Guaranteeing Threshold Attendance of W/WSAN nodes in a reverted security paradigm

We consider a Wireline/Wireless Sensor and Actor Network composed of sensor/actor nodes and a data sink/command center (DSCC). Each node controls a generic device that can be in- or out-of-service, corresponding to the ENABLED or DISABLED node state. The node senses the device's intention to change state, and notifies and/or requests the DSCC for authorization to act upon the device. Motivated by requirements for critical infrastructures like smart grid systems, we seek a Threshold Attendance Protocol (TAP) that keeps the number of DISABLED nodes below a predefined threshold. The security challenge is that TAP messages have to be forwarded via the DSCC, which is exposed to various attacks and may turn rogue. In contrast, the nodes are arguably secure. For this `reverted security paradigm' we propose a TAP based on Shamir secret sharing, and discuss its correctness, optimizations and efficiency.