from three aspects: network security, attack models, and privacy preservation.

Other studies consider both privacy and integrity simultaneously. The QuerySec protocol [34], on the one hand, applies order-preserving encryption to encode sensing data and query requests, ensuring query confidentiality against untrusted storage nodes. On the other hand, it uses watermarking techniques to link data together and detect the deletion of result items. SafeQ [35] adopts a prefix-membership verification scheme, which transforms the problem of verifying whether a number falls within a specific range into checking the equality of two numbers—thus supporting privacy-preserving verification. For integrity protection, SafeQ introduces a neighborhood-chain technique to verify the integrity of query results. Dai et al. [36] proposed the dc and qp protocols, which integrate TAG routing, bucket partitioning, symmetric encryption, identity authentication, and check codes to achieve both privacy preservation and result integrity. Earlier studies mainly focused on attacks launched after storage nodes in TMWSNs were compromised, with an emphasis on addressing privacy and integrity breaches [37]. Zhang [38] further studied collusion attacks among nodes and proposed a family of collusion-resilient privacy-preserving range query protocols. These protocols employ Bloom-filter-based encoding to protect private data, while the integrity of results is verified through the order relationships among data items.

Existing secure query schemes in TMWSNs typically assume the successful delivery of data packets or focus on traditional attacker models. However, their security mechanisms do not directly address packet-loss detection. In loss-tolerant TMWSNs, adversaries may disguise malicious actions as normal packet losses. Such covert attacks—which exploit the inherent network characteristics of loss-tolerant TMWSNs and undermine query integrity—have not been thoroughly investigated. To the best of our knowledge, this paper is the first to propose a threat model tailored for loss-tolerant TMWSNs, as well as a novel integrity verification method designed to validate query results in such environments.

3. Methods

3.1. Network and Threat Models

3.1.1. Network Model

The network structure of the loss-tolerant TMWSN considered in this paper is illustrated in Figure 1. The entire sensing field is divided into multiple non-overlapping subregions, each containing several mobile sensor nodes and one storage node. Mobile sensor nodes can move freely within their respective subregions and may also migrate across adjacent subregions. At fixed periodic intervals, these sensor nodes transmit their sensing data to the corresponding storage node. Without loss of generality, this work focuses on queries over the sensing data generated within a single subregion during a specific time interval $T_t$.

Definition 1

(Loss-tolerant TMWSN). A loss-tolerant TMWSN is a type of TMWSN that can tolerate a certain degree of data packet loss. Due to factors such as interference from strong magnetic fields, obstacles in rugged terrain, and mobility of sensor nodes, wireless data transmissions in such networks are prone to failures. Instead of relying on retransmission mechanisms to recover all lost data, the network tolerates a limited degree of data loss, thereby mitigating potential resource overhead, such as excessive energy consumption and transmission delay that would otherwise be incurred by retransmissions. In practice, since the sensing data of a sensor node often exhibits strong spatial correlation with that of its neighboring nodes, the data of a neighboring node can serve as an approximate substitute for the lost data when precise query results are not strictly required. This allows the network to functionally tolerate a certain level of data loss without disrupting the overall monitoring task.

At the end of $T_t$, as illustrated in Figure 2, sensor nodes $s_i(1\le i\le n)$ within a subregion transmit their sensing data $D_{i,t}$ to a storage node via single-hop or multi-hop wireless communication. Without loss of generality, each sensing data record $D_{i,t}^j(1\le j\le \lambda )$ is characterized by three attributes: longitude, latitude, and a numeric sensing value (e.g., temperature). These attributes are denoted as $D_{i,t}^j.x$, $D_{i,t}^j.y$ and $D_{i,t}^j.v$, respectively. The storage node is responsible for processing queries initiated by the base station; these queries mainly include range queries, KNN queries, and Top-k queries, as formally defined below.

Definition 2

(Range Query). A spatial range query, denoted as $Q{R}_t$, is defined by a time interval t and a rectangular region bounded by longitude and latitude coordinates $(l_x,l_y)$ and $(u_x,u_y)$. A data point $D_{i,t}^j$ is a valid query result if it satisfies both of the following conditions: (1) It is generated within the time interval t. (2) Its coordinates satisfy $l_x\le D_{i,t}^j.x\le u_x$ and $l_y\le D_{i,t}^j.y\le u_y$.

Definition 3

(KNN Query). A KNN query, denoted as $Q{K}_t=\{t,target,k\}$, retrieves the k sensing data closest to a specified target point in a two-dimensional plane. The target consists of longitude x and latitude y, while k specifies the number of data items required. The query result must satisfy two conditions: (1) The data points must be generated within the specified time interval t. (2) For each returned data point $D_{i,t}^j$, the Euclidean distance from the target, $Distance(target,D_{i,t}^j)\le Distanc{e}_k$, must not exceed $Distanc{e}_k$, where $Distanc{e}_k$ represents the distance between the target and the k-th closest data point.

Definition 4

(Top-k Query). A Top-k query, denoted as $Q{T}_t=\{t,k\}$, retrieves the k sensing data records with the highest scores. Without loss of generality, the value attribute, $D_{i,t}^j.v$, is used as the score. The result set of the query must satisfy the following two conditions: (1) The data records must be generated within the specified time interval t; (2) For each returned data record $D_{i,t}^j$, its score must be no less than $Scor{e}_k$, where $Scor{e}_k$ is the k-th largest value among all $D_{i,t}^j.v$.

3.1.2. Threat Model

Previous studies have primarily considered two types of adversaries in secure query scenarios: honest-but-curious adversaries and malicious adversaries. An honest-but-curious adversary is primarily interested in the sensing data within the network and attempts to compromise its confidentiality. This type of adversary, however, still adheres to the predefined query protocols and executes query operations correctly—thus only posing a threat to data privacy. In contrast, a malicious adversary does not strictly follow the protocol; instead, it tampers with, replaces, or discards parts of the query results. Compared with the former, the attacks launched by malicious adversaries are more sophisticated and directly undermine the integrity of query results in TMWSNs.

In addition, traditional threat models typically assume that only storage nodes are vulnerable to attacks, whereas sensor nodes are considered relatively secure on the grounds that they do not store data.

In this paper, we consider a stronger threat model in which both storage nodes and sensor nodes may be compromised by adversaries. Storage nodes, as resource concentration points, are high-value targets for attackers; sensor nodes, although they do not store data, can be captured through physical tampering or remote intrusion, allowing adversaries to control a subset of them. Once a node is compromised, the attacker possesses the following capabilities: (1) dropping data packets during transmission; (2) tampering with or forging the content of data packets; (3) returning incorrect or incomplete query results at the storage node; and (4) executing selective forwarding attacks, i.e., targeting packets from specific sensor nodes for dropping rather than dropping uniformly.

In summary, the proposed threat model assumes that adversaries are capable of performing data tampering, data dropping, and partial node compromise, thereby capturing common internal and external attack scenarios in loss-tolerant TMWSNs. However, the adversary is not assumed to have unrestricted control over all stages of the query and verification process. Specifically, although a compromised storage node may manipulate the initial range query (or KNN/Top-k query), it is assumed not to simultaneously suppress the same target data during the subsequent single-point verification query. This assumption defines the applicability boundary of the proposed verification mechanism and is further discussed in Section 3.2.4 and Section 5.

In the context of loss-tolerant TMWSNs, however, adversaries can launch the following attacks:

• All Query Result Dropping by Storage Nodes. Under normal network conditions, sensor nodes transmit their sensing data to storage nodes on schedule. For a given query, if there is no matching data from a specific sensor node (i.e., the query result for this node is empty), the storage node only needs to return the corresponding verification information to indicate the absence of matching data—this is because traditional models assume that sensing data always reaches the storage node. In a loss-tolerant TMWSN, however, a malicious storage node can intentionally discard all query results from a target sensor node while still satisfying the verification requirement. This behavior undermines the integrity of the final query results without being easily detected, as “partial result dropping” could be identified under the paper’s predefined verification logic, whereas full result dropping is disguised as normal packet loss in loss-tolerant scenarios.
• Packet-Dropping Attacks Initiated by Sensor Nodes. In traditional threat models, sensor nodes are not primary targets for adversaries, as they do not store data. Additionally, under the assumption of reliable data transmission, packet losses occurring at sensor nodes can be detected. In a loss-tolerant TMWSN, however, adversaries can exploit this “loss tolerance” characteristic: they may either compromise sensor nodes to deliberately drop data packets or launch external attacks to prevent sensor nodes from receiving data properly. Either way, such actions disrupt the normal data flow within the network—a risk that is overlooked in traditional models.

Since loss-tolerant TMWSNs inherently tolerate a certain degree of packet loss, the two attack strategies outlined above can be exploited to undermine the integrity of query results—without being easily detected—unless an appropriate integrity verification mechanism is deployed.

3.2. NNFDA

The overall workflow of the NNFDA scheme is illustrated in Figure 3, which comprises four key steps: ① generation and forwarding of sensing data and data digests; ② query execution at storage nodes; ③ integrity verification of query results at the base station; ④ secondary verification requests initiated by the base station to storage nodes. A high-level overview of this workflow is provided via pseudocode in Algorithm 1.

In the NNFDA scheme, the data transmitted from a sensor node to the storage node comprises two components: (1) the sensor node’s own sensing data, and (2) the digest information generated by other neighboring sensor nodes. Upon receiving a query request from the base station, the storage node returns the query results—including both the sensing data from the queried sensor nodes and their corresponding digests. The base station then uses these digests to verify whether any qualified sensing data have been omitted from the query results; if omissions are detected, it issues a secondary verification request to the storage node. This process enables the integrity verification of the final query results.

Algorithm 1: Complete procedure of NNFDA

3.2.1. Digest Generation and Verification Chain

Before transmitting its sensing data, each sensor node generates and forwards digest information. As shown in Figure 4, sensor node $s_i$ computes a digest $V_{i,t}$ based on its sensing data $D_{i,t}$. Both the sensing data $D_{i,t}$ and the corresponding digest $V_{i,t}$ are then routed to the storage node through separate communication paths.

Digests are used to ensure the integrity of query results, but adding them will inevitably take extra communication overhead. Thus, digests should meet the following two core requirements: (1) They must faithfully summarize the corresponding sensing data. (2) Their content should remain concise. In general, the more detailed a digest is, the higher the communication cost that comes with it. For instance, sending all raw sensing data would let us fully reconstruct the sensing state, yet it would also take prohibitive network overhead. Therefore, digest design must strike a balance between digest representation completeness and communication efficiency.

This work focuses on simple query scenarios and adopts the minimum and maximum values of sensing data to construct the digest $V_{i,t}$, whose structure is defined in Equation (1). Here, i and t denote the sensor node identifier and the time period, respectively; min and max represent the minimum and maximum values of the sensing data across each attribute dimension. Specifically, x and y in the subscripts denote the two-dimensional spatial coordinates (longitude and latitude) of the sensor node’s location. In TMWSNs, sensor nodes are mobile: each node collects multiple sensing data records over a time interval and uploads them to the storage node at the end of time period t. Consequently, the digest captures the spatial extent (min/max bounds) of all data points collected during that interval. To preserve the privacy of the digest while supporting comparison operations on encrypted data, the NNFDA employs an order-preserving encryption (OPE) function $E_{OPE}\left(\right)$, referencing the Order-Preserving Encryption Scheme (OPES) [39] as an equivalent abstract model. OPE is chosen over conventional symmetric encryption because it preserves the order relationship between plaintexts and ciphertexts. This property enables the storage node to perform sorting and Top-k selection directly on ciphertexts, and also allows the base station to execute range comparisons on encrypted data (e.g., determining whether a data value falls within the query range) without decryption. Traditional symmetric encryption cannot support such order-preserving operations in the ciphertext domain.

$$\begin{array}{c}\hfill V_{i,t}=\{i,t,E_{OPE}\left(mi{n}_x\right),E_{OPE}\left(mi{n}_y\right),E_{OPE}\left(mi{n}_v\right),E_{OPE}\left(ma{x}_x\right),\\ \hfill E_{OPE}\left(ma{x}_y\right),E_{OPE}\left(ma{x}_v\right)\}\end{array}$$

(1)

After generating the digest, each sensor node forwards both its raw data and the digests received from neighboring nodes toward the storage node through multi-hop transmission. The transmitted content is structured as in Equation (2). In this equation, i and t denote the sensor ID and time period, $D_{i,t}^j(1\le j\le \lambda )$ represents the $\lambda$ data items generated by $s_i$, $V_{s,t}$ denotes digests received from neighbors, v is the number of such digests, and $has{h}_{allV}$ is a hash value computed over all digests. The encryption key used in the digest construction is shared between the sensor nodes and the base station, kept secret from the storage nodes, and updated over time according to $k_t=H\left(k_{t-1}\right)$.

$$D{S}_{i,t}=\{i,t,D_{i,t}^1,D_{i,t}^2,\dots ,D_{i,t}^{\lambda },V_{s_1,t},V_{s_2,t},\dots ,V_{s_v,t},has{h}_{allV}\}$$

(2)

The above process establishes an integrity verification chain across neighboring sensor nodes. Specifically, each sensor node’s digest is bundled with the sensing data of its neighboring nodes during transmission to the storage node. As a result, the verification responsibility propagates hop-by-hop along the neighbor chain: if node A’s data is lost, its digest can still reach the base station via node B’s data packet (since A’s digest is attached to B’s data); if both A’s data and B’s data are lost, the verification responsibility passes further to node C (which carries B’s digest), and so on. This chained relationship among sensor data forms the foundation for the integrity verification mechanism described in the following subsections.

3.2.2. Query Processing

Upon receiving a query request from the base station, the storage node processes the query in two stages. First, it employs existing secure query algorithms to identify the set of sensor nodes that satisfy the query condition. Then, it returns both the qualifying sensor data and the associated digest information as the query results. Formally, the query result is represented as $\omega =\{{\omega }_{1,t},{\omega }_{2,t},\dots ,{\omega }_{\beta ,t}\}$, where $\beta$ denotes the number of sensor nodes that satisfy the query. The structure of each result ${\omega }_{i,t}(1\le i\le \beta )$ is shown in Equation (3), where $\delta$ indicates the number of sensing data items from $s_i$, that meet the query condition.

$${\omega }_{i,t}=\{i,E_{OPE}\left(D_{i,t}^1\right),E_{OPE}\left(D_{i,t}^2\right),\dots ,E_{OPE}\left(D_{i,t}^{\delta }\right),V_{s_1,t},V_{s_2,t},\dots ,V_{s_v,t},has{h}_{allV}\}$$

(3)

3.2.3. Integrity Verification

After receiving the query results from the storage node, the base station conducts two layers of verification: it not only performs the standard integrity checks supported by existing secure query techniques, but also implements additional verification steps to detect the attacks described in Section 3.1.2.

First, the base station recomputes a hash value $has{h}_{allV}^{\prime }$ using the received digests, then compares it with the $has{h}_{allV}$ returned in the query results to confirm that no digest information has been omitted. Next, the base station leverages these validated digests to further verify the integrity of query results for different query types:

• Range queries. For each query result, the base station checks whether the spatial bounds in the digests intersect with the query range. Specifically, given the digests $V_{s_1,t},V_{s_2,t},\dots ,V_{s_v,t}$ contained in ${\omega }_{i,t}$, the base station verifies whether both the longitude intervals $[Q{R}_t.l_x,Q{R}_t.u_x]$ (query range) and $[V_{s_z,t}.mi{n}_x,V_{s_z,t}.ma{x}_x](1\le z\le v)$ (digest bounds), the latitude intervals $[Q{R}_t.l_y,Q{R}_t.u_y]$ (query range) and $[V_{s_z,t}.mi{n}_y,V_{s_z,t}.ma{x}_y](1\le z\le v)$ (digest bounds) overlap, thereby identifying the corresponding sensor nodes.
• KNN queries. The base station first computes the distance $Distanc{e}_k$ between the query point and the k-th nearest data item among all query results. For each digest, it then checks whether the rectangular region defined by the digest intersects with the circle centered at the query point with radius $Distanc{e}_k$. This is equivalent to verifying whether the minimum distance between the digest region and the query point is less than or equal to $Distanc{e}_k$.
• Top-k queries. The base station identifies the smallest attribute value in the returned results, denoted as $va{l}_k$. It then examines all digests and selects those satisfying the condition $V_{s_z,t}.ma{x}_v\ge va{l}_k$. The corresponding sensor nodes are collected into a candidate set, from which nodes already included in the returned results are excluded. The remaining candidates undergo secondary verification.

3.2.4. Secondary Verification

The final step of the NNFDA scheme involves the secondary verification of sensor nodes identified in Section 3.2.3—specifically, those nodes whose digests intersect the query range but whose data were not included in the initial query results. The purpose of this step is to confirm two key points: first, whether the storage node actually holds the sensing data of these sensor nodes; second, whether the held data meet the query conditions.

The base station performs this verification by issuing point queries for the relevant sensor nodes. As confirmed by the digest information, these nodes are present in the network—thus, their sensing data should be available at the storage node. If the storage node fails to return results for these point queries, this indicates either deliberate or unintentional data loss. If the returned sensing data meet the query conditions, it means the storage node deliberately omitted them from the original query results. Only when the storage node returns the corresponding sensing data and such data fail to satisfy the query conditions can the original query results be deemed complete. Otherwise, either an adversarial attack or packet loss has occurred, undermining the integrity of the query results.

It should be noted that the secondary verification mechanism relies on a trust boundary also defined in the threat model (Section 3.1.2): the mechanism assumes that a compromised storage node does not simultaneously manipulate both the initial query (range, KNN, or Top-k) and the subsequent single-point query. If the same compromised node hides the target data in both stages, the secondary verification would be circumvented. This boundary condition is further discussed in Section 5.

3.2.5. Algorithm Analysis

Feasibility analysis. In TMWSNs, due to the deployment and mobility characteristics of sensors, neighboring nodes often report highly similar or correlated data. First, leveraging spatial correlation, when a node’s data satisfies the query conditions, forwarding digest information to its neighbors increases the probability that the node’s data can be verified. Second, since digest information and sensing data are transmitted to the storage node through different routing paths, the risk of both being lost simultaneously is reduced. This two-tier verification process enables the detection of sensor nodes responsible for either intentional or unintentional packet dropping.

Security analysis. We analyze the protection capabilities of the NNFDA against the following attack types.

Forgery and replacement attacks. The $has{h}_{allV}$ field is designed to detect whether any digest has been modified or replaced during transmission. If a digest is forged or replaced, the hash value $has{h}_{allV}^{\prime }$ recomputed by the base station will not match the $has{h}_{allV}$ returned in the query results, thus triggering an alert. It should be noted that $has{h}_{allV}$ primarily verifies the integrity of digest information; protecting the sensing data itself against forgery or replacement relies on the homomorphic encryption mechanism in NNFDA-BM (see Section 3.3), where forged data would produce detectable anomalies in the encrypted domain.

Deletion attacks. The NNFDA detects selective omission of query results through the combination of digest-data bundling and secondary single-point verification. The verification logic is best illustrated through three cases: (1) Data loss: node A’s data is lost, but neighbor B’s data (bundled with A’s digest) is returned by the query. The digest indicates that A’s data range intersects with the query range, so the base station initiates a secondary verification for A. If the storage node cannot provide A’s data, data loss is confirmed. (2) Malicious discard by storage node—detectable: A’s data is stored at the storage node but was deliberately omitted from the range query results. During secondary verification, the base station requests A’s data via a single-point query; the storage node returns the data and it satisfies the query conditions, confirming malicious omission. (3) Normal case: A’s data genuinely does not satisfy the query conditions. Secondary verification retrieves A’s data, confirms it falls outside the query range, and verifies that the original query result is complete.

Replay attacks. Each sensor data packet includes a timestamp identifier. Although replayed old packets may consume network bandwidth and energy, they do not affect the data already stored at the storage node, as the base station can identify and discard duplicate packets based on timestamps. Query-level replay attack protection depends on upper-layer protocol design between users and the base station, which is beyond the direct scope of this paper.

Order-preserving encryption ensures that the content of digest information cannot be disclosed to adversaries. The encryption key is shared exclusively between sensor nodes and the base station, and is updated periodically following the rule $k_t=H\left(k_{t-1}\right)$. Since storage nodes do not possess the key, they cannot recover the content of digest information.

We acknowledge that the security analysis presented above is primarily qualitative in nature. A formal security model with rigorous proofs remains as future work.

3.3. NNFDA-BM

In Section 3.2, the NNFDA scheme is introduced to prevent two types of attacks: malicious sensor nodes dropping packets, and malicious storage nodes discarding all query results from specific sensors. In the NNFDA, each sensor node generates a data digest from its sensing data and forwards the digest to its neighboring nodes. The node then transmits its own digest alongside the neighboring nodes’ sensing data to its corresponding storage node. When processing queries, storage nodes include digest information in the query results. Using this digest information, the base station can verify whether each sensor node has qualifying query results and subsequently perform secondary verification. Compared with existing secure query approaches, the NNFDA incurs two additional types of energy overhead:

1.

Extra communication cost in secondary verification. During secondary verification, the base station requests sensing data of specific sensor nodes from storage nodes according to IDs of the sensor nodes. However, the base station only needs to verify the data that actually satisfies the query conditions. This mismatch leads to unnecessary data transmission and additional communication cost.

2.

Overhead of generating, transmitting, and storing digests. To ensure the completeness of query results, sensor nodes must send digest information to their neighbors, where it is bound with other digests. Consequently, multiple redundant digests are transmitted to and stored at the storage nodes, resulting in extra communication and storage overhead.

To mitigate the aforementioned overhead and better adapt to the energy constraints of TMWSNs, this paper proposes an enhanced version of the scheme, namely NNFDA-BM.

3.3.1. Improved Digest Generation Algorithm

The primary objective of secondary verification is to confirm the completeness of query results. Against this goal, it is unnecessary to transmit all sensing data of the corresponding sensor nodes during the verification process. Specifically, if the verification result shows that a sensor node has no data meeting the query conditions, users only require confirmation that the node lacks qualifying data—rather than receiving redundant data.

Upon analysis, part of the communication overhead in secondary verification stems from the inaccuracy of digest information used for verification. In Section 3.2, the original NNFDA scheme adopted a simple representation of the spatial range of sensing data. As illustrated in Figure 5, this leads to “false intersections” in different query types:

• For range queries: if a sensor’s data range intersects with the query range, there may in fact be no data satisfying the query condition.
• For KNN queries: if the circle, centered at the query point with radius equal to $Distanc{e}_k$, intersects with the sensor’s data range, it is still possible that no data lies within $Distanc{e}_k$.

By contrast, for Top-k queries, the maximum score can be directly derived from the digest, thus avoiding such false positives.

To address this issue, we extend the range-based digest by introducing a bitmap-based range digest, which improves verification accuracy in range and KNN queries and thereby reduces the communication overhead of secondary verification. The construction process of the bitmap-based digest is illustrated in Figure 6: (1) the sensing range is partitioned into $DIC$ cells along both the longitude and latitude, forming a $DIC\times DIC$ grid; (2) a bitmap of size $DIC\times DIC$ is generated, where each grid cell is set to 1 if it contains sensing data and 0 otherwise; (3) the bitmap is serialized row-by-row into a bit array of length $DIC\times DIC$. Compared with the original digest, the improved digest includes this additional bit array, as defined in Equation (4).

$$\begin{array}{c}\hfill V^{\prime }=\{i,t,E_{OPE}\left(mi{n}_x\right),E_{OPE}\left(mi{n}_y\right),E_{OPE}\left(mi{n}_v\right),E_{OPE}\left(ma{x}_x\right),E_{OPE}\left(ma{x}_y\right),\\ \hfill E_{OPE}\left(ma{x}_v\right),bitarray\}\end{array}$$

(4)

For example, in Figure 6, the sensing range is partitioned into 16 cells. The grid cells at positions (1, 3), (1, 4), and (3, 3) contain no sensing data, so their corresponding bitmap values are set to 0. The resulting bit array is illustrated in Figure 7. During verification, if the base station first detects that a sensor node’s data range intersects the query range, it can use the bitmap to further confirm that no sensing data exists in the overlapping grid cells (1, 3) and (1, 4). Thus, secondary verification for this sensor node can be skipped, reducing overall communication overhead, conserving sensor node energy, and extending the network lifetime.

3.3.2. Improvements on Digest Transmission and Storage

In the original NNFDA scheme, forwarding data digests to all neighboring nodes (or a fixed number of neighbors) leads to multiple redundant copies of the same digest propagating throughout the network. Yet for the base station, only a single digest copy is sufficient for the initial phase of integrity verification. To resolve this inefficiency, NNFDA-BM introduces an optimization: it adopts separate routing paths for data digests and sensing data, thereby reducing both transmission and storage overhead.

Digest Generation and Forwarding. In the original NNFDA scheme design, each sensor node computes a digest from its sensing data and forwards this digest to its neighbors. In the improved NNFDA-BM scheme, instead of directly forwarding the digest $V_{i,t}^{\prime }$, the sensor node transmits the homomorphically encrypted hash of the digest $E_{hom}\left(H\left(V_{i,t}^{\prime }\right)\right)$ to its neighbors. Following the forwarding phase, each sensor node records the identifiers of the nodes from which it received digests. It then performs homomorphic aggregation on all received information: ${\displaystyle Hom={\displaystyle \sum _{c=1}^{NNC}}{E}_{hom}\left(H\left(V_{s_c,t}\right)\right)}$ where $NNC$ denotes the number of digests received from neighbor nodes. The set of recorded node identifiers and the computed homomorphic sum are then used to replace the original digest list in $D{S}_{i,t}$, as formally defined in Equation (5):

$$D{S}_{i,t}^{\prime }=\{i,t,D_{i,t}^1,D_{i,t}^2,\dots ,D_{i,t}^{\lambda },s_1,s_2,\dots ,s_v,Hom\}$$

(5)

Both $D{S}_{i,t}^{\prime }$ and $V_{i,t}^{\prime }$ are then transmitted to the storage nodes via two separate data routing paths. During this process, a proper and effective key management scheme must be established among each sensor node, its neighbors, and the base station—this ensures the correct computation and decryption of homomorphically encrypted data. It should be noted that NNFDA-BM does not propose a new key management protocol; rather, it assumes that key management is provided by existing mature schemes widely adopted in WSN security research, such as pairwise key pre-distribution or cluster-based key management methods, with keys periodically refreshed via $k_t=H\left(k_{t-1}\right)$. Furthermore, the separate forwarding of $D{S}_{i,t}^{\prime }$ and $V_{i,t}^{\prime }$ imposes specific requirements on routing techniques, which should be designed to maximize the likelihood that at least one of $D{S}_{i,t}^{\prime }$ and $V_{i,t}^{\prime }$ successfully reaches the storage node.

Query Process. After data digests and sensing data are transmitted to storage nodes via separate routes, they are stored using different structured storage methods within the same node. For data digests, storage nodes establish a mapping between sensor identifiers and their corresponding digests, constructing a hash table named the “Table of Sensor IDs to Verification Digests (TSV)”. The storage nodes retrieve the relevant digest from the TSV based on the query’s target sensor IDs and include it as part of the query results. For the integrity verification of the retrieved digest, the homomorphic sum $Hom$, as defined in the algorithm, replaces $has{h}_{allV}$ from Equation (3).

The digest transmission method has no direct impact on the verification results at the base station. In existing query results, multiple sensor nodes’ data pending verification may correspond to identical digests. Thus query results and their associated digest lists can be transmitted independently. Moreover, the digest list can be deduplicated prior to transmission, further optimizing the efficiency of the query process.

Performance Analysis. In NNFDA-BM, each sensor node’s $DS$ contains a list of neighboring sensor nodes from which it received the homomorphically encrypted hashes of digests. The actual data digest itself is transmitted only once. The storage nodes store the specific data digests corresponding to the sensor nodes in this list, ensuring that when the $DS$ is returned as part of a query result, it includes both the identifiers of the relevant sensor nodes and their associated data digests. Compared to the previous design, each sensor node achieves an average reduction in transmission and storage overhead of approximately $\left(size\right(V)-size(sid\left)\right)/NNC$, where V denotes the size of the original data digest; $sid$ represents the size of the list recording sensor node identifiers in $D{S}_{i,t}^{\prime }$; and $NNC$ is the average number of neighbor digests received per node. By forwarding only a single data digest along with the identifiers of originating sensor nodes, the system significantly reduces redundant data propagation and storage overhead compared to the original design.

4. Experiments

4.1. Experimental Setup

The experimental scenario is illustrated in Figure 8. Specifically, a single sensing subregion is configured to contain 25 mobile sensor nodes and one fixed storage node. The storage node is deployed at the center of the subregion, while the mobile sensor nodes move freely within the subregion’s boundary—generating sensing data periodically during their movement. The generated data are transmitted to the storage node through multi-hop communication.

This study represents the first attempt to address secure query issues in loss-tolerant TMWSNs. Since no existing schemes have been designed for this specific scenario, comparative experiments with external approaches are not conducted. Instead, the performance evaluation focuses exclusively on the proposed the NNFDA and NNFDA-BM. The simulation primarily evaluates two metrics: the integrity verification success rate, denoted as P, and the communication overhead incurred during secondary verification, denoted as $CO$.

The simulation is built using Python 3.8 and operates at the protocol level without involving physical devices. It explicitly models the following four aspects:

Communication mode. Two communication patterns are modeled: (1) neighbor communication among sensor nodes, where each sensor node first forwards its verification digest to its $NNC$ neighboring nodes; (2) uplink communication from sensor nodes to the storage node, where each sensor node uploads its own sensing data together with the collected neighbor digests. Communication overhead is measured uniformly in terms of packet size (bytes).

Attack modeling. Attack behavior is triggered at the storage node with probability $attac{k}_p$. For sensor nodes whose data satisfy the query conditions, their query results may be randomly discarded to simulate intermittent adversarial behavior. The attack model independently samples in each query round to capture the randomness and unpredictability of attacks, thereby avoiding detection bias from fixed attack patterns.

Processing capability. The simulation does not incorporate specific cryptographic libraries for homomorphic encryption or other operations; instead, it adopts a protocol-level abstract modeling approach. The generation and matching of verification digests (MBR and bitarray) are abstracted as lightweight protocol operations, with their computational overhead indirectly reflected through communication packet sizes. The evaluation focuses on the trade-off between detection effectiveness and communication overhead of the two-tier verification mechanism, rather than the runtime performance of underlying cryptographic implementations.

Physical layer. The network is deployed on a regular grid topology, with neighbor relationships determined by spatial proximity (8-neighbor connectivity). The simulation adopts an idealized single-hop reliable communication model and does not explicitly model signal propagation, path loss, or physical-layer channel attenuation. Under this model, physical-layer transmission uncertainty and attack behavior are uniformly abstracted at the protocol level as “data packet unavailable events” to support system-level security analysis.

The experiments focus on scenarios in which the storage node discards all query results originating from a given sensor node. For the original NNFDA scheme, the success rate of integrity verification is evaluated under three types of queries: range queries, KNN queries, and Top-k queries. The definitions of the success rates for these three query types are as follows:

Definition 5

(Success rate of integrity verification for range queries). The success rate is defined as the ratio of the number of sensor nodes that pass integrity verification to the total number of sensor nodes whose sensing data fall within the user-specified query range, with a maximum value of 1.

Definition 6

(Success rate of integrity verification for KNN queries). The success rate is defined as the ratio of the number of sensor nodes that pass integrity verification to the total number of sensor nodes whose sensing data fall within the range of $Distanc{e}_k$ from the query point, with a maximum value of 1.

Definition 7

(Success rate of integrity verification for Top-k queries). The success rate is defined as the ratio of the number of sensor nodes that pass integrity verification to the number of sensor nodes whose sensing data have values no less than $va{l}_k$, with a maximum value of 1.

It should be noted that the purpose of testing KNN queries in the experiments is not to use KNN for sensor node localization. Rather, the KNN experiments evaluate the verification coverage of the digest-data bundling mechanism: if node A’s data is lost, the KNN query measures how likely a neighboring node’s data (which carries A’s digest) is to be returned in the query results. The base station can then use A’s digest, bundled with the neighbor’s data, to initiate secondary verification for A. This experimental design allows us to assess the effectiveness of the bundling mechanism under different query semantics.

The simulations investigate how the following factors affect the success rate of integrity verification P and the communication overhead of secondary verification $CO$: the number of digests transmitted to neighboring nodes $NNC$, the probability of storage node attacks $attac{k}_p$, query conditions, and the cell division parameter $DIC$ in NNFDA-BM. Other default parameters are provided in

Table 1. Default experimental setup.

Parameter	Default Value
Width of sensing region	50
Length of sensing region	50
Amount of sensing data generated per sensor node	10
Number of digests transmitted to neighboring nodes $NNC$	4
Storage node attack probability $attac{k}_p$	0.1
Division into cells ($DIC$) in NNFDA-BM	4
Range query condition	[5.0, 5.0], [15.0, 15.0]
KNN query condition	[10,10], 6
Top-k query condition	5

. To obtain reliable results, the reported data are the average values calculated from 100 network instances.

4.2. Experimental Results Analysis

Figure 9 illustrates the impact of the number of digest forwards on the success rate of integrity verification. In this set of experiments, $NNC$ is varied within the range of 0 to 8. During the digest forwarding phase, each sensor node transmits digest information to its $NNC$ neighboring nodes; if the number of neighbors is less than $NNC$, the node sends the digest information to all available neighbors, disregarding the predefined $NNC$ value.

As illustrated in Figure 9, the success rates of integrity verification P for all three query types generally increase as $NNC$ increases. This trend arises because a larger $NNC$ allows each sensor node to carry more verification information, thereby providing the base station with richer data to support successful integrity verification. Compared to Top-k queries, range queries and KNN queries achieve higher P values. This discrepancy is attributed to the spatial characteristics of range and KNN queries: forwarding digests to neighboring nodes better preserves spatial correlation. In contrast, Top-k queries rely on randomly generated scores with weak spatial correlation, leading to a lower overall success rate. Notably, when $NNC=0$, the NNFDA scheme becomes non-functional because no digest is forwarded to neighbors, and the integrity verification success rate drops to 0 under the designed attack scenario. This result is consistent with the performance of existing relevant algorithms.

As depicted in Figure 10, with an increase in $NNC$, the overall communication overhead rises, since a larger $NNC$ results in more digests being returned in the query results. Compared to the original NNFDA scheme, the NNFDA-BM algorithm further reduces the communication overhead during secondary verification. The reduction effect becomes more pronounced as $NNC$ increases.

Figure 11 illustrates the impact of varying storage node attack probabilities on the integrity verification success rate P in the NNFDA scheme. In this experiment, the attack probability $attac{k}_p$ is varied from 0.1 to 0.9. When $attac{k}_p=0$ (i.e., no attacks occur), no verification is required; when $attac{k}_p=1$ (i.e., no query results are returned), the integrity verification success rate is inevitably 0.

The results indicate that as $attac{k}_p$ increases, the integrity verification success rate decreases. This trend occurs because a higher attack frequency leads to fewer query results being returned, which reduces the number of digests received by the base station and lowers the success rate. In particular, when the storage node discards all query results from sensor nodes, the base station receives no digests at all, which results in a success rate of 0. A vertical comparison of the three query types shows that the success rate for Top-k queries remains relatively stable with increasing $attac{k}_p$. This stability is again attributed to the weak spatial correlation of the data involved in Top-k data.

Figure 12 illustrates the impact of $attac{k}_p$ on the communication overhead of secondary verification in the NNFDA scheme. As $attac{k}_p$ increases, the communication overhead for both algorithms generally decreases. This trend occurs because a higher $attac{k}_p$ results in fewer query results and digests being transmitted to the base station—this reduces the volume of data for secondary verification, thereby lowering the associated communication overhead. Nevertheless, the NNFDA-BM scheme maintains a significant advantage in reducing communication overhead compared with the original NNFDA scheme.

The set of experiments illustrated in Figure 13 investigates the impact of query conditions on algorithm performance. Since the results of range queries are theoretically predictable, the analysis focuses on KNN queries and Top-k queries. By varying the value of k from 1 to 9 in both query types, the experiments analyze how k impacts the success rate and the communication overhead.

Figure 13 illustrates the impact of varying k on the success rates for KNN queries and Top-k queries. For KNN queries, the success rate initially rises as k increases; however, it stabilizes once $k\ge 3$. This trend occurs because, under the network configuration and default target settings, KNN query results are concentrated among four sensor nodes. Once the digests from these four sensors are successfully returned, additional increases in k no longer improve the success rate. For Top-k queries, increasing k leads to more query results being returned, carrying more digest information, which increases the probability of detecting the sensor nodes targeted by attacks. Consequently, the integrity verification success rate improves as k increases.

Figure 14 demonstrates that the NNFDA-BM scheme performs effectively in reducing the communication overhead of secondary verification. When k is small, the reduction effect on the communication overhead is more significant. Once k exceeds a certain threshold, the reduction stabilizes at a constant value. This trend is attributed to the concentration of Top-k query results among four sensor nodes. As k increases, the base station essentially receives the duplicate digest information. This limits the potential for further reducing the communication overhead.

The set of experiments illustrated in Figure 15 investigates the impact of $DIC$ on the integrity verification success rate and the communication overhead for range queries and KNN queries. The actual values of $DIC$ are set to 1, 2, 4, 8, 16, and 32; correspondingly, the horizontal axis of Figure 15 uses the log2-transformed values of $DIC$ for clearer visualization. As shown in Figure 15a, the success rate of the NNFDA scheme tends to decrease as $DIC$ increases. This downward trend stems from the fact that the definition of the integrity verification success rate is related to the size of verification set—specifically, the number of nodes requiring secondary verification, which is determined during the verification phase. As $DIC$ increases, sensor nodes that do not meet the query conditions are gradually excluded, reducing the total number of nodes available for integrity checking and thus lowering the overall success rate. Meanwhile, Figure 15b demonstrates that increasing $DIC$ reduces the secondary verification communication overhead for both query types. This is attributed to the more accurate identification of sensor nodes involved in the verification phase; fewer irrelevant nodes are included, thereby reducing the volume of redundant communication.

Based on the above results, DIC values between 4 and 8 provide a favorable trade-off between communication overhead and verification performance. Specifically, increasing DIC from 1 to 4 significantly reduces communication cost, while further increases yield only marginal improvements. Meanwhile, the verification success rate remains above 95% for both range and KNN queries when $DIC\le 8$, but begins to decline noticeably for larger values. Therefore, DIC = 4 or 8 is recommended for most deployments. When communication efficiency is the primary concern, DIC = 16 may also be considered at the cost of a moderate reduction in KNN verification performance.

5. Discussion

5.1. Limitations of the Current Work

Detection boundary of the integrity verification chain. The NNFDA mechanism relies on the assumption that a sensor node’s digest can reach the base station via at least one neighbor’s data packet. When all digests within an affected region fail to escape—for instance, due to regional interference that blocks all outgoing digest paths, correlated link failures that simultaneously affect both data and digest forwarding, or collusion among neighboring compromised nodes that intercepts all digest transmissions—the detection capability of the NNFDA ceases to function. Under such conditions, neither the original data nor any copy of the associated digests reaches the base station, and the verification chain is entirely broken.

Attacker simultaneously controlling range and point queries. The secondary verification mechanism in the NNFDA assumes that, while an attacker may manipulate the range query logic at the storage node, they do not simultaneously control the single-point query logic used during secondary verification. If an attacker can precisely manipulate both query types—for example, dropping a node’s qualifying results in the range query while also hiding the same data during the subsequent single-point verification—the two-tier verification mechanism would be circumvented.

Homomorphic encryption performance on sensor hardware. In NNFDA-BM, the additive homomorphic encryption (AHE) operations for digest aggregation have not been benchmarked on specific sensor hardware platforms (e.g., 8-bit or 16-bit MCUs). While we employ AHE rather than fully homomorphic encryption (FHE) and restrict encryption to digest-level metadata rather than full sensing data, the concrete latency and energy consumption of AHE on resource-constrained devices remain to be quantitatively evaluated. Compared with conventional symmetric encryption such as AES, AHE imposes a higher computational complexity, which represents a necessary security premium in scenarios requiring trustworthy aggregation, and may impose moderate requirements on node hardware configurations such as FPU support and memory capacity.

Qualitative nature of the security analysis. The security analysis presented in this paper is primarily qualitative. Formal security definitions and rigorous proofs that integrate the security properties of the NNFDA (digest integrity, omission detection, replay resistance) into a unified formal framework have not yet been developed. The construction of a formal security model tailored to loss-tolerant TMWSNs remains an important direction for future investigation.

Experimental scale and baseline comparisons. The current experiments employ a single subregion with 25 mobile sensor nodes and one storage node, which is sufficient for validating the basic feasibility and effectiveness of the NNFDA and NNFDA-BM under controlled conditions, but is considerably smaller than typical real-world TMWSN deployments. In large-scale networks, additional challenges may arise, including: inflation of bundled digests per data packet as the number of neighbors increases, which may raise communication load and verification latency; cumulative delay introduced by deep verification chain propagation across many hops; and cross-subregion management when sensors migrate, where the interruption and re-establishment of digest forwarding chains may affect detection coverage. Furthermore, baseline comparisons with redundant digest schemes, multi-path forwarding strategies, or adapted secure query protocols have not been conducted, as no existing schemes in the literature are designed for the same loss-tolerant TMWSN scenario with simultaneous consideration of packet loss tolerance and integrity verification.

Packet loss model diversity and evaluation metrics. The current experiments are primarily based on a uniform random packet loss model. In real TMWSNs, loss patterns may exhibit burstiness or spatial correlation due to environmental factors such as interference, congestion, or node mobility. The evaluation metrics focus mainly on detection rate and communication overhead, while total communication cost, energy consumption, and robustness under different loss models have not been comprehensively quantified.

Granularity of the success rate metric. The integrity verification success rate P defined in Section 4.1 is measured at the sensor-node level and reflects the proportion of qualifying sensor nodes whose integrity status is correctly identified during verification. To avoid overstating the practical protection effect, we note that this metric does not directly characterize item-level omission rates or false-positive rates. Since the proposed digest records only the minimum and maximum attribute values of each sensor node, the current design operates at the node granularity and does not explicitly evaluate these aspects. Therefore, the reported success rate should be interpreted as a node-level integrity verification metric rather than a complete assessment of result-set completeness.

5.2. Applicability Boundaries

The effectiveness of the NNFDA depends on several conditions that define its applicability boundaries:

Spatial correlation assumption. The digest forwarding verification mechanism relies on the premise that neighboring sensor nodes exhibit strong spatial correlation in their sensing data. This assumption may not hold in the following scenarios: (1) sparse deployment, where sensor nodes are too far apart for their readings to maintain sufficient similarity; (2) high mobility, where rapidly changing node positions may destabilize neighbor relationships and disrupt the digest-data bundling during transmission; (3) heterogeneous sensing tasks, where different nodes monitor different physical quantities (e.g., temperature, humidity, pressure), making cross-node data comparison meaningless; and (4) spatially discontinuous phenomena, where the monitored environmental variable itself exhibits sharp spatial gradients, causing neighboring nodes to report significantly different values. In summary, the proposed method is best suited for TMWSN scenarios characterized by dense node deployment, low-to-moderate mobility, homogeneous sensing tasks, and spatially continuous physical phenomena. Applicability beyond these boundary conditions requires further validation.

Routing independence assumption. The paper assumes that sensing data and digest information are transmitted via different routing paths to minimize the probability of simultaneous loss. In this context, “different paths” refers to local differentiated forwarding—data and digests are forwarded through different next-hop neighbors rather than requiring fully disjoint routes at the network-wide level. This local differentiation is feasible in moderately dense TMWSNs (where each node has 3–5 neighbors) with manageable overhead. However, the assumption may be compromised when regional interference blocks all escape paths, correlated link failures simultaneously affect both data and digest forwarding, or colluding neighboring nodes intercept digest transmissions. Mitigation strategies for practical deployment include: increasing the number of multi-path digest replicas (trading communication efficiency for reliability), explicitly prioritizing non-overlapping next-hop nodes for digest forwarding in the routing protocol, and introducing redundant digest caching at boundary nodes. The quantitative effectiveness of these strategies warrants further study.

Inability to distinguish malicious from natural packet loss. The NNFDA detects the occurrence of packet loss but cannot distinguish between malicious dropping and natural loss caused by adverse wireless channel conditions. This ambiguity has practical implications: in areas with poor channel quality (e.g., high interference, severe multi-path fading), naturally high loss rates may trigger frequent alerts, leading to elevated false positive rates. High false positive rates may in turn cause unnecessary field inspections by network administrators, wasting operational resources and potentially eroding trust in the alerting system. A potential mitigation approach for practical deployment is to combine NNFDA detection results with environmental channel quality indicators such as RSSI, Link Quality Indicator (LQI), and historical packet loss rates: when persistent alerts correlate with abnormal channel quality metrics in the same region, losses can be preliminarily attributed to environmental factors; when alerts occur in the absence of channel quality anomalies, malicious dropping becomes a more likely cause. The effectiveness of this multi-source discrimination strategy requires validation in real-world environments.

5.3. Future Work

Several directions are identified for extending this work:

• Quantitative overhead evaluation on real hardware. Benchmarking the computational, memory, and energy overhead of digest generation, forwarding, and homomorphic aggregation on specific sensor hardware platforms (e.g., 8-bit/16-bit MCUs) with concrete cryptographic library implementations.
• Large-scale multi-subregion deployment. Evaluating the scalability and robustness of the NNFDA and NNFDA-BM in larger networks with multiple subregions, hundreds to thousands of sensor nodes, and multiple storage nodes.
• Formal security model and proofs. Developing a formal security model tailored to loss-tolerant TMWSNs and providing rigorous proofs that integrate the security properties of the proposed mechanisms into a unified framework.
• Multi-path redundancy and routing strategies. Quantitatively evaluating the effectiveness of increasing digest replicas, priority-based next-hop selection, and boundary-node caching for improving verification chain reliability under adverse conditions.
• Comprehensive evaluation under diverse packet loss models. Assessing scheme performance under bursty and spatially correlated loss models in addition to the uniform random model, with expanded metrics including total communication cost, energy consumption, and robustness.
• Baseline comparisons with adapted secure query schemes. Implementing and comparing against adapted versions of existing secure query protocols (e.g., redundant digest schemes, multi-path forwarding) that are modified to operate in loss-tolerant TMWSN scenarios.
• Integration with channel quality indicators. Empirically validating the effectiveness of combining NNFDA alerts with RSSI/LQI data for reducing false positive rates caused by natural packet loss.

6. Conclusions

Existing secure query algorithms for TMWSNs typically assume reliable delivery of data packets. As a result, they are not suitable for loss-tolerant networks where packet loss is inherently inevitable. This work addresses secure query mechanisms in loss-tolerant TMWSNs by first identifying and analyzing two potential attacks: (1) storage nodes discarding all query results from a specific sensor node, and (2) packet loss at sensor nodes. Notably, both attacks undermine the integrity of query results.

To mitigate these two threats, we propose the Neighbor Node-Forwarding Digest Algorithm (NNFDA) for integrity verification. The NNFDA constructs a chain-like structure by linking data digests of adjacent sensor nodes, enabling integrity verification of query results through this relationship.

Furthermore, we analyze and improve the NNFDA by proposing NNFDA-BM, which aims to reduce the overall overhead of the former. Experimental results show that the NNFDA effectively verifies the integrity of query results, especially for spatially correlated queries (e.g., range queries and KNN queries). Meanwhile, NNFDA-BM significantly reduces the NNFDA’s overhead while preserving high verification accuracy.