Abstract: The CBSP (cluster-based security protocol) is proposed to enhance the original SPINS and SECOS protocols. In CBSP the security for clusterhead election and the updating mechanism of broadcast-based authentication key can efficiently improve the security of cluster and key management, thus reducing the number of nodes and consumption of network resources. The strand space model is used to make formalized analysis of the proposed protocol, and its correctness is verified. With the cluster-based intrusion detection system in CBSP, the attack from external nodes can be efficiently resisted. The updating cycles of clusterhead and key are shortened due to the response updating mechanism of IDS, and then the CBSP is further optimized. Simulation result showed that CBSP is available to adapt well the characteristics of WSN, especially when WSN suffers the selected or retransmitted attacks the CBSP will resist them effectively so as to reduce the damage to WSN resources.