Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen
Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Alfred Kobsa University of California, Irvine, CA, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen TU Dortmund University, Germany Madhu Sudan Microsoft Research, Cambridge, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany
6033
Pierangela Samarati Michael Tunstall Joachim Posegga Konstantinos Markantonakis Damien Sauveron (Eds.)
Information Security Theory and Practices Security and Privacy of Pervasive Systems and Smart Devices 4th IFIP WG 11.2 International Workshop, WISTP 2010 Passau, Germany, April 12-14, 2010 Proceedings
13
Volume Editors Pierangela Samarati Università degli Studi di Milano, Dipartimento di Tecnologie dell’ Informazione Via Bramante 65, 26013 Crema (CR), Italy E-mail:
[email protected] Michael Tunstall University of Bristol, Department of Computer Science Merchant Venturers Building, Woodland Road, Bristol, BS8 1UB, UK E-mail:
[email protected] Joachim Posegga Institute of IT Security and Security Law 94030 Passau, Germany E-mail:
[email protected] Konstantinos Markantonakis University of London, Information Security Group, Smart Card Centre Royal Holloway, Egham, Surrey TW20 0EX, UK E-mail:
[email protected] Damien Sauveron University of Limoges, XLIM, UMR CNRS 6172 123 avenue Albert Thomas, 87060 Limoges, France E-mail:
[email protected] Library of Congress Control Number: 2010923798 CR Subject Classification (1998): E.3, C.2, D.4.6, K.6.5, J.1, H.4 LNCS Sublibrary: SL 4 – Security and Cryptology ISSN ISBN-10 ISBN-13
0302-9743 3-642-12367-8 Springer Berlin Heidelberg New York 978-3-642-12367-2 Springer Berlin Heidelberg New York
This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. springer.com © IFIP International Federation for Information Processing 2010 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper 06/3180
Preface
These proceedings contain the papers selected for presentation at the 4th Workshop on Information Security Theory and Practice (WISTP 2010), held during April 12–14, 2010 in Passau, Germany. In response to the call for papers, 69 papers were submitted to the workshop. These papers were evaluated on the basis of their significance, novelty, and technical quality. Each paper was reviewed by four members of the Program Committee. Reviewing was double-blind meaning that the Program Committee was not able to see the names and affiliations of the authors, and the authors were not told which committee members reviewed which papers. The Program Committee meeting was held electronically, holding intensive discussions over a period of two weeks. Of the papers submitted, 20 full papers and 10 short papers were selected for presentation at the workshop. This workshop was sponsored by Vodaphone, who also provided a best paper award. We would like to thank this organization for their support, which helped make this workshop possible. Their continued support helps to reduce registration fees and make WISTP a continuing success. WISTP 2010 was also organized in cooperation with the International Association for Cryptologic Research (IACR), the IFIP WG 11.2 Pervasive Systems Security, and ACM SIGSAC. Their support has significantly contributed to raising the profile of WISTP, which is reflected in the number of high-quality submissions that we received. There is also a long list of people who volunteered their time and energy to put together the workshop and who deserve acknowledgment. Thanks to all the members of the Program Committee, and the external reviewers, for all their hard work in their evaluation of the submitted papers. We are also very grateful to everyone who gave their assistance and ensured a smooth organization process: the WISTP Steering Committee, Damien Sauveron in particular, for their advice; Joachim Posegga and Konstantinos Markantonakis, for their support in the overall organization as General Chairs; Claudio A. Ardagna, Ioannis G. Askoxylakis, and Gerhard Hancke, for taking care of the publicity for this workshop. Last, but certainly not least, our thanks go to all the authors who submitted papers and all the attendees. We hope you find the proceedings stimulating. February 2010
Pierangela Samarati Michael Tunstall
WISTP 2010 4th International Workshop on Information Security Theory and Practice Passau, Germany April 12–14, 2010
General Chairs Joachim Posegga Konstantinos Markantonakis
University of Passau, Germany Royal Holloway, University of London, UK
Local Organizer Joachim Posegga
University of Passau, Germany
Workshop/Panel/Tutorial Chair Damien Sauveron
University of Limoges, France
Publicity Chairs Claudio Ardagna Ioannis G. Askoxylakis Gerhard Hancke
University of Milan, Italy FORTH-ICS, Greece Royal Holloway, University of London, UK
Program Chairs Pierangela Samarati Michael Tunstall
University of Milan, Italy University of Bristol, UK
Program Committee Rafael Accorsi Claudio Ardagna Franois Arnault Ioannis G. Askoxylakis Gildas Avoine
University of Freiburg, Germany University of Milan, Italy University of Limoges, France FORTH-ICS, Greece Catholic University of Louvain, Belgium
VIII
Organization
Angelos Bilas Carlo Blundo Marco Casassa Serge Chaumette Sabrina De Capitani di Vimercati Jan de Meer Estbaliz Delgado Tassos Dimitriou Sara Foresti Flavio Garcia Stefanos Gritzalis Yong Guan Gerhard Hancke Ragib Hasan Olivier Heen Jaap-Henk Hoepman Michael Huth Sotiris Ioannidis Sokratis Katsikas Evangelos Kranakis Michiharu Kudo Konstantinos Markantonakis Olivier Markowitch Fabio Martinelli Sjouke Mauw Keith Mayes Carlos Maziero Chris Mitchell Stefaan Motte Jose Onieva Rolf Oppliger Dan Page Stefano Paraboschi Pierre Paradinas Gerardo Pelosi Erik Poll Konstantinos Rantos
FORTH-ICS & University of Crete, Greece University of Salerno, Italy Mont. HP Labs, UK University Bordeaux 1, France University of Milan, Italy Brandenburg Technical University, Germany European Software Institute, Spain Athens Information Technology, Greece University of Milan, Italy Radboud University Nijmegen, The Netherlands University of the Aegean, Greece Iowa State University, USA Royal Holloway, University of London, UK University of Illinois, USA INRIA, France TNO & Radboud University Nijmegen, The Netherlands Imperial College London, UK FORTH-ICS & University of Crete, Greece University of Piraeus, Greece Carleton University, Canada IBM Research, Japan Royal Holloway University of London, UK ULB, Belgium IIT-CNR, Italy University of Luxembourg, Luxembourg Royal Holloway, University of London, UK Pontifical Catholic University of Parana, Brazil Royal Holloway University of London, UK NXP Semiconductors, Belgium University of Malaga, Spain eSECURITY Technologies, Switzerland University of Bristol, UK University of Bergamo, Italy INRIA & CNAM, France University of Bergamo, Italy Radboud University Nijmegen, The Netherlands Hellenic Ministry of Interior, Greece
Organization
Kui Ren Vincent Rijmen Rei Safavi-Naini Damien Sauveron Daniel Schreckling Byron Thomas Erik Zenner Bo Zhu
Illinois Institute of Technology, USA Katholieke Universiteit Leuven, Belgium University of Calgary, Canada University of Limoges, France University of Passau, Germany SiVenture, UK Technical University of Denmark, Denmark University of Concordia, Canada
Steering Committee Angelos Bilas Jaap-Henk Hoepman Konstantinos Markantonakis Chris Mitchell Jean-Jacques Quisquater Damien Sauveron
FORTH-ICS & University of Crete, Greece TNO and Radboud University Nijmegen, The Netherlands Royal Holloway, University of London, UK Royal Holloway, University of London, UK Universit´e Catholique de Louvain, Belgium University of Limoges, France
External Reviewers Naveed Ahmed Efthimia Aivaloglou Haitham Al-Sinani J´er´emie Albert Mina Askari Theodoros Balopoulos Masoud Barati Lejla Batina Samia Bouzefrane Lukasz Chmielewski Gabriele Costa Gerhard de Koning Gans Damien Dubernet David Galindo Carl Gebhardt Dimitris Geneiatakis Simon Hoerder Hugo Jonker Ioanna Kantzavelou
Giorgos Karopoulos Aliaksandr Lazouski Hoi Le Gregor Leander Olivier Ly Benjamin Martin Tania Martin Emmanuel Michailidis Shivaramakrishnan Narayan Svetla Nikova Jonathan Ouoba Vassilis Prevelakis Sasa Radomirovic Evangelos Rekleitis Peipei Shi Ton van Deursen Pim Vullers Artsiom Yautsiukhin
IX
Table of Contents
Embedded Security Efficient and Effective Buffer Overflow Protection on ARM Processors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Raoul Strackx, Yves Younan, Pieter Philippaerts, and Frank Piessens
1
Efficient Entropy Estimation for Mutual Information Analysis Using B-Splines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Alexandre Venelli
17
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tansu Alpcan, Christian Bauckhage, and Aubrey-Derrick Schmidt
31
A Smart Card Implementation of the McEliece PKC . . . . . . . . . . . . . . . . . Falko Strenzke
47
Evaluation Metrics of Physical Non-invasive Security . . . . . . . . . . . . . . . . . Huiyun Li, Keke Wu, Fengqi Yu, and Hai Yuan
60
Protocols Trust in Peer-to-Peer Content Distribution Protocols . . . . . . . . . . . . . . . . . Nicolai Kuntze, Carsten Rudolph, and Andreas Fuchs Generic Constructions of Biometric Identity Based Encryption Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Neyire Deniz Sarier Design and Analysis of a Generalized Canvas Protocol . . . . . . . . . . . . . . . . Mari´ an Novotn´y
76
90 106
Highly Constrained Embedded Systems Efficient Mutual Authentication for Multi-domain RFID Systems Using Distributed Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Michael Braun, Ulrike Meyer, and Susanne Wetzel
122
Practical Schemes for Privacy and Security Enhanced RFID (Extended Abstract) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Jaap-Henk Hoepman and Rieks Joosten
138
MoteAODV – An AODV Implementation for TinyOS 2.0 . . . . . . . . . . . . . Werner Backes and Jared Cordasco
154
XII
Table of Contents
Security Random Number Generation Based on Fingerprints . . . . . . . . . . . . . . . . . . ˇ ıha, and Ludˇek Smol´ık Shkodran Gerguri, V´ aclav Maty´ aˇs, Zdenˇek R´
170
Improvements of pan-European IDM Architecture to Enable Identity Delegation Based on X.509 Proxy Certificates and SAML . . . . . . . . . . . . . Sergio S´ anchez Garc´ıa and Ana G´ omez Oliva
183
Fraud Detection for Voice over IP Services on Next-Generation Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Igor Ruiz-Agundez, Yoseba K. Penya, and Pablo Garcia Bringas
199
Smart Card Security Proxy Smart Card Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Giuseppe Cattaneo, Pompeo Faruolo, Vincenzo Palazzo, and Ivan Visconti
213
Can We Support Applications’ Evolution in Multi-application Smart Cards by Security-by-Contract? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nicola Dragoni, Olga Gadyatskaya, and Fabio Massacci
221
Website Credential Storage and Two-Factor Web Authentication with a Java SIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Jonathan Hart, Konstantinos Markantonakis, and Keith Mayes
229
Algorithms Attribute-Based Encryption with Break-Glass . . . . . . . . . . . . . . . . . . . . . . . Achim D. Brucker, Helmut Petritsch, and Stefan G. Weber
237
On the Security of a Two-Factor Authentication Scheme . . . . . . . . . . . . . . Luigi Catuogno and Clemente Galdi
245
The Design of Secure and Efficient P2PSIP Communication Systems . . . Xianghan Zheng and Vladimir Oleshchuk
253
Hardware Implementations Novel FPGA-Based Signature Matching for Deep Packet Inspection . . . . Nitesh B. Guinde and Sotirios G. Ziavras
261
Towards Electrical, Integrated Implementations of SIMPL Systems . . . . . Ulrich R¨ uhrmair, Qingqing Chen, Martin Stutzmann, Paolo Lugli, Ulf Schlichtmann, and Gy¨ orgy Csaba
277
Table of Contents
A Very Compact Hardware Implementation of the KASUMI Block Cipher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Dai Yamamoto, Kouichi Itoh, and Jun Yajima
XIII
293
Embedded Systems Secure and Usable Out-Of-Band Channels for Ad Hoc Mobile Device Interactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ronald Kainda, Ivan Flechais, and A.W. Roscoe
308
Identification and Verification of Security Relevant Functions in Embedded Systems Based on Source Code Annotations and Assertions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Johannes Loinig, Christian Steger, Reinhold Weiss, and Ernst Haselsteiner
316
Security Analysis of Mobile Phones Used as OTP Generators . . . . . . . . . . H˚ avard Raddum, Lars Hopland Nest˚ as, and Kjell Jørgen Hole An Energy-Efficient Symmetric Cryptography Based Authentication Scheme for Wireless Sensor Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Oscar Delgado-Mohatar, Jos´e M. Sierra, Ljiljana Brankovic, and Amparo F´ uster-Sabater
324
332
Anonymity/Database Security The Market Failure of Anonymity Services . . . . . . . . . . . . . . . . . . . . . . . . . . Heiko Rossnagel
340
Exploiting Node Mobility for Coordinating Data Usage in Crisis Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Giovanni Russello and Enrico Scalavino
355
Predicting and Preventing Insider Threat in Relational Database Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Qussai Yaseen and Brajendra Panda
368
Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
385
Efficient and Effective Buffer Overflow Protection on ARM Processors Raoul Strackx, Yves Younan, Pieter Philippaerts, and Frank Piessens Katholieke Universiteit Leuven, Celestijnenlaan 200A, B-3001 Heverlee, Belgium {raoul.strackx,yves.younan,pieter.philippaerts, frank.piessens}@cs.kuleuven.be
Abstract. Although many countermeasures have been developed for desktop and server environments, buffer overflows still pose a big threat. The same approach can be used to target mobile devices. Unfortunately, they place more severe limitations on countermeasures. Not only are the performance requirements at least as important, memory and power consumption need to be considered as well. Moreover, processors used in mobile devices generally are equipped with a different instruction set. Therefore countermeasures may not be ported easily. Multistack is an effective countermeasure against stack-based buffer overflows. It protects applications by using multiple stacks to separate possible attack targets from possible sources. However, its performance overhead will no longer be negligible on the ARMv7 platform (widely used on mobile devices) and it wastes too much memory, making it too costly for mobile applications. We propose 3 methods to reduce memory overhead up to 28% with only a 3.91% performance overhead. Keywords: Control flow attacks, Stack-based buffer overflow, Software security, mobile platform.
1
Introduction
Buffer overflow vulnerabilities pose a significant threat to applications written in unsafe languages and to the devices they run on. Most of the existing buffer overflow attacks write past the boundary of a buffer located on the stack and modify an interesting memory location. Function return addresses are a frequently chosen target of attack. By overwriting them with the location of code inserted as data into memory, the program can be forced to execute instructions with the privilege level of the attacked program [1,2]. Many countermeasures that protect desktop and server environments have been developed. Some try to solve the problem entirely by inserting bound checks or modifying the language itself [3,4,5]. Others rely on randomness and secrets to detect or prevent modifications of data in memory. The latter have less performance overhead [6,7,8,9]. Even though many more approaches exist, attackers still find ways to attack systems successfully, for example by breaking some of the assumptions made in the countermeasures in place, such as the fact that a canary remains secret [10]. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 1–16, 2010. c IFIP International Federation for Information Processing 2010
2
R. Strackx et al.
According to the NIST’s National Vulnerability Database [11], 563 buffer overflow vulnerabilities were reported in 2008, making up 10% of the total 5,634 vulnerabilities reported in that period, only preceded by Cross Site Scripting (14.0%) and SQL injection vulnerabilities (19.5%). Of those buffer overflow vulnerabilities, 436 had a high severity rating. As a result, buffer overflows make up 15% of the 2,853 vulnerabilities with a high severity rating reported in 2008, second only to SQL injection vulnerabilities (28.5%). During the last decade, mobile devices built upon the ARM architecture, such as smartphones and PDA’s, became ubiquitous objects. They are used for a wide variety of tasks, ranging from surfing the web to managing important data. As their number increases, so does the interest of attackers in the platform. Since they are built using the same principle as desktop systems, they as well are vulnerable to buffer overflow attacks [12,13]. However, defending embedded devices against these attacks is more difficult than desktop systems. To reduce costs and increase mobility, they are generaly equipped with a less powerfull processor and limited memory. Moreover, processors used in embedded devices (i.e. ARM CPU’s) generally are equipped with a different instruction set than desktop systems. As a results, not all countermeasures can be ported easily. Multistack [14] is an effective stack-based buffer overflow countermeasure, originally designed for the x86 architecture. It does not rely on secret values (such as canaries), but separates buffers from possible attack targets using guard pages. This prevents state-of-the-art attacks [10] with negligible performance overhead. However, its memory consumption is significant, making it too costly to protect applications on mobile devices. Moreover, it relies on the ability to add a 32bit constant value to a register in a single load/write instruction, an operation not supported by ARM processors. As a result, performance degradates on this platform. In this paper, three techniques are proposed to port the Multistack countermeasure to the ARMv7 platform. They all minimize memory consumption while at the same time performance overhead is reduced compared to the original Multistack method on the ARMv7 platform, making the countermeasure efficient enough to be deployed on existing mobile devices. This paper is structured as follows: first buffer overflows are reexamined (section 2), followed by the original Multistack countermeasure. Section 4 presents the different approaches, which are evaluated in section 5. Possible enhancements are described in section 6. The proposed techniques are compared to existing countermeasures in section 7, while section 8 presents our conclusions.
2
Buffer Overflows
Buffer overflows are the result of an out of bounds write operation on an array. In this section we briefly recap how an attacker could exploit such a buffer overflow. Many derivative attacks exists; more complete overviews can be found in [1,2,15].
Efficient and Effective Buffer Overflow Protection on ARM Processors
3
Buffers can be allocated on the stack, the heap or in the data/bss section in C. For arrays1 that are declared in a function body, space is reserved on the stack. Buffers that are allocated dynamically (using the malloc function, or some other variant), are put on the heap, while arrays that are global or static are allocated in the data/bss section. The array is manipulated by means of a pointer to the first byte. Bytes within the buffer can be addressed by adding the desired index to this base pointer. v o i d copy ( c h a r ∗ s r c , c h a r ∗ d s t ) { int i = 0; char c u r r = s r c [ 0 ] ; while ( c u r r ) { dst [ i ] = curr ; i ++; curr = src [ i ] ; } } Listing 1.1. A C function that is vulnerable to a buffer overflow
Most C-compilers generate code that does not check the bounds of an array and allow programs to copy data beyond their end. This behavior can be used to overwrite data in adjacent memory space. The unprotected application can be successfully attacked if these memory locations contain data that influence control flow and is used after the buffer overflow. On the stack this is usually the case: it stores the addresses to resume execution at, after a function call has completed its execution. This address is called the return address. Manipulating it gives the attacker the possibility to execute arbitrary code. Listing 1.1 shows a straightforward string copy function. Improper use of this function can lead to a buffer overflow, because there is no validation that the destination buffer can actually hold the input string. An attacker can thus exploit the buffer overflow vulnerability to overwrite memory that is stored adjacent to the destination buffer.
3
Multistack
3.1
Approach
Multistack [14] is a separation-based countermeasure designed to protect applications against stack-based buffer overflows. For each data type that may be stored on the stack, an analysis is made to determine the feasibility that 1) it can be used as a source of attack and 2) it will ever be a target of an attack. Using this information, types with a comparable source/target trade-off are placed in the same category. 1
We will use array as a synonym for buffer throughout the paper.
4
R. Strackx et al.
For example, an array of characters is a common source of attack, but is rarely a target itself. Pointers on the other hand, are much more likely to be a target. In case an attacker is able to overwrite a pointer and specify the value written to memory by dereferencing that modified pointer, he/she can write an arbitrary value to a chosen memory location [16]. It is clear that these types should be separated from one another and they are placed in different categories. This however, may not always be possible. Consider a structure containing an array of characters as well as pointers. This type may be used as an attack source, but may also be a target of attack. This type does not fit in either one of the two previous categories and a new one is created. Multistack operates by placing the categories of variables on different stacks (see Figure 1). Guard pages 2 prevent buffer overflows on one stack from reaching another. Note that the guard pages will not prevent arrays in structures to overwrite the accompanied pointers. However, in most applications the usage of such structures is modest and the chance of finding a buffer overflow vulnerability in code operating on them, is limited. Applications that do not fulfill this assumption may apply additional countermeasures, possibly only in functions that use such types as local variables. By placing the separate stacks sequentially in memory, their exact location can be calculated at compile-time. Consider a variable x that should be placed on stack s with offset d from the stack pointer. When all stacks are assigned a maximum length of 8 MiB3 , the updated offset will be f p − d − s · 8M iB where fp, the frame pointer, points to the start of the stack frame. This has another advantage; it allows address space layout randomization (ASLR) (see section 7) to relocate the base of the stack each time the application is run. Obviously, the relative distance between the stacks must be specified at compile-time. To address a variable on the stack, unprotected applications also have to perform this addition, though with a different operand. Since the x86 instruction set provides load and store instructions that are able to store an immediate constant of 32-bits, no extra instructions need to be issued to access the variable. Multistack can be configured to use any number of stacks. However, when their number increases, the drawbacks of the countermeasure do as well (see section 3.2). Some methods that will be described in section 4 limit the maximum number of categories to four. 3.2
Discussion
Performance penalty. With the exception of code to allocate the different stacks and the creation of guard pages, no extra instructions are required. 2 3
A memory page without any permission. Any attempt to read, write or execute from this page will result in a segmentation fault. 1 MiB = 1 mebibytes = 220 bytes (standardized by IEC 60027-2).
Efficient and Effective Buffer Overflow Protection on ARM Processors
5
Fig. 1. Multistack stack layout for 4 stacks
Performance evaluation [14] shows an overhead between 0% and 3%, on the x86 platform. This efficiency is reached because this platform is able to use a 32-bit offset in a load and store instruction. On processors equipped with the ARM instruction set, multiple instructions would be required, leading to a degradation of performance (see section 4.1). Memory consumption. By only modifying the offset used to address a stackbased variable, performance loss remains negligible, but it also leads to wasted memory. The corresponding locations of a variable x on the other stacks, remain unused until the function returns. At any time in the execution of an application with s stacks and m the combined size of all variables on the stack, (s - 1)m MiB of virtual memory is wasted. The situation even deteriorates in case multi-threaded applications are considered. In that case, each thread would waste that amount of memory. In section 5 a more detailed analysis is given. 3.3
Conclusion
The multistack countermeasure has a very limited performance penalty while providing effective protection against stack-based buffer overflows on the x86 platform. Its memory consumption and increased performance overhead on ARM processors, however make it too costly for mobile devices.
4 4.1
Approaches on Mobile Devices Original Approach
The most obvious implementation of Multistack on mobile devices is using a similar implementation as on the x86 platform. As described in section 3, a
6
R. Strackx et al.
single frame pointer is used to address stack-based variables. This poses an issue since the ARMv7 instruction set does not support adding an arbitrary 32-bit integer using a single instruction. A simple solution is to use multiple additions (i.e. add instructions), however a performance penalty is expected. The obvious drawback of this technique is its memory consumption. However, the evaluation in section 5 will reveal that this memory overhead in some cases is negligible. 4.2
Dedicated Registers
Most applications never allocate space on the stack dynamically. Therefore the size of the stack frame is fixed for each function and the stack pointer can be used to address variables located on the stack. Applications that do not follow this assumption, can be modified by the compiler to not allocate space on the stack at runtime but on the heap instead. ARM processors are equipped with a large number of registers to store intermediate results. To reduce memory consumption, three stack pointers can be stored in specially reserved registers and used to track the top of each stack. This can be implemented in a compiler in a straightforward way. The main function is modified to allocate the different stacks and initialize the stack pointers. To each function’s prologue and epilogue, instructions are added to allocate and free the required space on the related stacks by updating the corresponding registers. The addressing of stack-based variables is modified to use the appropriate stack pointer. By reserving save-by-callee registers to hold the stack pointers, protected code is able to call unprotected libraries. However, the registers may not always contain the correct value when callbacks are used to return to protected code. Only in that case, recompilation of the library is required. 4.3
Indirection Using a Fixed Address
The previous technique reserves three registers. This may lead to an increased register pressure and consequently a degradation of performance. Alternatively, the location of the stack pointers can be stored at a fixed location. Since all instructions in the ARMv7 instruction set have a fixed length of 32 bits, it is impossible to load an arbitrary 32-bit address in a register by specifying it as the payload of a single instruction. However, the mov instruction is able to do just that when certain requirements on the value are met. To be able to use this instruction, the stack pointers are stored on a reserved page at 0xbe000000 0xbe000008. Before executing any other code, the stacks are created and the page at 0xbe000000 is allocated. To allocate/deallocate memory on stack 2 to 4 or address a stack-based variable, the location of stack pointer 2 is loaded in a register first. The subsequent load or store instruction adds the required offset to access the relevant stack pointer. Note that by storing the stack pointers at a well
Efficient and Effective Buffer Overflow Protection on ARM Processors
7
chosen location, no register has to be reserved and only one extra instruction needs to be executed before each memory access related to stack 2 to 4. 4.4
Packed Stack Pointers
The previous technique assumes the increased register pressure to be the main contributor to the performance overhead of the countermeasure. In order to reduce it, stack pointers are loaded from and stored in memory when appropriate. This assumption however, may not hold for all applications. The presented “improvements” may in some cases even lead to a further deterioration of the countermeasure’s performance. Technological developments during the last decades resulted in a huge increase of processor and memory speed. However, making inexpensive, large memory that can be accessed rapidly, proved to be challenging. Multiple levels of caches were introduced to increase the overall performance of the system but accessing registers remains faster than loading a value from cache. To load instructions from memory quickly, processors are equipped with pipelines to decode instructions. This technique works well when branches are reduced to a minimum. Considering both optimizations, it is obvious that it may be more efficient to execute more instructions when this avoids memory accesses. The approach presented in this section uses another observation. The dedicated register approach uses one register for each stack pointer. While theoretically the stack is able to grow arbitrarily large, in practice only in extremely rare cases more than 8 MiB is required. By aligning the added stacks at 8 MiB, the 11 most significant bits of their stack pointers will remain fixed for the entire execution of the program. As a result, by allocating the stacks at a location specified at compile time, only the 23 least significant bits need to be stored. This number can be reduced to 21 when it is assumed that each variable on the stack is 4-byte aligned. Using this approach [17], three stack pointers can be stored in only two registers. The stack pointer of the least frequently accessed stack will be split over the two registers. Note that even more stack pointers can be stored using less registers by limiting the size of the stacks. Another option is to increase the alignment of both the stacks and the stored variables to facilitate larger stacks. However, in case a stack frame’s length is not a multiple of the alignment, memory will be wasted. As before, the main function is modified to allocate memory for the different stacks, to set the guard pages and initialize the stack pointers. Allocating space on a stack can be done without completely restoring the stack pointers. However, care must be taken when the stack pointer that is split over two registers needs to be updated. A carry bit may need to be added or subtracted from the most significant part of the pointer when the least significant part wraps around zero. By carefully choosing bit shift operations, this can be done without using any extra registers or branches. Since this approach requires that two registers are reserved, the same incompatibility with callback functions as described in section 4.2 exists and a full recompilation of the application may be required.
8
5
R. Strackx et al.
Evaluation
During development, we focused mainly on smart phones and PDA’s. The telecom and consumer suite of the MiBench benchmark [18] provides representative applications for these devices. They are used to evaluate memory and performance overhead. The typeset application is omitted because its in-line assembly uses the reserved registers. Applications that would only use stack 1 (CRC32 and adpcm) do not benefit from the countermeasure and are not considered. 5.1
Security Evaluation
Two of the presented approaches store the stack pointers in registers. This has the advantage that an attacker is not able to modify this control data, before a successful code execution attack. In case the stack pointers are stored in memory (section 4.3), they are an interesting target of attack. Additional countermeasures need to be installed. However, a simple solution is to modify the location of stack 1 so it contains the memory locations where the pointers are stored. With the exception of the packed stack pointers approach (section 4.4), the presented techniques have an additional advantage: they allow the locations of the stacks to be randomized, also relative to each other. In all other aspects, our proposed approaches are as secure as the original Multistack countermeasure [14]. 5.2
Memory Consumption
The question how much physical memory can be gained by applying one of the proposed techniques for a specific application, is difficult to answer because many factors must be considered. The core of the problem is that when a virtual page remains unused, there is no need to store the corresponding physical page. To determine the likelihood of this situation, we ran the telecom and consumer suite of MiBench, protected with the original Multistack implementation. Memory usage of each application was tracked, as well as the number of physical memory pages that were referenced. These measurements relied on two assumptions. First, we assumed that in any function, the stack variables on stack 1 were placed closest to the base of the stack. Variables on stack 2 came next and so on. Note that the C standard does not specify the exact order of these variables in memory. Second, each stack, including stack 1, started at the beginning of an empty page. This is a worst case scenario. Applications with maximum stack sizes smaller than a single page, will not waste physical memory. In practice, memory may be wasted much sooner. Table 1 displays the result of the test. Using these figures, the number of pages that will be gained by the proposed approaches, can be calculated easily. The measurements show improvements between 0% and 28% for the test applications, assuming a page size of 4,096 bytes. This large difference in potential gain depends on several factors, being discussed next.
Efficient and Effective Buffer Overflow Protection on ARM Processors
9
Number, size and type of stack variables. As explained in section 3.1, the original Multistack implementation, will result in holes of unused virtual memory. Depending on the number, size and type of stack variables, this in turn leads to internally fragmented, unused and/or completely used pages. Figure 2 displays these possibilities for the lame and qsort applications. In case pages remain unused, no physical memory is wasted. This situation occurs when a stack is rarely used or when large arrays are allocated. When space is allocated to hold an array larger than two pages, at least one page remains unreferenced on the other stacks. The qsort application allocates 1.2 · 106 MiB to hold the values to be sorted and thus is a good example of this situation. Compacting the stacks will have a positive influence in case many pages are internally fragmented. Consider stack 1 of the lame application. It uses 7 pages (28,672 bytes) to store only 1,444 bytes, or 35.3% of the memory it allocated. Figure 2 also displays the percentage of actually used physical memory to the amount that was allocated.
Fig. 2. Depending on the number, size and other factors, physical pages may remain unused (white boxes), internally fragmented (gray boxes) or completely used (black boxes). Compacting the stack minimizes the number of internally fragmented pages.
Number of function calls. The number of function calls also plays an important role. Obviously, in case the number of calls is small, the combined stack size may not be larger than a single page. As a result, even though the original implementation does leave unused memory locations on the stacks, no pages can be saved by compacting the stacks. A number of examples of this situation can be found in the MiBench benchmark, including jpeg, tiff2bw, gsm, FFT, . . . The number of function calls made throughout the execution of the application and the way these calls are made, can play a role in memory usage. When functions call each other to a great depth, the size of the stack could grow large. As a result, multiple pages could be used to store only a few bytes.
application qsort qsort FFT IFFT gsm (enc.) gsm (dec.) jpeg (enc.) jpeg (dec.) lame mad mad tiff2bw tiff2rgba tiffdither tiffmedian
set small large both both both both both both both small large both both both both
stack 1 stack 2 stack 3 bytes pages bytes pages bytes pages 796 2 0 0 7,680,000 0 948 3 1,200,000 293 0 0 360 1 48 1 0 0 360 1 48 1 0 0 544 1 957 1 0 0 540 1 932 1 0 0 436 1 2,960 1 132 1 480 1 1,484 1 132 1 1,444 7 56,044 15 4 1 1,216 3 7,192 1 632 1 1,216 2 368 1 404 1 472 1 100 1 0 0 464 1 102 1 0 0 1,044 1 92 1 0 0 532 1 228 1 0 0
stack 4 Total bytes pages bytes pages 0 0 7,680,796 1,878 0 0 1,200,948 296 0 0 408 2 0 0 408 2 0 0 1,501 2 0 0 1,472 2 257 1 3,785 4 257 1 2,353 4 16,389 6 73,881 29 27,674 8 36,714 15 27,674 8 29,662 12 1,104 1 1,676 3 1,024 1 1,590 3 1,104 1 2,240 3 80 1 840 3
Potential gain bytes pages % 8,192 2 0.11% 8,192 2 0.68% 0 0 0% 0 0 0% 0 0 0% 0 0 0% 0 0 0% 0 0 0% 32,768 8 27.59% 16,384 4 26.67% 8,192 2 16.67% 0 0 0% 0 0 0% 0 0 0% 0 0 0%
Table 1. From the MiBench benchmark the telecom and consumer suites were selected. The different applications from these suites were run protected with the original Multistack implementation. This table displays the maximum number of memory locations used on the different stacks. The size in bytes is displayed together with the used physical pages. The last column displays how much memory is saved by compacting the stacks.
10 R. Strackx et al.
Efficient and Effective Buffer Overflow Protection on ARM Processors
11
Also, if a lot of consecutive calls are made, memory usage could degrade. The diversity of the different calls will decrease the chances that pages on other stacks remain unused. Page size. Consider the example that a variable is stored on a certain stack. When this variable is larger than two pages, the corresponding location at the other stacks may remain unused and no physical pages need to be stored. The chances that this situation occurs increases inversibly with the size of the pages. Small pages have a second advantage; on average only half of the pages before and after such a hole are used. In case the pages are smaller, less physical memory is wasted. Our memory usage measurement on the MiBench benchmark assumes that the stack pointer points to the beginning of a blank page when the Multistack countermeasure is installed. In practice this may not be the case. In the worst case, it points to the end. As a result, only a few bytes can be stored on the first page of stack 2 to 4. However, the original implementation of Multistack could be adjusted easily. By allocating more space on stack 1, memory consumption on the other stacks may decrease with one page. Programming style. It is clear that the way a program is written will have a huge impact on the structure of the stack. A programmer could opt solving a problem iteratively instead of using recursive calls. This would prevent the size of the stacks from growing rapidly and wasting memory. Also by allocating large variables on the heap, more pages could be reused on the stack with less fragmentation. This could be implemented in a compiler as a heuristic. 5.3
Performance Evaluation
To evaluate the performance of the different Multistack implementations, we ran the telecom and consumer suite of the MiBench benchmark [18] on a Sharp PC-z1 running Ubuntu Linux 9.04 (kernel 2.6.28). This netbook is equipped with an ARM Cortex-A8 CPU running at 800 MHz and 512 MiB RAM. The countermeasures were implemented in the gcc-4.3.3 revision 143643 compiler. The benchmark was compiled with -O0 -fomit-frame-pointer flags. To receive accurate results, each application was provided the large input set and run 500 times. Table 2 displays the results. Explaining and predicting performance overhead is complex since there are many factors to consider. Two of the most relevant factors are discussed next. Increased number of instructions. There are two obvious places where instructions may be added. First, all techniques, with the exception of the original Multistack, require the prologues and epilogues to be modified to allocate memory on the stack. Obviously, this will have a negative impact on performance in case an application makes many function calls, for example, if recursion is used. Second, additional instructions may be required to access a variable on a stack. Applications such as fft and ifft read and write to stack 2 very often. Hence, the time to access this stack will have a huge impact on their performance.
12
R. Strackx et al.
In case of the original Multistack implementation, the immediate offset in the load/store instruction can not be used to load/store a value on stack 2, 3 or 4 since this offset is too large. Therefore an extra addition is required, leading to a performance loss of 15.1% for fft and even 19.08% for ifft. In case dedicated registers are used to store the different stack pointers, the stack-based variables can be accessed in only one instruction. This leads to a much lower performance loss; 6.99% for ftt and 9.03% for ifft. In case the stack pointers are packed, the accessed variable’s location will have an influence as well. Acesses to stack 2 or 4 only require a few instructions. Variables on stack 3 are much harder to access since their stack pointer is scattered over 2 registers. As a result, accessing stack 3 is slower than stack 2 or 4. With the exception of the dedicated registers approach, the same applies for the other implementations; variables on stack 1 can be addressed by simply specifying an offset to register sp. For other stacks, more instructions are needed. When main memory needs to be accessed, the order wherin the instructions are scheduled and the memory’s access time will also play an import role. Register pressure. The dedicated register approach does not require additional instructions to access a stack-based variable. Therefore, it was able to execute the fft and ifft applications much faster. However, by reserving three registers, register pressure may increase, leading to a performance deterioration. To discover the impact on the selected applications, each was run unprotected with 3 reserved registers but no significant impact on performance was found. Summary. Many factors influence the performance of the different presented techniques. On average (see table 2), all the presented techniques perform better than the original Multistack implementation. By storing the stack pointers at a fixed location, performance overhead is reduced from 4.91% (original Multistack) to 4.57%. Packing the stack pointers in two registers further reduces the performance overhead to 4.39%. The dedicated register approach is on average even 1% faster (3.91%). In case for each application the best performing countermeasure is chosen while requiring that no physical memory is wasted, the average performance overhead is reduced to 3.30%.
6
Discussion and Ongoing Work
Besides the possible implementations presented in section 4, another one was developed, but omitted due to page limits. As the technique described in section 4.3, the stack pointers are stored in main memory but a reserved register stores their location. This eliminates the instruction to load the location in a register. However, its performance proved slightly worse in practice. We assume that the processor on our test was not able to schedule the instructions as well as the fixed address approach. More detailed information can be found in [19]. Using static analysis, many of the presented approaches can still be improved. At compile time it could be determined that some of the stacks will never be used
application FFT IFFT gsm (enc.) gsm (dec.) jpeg (enc.) jpeg (dec.) lame mad tiff2bw tiff2rgba tiffdither tiffmedian average
unprot. sec 1.25 ± 0.01 1.02 ± 0.01 6.32 ± 0.02 2.68 ± 0.02 0.34 ± 0.01 0.09 ± 0.01 26.42 ± 0.06 1.44 ± 0.01 0.94 ± 0.01 2.57 ± 0.02 3.38 ± 0.02 2.64 ± 0.02
1.43 1.21 6.33 2.68 0.41 0.09 26.56 1.48 0.94 2.56 3.46 2.64
original sec % ± 0.01 15.10% ± 0.01 19.08% ± 0.02 0.08% ± 0.02 0.14% ± 0.01 19.31% ± 0.01 0.00% ± 0.08 0.53% ± 0.01 2.78% ± 0.01 -0.46% ± 0.02 -0.13% ± 0.02 2.35% ± 0.02 0.18% 4.91%
dedicated regs. sec % 1.33 ± 0.01 6.99% 1.11 ± 0.01 9.03% 6.32 ± 0.02 0.05% 2.68 ± 0.02 0.15% 0.43 ± 0.01 25.53% 0.09 ± 0.01 -0.34% 26.40 ± 0.07 -0.05% 1.50 ± 0.01 4.51% 0.94 ± 0.01 -0.11% 2.57 ± 0.02 -0.06% 3.41 ± 0.02 1.03% 2.64 ± 0.02 0.18% 3.91%
packed sp sec % 1.36 ± 0.01 8.93% 1.13 ± 0.01 10.95% 6.32 ± 0.03 0.05% 2.68 ± 0.02 0.10% 0.43 ± 0.01 26.19% 0.09 ± 0.01 0.67% 26.64 ± 0.05 0.86% — —% 0.94 ± 0.01 -0.54% 2.57 ± 0.02 -0.03% 3.42 ± 0.02 1.22% 2.63 ± 0.02 -0.14% 4.39%
fixed address sec % 1.36 ± 0.01 8.88% 1.13 ± 0.01 10.65% 6.33 ± 0.03 0.08% 2.68 ± 0.02 0.14% 0.44 ± 0.01 27.12% 0.09 ± 0.01 0.22% 26.53 ± 0.05 0.43% 1.57 ± 0.01 8.95% 0.94 ± 0.01 -0.27% 2.57 ± 0.02 0.03% 3.46 ± 0.02 2.47% 2.63 ± 0.02 -0.28% 4.57%
Table 2. Running the telecom and consumer suite of the MiBench benchmark shows that the dedicated register approach, on average, outperforms the other approaches
Efficient and Effective Buffer Overflow Protection on ARM Processors 13
14
R. Strackx et al.
by the application (see section 5.2). This knowledge could be applied to reserve less registers for the dedicated register approach. Combining this knowledge with a more guided estimation of the maximum size of each stack, the packed stack pointers technique could be modified to reduce the number of registers reserved and/or store less bits of each stack pointer. Also a heuristic could be used in case registers are reserved to reduce the register pressure; functions may use these registers to store intermediate values, as long as their contents is restored before they are used by the function itself or one that it calls (in)directly. The main goal was to eliminate the memory usage of the original Multistack implementation. Not only do all proposed implementations satisfy this goal, section 5.3 showed that on average they also reduce performance overhead. The dedicated registers approach not only outperforms all other implementations, but it can also be adapted easily for multithreaded applications, a situation not supported by the original approach.
7
Related Work
Many countermeasures to protect applications against (stack-based) buffer overflow attacks have been developed during the last decades. In this section we briefly highlight the differences between our and existing approaches to the problem. A more elaborate overview can be found in [2,15,20]. One obvious way to defend applications against buffer overflow attacks is to add bound checks [3], however when implemented for C, their performance overhead is significantly larger than other countermeasures. Another approach uses a type system and runtime checks to create safe languages where the existence of buffer overflow vulnerabilities are prevented. There are safe languages, referred to as safe dialects, that remain as close to C or C++ as possible. However, their performance overhead is also significant [4,5]. The most often applied countermeasure in practice uses random data to detect buffer overflows or try to prevent their successful execution. StackGuard [6,7] is an example of such a probabilistic countermeasure. It places a random value, called canary, in front of each return address on the stack. An attacker that overflows a stack-based buffer up to a return address, will modify the canary. The canary check at each function’s epilogue will notice this modification and prevent the exploit before the return address is used. However, by overwriting a pointer, an attacker is able to write to an arbitrary memory location, when the application dereferences the pointer for such an instruction. In case he/she is also able to control the written value, the execution path can be redirected to injected code, for example, by overwriting a return address [16]. Since the canary is not modified, StackGuard is not able to detect the attack. ProPolice [7] entangles the canary and the return address by taking the xor function from a random value and the return address. This allows the detection of any change to the return address. Address space layout randomization (ASLR) [8,9] randomizes the location of program data and code. As a result, redirecting execution to shellcode is hard.
Efficient and Effective Buffer Overflow Protection on ARM Processors
15
While these last approaches are efficient, they rely on keeping memory locations secret. However, programs could also contain “buffer overreads” [10] or other vulnerabilities like format string vulnerabilities [21], which allow attackers to print out memory locations. Such memory leaking vulnerabilities could allow attackers to bypass this type of countermeasure. Other countermeasures take advantage of hardware to protect against buffer overflows. Francillon et. al. [22] implement a similar approach as Multistack, but only two stacks are supported and the presence of specialized hardware is required. The techniques presented in this paper take advantage of a Memory Management Unit (MMU) to create guard pages, hardware that can also be used to facilitate additional countermeasures (e.g. non-executable memory [23,8]) and already present in many modern processors.
8
Conclusion
The Multistack countermeasure effectively protects against stack-based buffer overflows, defeating many state-of-the-art attacks. Unfortunately, its straightforward port to the ARMv7 instruction set, does not reach the same efficiency as on the x86 platform and it suffers from high memory overhead. In this paper we presented three approaches that reduce memory overhead up to 28%. In addition, each approach also reduces performance overhead. The best performing has an overhead of only 3.91% and supports multi-threaded applications, a situation not supported by the original Multistack implementation. Acknowledgments. We thank Thomas Walter and Sven Lachmund for the discussions on this topic, and the feedback on an earlier draft of the paper. This research is partially funded by NTT Docomo Eurolabs, by the Interuniversity Attraction Poles Programme Belgian State, Belgian Science Policy, and by the Research Fund K.U.Leuven.
References 1. Aleph1: Smashing the stack for fun and profit. Phrack 49 (1996) ´ Younan, Y., Piessens, F.: Handbook of information and communi2. Erlingsson, U., cation security (2010) 3. Kendall, S.: Bcc: Runtime checking for C programs. In: Proceedings, The Association, p. 5 (1983) 4. Larus, J., Ball, T., Das, M., DeLine, R., F¨ ahndrich, M., Pincus, J., Rajamani, S., Venkatapathy, R.: Righting software. IEEE Software, 92–100 (2004) 5. Necula, G., Condit, J., Harren, M., McPeak, S., Weimer, W.: CCured: Type-safe retrofitting of legacy software. ACM Transactions on Programming Languages and Systems (TOPLAS) 27(3), 526 (2005) 6. Cowan, C., Pu, C., Maier, D., Hintony, H., Walpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., Zhang, Q.: Stackguard: automatic adaptive detection and prevention of buffer-overflow attacks. In: SSYM’98: Proceedings of the 7th conference on USENIX Security Symposium, Berkeley, CA, USA. USENIX Association (1998)
16
R. Strackx et al.
7. Etoh, H., Yoda, K.: Protecting from stack-smashing attacks. Technical report, IBM Research Division, Tokyo Research Laboratory (June 2000) 8. Team, P.: Documentation for the PaX project. Homepage of The PaX Team (2003) 9. Bhatkar, S., DuVarney, D.C., Sekar, R.: Address obfuscation: An efficient approach to combat a broad range of memory error exploits. In: Proceedings of the 12th USENIX Security Symposium, August 2003, pp. 105–120 (2003) 10. Strackx, R., Younan, Y., Philippaerts, P., Piessens, F., Lachmund, S., Walter, T.: Breaking the memory secrecy assumption. In: EUROSEC ’09: Proceedings of the Second European Workshop on System Security, New York, NY, USA, pp. 1–8. ACM, New York (2009) 11. National Institute of Standards and Technology: National vulnerability database statistics (2009), http://nvd.nist.gov/statistics.cfm 12. Younan, Y., Philippaerts, P., Piessens, F., Joosen, W., Lachmund, S., Walter, T.: Filter-resistant code injection on ARM. In: Proceedings of the 16th ACM conference on Computer and communications security, pp. 11–20. ACM, New York (2009) 13. National vulnerability database, cve-2006-4131 (2006) 14. Younan, Y., Pozza, D., Piessens, F., Joosen, W.: Extended protection against stack smashing attacks without performance loss. In: ACSAC (2006) 15. Younan, Y., Joosen, W., Piessens, F.: Code injection in c and c++: A survey of vulnerabilities and countermeasures. Technical report, Departement Computerwetenschappen, Katholieke Universiteit Leuven (2004) 16. Bulba, Kil3r: Bypassing stackguard and stackshield. Phrack Magazine 0xa(0x38) (January 2000) 17. Ergin, O., Balkan, D., Ghose, K., Ponomarev, D.: Register packing: Exploiting narrow-width operands for reducing register file pressure. In: Proceedings of the 37th International Symposium on Microarchitecture (2004) 18. Guthaus, M., Ringenberg, J., Ernst, D., Austin, T., Mudge, T., Brown, R.: MiBench: A free, commercially representative embedded benchmark suite. In: IEEE 4th annual Workshop on Workload Characterization, vol. 131, pp. 184–193 (2001) 19. Strackx, R.: Protecting mobile devices against stack-based buffer overflows. Master’s thesis, Katholiek Universiteit Leuven, Celestijnenlaan 200A, B-3001 Leuven (June 2009) 20. Younan, Y.: Efficient countermeasures for software vulnerabilities due to memory management errors. PhD thesis, Katholiek Universiteit Leuven, Celestijnenlaan 200A, B-3001 Leuven (2008) 21. Shankar, U., Talwar, K., Foster, J., Wagner, D.: Detecting format string vulnerabilities with type qaualifiers. In: Proceedings of the 10th conference on USENIX Security Symposium, vol. 10, p. 16. USENIX Association (2001) 22. Francillon, A., Perito, D., Castelluccia, C.: Defending Embedded Systems Against Control Flow Attacks 23. Non-executable stack patch (1998), http://www.openwall.com
Efficient Entropy Estimation for Mutual Information Analysis Using B-Splines Alexandre Venelli1,2 1
IML – ERISCS Universit´e de la M´editerran´ee, Case 907, 163 Avenue de Luminy 13288 Marseille Cedex 09, France 2 ATMEL Secure Microcontroller Solutions Zone Industrielle, 13106 Rousset, France
[email protected] Abstract. The Correlation Power Analysis (CPA) is probably the most used side-channel attack because it seems to fit the power model of most standard CMOS devices and is very efficiently computed. However, the Pearson correlation coefficient used in the CPA measures only linear statistical dependences where the Mutual Information (MI) takes into account both linear and nonlinear dependences. Even if there can be simultaneously large correlation coefficients quantified by the correlation coefficient and weak dependences quantified by the MI, we can expect to get a more profound understanding about interactions from an MI Analysis (MIA). We study methods that improve the non-parametric Probability Density Functions (PDF) in the estimation of the entropies and, in particular, the use of B-spline basis functions as pdf estimators. Our results indicate an improvement of two fold in the number of required samples compared to a classic MI estimation. The B-spline smoothing technique can also be applied to the rencently introduced Cram´er-vonMises test.
1
Introduction
Side-channel analysis, and power analysis attacks in particular, are a major concern for the smart card industry. Differential Power Analysis (DPA) is one of the most known and efficient side-channel attacks. Introduced by Kocher et al. [1] in 1999, DPA exploits statistical differences in a large set of observations to deduce the secret key of the attacked algorithm. It uses a partition function to sort the set of observations into two subsets. This partition function simulates an intermediate cryptographic computation of the algorithm where parts of the secret and the plaintext are combined. Then, DPA consists in using the differences between averages of power consumption curves of the two subsets to show a peak when the attack uses a correct key guess. This statistical tool shows how different the subsets are. In 2004, Brier et al. [2] proposed a Correlation Power Analysis (CPA), an attack using the Pearson correlation coefficient as a statistical distinguisher. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 17–30, 2010. c IFIP International Federation for Information Processing 2010
18
A. Venelli
This correlation factor seems to be the most successfull in differential power analysis on standard CMOS devices. It finds the linear dependencies between power consumption curves and a leakage function based on a key guess and a plaintext value. Batina et al. [3] proposed using non-parametric tests when the dependency between the power consumption and the leakage fuction used is not so close to linear. They showed that the non-parametric Spearman rank correlation coefficient outperforms the Pearson coefficient in such case. Recently in [4], the authors presented the use of mutual information as a distinguisher. This Mutual Information Analysis (MIA) is a more general attack. It makes no assumptions on the relation between observations and the leakage function whereas CPA just recovers the linear correlation. As most standard CMOS devices seem to follow the linear Hamming weight power model, CPA often performs better than MIA. However on special logic, e.g. Wave Dynamic Differential Logic where the assumption on the Hamming weight power model no longer holds, MIA seems to be quite efficient [4]. The MIA, as presented in [4], could perform better in term of efficiency of the results, even on standard CMOS devices. In the present paper, we introduce the use of B-splines as a tool to better estimate entropy. B-spline basis functions can be used as Probability Density Function (PDF). By construction, the B-spline estimation takes into account the measurement noise of the data. We evaluate the efficiency of this improved evaluation and demonstrate significantly better results on practical data. We also apply the B-spline technique to the recently proposed Cram´er-von-Mises test [5]. Section 2 summarizes the fundamentals of information theory. Section 3 introduces the classical methods of estimating probabilities and entropies. Section 4 presents our contributions with the use of B-spline functions as estimators and how it particulary fits into the side-channel context. Experimental results are provided in Section 5 and Section 6 concludes the paper.
2
Information Theory Background
In information theory, Mutual Information (MI) is defined as a measure of mutual dependance of two variables. Unlike the linear Pearson correlation coefficient, it is sensitive also to dependencies which do not occur in covariance. Let X be a random variable, with a finite set of MX possible states Xi with i ∈ {1, . . . , MX } and with a probability distribution IPX , the Shannon entropy of X, noted H(X) or H(IPX ) is defined as: H(X) = −
MX
p(Xi ) log(p(Xi )),
(1)
i=1
where p(Xi ) is the probability of the state Xi . The Shannon entropy is a measure of how evenly the states of X are distributed.
Efficient Entropy Estimation for Mutual Information Analysis
19
The joint entropy H(X, Y ) of two random variables X and Y is analogously defined as: H(X, Y ) = −
MX ,MY
p(Xi , Yj ) log(p(Xi , Yj )),
(2)
i=1,j=1
and expresses the uncertainty one variable has about another. The conditional entropy H(X|Y ) expresses the uncertainty of X given Y and is defined as: H(X|Yj ) = −
MX
p(Xi |Yj ) log(p(Xi |Yj )),
(3)
i=1
H(X|Y ) =
MY
p(Yj )H(X|Yj ).
(4)
j=1
The mutual information I(X; Y ) can then be defined as: I(X; Y ) = H(X) − H(X|Y ), or I(X; Y ) = H(X) + H(Y ) − H(X, Y ).
3
(5) (6)
Classical Techniques for Estimating Mutual Information
There are two basic approaches to estimation, parametric and non-parametric. In this paper we restric ourselves to the non-parametric field. Parametric estimation makes assumptions about the regression function that describes the relationship between dependent variables. Therefore, the density function will assume that the data are from a known family of distributions, such as normal, and the parameters of the function are then optimized by fitting the model to the data set. Non-parametric estimation, by contrast, is a statistical method that has no meaningful associated parameters. There is often no reliable measure used for the choice of the parameters. This paper seeks to introduce efficient non-parametric PDF estimation methods in the context of side-channel analysis. 3.1
The Intuitive Histogram-Based Approach
All definitions in Section 2 involved the explicit knowledge of the probability distributions. However, in practice, these probabilities are not known and have to be estimated from measurements. The most straightforward and widely used approach is the histogram-based algorithm. Consider a collection of N measurements of two variables X and Y . The data is partitioned into B different bins. The bins are defined through B intervals ai = [o + i.h, o + (i + 1).h] where o is the value of the origin and h is the width
20
A. Venelli
of the bins and with i = 0, . . . , B − 1. We note ki the number of mesurements that lie in the interval ai . The probabilities p(ai ) are then approximated by the corresponding relative frequencies of occurence: p(ai ) =
ki . N
From these approximated probabilities, we calculate the entropies and finally the mutual information. The choice of the number of bins B is critical. It plays the role of smoothing parameter (see Fig. 1). The number of bins determines two things: how good the statistics will be reflecting the ideal, continuous distribution and how close the partitioning will be to the actual physical data-dependency of the device. Histogram PDF estimation is very computationally efficient, however it can give approximate results.
0.5
0.5
0.4
0.4
0.3
0.3
0.2
0.2
0.1
0.1
0
0 -3
-2
-1
0
1
2
(a)
3
-3
-2
-1
0
1
2
3
(b)
Fig. 1. Effect of the number of bins on how close the estimation is to the actual distribution. The dotted line in these figures is a Gaussian distribution, the solid line is the estimation. Figure 1a shows an estimation with 4 bins. Figure 1b is an estimation with 18 bins.
3.2
Kernel Density Estimation
There exists alternatives to the histogram-based approach. We introduce the Kernel Density Estimation (KDE) [6], also called Parzen window method [7]. Kernel techniques assume that the probability density is smooth enough such that structure below a certain kernel bandwidth can be ignored. The kernels essentially weight the distances of each point in the sample to a reference point depending on the form of the kernel function and according to a given bandwidth h. The simplest possibility is to estimate the density at a point x by the number of points in a box centered at x of size h divided by its volume. Rather than simply counting the points, kernel functions are used to give them
Efficient Entropy Estimation for Mutual Information Analysis
21
distance-dependant weights. We obtain a naive estimator f (x) that aims at improving the estimate of the probability p(x): 1 Θ(h − |x − xi |), 2N h i=1 N
f (x) =
where Θ denotes the Heaviside function defined as: 1 if z > 0 Θ(z) = 0 if z ≤ 0.
(7)
(8)
For a more general definition, we note K(x) as the kernel function. We then define the kernel density estimor f (x) as N 1 x − xi f (x) = K . (9) N h i=1 h An example of kernel function K often used is the Gaussian kernel, the density estimator is then defined as N 1 (x − xi )2 √ f (x) = exp − . (10) 2h2 N h 2π i=1 The Gaussian estimator can be seen as placing small Gaussian ’bumps’ at each observation point xi . The estimation is then the sum of the ’bumps’. Instead of the critical choice of bins in the histogram approach, the choice of bandwidth h is now crucial in kernel density estimation. If h is too large, the estimate suffers from too little resolution, whereas if it is too small, the estimate suffers from too much statistical variability (Fig. 2). Even if KDE estimation is more accurate than the histogram-based approach, it suffers from heavy computational requirements. Recently, Prouff and Rivain [8] presented a parametric estimation of entropy that seems as efficient as the CPA when the noise is increasing. We rather focus on non-parametric methods and in particuliar, a more balanced method between accuracy and efficiency. Using B-splines basis functions, we can greatly improve the histogram-based estimation with an acceptable computational overhead.
4 4.1
Improving MIA Results Using B-Spline Functions Introduction to Piecewise Polynomials and Splines
Let X be a one-dimensional variable. A piecewise polynomial function f (X) is obtained by dividing the domain of X into contiguous intervals, and representing f by a separate polynomial in each interval. Figures 3a and 3b show simple piecewise polynomials. However, we often prefer smoother functions that can be obtained by increasing the order of the local polynomial. Figure 3c shows a piecewise-cubic polynomial fit, it is known as a cubic spline. More generally, an order k spline with knots ti , i = 0, . . . , m is a piecewise polynomial of order k and has continuous derivatives up to order k − 2. A cubic spline has order k = 4. In fact, Fig. 3a is an order 1 spline and Fig. 3b is an order 2 spline.
22
A. Venelli
0.5
0.5
0.4
0.4
0.3
0.3
0.2
0.2
0.1
0.1
0
0 -3
-2
-1
0
1
2
3
(a)
-3
-2
-1
0
1
2
3
(b)
Fig. 2. Kernel density estimation using the Heaviside function with different bandwidth. The dotted line in these figures is a Gaussian distribution, the solid line is the estimation. Figure 2a shows an estimation with a bandwith h = 0.3. Figure 2b is an estimation with bandwidth h = 0.03.
4.2
Computation of B-Splines
We briefly introduce B-splines which are generalizations of B´ezier curves. One can look at [9] for more background on splines. A B-spline curve defined over an interval [a, b] is specified by: – the degree d (or order k = d + 1), so that each segment of the piecewise polynomial curve has degree d or less, – a sequence of m + 1 numbers, t0 , . . . , tm , called knot vector, such that ti ≤ ti+1 , ∀i ∈ {1, . . . , m − 1}, – control points, b0 , . . . , bn . A B-spline curve is defined in terms of B-spline basis functions. The i-th basis function of degree d, noted Bi,d , defined by the knot vector t0 , . . . , tm is defined by the Cox-de Boor recursion formula as follows: 1 if ti ≤ z < ti+1 Bi,0 (z) = (11) 0 otherwise. z − ti ti+d+1 − z Bi,d (z) = Bi,d−1 (z) + Bi+1,d−1 (z), (12) ti+d − ti ti+d+1 − ti+1 for i = 0, . . . , n and d ≥ 1. The B-spline curve of degree d with control points b0 , . . . , bn , knots t0 , . . . , tm is then defined by: n B(z) = bi Bi,d (z), i=0
where Bi,d (z) is the B-spline basis function previously defined.
Efficient Entropy Estimation for Mutual Information Analysis
Piecewise Constant
23
Continuous Piecewise Linear
2
2
1.5
1.5
1
1
0.5
0.5
0
0
-0.5
-0.5
-1
-1
-1.5
-1.5
-2
-2 0
2
4
6
8
10
0
2
(a)
4
6
8
10
(b)
Continuous Piecewise-cubic Polynomial 2 1.5 1 0.5 0 -0.5 -1 -1.5 -2 0
2
4
6
8
10
(c) Fig. 3. In each figure, the dotted lines represent the positions of the knots. The thin line is the true function y(x) = cos(x) exp(−x/5). The crosses are data generated from the function y(x) with random gaussian noise added. The thick line represents the estimation.
From (12), it is clear that Bi,d (z) is non-zero in the interval [ti , ti+d+1 ]. For example, a cubic B-spline basis function Bi,3 (z) is non-zero in the interval [ti , ti+4 ]. This basis function spans the knots ti , ti+1 , ti+2 , ti+3 , ti+4 . We also note that, when knots are not repeated, a B-spline is zero at the end-knots ti and ti+d+1 . But Bsplines can use repeated knots. If the knot vector contains a sufficient number of repeated knot values, then a division of the form 0/0 may occur, it is then assumed that 0/0 := 0. Finally, the property that is essential to this study is: n i=0
Bi,d (z) = 1,
24
A. Venelli
for any value of z. We can adapt easily B-spline basis functions to be a probability distribution function. 4.3
PDF Estimation Using B-Spline Functions
In [10], authors compare their method with other MI estimators. They show that B-splines offer an increase by roughly two-fold in significance of the MI compared to a simple binning method on an artificially generated dataset. They also noted that using high spline orders doesn’t give much better results than a k = 2 or k = 3 order. As we found the same conclusion with our experiments, we use in the rest of the paper order k = 3. The main problem in a naive histogram approach is that each data point is assigned to only one bin. We loose the information of points near neighbouring bins that could be in either bins depending on the measurement noise for example. The idea of [10] is to allow a data point to be in simultaneously k different neighbouring bins using B-splines basis functions. We want to imitate the histogram approach replacing the naive binning of the interval of values with a more elaborate partition of the interval using B-spline basis functions. In classic binning as in B-spline estimation, the abscissa axis is broken up into some numbers of intervals, where endpoints of each interval are called breakpoints. To change the shape of a B-spline curve, we already noticed that one can modify: the degree of the curve, the control points or the knot vector. The number of breakpoints is linked to those previously defined values with the formula: nbreak = n − k + 2 where n is the number of control points and k is the order of the spline. The B-spline order is generally fixed beforehand, for optimal results we fix k = 3 as previously stated. We then have to modify the knot vector and the number of breakpoints so that B-spline functions can act as correct partitions. A practical example of how the parameters are fixed for an attack on DES is explained in the next Section. In general, B-spline curves are not tangent to the first and last knots. In our case we want to clamp the curve to these extremities. We want the basis functions to fully cover the interval of values. To do so, we have to repeat the first and last knot value d + 1 times in the knot vector. B-spline curves that fit the properties previously stated are called open Bspline curves. We construct it with a type of knot vector called uniform nonperiodic knots. We use this type of construction for our application to the MIA. First, let’s define uniform non-periodic knot vector: Uniform non-periodic knot vector. Let Bi,d (z) be a B-spline of degree d (order k = d + 1) for i = 0, . . . , n and z ∈ [0, n − k + 2]. We define the knot vector t0 , . . . , tn+k as follows: ⎧ 0 if 0 ≤ i < k ⎨ i − k + 1 if k ≤ i ≤ n ti = ⎩ n − k + 2 if n < i ≤ n + k.
Efficient Entropy Estimation for Mutual Information Analysis
25
For example the uniform non-periodic knot vector for n = 5 and k = 3 is [0, 0, 0, 1, 2, 3, 4, 4, 4]. In general, this type of knot vector has the structure: 0, . . . , 0, 1, 2, . . . , n − k − 1, n − k + 2, . . . , n − k + 2 .
k knots
4.4
k knots
B-Spline Estimation in the Side-Channel Context
In the PDF estimation context, there is a clear similarity between B-spline estimation and the histogram method as order 1 B-splines are in fact step functions (Fig. 3a). Indeed, instead of affecting a point to only one bin, i.e. one interval, we can spread the same point onto a wider interval with B-spline functions. The higher the degree d of the spline, the wider the considered interval will be. This is particulary interesting in the side-channel context. Each point of the power consumption curve has measurement noise attached to it. This noise could shift points to false neighbouring bins in the classic histogram. B-spline estimation affects a weight to each point so that it covers a larger interval of possible values covering its possible attached noise. Furthermore, each point is weighted by a curve on an interval when in the histogram it is weighted by a simple step function. With this property, B-spline estimation seems similar to a KDE approach while being more simple, hence less computationally intensive. This claim is adressed in Section 5. B-spline PDF estimation is a good compromise between the time efficient but naive histogram and the complex KDE estimation. Example of use of B-spline estimation to attack a DES implementation. Using notations from [11], let H be a hypothetical function of the intermediate values targeted by the attacker. The function H is often a surjection from the value space V into a hypothetical leakage space H. Let’s consider a leakage vector and its partition into B sets. For example, suppose the intermediate value targeted in a DES is the three most significant bits of SBox(x⊕ k). It would seem natural to have B = 8 partitions in a classic histogram approach to place the targeted values that range from 0 to 7. If we consider B-spline estimation, we also want to cover the range of the targeted values [0, 7]. Recall that B-spline functions are defined on [0, n − k + 2] and using uniform non-periodic knot vector the functions are clamped on the extremities. The parameter k is generally fixed at k = 2 or k = 3 so that the calculation of B-spline functions is not too complex while the curves are smooth enough [10]. The number of breakpoints nbreak = n−k+2 corresponds to B in the classic binning. For our example, with k = 3 and nbreak = 8, we have n = nbreak + k − 2 = 9 basis functions. Hence, we only modify the parameters k and nbreak, the number of basis functions n is inferred. Algorithm computing MI using B-spline PDF estimation. The algorithm to estimate the mutual information using B-spline PDF estimation between two random variables X and Y is as follows [10]:
26
A. Venelli
– Input: random variables X = {x1 , . . . , xN } and Y = {y1 , . . . , yN }, spline order: k, nX the number of B-spline basis functions for X and nY for Y . – Output: I(X; Y ). 1. Estimate the entropy of X. (a) Determine the nX Weighting Coefficients (WC) for each xu , u = 1, . . . , N as Bi,d (x), i = 1, . . . , nX . Save the matrix MatrixWC X of (nX × N ) values containing all the weighting coefficients. MatrixWC X [i][u] = Bi,d (xu ). (b) Compute the nX probabilities p(ai ), i = 1, . . . , nX : p(ai ) =
N 1 Bi,d (xu ). N u=1
(c) Compute the entropy (1): H(X) = −
nX
p(ai ) log(p(ai )).
i=1
2. Repeat step 1 for the variable Y to obtain the matrix MatrixWC Y and the entropy H(Y ). 3. Determine the joint probability p(ai , bj ) for all (nX × nY ) bins:
p(ai , bj ) = N1 N u=1 (Bi,k (xu ).Bj,k (yu )) =
1 N
N u=1
(MatrixWC X [i][u].MatrixWC Y [j][u]).
4. Calculate the joint entropy H(X, Y ) (2). 5. Compute the mutual information (6). 4.5
Combining Cram´ er-von-Mises Test with B-Spline Smoothing
The Cram´er-von-Mises (CvM) test is similar to the Kolmogorov-Smirnov (KS) test. The KS statistic is a widely used non-parametric statistical test. The twosample KS test evaluates the maximal difference between two empirical cumulative distribution functions. The two-sample KS test can also be compared to the non-parametric Mann-Whitney test that is the non-parametric equivalent to the T-test used in DPA. The Mann-Whitney test measures the difference in central tendency between two distributions whereas the KS test seems sensitive to any kind of distributional difference. We first briefly introduce the principle of the two-sample KS test. Let two samples Xi and Yj with size n and m. The samples can be characterized by their empirical cumulative density functions: cdfX =
#i : Xi ≤ x n
and cdfY =
#j : Yj ≤ x , m
Efficient Entropy Estimation for Mutual Information Analysis
27
that correspond to the proportion of observed values inferior or equal to x. Then, the two-sample KS test is defined as: DKS (X||Y ) = maxx (|cdfX − cdfY |). The Cram´er-von-Mises test is an alternative to the Kolmogorov-Smirnov test. It is also based on the empirical cumulative density functions but it is defined as: DCvM (X||Y ) = (cdfX − cdfY )2 . x
In [5], the authors introduce a MIA-inspired distinguisher based on the CvM test and show its efficiency compared to other MIA-like side-channel attacks. In practice, the empirical cumulative functions are constructed based on histograms. The CvM test does not costs much more than a classical histogram estimation of PDF and is therefore very interesting. The B-spline method previously introduced can also be applied in this context of cumulative function estimations in a similar way. The different values of the samples are affected to more than one bin with an apprioriate weight given by the B-spline functions. Once this smoothed histogram created, the cumulative functions and the CvM test can be computed as originaly. The improvement due to the B-splines is not as advantageous as previously noted with probability density functions. Indeed, the histogram smoothing is less significant in the computation of cumulative density functions than classical PDF. However subtle, the improvement is still noticeable in certain cases. In the next section, we demonstrate with practical data the two-fold increase of the B-spline estimation compared to an histogram method. Furthermore, this technique adjusts particularly well to side-channel analysis. Indeed, allowing a point of a power consumption curve to be in k different neighbouring bins compensate the measurement noise that might shift the point to a different bin. This observation is demonstrated on practical data sets in the following.
5
Experimental Results
As previously stated, we restrict ourselves to the comparision of the efficiency of non-parametric estimation in the MIA context. We carried out attacks on two different kinds of setups and two different algorithms. For each setup, we measure the efficiency of the attacks using known metrics introduced in the literature: – the guessed entropy [11] that is the average position of the correct hypothesis in the sorted hypothesis vector of an attack, – and the first order success rate [11] that is, given a number of traces, the probability that the correct hypothesis is the first best hypothesis of an attack. We compare the classical MIA attack using histogram estimation [4] (simply noted MIA in the figures), MI estimation using B-spline smoothing of Section 4.4
28
A. Venelli
(noted MIB), the Cram´er-von-Mises test [5] (noted CVM), this same test with B-spline smoothing of Section 4.5 (noted CVMB) and finally, as a reference, the CPA [2]. First, we briefly analyse the computational efficiency of these attacks in Fig. 4. The time measurements are recorded on a classical workstation computer with Pentium 4 processor. We remark that, even if the MIB requieres more computational time than a classical MIA, it is clearly more effective than a KDE analysis.
time in seconds
Computational Time 2 1.8 1.6 1.4 1.2 1 0.8 0.6 0.4 0.2 0
CPA CVM MIA MIB KDE
0
100
200
300
400
500
600
number of traces Fig. 4. Comparison of the necessary computational time per byte for each attack on a DES implementation
First-Order Success Rate
Guessed Entropy 35
CPA CVMB CVM MIA MIB
30 25 20 15
1 0.8 0.6
CPA CVMB CVM MIA MIB
0.4
10 0.2
5 0
0 0
100 200 300 400 500 600 number of traces
0
100 200 300 400 500 600 number of traces
Fig. 5. Comparative results of attacks using the DPA Contest traces implementing a DES
Efficient Entropy Estimation for Mutual Information Analysis
First-Order Success Rate
Guessed Entropy 140
1
CPA CVMB CVM MIA MIB
120 100 80
0.8 0.6
60
CPA CVMB CVM MIA MIB
0.4
40
0.2
20 0
29
0 0
500
1000
1500
number of traces
2000
0
500
1000
1500
2000
number of traces
Fig. 6. Comparative results of attacks using traces acquired on an Atmel STK600 board with an Atmel AVR ATmega2561 [13] that implements a multi-precision multiplication algorithm
Our first set of attacks (Fig. 5) are made using the publicly available traces of the DPA Contest [12]. We remark that the two-fold performance increase of the MIB is clear compared to the MIA. The closely tied CVM and CVMB perform relatively better. However, their results are still far from the CPA. We then tested the efficiency of the attacks on a different platform and with a different attacked algorithm. We implemented on an Atmel STK600 board with an Atmel AVR ATmega2561 [13] a well-known multi-precision multiplication algorithm using Comba’s method [14]. The attacker’s goal is to find the bytes of a fixed secret multiplicand, while several random publicly-known multiplicand of the same size are used as input. The major difference between this setup and the one of DPA Contest is that the Atmel STK600 board is not particularly suited for side-channel measurement. Therefore, the power traces contain a lot more noise. The results in this context are particularly interesting (Fig. 6). First, we can observe as previously an increase by roughly two-fold of the MIB efficiency compared to the MIA. The results of the CVM and CVMB and now relatively close the MIB. However, more importantly, we note that the MI-based attacks using the B-spline technique perform globally much better compared to the CPA. In particular, the guessed entropy criterion indicates that the MIB, CVM and CVMB are more efficient than the CPA in this scenario.
6
Conclusion
We present in this paper efficient PDF estimation techniques using B-splines in the side-channel analysis context. The B-spline estimation fits very well as it takes into account the possible measurement noise that can be attached to a data point. This is particularly well demonstrated with our comparative analysis in a
30
A. Venelli
noisy environment that proved the effect of B-spline smoothing. We even obtain better than the powerful CPA in this scenario. Further research on this topic can include the investigation of other PDF estimators, for example: the parametric edgeworth-based entropy estimation [15], the non-parametric wavelet estimation [16] or the non-parametric method using the k-nearest neighbors algorithm [17].
References 1. Kocher, P., Jaffe, J., Jun, B.: Differential power analysis. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388–397. Springer, Heidelberg (1999) 2. Brier, E., Clavier, C., Olivier, F.: Correlation power analysis with a leakage model. In: Joye, M., Quisquater, J.-J. (eds.) CHES 2004. LNCS, vol. 3156, pp. 135–152. Springer, Heidelberg (2004) 3. Batina, L., Gierlichs, B., Lemke-Rust, K.: Comparative evaluation of rank correlation based DPA on an AES prototype chip. In: Wu, T.-C., Lei, C.-L., Rijmen, V., Lee, D.-T. (eds.) ISC 2008. LNCS, vol. 5222, pp. 341–354. Springer, Heidelberg (2008) 4. Gierlichs, B., Batina, L., Tuyls, P., Preneel, B.: Mutual information analysis - a generic side-channel distinguisher. In: Oswald, E., Rohatgi, P. (eds.) CHES 2008. LNCS, vol. 5154, pp. 426–442. Springer, Heidelberg (2008) 5. Veyrat-Charvillon, N., Standaert, F.: Mutual information analysis: How, when and why? In: Clavier, C., Gaj, K. (eds.) CHES 2009. LNCS, vol. 5747, pp. 429–443. Springer, Heidelberg (2009) 6. Moon, Y.I., Rajagopalan, B., Lall, U.: Estimation of mutual information using kernel density estimators. Physical Review E 52(3), 2318–2321 (1995) 7. Parzen, E.: On the estimation of a probability density function and mode. Annals of Mathematical Statistics 33, 1065–1076 (1962) 8. Prouff, E., Rivain, M.: Theorical and practical aspects of mutual information based side channel analysis. In: Abdalla, M., Pointcheval, D., Fouque, P.-A., Vergnaud, D. (eds.) ACNS 2009. LNCS, vol. 5536, pp. 499–518. Springer, Heidelberg (2009) 9. Deboor, C.: A Practical Guide to Splines. Springer, Heidelberg (1978) 10. Daub, C., Steuer, R., Selbig, J., Kloska, S.: Estimating mutual information using B-spline functions - an improved similarity measure for analysing gene expression data. BMC Bioinformatics 5, 118 (2004) 11. Standaert, F.X., Gierlichs, B., Verbauwhede, I.: Partition vs comparison sidechannel distinguishers: An empirical evaluation of statistical tests for univariate side-channel attacks against two unprotected CMOS devices. In: Lee, P.J., Cheon, J.H. (eds.) ICISC 2008. LNCS, vol. 5461, pp. 253–267. Springer, Heidelberg (2009) 12. VLSI research group and TELECOM ParisTech: (The DPA contest 2008/2009), http://www.dpacontest.org 13. Atmel: (ATmega 2561 Data Sheet), http://www.atmel.com/dyn/resources/prod_documents/doc2549.pdf 14. Comba, P.G.: Exponentiation cryptosystems on the IBM PC. IBM Syst. J. 29, 526–538 (1990) 15. Van Hulle, M.: Multivariate edgeworth-based entropy estimation. In: Machine Learning for Signal Processing, pp. 311–316 (2005) 16. Vannucci, M.: Nonparametric density estimation using wavelets. ISDS, Duke University, Tech. Rep. DP95-26 (September 1995), http://www.isds.duke.edu 17. Kraskov, A., Stogbauer, H., Grassberger, P.: Estimating mutual information. Physical Review E 69, 66138 (2004)
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones Tansu Alpcan1, , Christian Bauckhage2, and Aubrey-Derrick Schmidt3 1
Deutsche Telekom Labs., Technical Univ. Berlin, 10587 Berlin, Germany
[email protected] 2 University of Bonn and the Fraunhofer IAIS Schloss Birlinghoven, 53754 Sankt Augustin, Germany
[email protected] 3 DAI-Labor, Technische Universit¨at Berlin, 10587 Berlin, Germany
[email protected] Abstract. Widespread use and general purpose computing capabilities of next generation smartphones make them the next big targets of malicious software (malware) and security attacks. Given the battery, computing power, and bandwidth limitations inherent to such mobile devices, detection of malware on them is a research challenge that requires a different approach than the ones used for desktop/laptop computing. We present a novel probabilistic diffusion scheme for detecting anomalies possibly indicating malware which is based on device usage patterns. The relationship between samples of normal behavior and their features are modeled through a bipartite graph which constitutes the basis for the stochastic diffusion process. Subsequently, we establish an indirect similarity measure among sample points. The diffusion kernel derived over the feature space together with the Kullback-Leibler divergence over the sample space provide an anomaly detection algorithm. We demonstrate its applicability in two settings using real world mobile phone data. Initial experiments indicate that the diffusion algorithm outperforms others even under limited training data availability. Keywords: Anomaly detection, mobile security, machine learning.
1 Introduction Next generation smartphones and mobile devices (e.g. Internet tablets) offer advanced capabilities beyond a typical mobile phone and often provide general-purpose computing functionality. Although some of the smartphone manufacturers are ahead of traditional PC systems in terms of security through advanced sandboxing models, it is only a matter of time for the malware authors exploit the underlying weaknesses of the respective platforms or resort to social engineering to circumvent these measures. Furthermore, some of the recently emerging platforms forsake such sandboxing schemes in favor of open computing, which unfortunately brings well-known security problems with it. As a consequence of the underlying architecture of current computing systems
Research supported in part by Deutsche Telekom Laboratories.
P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 31–46, 2010. c IFIP International Federation for Information Processing 2010
32
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
and due to its social underpinnings, security will continue to pose significant challenges in the mobile domain [9]. Mobile computing platforms such as smartphones have unique features that make the task of detecting security-related problems even more challenging than desktop systems. Severe limitations on battery life, computing power, and available bandwith (and its cost) reduce the effectiveness of signature-based detection schemes as a result of their high bandwidth usage due to frequent signature updates and battery cost due to computational requirements. Furthermore, signature-based detection is mainly centralized, non-automatic, and not very scalable. Many security vendors acknowledge the problems with this decades-old methodology and search for new techniques to address the problem of malware detection in a more efficient, flexible, and scalable manner [20]. Anomaly-based detection has the potential of automated and scalable detection of never before seen malware, also known as zero-day attacks. It can be seen as a form of binary classification problem in machine learning. Consequently, anomaly-based detection algorithms usually require a training (learning) phase before the actual detection (monitoring). Over the years, a large number of anomaly detection schemes have been proposed, most of them relying on a variety of machine learning and data mining techniques [19, 25, 26]. Decentralized malware detection schemes as well as deployment of filtering mechanisms have been studied in [6, 18, 24, 4, 5]. A game theoretic model, which takes into account the attacker behavior in decision making, has been presented in [2]. Other approaches in the existing literature include semantic models, grammars, or rule bases [8]. A detailed survey of the field can be found in [14]. Recently, malicious software detection in smartphones and mobile devices has been a topic of increasing interest [27, 7, 23, 21]. Despite the extensive research efforts, an inherent limitation of anomaly-based detection has been its high false alarm rate. It is mainly due to the difficulty in distinguishing between actual malware and mere “unusual behavior” of the system. The detection algorithm is expected to be sensitive enough to detect tiny deviations yet precise enough to separate abnormal behavior, which may indicate existence of malware, from previously observed daily usage patterns. The base-rate fallacy captures the essence of this problem. Even if the detection scheme achieves low false-negative and false-positive rates, the legitimate network traffic is much higher in volume than the malware traffic that the number of false alarms is substantial [3]. In other words, most of the time detection process is similar to searching for a needle in a haystack, and current methods are often not good enough to find “the needle” without processing a lot of “hay”. Many classical detection and estimation techniques rely on probabilistic models based on well-known random processes with known characteristics. However, such statistical descriptions are most of the time not applicable to malware detection. The problem of malware detection is further complicated by its inherent non-convex nature and the limited availability of normal usage data for training the algorithms. The availability of attack information is often even more limited. In addition, the monitoring has to be done in near real-time and should not bring excessive overhead in terms of resource usage. All these requirements clearly pose a significant challenge and motivate our research on advanced detection techniques.
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones
33
We present, in this paper, a behavior-based approach to anomaly-based malware detection. Our method is based on the study of higher order relationships between data samples that stem from smartphones daily usage patterns. The basic idea is to model dependencies of samples and features by means of a bipartite graph which then serves as the domain of a Markov process. On the one hand, as the algorithm involves mappings between the feature and the sample space, it can be seen as another instance of the kernel trick well-known in machine learning. On the other hand, it shares some of the characteristics of the famous Google pagerank algorithm. The algorithm is applied to two separate data sets obtained from smart mobile phones during normal daily usage. In one case, a –rather harmless– malware (Trojan) is activated on the mobile phone after the training period that sends an SMS message whenever the user presses button 2 on the keypad. In the other case, we simulate a malware that exhibits symptoms similar to Viver and Beselo Trojans. Both data sets, which contain real phone useage data, have allowed us to conduct experiments and test the performance of our algorithm in a realistic setting and investigate multiple scenarios involving different malware. The rest of the paper is organized as follows: in the next section we present the model and our algorithm. Section 3 reports and discusses experimental results. The paper concludes with remarks of Section 4.
2 Detection Algorithm In this section, we present our computational model and algorithm for anomaly detection. For the rest of the paper, we adopt the following notational conventions. Vectors are column vectors and the ith component of a vector v is denoted by vi . Correspondingly, the (i, j) entry of a matrix M is denoted by Mij . Finally, I denotes the identity matrix. 2.1 Model The basic idea behind our approach to anomaly detection is to consider diffusion processes over a graph. Diffusion processes as a means for computing similarities on manifolds or among the vertices of graphs have recently been studied by several authors [16, 1, 15, 28]. Given an unstructured set of observations or feature vectors, these approaches compute a matrix that represents local structures in the data by means of the distances between each data point and its k nearest neighbors. Once the adjacency matrix is available, global similarities among the data points can be determined from graph traversal. The approach we present in this paper differs from the work in [16, 1, 15, 28] in that it does not rely on geometry-based adjacency matrices. Instead, we assume a bipartite graph G = (N, E) as shown in Figure 1. Its set of nodes N is partitioned such that N = F ∪ O and F ∩ O = ∅ and for the edges we have E ⊆ O × F ∪ F × O. We assume that F = {f1 , . . . , fm } represents a set of observable features that allow for characterizing a given set O = {o1 , . . . , on } of acceptable patterns of cell phone usage. In other words, we assume that n feature vectors f ∈ Rm representing “normal” behavior are available to train our malware detection system.
34
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
(a) o(0) = (0010)T f (0) = R o(0)
(b) o(1) = S f (0)
(c) f (1) = R o(1)
(d) o(2) = S f (1)
Fig. 1. Bipartite graph model of relations between observations oj and their features fi . 1(a) Index vectors, e.g. o(0) = [0010]T , indicate individual observations, e.g. o3 . Individual observations or mixtures of observations correspond to a feature distribution f (0). 1(b) A feature distribution f (0) diffuses to an updated distribution over the observations which is represented by a vector o(1). 1(c) and 1(d) The diffusion process continues and provides a ranking of the observations with respect to the initial one. If the stochastic matrices R and S are defined as in the text, diffusion processes like this are guaranteed to converge to a unique limiting distribution o∗ .
In addition, we require the nodes in F to be labeled. In a slight abuse of notation, we represent a given labeling by means of a vector f = [f1 , . . . , fm ]T . Furthermore, we normalize the feature vectors f such that they become stochastic vectors whose components sum 1. This normalization turns vectors into distributions of features and is a rather common procedure in fields such as pattern recognition, data mining,or information retrieval, especially if the features are given in form of histograms [10, 13, 22]. Similarly, we assume the nodes in O to be labeled and again identify a given labeling with a stochastic vector o ∈ Rn . In this way, the ith prototypic pattern or observation oi will be indexed by the vector o = ei , i.e. the ith standard basis vector in Rn . Note that this modeling approach also allows for representing mixtures of prototypes. The intuition behind the formulation above is that, even though there are no immediate relations (i.e. no edges) among the individual observations in O, the model nevertheless allows for determining partial orders. The key idea is to understand their relations as the outcome of a stochastic diffusion process over the bipartite graph. If the normalized feature vectors f i that the observations oi are stored in characterize a column stochastic m × n matrix R = f 1 . . . f n , its elements Rij can be interpreted as the probability or extent of an occurrence of a feature fi given a prototype oj Rij = p(fi |oj ).
(1)
Applied to a mixture of observations o, the matrix R realizes a probabilistic mapping f = Ro from the set of observations to the set of features. Given the transition matrix R, we can deduce a probabilistic mapping S = RT D−1 that maps of features to a distribution of observations (see Fig. 1). Here a distribution T T Djj = A and D ij = 0 is used to normalize the columns of R . Note that i ij
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones
35
S maps an arbitrary distribution of features o the distribution of prototypes that most likely explains the observation, which follows from simple Bayesian reasoning. 2.2 Stochastic Diffusion Algorithm For diffusion-based classification, we consider dynamic processes over the prototypes. Given a prototype distribution o(t) at time t, an updated distribution results from o(t + 1) = Sf (t) = SRo(t) ≡ Ho(t).
(2)
Some straightforward algebra shows that the n × n matrix H introduced above is a doubly stochastic matrix whose rows columns and rows both sum to 1. It is square, nonnegative, and in accordance with the Perron-Frobenius theorem its eigenvalues λ satisfy |λ| ≤ 1. The process defined by H is therefore a Markov process over O. Consequently, even though our model does not assume any direct relations among the oi ∈ O, it can rank them: if we assume an initial distribution o(0) with only a few non zero entries, after t iterations, the probabilities in o(t) = Ht o(0) will be higher for observations more closely related to the initially indexed elements of O and less high for less closely related ones (see Fig. 1). In order to produce similarity rankings where all oi ∈ O are properly taken into account, we would have to compute o∗ = limt→∞ o(t) = Ht o(0). However, the bistochastic nature of H forces o(t) to converge to the uniform distribution where all elements equal n1 . We therefore consider a modification where we assume the initial distribution o(0) to be a steady source of probability mass which is constantly fed into the process. The update rule for prototype distributions then becomes o(t + 1) = αHo(t) + (1 − α)o(0).
(3)
The Perron-Frobenius theorem guarantees the convergence of this process, too. Its stationary distribution o∗ depends on o(0) and can be shown to amount to −1 o∗ = (1 − α) I − αH o(0).
(4)
Therefore, given an arbitrary initial distribution o(0) that represents a single observation, we can immediately determine the corresponding stationary distribution and the ranking it implies. It is interesting to note that the matrix in equation (4) constitutes a diffusion kernel [16]. In fact, from the derivation, we recognize another instance of the kernel trick. The similarities among vectors o ∈ Rn that are contained in H = SR result from mapping the vectors back and forth to a –possibly larger– space Rm . Diffusion kernels for computing similarities on manifolds or graphs have recently found much attention [16,1,15,28]. Usually, they are derived similarity matrices which, in turn, are derived from geometry-based adjacency matrices. They thus require to introduce distance measures in order to determine adjacencies and similarities and it is left to the user to decide which metric best fits his or her practical needs. Our approach avoids such overhead. By basing our derivation on a bipartite graph model and due to the Bayesian nature of the mapping between prototypes and features, the resulting
36
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
matrix H is a stochastic matrix that allows for a concise interpretation of the ranking procedure in terms of a Markov process. Moreover, our model also provides a latent semantic interpretation of the diffusion process. The transition probabilities Hji can be explained as the effect of hidden latent variables: p(oj |fk ) p(fk |oi ). (5) Hji = p(oj |oi ) = k
Ranking on manifolds has already been applied in systems for document and image retrieval [12]. In fact, equation (3) corresponds to the iterative version of the adjusted page rank procedure used by the Google search engine [17]. However, to the best of our knowledge, all such systems consider diffusion processes over adjacency graphs that represent local neighborhoods similar to the way discussed above. As these approaches do not distinguish between features and prototypes, their applicability for classification and prediction is limited. Either, the class label of a new feature vector has to be decided according to its k nearest neighbors on the manifold, or a new transition matrix would have to be computed that also regards the new vector. Our bipartite graph model, on the other hand, distinguishes between features and prototypic observation and immediately allows us to devise classifiers that take into account the whole set of given prototypes. This can be done in just a single step and does not require to update the given transition matrix. 2.3 Diffusion-Based Anomaly Detection Let f denote a novel measurement of features which is normalized such that its components sum to 1. A stationary distribution that characterizes its relation to all of the prototypic observations oi simply results from −1 (6) o∗ = (1 − α) I − αH Sf . If we were dealing with a classification problem for which a labeled training set was available, a class label ω for the unknown observation could then, for instance, be obtained from ω(f ) = argmaxk {ω(u∗k )}. However, in anomaly-based malware detection the nature of a novel observation f must be decided from a given set of normal observations only. Since there is thus only one type of class label, we apply the stationary prototype distributions resulting from our method in a divergence-based classifier. The algorithm (summarized in Fig. 2) first computes the stationary distribution that belongs to the novel observation f and then compares it to the stationary distributions that result from the prototypes available for training. In our current implementation, the differences between distributions are determined using the Kullback-Leibler divergence. Finally, the minimal divergence thus estimated is taken as a measure of how the current observation deviates from the manifold of prototypes. Classification is obtained through thresholding with an adjustable parameter. In contrast to the usual approaches in anomaly-based malware detection, our method does not compute distances between feature vectors and classification is not carried out in the feature space at all. In a series of experiments presented in the next section, the dual treatment of features and samples has been observed to outperform classical feature-based approaches.
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones
37
Input: an observation f and a set {o1∗ , . . . , on∗ } of stationary prototype distributions derived from a set O = {o1 , . . . , on } of acceptable prototypes Output: a divergence measure d characterizing how far off f is from the manifold of prototypes compute the stationary prototype distribution w.r.t. f −1 o∗ = (1 − α) I − αH Sf for i = 1, . . . , n compute the Kullback-Leibler divergence oi∗ k D(i) = DKL (oi∗ o∗ ) = k oi∗ k log o∗ k endfor determine the minimal divergence d = argmini {D(i)} Fig. 2. Algorithm for anomaly detection w.r.t a set of normal prototypes that have been submitted to stochastic diffusion
3 Experiments In this section, we present experiments conducted on two different data sets. Altough both sets contain real phone usage data obtained from a real world setting, they have different characteristics and allow us to explore different aspects of the malware detection problem. In each case, the performance of the algorithm introduced in the previous section is compared to several baseline approaches and schemes. 3.1 Smartphone System Data Set and Experiments The smartphone system data set is obtained from a monitoring client installed on a Nokia E61 smartphone. This client sends numerical feature vectors to a remote server that stores them in a database. The client code was developed in Symbian C++ version S60 3rd with Nokia Carbide.vs and consists of the three main components: User Interface, Communication Module, and Feature Extractor. The User Interface can be used to change server port and address. The Communication Module uses SOAP webservices in order to communicate with the server. As expected, collecting and sending system level data regularly is rather expensive in terms of battery power. To prevent the rapid depletion of the power source, the monitored data is sent in bulks. The Feature Extractor is triggered to fetch new data every thirty seconds which is stored locally and later, upon reaching a threshold, sent to the server using the appropriate webservice [23]. This data consists of system characteristics that describe all areas of the monitored device. Some of these values are shown in Figure 3. The recording period of the used data spanned more than a 100 hours of activity where the monitoring client was activated for about 4 hours a day which were varied between different daytimes. While the monitoring client was active, the device was used in a typical manner to make phone calls, read and write messages, to install and
38
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
1 0.9
Normalized Length
0.8 0.7
FREE_RAM SMS_INBOX HD_FREE INSTALLED_APPS PROCESS_COUNT TASK_COUNT CPU_USAGE SIGNAL_STRENGTH
0.6 0.5 0.4 0.3 0.2 0.1 0
0
100
200
300
400
500 600 Vector Count
700
800
900
1000
Fig. 3. Normal device usage on a Nokia E61 over a period of 1000 vectors
use applications when not idle. Figure 3 exemplifies how behaviors like these affect some of the observed features over a period of 1000 recordings where the the values have been normalized. The malware deliberately installed on the device is a rather harmless trojan, which was chosen due to security reasons. It is activated automatically without the user of mobile phone being aware of it and sends an SMS message whenever the user presses button 2. Figure 4 charts the outcomes of several attempts of detecting the activity of the malware in the recorded data. After dividing the data into independent sets for training and testing, the methods used to produce these results were: (a) computing the minimal l2 norm between the currently observed features and the feature vectors in the training set; in this rudimentary setting, distances were computed in the original feature space high dimensional feature space; (b) an analysis of the eigenvalue spectrum of the vectors in the training set revealed that almost all the energy was contained in a six dimensional subspace; training and test samples were therefore projected to that subspace and the minimal l2 norm between the current observation vector and the set of training prototypes was computed in the lower dimensional space; (c) instead of the l2 norm, we computed the Mahalanobis distances (since it takes into account higher moments, it is frequently considered the method of choice in present day anomaly detection systems [25, 26]); again, distance computation was carried out in in the low dimensional subspace; (d) self organizing maps (SOMs) were fitted to the six-dimensional approximations of the training data; the minimal distances of test vectors were computed w.r.t. the weights of the SOM neurons; (e) our algorithm presented in the previous section was applied; training and classification were based on feature vectors in R40 .
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones
39
For each of these methods, a set of 1500 feature vectors in R40 was available for training. However, methods (a), (b), (c), and (e) were trained with considerably smaller numbers of randomly sampled prototypes. For method (d), we considered corresponding small numbers of SOM neurons but used all available training data in the fitting process. For method (e), i.e. the approach proposed in this paper, the parameter α was set to 0.9. The observation period of t ≈ 1500, . . . , 5500 shown in Fig. 4 contains an instructive example that illustrates the benefits of the approach proposed in this paper. In this period, the trojan was active only in the interval 3400 ≤ t ≤ 3700. Obviously, none of the common malware detection techniques (a) – (d) which we considered for baseline comparison was able to detect its activity. Regardless of the number of prototypes used for training, they fail to produce a coherent interpretation as to whether the mobile device’s activity patterns are normal or not. Chaotic responses like these virtually rule out anomaly detection. The algorithm, we proposed in the previous section, on the other hand, produces a clear peak at the point of activity of the malware. Figure 4(e) even shows that this effect becomes more pronounced the more training examples there are. While stochastic diffusion over a sample of 50 prototypes yields peaks of almost the same magnitude for normal and abnormal behavior alike, a growing number of training samples considerably widens the gap between peaks at points of normal and abnormal behavior (note the changing scale of the y-axis of the plots). Therefore, where anomalies are too small to be noticeable for norm-based techniques, divergence from a set of stochastically diffused training samples, still accomplishes reliable detection. Apart from the activity of the malware, the example considered in this discussion is instructive for another reason. From regarding the plateau of peaks in Fig. 4(e) that cover the period 3700 ≤ t ≤ 4400, one would suspect the device to have behaved suspiciously during that period, too. However, this was not the case. Immediately after the trojan was active, the user of the mobile phone received a multimedia message, an event that did not occur during the training period. In addition, deleting this message as well as a bunch of previously receives short text messages and a short time of lost connectivity immediately followed that event. None of these rare but unsuspicious patterns of activities was present in the training sample. This explains the considerably high divergence from the prototype distributions. However, although being rare, the stationary distributions resulting from these observations were still much closer to the prototype distributions than the distribution that resulted from the observations during the active period of the malware. 3.2 Smartphone Log Data Set and Experiments The experiment in the previous section focuses on collection and utilization of systemlevel features of a smartphone for malware and anomaly detection. In this second experiment, we rely on application level data for the same purposes. We use a subset of the data from the MIT reality mining project [11] which consists of smartphone call, SMS, and data communication logs collected via a special application during normal daily usage of volunteers. We use specifically the log file from a single user that covers 244 days of activity. Subsequently, we pre-process this data and generate per-day
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
100 prototypes
1.000 0.750 0.500 0.250 0 1500
3500 time t
1.250 1.000 0.750 0.500 0.250 0 1500
5500
200 prototypes min. l2 dist. in R40
1.250
min. l2 dist. in R40
min. l2 dist. in R40
40
3500 time t
1.250
0.750 0.500 0.250 0 1500
5500
400 prototypes
1.000
3500 time t
5500
(a) min. l2 distances of observations at time t to the set of samples of normal behavior; distances were computed among 40 dimensional feature vectors 1.250
1.000 0.750 0.500 0.250 0 1500
3500 time t
1.250
1.000 0.750 0.500 0.250 0 1500
5500
200 prototypes min. l2 dist in R6.
100 prototypes min. l2 dist in R6.
min. l2 dist in R6.
1.250
3500 time t
0.750 0.500 0.250 0 1500
5500
400 prototypes
1.000
3500 time t
5500
100 prototypes
4.000 3.000 2.000 1.000 0 1500
3500
5500
5.000
min. Mahalanobis dist. in R6
6
5.000
min. Mahalanobis dist. in R
min. Mahalanobis dist. in R
6
(b) min. l2 distances of observations at time t to the set of samples of normal behavior; distances were computed among 6 dimensional feature vectors 200 prototypes
4.000 3.000 2.000 1.000 0 1500
time t
3500
5500
5.000
400 prototypes
4.000 3.000 2.000 1.000 0 1500
time t
3500
5500
time t
100 prototypes
1.600 1.200 0.800 0.400 0 1500
3500
5500
2.000
min. l2 dist. to SOM in R6
2.000
min. l2 dist. to SOM in R6
min. l2 dist. to SOM in R6
(c) min. Mahalanobis distances of observations at time t to samples of normal behavior; distances were computed among 6 dimensional feature vectors 200 prototypes
1.600 1.200 0.800 0.400 0 1500
time t
3500
5500
2.000
400 prototypes
1.600 1.200 0.800 0.400 0 1500
time t
3500
5500
time t
100 prototypes
0.004 0.003 0.002 0.001 0 1500
3500 time t
5500
0.014
min. KL div. over samples
0.005
min. KL div. over samples
min. KL div. over samples
(d) min. l2 distances of observations at time t to weight vectors of a SOM; distances were computed among 6 dimensional vectors 200 prototypes
0.011 0.008 0.005 0.002 0 1500
3500 time t
5500
0.033
400 prototypes
0.026 0.019 0.012 0.005 0 1500
3500 time t
5500
(e) min. Kullback-Leibler divergences resulting from the algorithm in Fig. 2; note the change in scale caused by the growing number of training samples Fig. 4. Malware detection results obtained from various methods. For methods (a), (b), (c), and (e), the number of samples representing normal behavior are varied between 100 and 400; for method (d), the number of SOM neurons vary correspondingly.
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones
41
Table 1. Histogram Features Feature (in numbers per day) Short duration calls (less than 2 min) Medium duration calls (between 2 and 6 min) Long duration calls (more than 6 min) Short intervals between calls (less than 1 hour) Medium length intervals between calls (between 1 and 3 hours) Long length intervals between calls (more than 3 hours) Outgoing SMS Short periods between outgoing SMS Medium periods between outgoing SMS Long periods between outgoing SMS Incoming SMS Short periods between incoming SMS Medium periods between incoming SMS Long periods between incoming SMS Short duration packet sending activities Medium duration sending activities Long duration sending activities short periods between sending activities Medium periods between sending activities Long periods between sending activities
histograms with the following 20 entries: In Table 1, short periods or intervals refer to less than 1 hour, medium ones to between 1 and 3 hours, and long ones to more than 3 hours, respectively, whereas short duration refers to less than 2 minutes, medium one to between 2 and 6 minutes, and long one to more than 6 minutes, respectively. The selected feature set is clearly statistical in nature, and hence, privacy-preserving to a large extend despite the algorithm running for each smartphone user individually. In other words, we are not interested in whom the user has called and when but the aggregate and high level usage characteristics. Thus, it is possible to run the algorithm on the server-side without intruding the privacy of the mobile user. As training data we randomly choose 7, 14 and 21 days out of a training period of 44 days in order to randomize the data and avoid possible artificial regularities in the data set. After training, we inject malware symptoms into the test set which consists of 200 days of separate usage data. We specifically choose a malware that behaves similar to well-known Viver1 or Beselo2 Trojans. It sends out one SMS every other minute up to 20 in less than an hour but at most once per day. Then, we induce it on days 166, 169, and 171 of the test period. In Figure 5, we show the results of various algorithms used for detecting anomalous activity in the test data spanning a period of 200 days. In the figure, the days with malware activity (166, 169, and 171) are colored red. The specific methods used are: 1 2
http://www.f-secure.com/v-descs/trojan_symbos_viver_a.shtml http://www.f-secure.com/v-descs/worm_symbos_beselo.shtml
42
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
(a) computing the minimal l1 norm between the currently observed features and the feature vectors in the training set; (b) computing the minimal l2 norm between the currently observed features and the feature vectors in the training set; (c) instead of the l2 norm, we compute the Mahalanobis distances; (d) the algorithm presented in Section 2 is applied. In each case, the higher the value, i.e. the distance between training prototypes representing normal behavior observed and the test sample of each day, the higher the anomaly. It is important to note that the usage data itself has a lot of natural variation due to its realism. Therefore, we observe algorithms including ours indicating these extreme deviations in addition to the ones caused by malware. Based on the results depicted in Figure 5, we compute the precision and recall in order to quantify the performace of the algorithms. In order to do this, we resort to a simple method of choosing the top 3, 6, and 9 deviations from within the 200 day test data set and check if the malware induced days are among them3 In this context, the precision measures the percentage of these deviations actually belonging to the malware set and recall the percentage of malware detected in the set of given deviations. Ideally, recall should be 1 and precision {1, 0.5, 0.33} for {3, 6, 9} preset deviations, respectively. We summarize the precision and recall values for various algorithms in Table 2. Here, we omit the l2 -based method as it gives very poor results in almost all cases. The results show that the diffusion algorithm proposed outperforms others in all cases and detects malware satisfactorily even when the training data is scarce. Table 2. Recall and Precision Nbr. Dev. Diffusion KL (R/P) Mahalanobis (R/P) L1 (R/P) 7 ptypes 3 6 9 14 ptypes 3 6 9 21 ptypes 3 6 9
0.33 / 0.33 1.00 / 0.50 1.00 / 0.33
0.33 / 0.33 0.33 / 0.16 0.33 / 0.11
0/0 0/0 0/0
0.66 / 0.66 1.00 / 0.50 1.00 / 0.33
0.33 / 0.33 0.33 / 0.16 0.66 / 0.22
0/0 0.33 / 0.16 0.33 / 0.11
0.66 / 0.66 1.00 / 0.50 1.00 / 0.33
0.33 / 0.33 0.66 / 0.33 1.00 / 0.33
0/0 0.33 / 0.16 1.00 / 0.33
3.3 Discussion The experiments in this section are conducted on two different data sets which reflect real world usage but differ from each other in terms of their characteristics. Both 3
Notice that precision and recall values can also be calculated by choosing thresholds. However, we do not want to limit our investigation to a specific threshold set or algorithm at this stage.
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones
1 0.5
2 min. L1 norm
2 min. L1 norm
min. L1 norm
2 1.5
1.5 1 0.5
0
1.5 1 0.5
0 50
100 day n
43
0
virus 200
50
100 day n
virus 200
50
100 day n
virus 200
1.2
1
1
0.8 0.6 0.4
0.6 0.4 0.2
0
0 100 day n
1
0.8
0.2 50
1.2 min. L2 norm
1.2 min. L2 norm
min. L2 norm
(a) min. l1 distances between prototypes and test vectors on each day of the test period (left-toright: 7, 14, and 21 prototypes)
0.8 0.6 0.4 0.2 0
virus 200
50
100 day n
virus 200
50
100 day n
virus 200
50
100 day n
virus
8 7 6 5 4 3 2 1 0
min. Mahalanobis norm
8 7 6 5 4 3 2 1 0
min. Mahalanobis norm
min. Mahalanobis norm
(b) min. l2 distances between prototypes and test vectors on each day of the test period (left-toright: 7, 14, and 21 prototypes)
200
50
100 day n
virus
8 7 6 5 4 3 2 1 0
200
50
100 day n
virus
200
0.12 0.1 0.08 0.06 0.04 0.02 0
0.14
min. diffusion KL div.
0.14
min. diffusion KL div.
min. diffusion KL div.
(c) min. Mahalanobis distances between prototypes and test vectors on each day of the test period (left-to-right: 7, 14, and 21 prototypes)
0.12 0.1 0.08 0.06 0.04 0.02 0
50
100 day n
virus 200
0.14 0.12 0.1 0.08 0.06 0.04 0.02 0
50
100 day n
virus 200
50
100 day n
virus 200
(d) min. Kullback-Leibler divergences between diffused prototypes and test vectors resulting from the algorithm in Fig. 2 on each day of the test period (left-to-right: 7, 14, and 21 prototypes) Fig. 5. Malware detection results obtained from various methods. For all methods in (a), (b), (c), and (d), the number of prototypes representing normal behavior are 7, 14, and 21. The days with malware activity, 166, 169, and 171, are colored red.
44
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
data sets result from daily usage by ordinary volunteers over extended periods of time. Therefore, however limited, they can be seen as representative. Into both data sets we insert only one Trojan that exhibits itself only a few times within the test data. This is done on purpose in order to increase realism and simulate the situation of “searching a needle in a haystack”. Similarly, we limit the available training data as much as possible for both cases to create realistic scenarios. In practice, the usage patterns are hardly stationary, i.e. even if usage data of a smartphone user from months ago was available, it would not be of much use due to changing behavioral patterns. Each one of the experiments conducted and the respective data sets represent different approaches. Monitoring the system parameters of a smartphone continuously and using them for malware detection has advantages as it gives a broader picture of the situation by observing the complete profile of the device. However, resource usage –especially battery, CPU, and network access– are the clear disadvantages of this approach. Malware detection based on application (communication) logs, on the other hand, brings less overhead to the system. While the amount of information obtained on the system is much more limited, the focus is on behavioral aspects of the problem. This application-layer approach has its unique strengths such as generation of an individual profile of the user independent of the specific device brand/type and opening doors to the direction of semantic interpretations. As we have discussed, the second approach can also be less intrusive in terms of privacy after preprocessing depending on the type of features selected. By outperforming alternative methods on both data sets in various realistic scenarios, the presented probabilistic diffusion algorithm establishes its wide-range applicability and robustness with respect to training data availability. Furthermore, its lightweight nature allows for personalization at the user level, yet it can also be applied in a privacypreserving manner as demonstrated. Both of the malware detection schemes based on the proposed diffusion algorithm can be deployed in conjunction with more traditional methods such as signature-based detection or as a last line of defense in addition to various other security measures.
4 Conclusion This paper presents a behavior-based approach to anomaly-based malware detection for application in mobile security systems. Despite extensive research, present day malware detectors still suffer from high false alarm rates. Towards the problem of distinguishing between anomalies (malware) and normal usage, we propose a probabilistic diffusion scheme that is based on a bipartite graph model that models probabilistic dependencies between a set of prototypes and a set of features that characterize these prototypes. Our model allows for mapping distributions of features onto distributions of prototypes and vice versa. In this manner, we can define Markov processes over the set of prototypes whose stationary distributions constitute similarity rankings of prototypes. This resembles the page rank procedure used by Google. However, in contrast to the page rank algorithm and other recent contributions to ranking on graphs and manifolds, the approach presented in this paper does not require the definition or computation of adjacency relations among prototypes. Rather, due to our dual treatment of features and
A Probabilistic Diffusion Scheme for Anomaly Detection on Smartphones
45
prototypes the diffusion kernel that allows for ranking with respect to the manifold of prototypes results from Bayesian reasoning. Given the stochastic diffusion scheme, malicious activities are detected by first mapping feature vectors to stationary distributions over a set of prototypes of normal behavior and then computing their Kullback-Leibler divergence w.r.t. the stationary rankings of the prototypes themselves. Experiments with multiple real-world data resulting from monitoring usage of different mobile phones demonstrate the wide-range applicability of the approach. Compared to several baseline algorithms that are frequently applied in present day malware detection systems, our method outperforms them consistently and in a robust manner. Furthermore, it has favorable characteristics such as privacy preservation of individual users when applied to communication logs instead of system-level data. On the other hand, statistical methods, no matter how advanced, can not fully distinguish between rare user behavior and symptoms of malware. This is due to the fact that they lack semantic capabilities and context-awareness. Therefore, our approach should not be seen as an ultimate solution but as a step towards application of novel and advanced machine learning schemes in the security domain. Future work will further exploit the lightweight nature of the algorithm. For training and application alike, it only requires multiplications of small to medium sized matrices. It is therefore suitable for application on modern mobile devices. Moreover, since the detector is based on data matrices only, update schemes seem worthwhile to explore. Currently, we are investigating mechanisms of dynamic feedback control for equation (3) as well ways to update the data matrix in order to adjust to evolving usage patterns. In another direction, combining statistical detection methods and semantic descriptions, i.e. closing the “semantic gap” remains as an open research challenge.
References 1. Agarwal, S.: Ranking on Graph Data. In: Proc. Int. Conf. on Machine Learning, ICML, pp. 25–32 (2006) 2. Alpcan, T., Bas¸ar, T.: A game theoretic analysis of intrusion detection in access control systems. In: Proc. IEEE Conf. Decision and Control, pp. 1568–1573 (2004) 3. Axelsson, S.: The base-rate fallacy and its implications for the difficulty of intrusion detection. In: Proc. ACM Conf. on Computer and Communications Security, pp. 1–7 (1999) 4. Bloem, M., Alpcan, T., Bas¸ar, T.: An optimal control approach to malware filtering. In: Proc. 46th IEEE Conference on Decision and Control, New Orleans, LA (December 2007) 5. Bloem, M., Alpcan, T., Schmidt, S., Bas¸ar, T.: Malware filtering for network security using weighted optimality measures. In: IEEE Conference on Control Applicatons (CCA), Singapore (October 2007) 6. Bye, R., Luther, K., Camtepe, S.A., Alpcan, T., Albayrak, S., Yener, B.: Decentralized detector generation in cooperative intrusion detection systems. In: Masuzawa, T., Tixeuil, S. (eds.) SSS 2007. LNCS, vol. 4838, pp. 37–51. Springer, Heidelberg (2007) 7. Cheng, J., Wong, S.H.Y., Yang, H., Lu, S.: Smartsiren: virus detection and alert for smartphones. In: Proc. of Int. Conf. on Mobile Systems, Applications, and Services (Mobisys 2007), pp. 258–271 (2007) 8. Christodorescu, M., Jha, S., Seshia, S., Song, D., Bryant, R.: Semantics-Aware Malware Detection. In: Proc. IEEE Symp. on Security and Privacy, pp. 32–46 (2005) 9. Coursen, S.: The future of mobile malware. Network Security (8), 7–11 (August 2007)
46
T. Alpcan, C. Bauckhage, and A.-D. Schmidt
10. Dalal, N., Triggs, B.: Histograms of Oriented Gradients for Human Detection. In: Proc. CVPR, vol. 2, pp. 886–893 (2005) 11. Eagle, N., Pentland, A.S.: Reality mining: sensing complex social systems. Personal Ubiquitous Computing 10(4), 255–268 (2006) 12. Fouss, F., Pirotte, A., Renders, J.M., Saerens, M.: Random-Walk Computation of Similarities between Nodes of a Graph with Application to Collaborative Recommendation. IEEE Trans. on Knowledge and Data Engineering 19(3), 355–369 (2007) 13. Gao, B., Liu, T.Y., Ma, W.Y.: Star-Structured Higher-Order Heterogeneous Data CoClustering Based on Consistent Information Theory. In: Proc. ICDM, pp. 880–884 (2006) 14. Idika, N., Mathur, A.: A Survey of Malware Detection Techniques. Tech. Rep. SERC-TR286, Software Engineering Research Center (March 2007) 15. Kashima, H., Tsuda, K., Inokuchi, A.: Kernels for graphs. In: Sch¨olkopf, B., Tsuda, K., Vert, J.P. (eds.) Kernel Methods in Computational Biology, pp. 155–170. MIT Press, Cambridge (2004) 16. Kondor, R., Lafferty, J.: Diffusion Kernels on Graphs and Other Discrete Input Spaces. In: Proc. ICML, pp. 315–322 (2002) 17. Langville, A., Meyer, C.: A Survey of Eigenvector Methods for Web Information Retrieval. SIAM Review 47(1), 135–161 (2005) 18. Luther, K., Bye, R., Alpcan, T., Muller, A., Albayrak, S.: A cooperative AIS framework for intrusion detection. In: Proc. of the IEEE Conference on Communication (ICC), Glasgow, Scotland, June 2007, pp. 1409–1416 (2007) 19. Maloof, M. (ed.): Machine Learning and Data Mining for Computer Security. Springer, Heidelberg (2006) 20. Messmer, E.: New approaches to malware detection coming into view. Network World (April 2007), http://www.networkworld.com/news/2007/ 042507-malware-detection.html 21. Miettinen, M., Halonen, P.: Host-based intrusion detection for advanced mobile devices. In: Proc. of 20th Intl. Conf. on Advanced Information Networking and Applications (AINA’06), vol. 2, pp. 72–76. IEEE Computer Society, Washington (2006) 22. Salton, G.: Introduction to Modern Information Retrieval. McGraw-Hill, New York (1983) 23. Schmidt, A.D., Peters, F., Lamour, F., Albayrak, S¸.: Monitoring smartphones for anomaly detection. In: Proc. of First Int. Conf. on Mobile Wireless Middleware, Operating Systems, and Applications (MOBILWARE 2008) (February 2008) 24. Schmidt, S., Alpcan, T., Albayrak, S., Bas¸ar, T., Muller, A.: A malware detector placement game for intrusion detection. In: Lopez, J., H¨ammerli, B.M. (eds.) CRITIS 2007. LNCS, vol. 5141. Springer, Heidelberg (2008) 25. Wang, K., Stolfo, S.: Anomalous Payload-Based Network Intrusion Detection. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 203–222. Springer, Heidelberg (2004) 26. Wu, N., Zhang, J.: Factor-analysis Based Anomaly Detection and Clustering. Decision Support Systems 42(1), 375–389 (2006) 27. Yap, T.S., Ewe, H.T.: A mobile phone malicious software detection model with behavior checker. In: Shimojo, S., Ichii, S., Ling, T.-W., Song, K.-H. (eds.) HSI 2005. LNCS, vol. 3597, pp. 57–65. Springer, Heidelberg (2005) 28. Zhou, D., Weston, J., Gretton, A., Bousquet, O., Sch¨olkopf, B.: Ranking on Data Manifolds. In: Proc. NIPS, pp. 169–176 (2004)
A Smart Card Implementation of the McEliece PKC Falko Strenzke1,2 1
2
FlexSecure GmbH, Germany
[email protected] Cryptography and Computeralgebra, Department of Computer Science, Technische Universit¨ at Darmstadt, Germany
Abstract. In this paper we present a smart card implementation of the quantum computer resistant McEliece Public Key Cryptosystem (PKC) on an Infineon SLE76 chip. We describe the main features of the implementation which focuses on performance optimization. We give the resource demands and timings for two sets of security parameters, the higher one being in the secure domain. The timings suggest the usability of the implementation for certain real world applications. Keywords: Public key encryption scheme, code-based cryptography, post quantum cryptography, smart card, implementation.
1
Introduction
Current public key schemes like RSA and elliptic curve based cryptosystems depend on the complex mathematical problems of integer factorization and the calculation of discrete logarithms [1,2,3,4]. These systems are known to be vulnerable against so-called quantum algorithms which could be run efficiently on quantum computers [5,6,7]. Today, practically useful quantum computers have not been build, but they are subject to intensive research. It is virtually impossible to predict how long it will take scientists to construct a quantum computer of sufficient potency to break today’s cryptographic schemes. But once this is the case, new classes of cryptographic schemes will be needed to furthermore guarantee data security. These new types of cryptographic schemes we refer to as quantum computer resistant cryptographic schemes or post quantum cryptography. Examples for theses types of algorithms are the hash-based cryptography, such as the Merkle signature scheme [8,9], and code-based cryptography like the McEliece PKC [10,11], which is the subject of this paper. While in principle it would suffice to switch to a quantum computer resistant signature scheme just when quantum computers become an actual threat, matters stand different for encryption schemes. Data that is encrypted today and sent through a public channel might be recorded and stored by an attacker. Then, once quantum computers are available to him, he is able to decrypt his
A part of the work of F. Strenzke was done at2 .
P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 47–59, 2010. c IFIP International Federation for Information Processing 2010
48
F. Strenzke
recorded ciphertexts. This scenario shows the importance and urgency of taking precautions against the threat that quantum computers pose for today’s public key cryptosystems. In this paper we present an implementation of the McEliece PKC on a smart card. In Section 2 we describe the key generation as well as the encryption and decryption operations of the McEliece PKC. A description of the hardware platform and the most basic software design choices are given in Section 3. In Section 4 we show timings for the encryption and decryption operations using realistic security parameters. The timings are in the magnitude of seconds and thus imply the usability of the implementation for certain purposes. In Section 5 we give the conclusion and consider possible future improvements to the implementation.
2
Preliminaries
In the following we will give a brief definition of classical Goppa codes and the McEliece PKC. In this section we assume that the reader is familiar with the basics of error correcting codes. We use the notation given e.g. in [12]. 2.1
Classical Goppa Codes
Goppa codes [13] are a class of linear error correcting codes. The McEliece PKC makes use of irreducible binary Goppa codes, so we will restrict ourselves to this subclass. Definition 1. Let the polynomial g(X) =
t
gi X i ∈ F2m [X]
(1)
i=0
be monic and irreducible over F2m [X], and let m, t be positive integers. Then g(X) is called a Goppa polynomial (for an irreducible binary Goppa code). Then an irreducible binary Goppa code is defined as G(F2m , g(X)) = {c ∈ Fn2 |Sc (X) :=
n−1 i=0
ci = 0 mod g(X)} X − γi
(2)
where n ≤ 2m , Sc (X) is the syndrome of c, the γi , i = 0, . . . , n − 1 are pairwise distinct elements of F2m , and ci are the entries of the vector c. The code defined in such way has length n, dimension k = n − mt and can correct up to t errors. Please note that our implementation only allows lengths n = 2m . The canonical check matrix H for G(F2m , g(X)) can be computed from the syndrome equation and is given in Appendix A.
A Smart Card Implementation of the McEliece PKC
2.2
49
The McEliece PKC
The McEliece PKC is named after its inventor [10]. It is a public key encryption scheme based on general coding theory. Specifically, the McEliece PKC uses Goppa codes. The strongest known attack against this scheme is based on solving the NP-hard decoding problem, and no quantum algorithm has been proposed which increases the efficiency of this attack [14]. In the following, we will give a brief description of the individual algorithms for key generation, encryption and decryption, without presenting the mathematical foundations behind the scheme or the consideration of its security. For these considerations, the reader is referred to [15]. It was shown that the original McEliece PKC is vulnerable against chosenciphertext attacks, see [15] for an overview. However, this problem can be solved by incorporating a CCA2-conversion in the scheme. A number of such conversions have been proposed for the McEliece PKC [11]. The conversion we are using in our implementation is described in Section 2.6. Parameters of the McEliece PKC. The security parameters m ∈ N and t ∈ N with t 2m have to be chosen in order to set up a McEliece PKC. An example for secure values would be m = 11, t = 50. These values can be derived from the considerations given in [16] and [17]. 2.3
McEliece Key Generation
The private key. The private key consists of two parts. The first part of the secret key in the McEliece PKC is a Goppa polynomial g(X) of degree t over F2m according to Definition 1, with random coefficients. The second part is a randomly created n × n permutation matrix P. The public key. The public key is generated from the secret key as follows. First, compute H as the parity check matrix corresponding to g(X). Then take Gpub = [Ik | R] as the generator in systematic form corresponding to the parity check matrix HP (refer to Appendix A for the creation of the parity check matrix and the generator of a Goppa code). Please note that choosing the generator in systematic form would be a security problem if the McEliece PKC was used without a CCA2-conversion. 2.4
McEliece Encryption
Assume Alice wants to encrypt a message m ∈ Fk2 . Firstly, she has to create a random binary vector e of length n and Hamming weight wt (e) = t. Then she computes the ciphertext z = mGpub ⊕ e. 2.5
McEliece Decryption
In order to decrypt the ciphertext, Bob computes z = zP−1 . He then computes the syndrome Sz = z HT . Afterwards he applies error correction by executing
50
F. Strenzke
an error correction algorithm, which receives as its input the syndrome and the permuted distorted codeword z . It outputs the so called error locator polynomial defined as σe (X) = (X − γj ) ∈ F2m [X], j∈Te
{i|ei
where Te = = 1} and e is the error vector of the permuted distorted code word z . Once the error locator polynomial is known, the permuted error vector is computed as e = (σe (γ0 ), σe (γ1 ), · · · , σe (γn−1 )) ⊕ (1, 1, · · · , 1), i.e. ei = 1 if σe (γi ) = 0 and ei = 0 otherwise. The error vector then is found by undoing the permutation: e = e P. Then the message is recovered as the first k bits of z ⊕ e. In our implementation, we use the Patterson Algorithm [18] as error correction algorithm. The Patterson Algorithm. The Patterson Algorithm. is an efficient algorithm for the determination of the error locator polynomial. We will give a brief description of the algorithm without any proofs. The algorithm uses the fact that the error locator polynomial can be written as σe (X) = α2 (X) + Xβ 2 (X). (3) Defining τ (X) =
Sz−1 (X) + X mod g(X) ,
(4)
with Sz (X) being the syndrome of the distorted code word z, the following equation holds: β(X)τ (X) = α(X) mod g(X) (5) Then, assuming that no more than t errors occurred, Equation 5 can be solved by applying the Euclidean algorithm with a breaking condition concerning the degree of the remainder [15]. Specifically, the remainder in the last step is taken as α(X) and the breaking condition is deg (α(X)) ≤ 2t . It can be shown that then, deg (β(X)) ≤ t−1 2 . Thus, once α(X) and β(X) are determined, the error locator polynomial σe is known. 2.6
CCA2-Conversion
As mentioned in Section 2.2, the original McEliece PKC needs to be extended by a CCA2-conversion to achieve security against chosen-ciphertext attacks. The conversion we are using in our implementation is introduced in [19] and was designed with respect to optimized computation time and side channel resistance. A security proof for this conversion will be given elsewhere. Note that in the implementation the CCA2-conversion is easily exchangeable.
A Smart Card Implementation of the McEliece PKC
51
In the following, we will use (z, e) ← EGpub (m) to denote the McEliece encryption of the message m to the ciphertext z using the public key Gpub , as depicted in Section 2.4. The error vector e is also modeled as an output of the encryption function, since it is needed in the CCA2-conversion which encapsulates the McEliece encryption. The same applies to the decryption (m, e) ← D(P,g(X)) (z) , i.e. here e is also an output of the algorithm. The conversion makes use of a hash function H() which outputs a bit vector of length l. In the implementation, we are using SHA256, so l = 256. Furthermore, by we denote concatenation. Note that in Algorithm 1 and 2, the ciphertext part z 1 has a bit length equal to the parameter n of the McEliece PKC, whereas z 2 and z 3 are of bit length l. Algorithm 1. McEliece - CCA2 secure encryption Require: message m ∈ Fl2 , public key Gpub Ensure: ciphertext z ∈ F2n+2l u1 ← random (k − l)-bit string. u2 ← random l-bit string. (z 1 , e) ⎛ ← EGpub (u1 H(mu2 )) ⎞ ⎜ ⎟ z ← ⎝z 1 (H(u1 ) ⊕ m) (u2 ⊕ H(e))⎠
z2
z3
Algorithm 2. McEliece - CCA2 secure decryption Require: ciphertext z = (z 1 , z 2 , z 3 ) ∈ Fn+2l , secret key (P, g(X)) 2 Ensure: decrypted message m ∈ Fl2 (w, e) ← D(P,g(X)) (z 1 ) r ← the first k − l bits of w h ← the bits at k − l + 1, · · · , k of w. m ← z 2 ⊕ H(r) if h = H(m(H(e) ⊕ z 3 )) then return m else return error end if
3
Features of the Implementation
In this Section we outline the most basic features of our software implementation and the hardware platform we are using.
52
3.1
F. Strenzke
The Hardware Platform
As hardware platform, we use an SLE76CF5120P controller out of the SLE76family [20] by Infineon Technologies AG. It features a 16 bit CPU based on the 80251 architecture. It has a clock rate of 33 MHz and provides 12 kByte of RAM. It es equipped with 504 kByte of non-volatile memory (NVM, i.e. flash memory). It also features a unified data and code cache of 1 kByte. 3.2
Design of the Software
As we did not use a preexisting smart card operating system, we had to implement the basic functions for memory management and I/O. This encompasses sending and receiving data via the serial interface, command processing and management of the heap memory. Despite from this, a large number of mathematical routines is needed for the encryption and decryption algorithms of the McEliece PKC. The source code is written in the C programming language but is strongly object oriented. In the following we give a brief overview of the most important mathematical objects modeled in the code. With respect to the prototypic nature of our implementation, we chose to optimize with regard to execution time, not memory usage. This is based on the following considerations. In a real world application the available RAM and NVM would be firmly determined by the actual hardware and OS platform. There, the time-memory tradeoffs arising in the implementation would have to be shifted towards reducing memory usage until the limitations are fulfilled. Without being given any concrete limitations, it seems more useful to show the so far best achievable performance. The field F2m . The Galois Field implementation is taken from the open source McEliece implementation [21], results concerning this implementation are given in [22]. This implementation uses lookup tables for the computation of exponentiations and logarithms of elements. These in turn are used to build most other operations in F2m . All of these operations are implemented as preprocessor macros. The Galois Field implementation determines the speed of the decryption operation to a large extent, as it realizes the lowest level of implementation for all polynomial operations. Polynomials over F2m . In order to minimize execution time, each coefficient is implemented as a two byte word. This in turn means that for our actual choices of the parameter m = 10 and m = 11 (see Section 4.1), a considerable number of bits in each word is unused. Permutations. Permutations are implemented as lookup tables. Again, each entry is two bytes wide. Accordingly, a number of bits is in each word remains unused. Note that there is no need to store the inverse of the permutation. A function to apply the inverse of the permutation is easily implemented.
A Smart Card Implementation of the McEliece PKC
53
Matrices over F2 . Clearly, no memory-time tradeoff choices arise with respect to binary matrices. Matrices are stored row-wise. It is, however, important to realize that in the binary case, by using the efficient “vector × matrix” type multiplication, the Hamming weight of the vector is leaked through the running time of the operation. This is not a problem in the decryption operation, as according to Section 2.5 the only operation preceding the computation of the syndrome vector (by multiplying z by the parity check matrix) is the application of the permutation P. Note that the application of the permutation leaves the Hamming weight of the vector invariant. Accordingly, in our implementation, we use this type of matrix-vector multiplication for syndrome computation. In case of the encryption operation (Section 2.4) however, the message vector is multiplied by the generator matrix. Here we have to use a “matrix × vector” type multiplication in order not to leak the Hamming weight of the message T through a timing side channel. Accordingly, the public key is stored as Gpub in the implementation. Private Key. As shown in Section 2.3, the private key consists of the Goppa polynomial g(X) and the permutation P. However, to allow for an efficient decryption operation, further precomputed objects have to be available. Parity Check Matrix. In order to perform efficient computation of the syndrome (see Section 2.5) the parity check matrix H has to be stored. It makes up the major part part of the private key, as is shown in section 4.3. Square root matrix. Furthermore, as the Patterson Algorithm involves the computation of a square root in F2m [X]/g(X) (Equation 4), it is helpful to store a so called square root matrix [23,24] as part of the private key. With the help of this matrix, computing square roots in F2m [X]/g(X) is split into a matrix multiplication and computing square roots in F2m . In this way, performance is greatly enhanced. The square root matrix is computed during the key generation in the following way. First, the squaring matrix Q for squarings in F2m [X]/g(X) is generated as a t × t matrix with coefficients in F2m as follows: Generate the i-th column as as X 2i mod g(X) for i ∈ {0, . . . t − 1}, where each coefficient goes into one row. ⎛ (0) (s) ⎞ γ1 γ0 γ0 γ0 . . . γ0 q0 . . . q0 ⎜ γ γ γ γ . . . γ q (0) . . . q (s) ⎟ ⎜ 0 0 0 0 0 1 1 ⎟ ⎜ ⎟ ⎜ γ0 γ1 γ0 γ0 . . . γ0 q2(0) . . . q2(s) ⎟ ⎜ ⎟ ⎜ γ0 γ0 γ0 γ0 . . . γ0 q (0) . . . q (s) ⎟ 3 3 ⎟ ⎜ Q=⎜ (6) (0) (s) ⎟ ⎜ γ0 γ0 γ1 γ0 . . . γ0 q4 . . . q4 ⎟ ⎜ ⎟ ⎜ γ0 γ0 γ0 γ0 . . . γ0 q5(0) . . . q5(s) ⎟ ⎜ ⎟ .. ⎟ ⎜ .. .. .. .. .. .. .. .. ⎝ . . . . . . . . . ⎠ (0)
(s)
γ0 γ0 γ0 γ0 . . . γ1 qt−1 . . . qt−1 Here, γ0 and γ1 represent the neutral element regarding addition and multiplication in F2m , respectively. The buildup of the matrix Q is as follows. The first
54
F. Strenzke
t/2 − 1 columns simply represent the mapping γ1 → γ1 , X → X 2 , X 2 → X 4 , etc. and thus are independent of g(X). Once the squaring causes a polynomial of degree t or higher, the reduction by g(X) must be carried out, causing the (a) entries qb to depend on the Goppa Polynomial. Here, the subscript and superscript of q simply indicate the rows and columns of the submatrix dependent on g(X) and thus s = t − 1 − t/2 − 1 . Note that the matrix depicted in Equation 6 is for an even value of the parameter t. In the case of t odd, the column containing the γ1 in the last row would not exist. The squaring of a polynomial with coefficients α = (α0 , α1 , . . . , αt−1 ) can now be carried out by computing α2 = Qα , where α = (α20 , α21 , . . . , α2t−1 ). The desired square root matrix is found as Q−1 . Taking root of a √ the square −1 polynomial β then amounts to compute β = Q β and β = ( β , β1 , . . . , 0 βt−1 ).
4
Timings and Resource Usage
In this section we give timings and resource demands of our implementation for two sets of security parameters. 4.1
Parameter Sets
The parameters m and t of the McEliece PKC determine the security of the scheme and its resource demands. We tested our implementation with two sets of parameters, shown in the table below. The bit security is given with respect to the attack given in [17], which is to the best of our knowledge the strongest known attack today. Note that the message size is determined merely by the length of the output of the hash function used in the CCA2-conversion. In our implementation, this is always SHA256 (see Section 2.6). Table 1. Security parameter sets for the McEliece PKC m,t 10,40 11,50
security bits message size ciphertext in byte size in byte 62 32 2 · 32 + 128 = 192 102 32 2 · 32 + 256 = 320
A Smart Card Implementation of the McEliece PKC
4.2
55
Timings
In Table 2 we give timings for the two parameter sets. For comparability, we also give timings for the same operations on a personal computer (PC). The computer is an Intel Core Duo T7300 2GHz running Linux with kernel version 2.6.24. The application uses the same source code as the smart card implementation, compiled with GCC-4.1.3, optimization level O2. The column labeled “time” lists the overall timing including the data transmission to and from the smart card. In the rightmost column we provide the time that is used by the mere computation on the card, excluding the transmission times. The gross bit rate of the transmission is 9600 bit/s. Please note that the SLE76 hardware platform generally supports much faster transmission rates than this. Table 2. Timings for encryption and decryption operation of the McEliece PKC on a personal computer and the SLE76 smart card platform PC PC SLE76 SLE76 PC PC SLE76 SLE76
parameter set m=10, t=40 “ “ “ m=11, t=50 “ “ “
operation
time
encryption decryption encryption decryption encryption decryption encryption decryption
0.75 ms 0.8 ms 1.26s 0.98s 1.2ms 1.6ms 1.85s 1.52s
time without I/O 0.97s 0.69s 1.39s 1.06s
Concerning the encryption operation, we must point out that the measurement results are of small practical relevance. This is due to the fact that we perform the encryption by using a public key stored in the NVM of the device. In real life applications, this key would have to be exchanged for every new communication partner. Considering the public key size, this would cause totally impractical transmission times. 4.3
Resource Demands
In Table 3 we give the resource demands, i.e. the RAM and non-volatile memory (NVM) space needed by the implementation. Again, we distinguish the two parameter sets we are examining in this work. The demanded RAM size is made up of a fixed stack size of 1024 bytes and the peak amount of allocated heap memory. Note that the RAM demands given below are with respect to the decryption operation. They are lower for the encryption operation. The main contribution to the private key size stems from the parity check matrix H, which makes up about 143, 000 bytes in case of m = 11, t = 50 and about 53, 000 bytes for m = 10, t = 40. This corresponds to portions of 95% and 88%, respectively. Please note that in addition to the raw matrix data, the given sizes also include certain management data overhead.
56
F. Strenzke
Table 3. Resource demands of the McEliece PKC smart card implementation with accuracy of 100 byte for RAM and 1000 byte for NVM resource RAM (m=11,t=50) RAM (m=10,t=40) NVM code NVM public key (m=10,t=40) NVM private key (m=10,t=40) NVM public key (m=11,t=50) NVM private key (m=11,t=50) NVM F210 lookup tables NVM F211 lookup tables
4.4
space in 103 byte 4.4 3.4 45 33 60 106 151 4 8
Key Generation
So far, our smart card implementation does not feature key generation. The reason for this is that this operation involves operations on matrices that by far exceed the card’s RAM size. Since writing to the NVM takes much more time than writing to RAM, an optimized key generation algorithm would be needed in order to minimize those NVM write accesses. In our implementation, we have realized a set of commands to write the private key parts from the PC to the card.
5
Conclusion and Outlook
The McEliece PKC, though existing for 30 years, has not experienced any serious use in real world applications so far. The main drawbacks of this scheme are the large sizes of the private and public key. But as shown by our work, the NVM and RAM provided by today’s smart cards are already sufficient to support implementations of McEliece using parameters that provide about 100 bit security. Also, the achievable performance seems sufficient for certain applications. The implementation presented in this work is fully functional, yet there are a number of possible improvements that could be applied to it. First of all, the code size could probably be reduced further by removing certain redundancies. Concerning the performance, a major improvement should result from the replacement of 32 bit pointers used throughout the code by 16 bit pointers. This is because the 16 bit CPU can handle the smaller pointers much faster. But since at least for the larger parameter set the private key size exceeds the 16 bit addressable area, this could only be achieved with the usage of the Memory Management Unit (MMU) available on the SLE76 platform. An alternative would be to use a 32 bit platform, of course. Furthermore, our implementation will undergo a thorough analysis with respect to side channels and appropriate countermeasures will be incorporated.
A Smart Card Implementation of the McEliece PKC
57
The problem of the transmission and storage of the public key for the encryption operation, which arises in certain applications will also be addressed in future work. Considering the fact that the McEliece PKC is providing security even in the presence of quantum computers, our results should encourage decision makers to examine applications of public key encryption schemes within their authority with respect to the need and possibility to switch to a quantum computer resistant scheme. As stated in the introduction, the replacement of the classical encryption schemes like RSA and elliptic curve based cryptography may not be delayed until the very moment at which potent quantum computers become available to attackers.
References 1. Diffie, W., Hellman, M.: New directions in cryptography. IEEE Transactions on Information Theory 22(6), 644–654 (1976) 2. Rivest, R., Shamir, A., Adleman, L.: A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM 21(2), 120–126 (1978) 3. Miller, V.: Use of Elliptic Curves in Cryptography. In: Williams, H.C. (ed.) CRYPTO 1985. LNCS, vol. 218, pp. 417–426. Springer, Heidelberg (1986) 4. ElGamal, T.: A Public Key Cryptosystem and A Signature Based on Discrete Logarithms. IEEE Transactions on Information Theory (1985) 5. Shor, P.W.: Algorithms for quantum computation: discrete logarithms and factoring. In: Proceedings, 35th Annual Symposium on Foundation of Computer Science (1994) 6. Shor, P.W.: Polynomial time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing 26(5), 1484–1509 (1997) 7. Proos, J., Zalka, C.: Shor’s discrete logarithm quantum algorithm for elliptic curves. Technical Report quant-ph/0301141, arXiv (2006) 8. Merkle, R.: A Certified Digital Signature. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 218–238. Springer, Heidelberg (1990) 9. Buchmann, J., Garcia, L., Dahmen, E., Doering, M., Klintsevich, E.: CMSS-An Improved Merkle Signature Scheme. In: 7th International Conference on Cryptology in India-Indocrypt, vol. 6, pp. 349–363 (2006) 10. McEliece, R.J.: A public key cryptosystem based on algebraic coding theory. DSN progress report 42–44, 114–116 (1978) 11. Kobara, K., Imai, H.: Semantically secure McEliece public-key cryptosystems - conversions for McEliece PKC. In: Practice and Theory in Public Key Cryptography - PKC ’01 Proceedings (2001) 12. MacWilliams, F.J., Sloane, N.J.A.: The theory of error correcting codes. NorthHolland, Amsterdam (1997) 13. Goppa, V.D.: A new class of linear correcting codes. Problems of Information Transmission 6, 207–212 (1970) 14. Menezes, A., van Oorschot, P., Vanstone, S.: Handbook of Applied Cryptography. CRC Press, Boca Raton (1996), http://www.cacr.math.uwaterloo.ca/hac/ 15. Engelbert, D., Overbeck, R., Schmidt, A.: A Summary of McEliece-Type Cryptosystems and their Security. Journal of Mathematical Cryptology (2007)
58
F. Strenzke
16. Canteaut, A., Chabaud, F.: A new algorithm for finding minimum-weight words in a linear code: application to primitive narrow-sense BCH-codes of length 511. IEEE Transactions on Information Theory 44(1), 367–378 (1998) 17. Bernstein, D.J., Lange, T., Peters, C.: Attacking and defending the McEliece cryptosystem. In: Buchmann, J., Ding, J. (eds.) PQCrypto 2008. LNCS, vol. 5299, pp. 31–46. Springer, Heidelberg (2008) 18. Patterson, N.: Algebraic decoding of Goppa codes. IEEE Trans. Info. Theory 21, 203–207 (1975) 19. Overbeck, R.: An Analysis of Side Channels in the McEliece PKC (2008), https://www.cosic.esat.kuleuven.be/nato arw/slides participants/ Overbeck slides nato08.pdf 20. Infineon Technologies AG: SLE76 Product Data Sheet, http://www.infineon.com/cms/de/product/ channel.html?channel=db3a3043156fd57301161520ab8b1c4c 21. Biswas, B., Sendrier, N.: HyMES - Hybrid McEliece System, http://ralyx.inria.fr/2008/Raweb/secret/uid18.html 22. Biswas, B., Sendrier, N.: McEliece cryptosystem in real life: theory and practice. In: Buchmann, J., Ding, J. (eds.) PQCrypto 2008. LNCS, vol. 5299, pp. 47–62. Springer, Heidelberg (2008) 23. D¨ oring, M.: On the Theory and Practice of Quantum-Immune Cryptography. PHDThesis (2008), http://www.cdc.informatik.tu-darmstadt.de/reports/README.diss.html 24. The FlexiProvider group at Technische Universit¨ at Darmstadt: FlexiProvider, an open source Java Cryptographic Service Provider, http://www.flexiprovider.de
A
Parity Check Matrix and Generator of an Irreducible Binary Goppa Code
The parity check matrix H of a Goppa code determined by the Goppa polynomial g can be determined as follows. H = XYZ, where ⎡ ⎤ ⎡ ⎤ 1 1 ··· 1 gt 0 0 · · · 0 ⎢ gt−1 gt 0 · · · 0 ⎥ ⎢ γ0 γ1 · · · γn−1 ⎥ ⎢ ⎥ ⎢ ⎥ X = ⎢ . . . . . ⎥,Y = ⎢ . .. . . .. ⎥ , ⎣ .. .. .. . . .. ⎦ ⎣ .. . . . ⎦ t−1 g1 g2 g3 · · · gt γ0t−1 γ1t−1 · · · γn−1 1 1 1 Z = diag , ,..., . g(γ0 ) g(γ1 ) g(γn−1 )
Here diag (. . .) denotes the diagonal matrix with entries specified in the argument. H is t × n matrix with entries in the field F2m As for any error correcting code, the parity check matrix allows for the computation of the syndrome of a distorted code word: Sz (X) = zH X t−1 , · · · , X, 1 . The multiplication with X t−1 , · · · , X, 1 is used to turn the coefficient vector into a polynomial in F2mt .
A Smart Card Implementation of the McEliece PKC
59
The generator of the code is constructed from the parity check matrix in the following way: Transform the t × n matrix H over F2m into an mt × n matrix H2 over F2 by expanding the rows. Then, find an invertible matrix S such that S · H2 = Imt | R , i.e., bring H into a systematic form using the Gauss algorithm. Here, Ix is the x × x identity matrix. Now take G = [Ik | R] as the public key. G is a k × n matrix over F2 , where k = n − mt.
B
The Extended Euclidean Algorithm (XGCD)
The extended Euclidean algorithm can be used to compute the greatest common divisor (gcd) of two polynomials[12]. In order to compute the gcd of two polynomials r−1 (X) and r0 (X) with deg (r0 ) (X) ≤ deg (r−1 (X)), we make repeated divisions to find the following sequence of equations: deg (r1 ) < deg (r0 ) , r−1 (X) = q1 (X)r0 (X) + r1 (X), deg (r2 ) < deg (r1 ) , r0 (X) = q2 (X)r1 (X) + r2 (X), ... ri−2 (X) = qi (X)ri−1 (X) + rj (X), deg (ri ) < deg (ri−1 ) , ri−1 (X) = qi+1 (X)ri (X) Then ri (X) is the gcd of r−1 (X) and r0 (X).
Evaluation Metrics of Physical Non-invasive Security Huiyun Li, Keke Wu, Fengqi Yu, and Hai Yuan Department of Integrated Electronics, Shenzhen Institute of Advanced Technology, The Chinese University of Hong Kong, Chinese Academy of Sciences, China
[email protected] Abstract. Physical non-invasive security has become crucial for cryptographic modules, which are widely used in pervasive computing. International security evaluation standards, such as U.S. Federal Information Processing Standard (FIPS) 140-3 and Common Criteria (CC) part 3 have added special requirements addressing physical non-invasive security. However, these evaluation standards lack of quantitative metrics to explicitly guide the design and measurement. This paper proposes practice-oriented quantitative evaluation metrics, in which the distinguishability between the key predictions is measured under statistical significance tests. Significant distinguishability between the most possible two key candidates suggests high success rates of the right key prediction, thus indicates a low security degree. The quantitative evaluation results provide high accountability of security performance. The accordance with FIPS 140-3 makes the proposed evaluation metrics a valuable complement to these widely adopted standards. Case studies on various smart cards demonstrate that the proposed evaluation metrics are accurate and feasible.
1
Introduction
Pervasive Computing is an emerging technology that harmonizes numerous networked devices at all scales throughout everyday life. Cryptographic modules are widely used in pervasive applications to provide security services such as confidentiality, integrity, and authentication. Modern cryptography algorithms are usually used to provide security to cryptographic modules, and are extremely robust against traditional black-box cryptanalysis attacks, such as brute force and factoring. Intelligent adversaries turn to focus their efforts on more subtle and complex attacks: physical non-invasive attacks, which exploit the correlations between the physical leakage (timing, power consumption, electromagnetic emission etc) information of the target cryptographic module and the internally used secret key. Since this correlation can be exploited with relatively cheap equipment, such as an oscilloscope and a few electromagnetic sensors, physical non-invasive attacks pose a serious threat to cryptographic modules. So far, physical non-invasive attacks have successfully broken the hardware or software implementations of many cryptographic systems including block ciphers P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 60–75, 2010. c IFIP International Federation for Information Processing 2010
Evaluation Metrics of Physical Non-invasive Security
61
(such as DES, AES, Camellia, IDEA etc), stream ciphers (such as RC4, RC6, A5/1, SOBER-t32 etc), public key ciphers (such as RSA, ElGamal, ECC, XTR etc), and also the implementations of signature schemes, the MAC schemes etc [1]. Enormous research efforts have been devoted to countermeasures against physical non-invasive attacks. However, the effectiveness of these countermeasures was generally evaluated qualitatively and just contained case studies showing that the proposed countermeasures really increased the number of samples, compared to the version without any countermeasures. There have only been a few attempts to quantitatively evaluate the physical non-invasive security. An example is paper [2], which defines the notion of physical computer that is the combination of an abstract computer (i.e. a Turing machine) and a leakage function. Another example is paper [3], which takes information theoretic conditional entropy into account. However, the models in [2,3] are too general to be applied to specific practice. An open question is to meaningfully restrict the models to realistic adversaries or evaluators. Paper [4] brought forward a tentative quantitative approach to evaluate the countermeasures by estimating the needed number of samples. The number of samples was deduced from signal-to-noise ratio (SNR). However, noise is hard to measure separately from the side-channel information on real products. Thus the approach in [4] is of limited use within estimation through simulation in stead of actual evaluation. Some guiding standards and good experiments of security metrics exist, such as FIPS 140-32007FIPS [5] and Common Criteria (CC) [6]. The CC has seven levels of assurance: EAL1: Functionally Tested; EAL2: Structurally Tested; EAL3: Methodically Tested and Checked; EAL4: Methodically designed, Tested, and Revised; EAL5: Semi-formally Designed and Tested; EAL6: Semi-formally Verified Design and Tested; and EAL7: Formally Verified Design and Tested. Nevertheless, the level of trust of various methodologies is a qualitative indicator by nature. There are no mathematical formulas to be applied to obtain the level of trust as a value of such an indicator [7]. The Federal Information Processing Standard FIPS 140-3 [5,8] specifies five increasing levels of security requirements, including the requirements on physical non-invasive security, as shown in Fig. 1. Security Level 1 requires minimum physical protection. Level 2 requires the addition of tamper-evident mechanisms such as a seal or enclosure. Level 3 specifies stronger detection and response mechanisms, and requires mechanisms against timing analysis attacks. Level 4 requires highly rigorous design processes and mechanisms against simple power analysis (SPA) and differential power analysis (DPA) attacks. Finally, Level 5 mandates mechanisms with environmental failure protection and electromagnetic emission analysis (EMA) attack countermeasures. FIPS 140-3 superseded FIPS 140-2 with emphasis on physical non-invasive security. However, there is still lack of quantifiable metrics to explicitly guide the design and evaluation of cryptographic modules.
62
H. Li et al.
Level 5
against electromagnetic analysis attacks
Level 4
against power analysis attacks
Level 3
against timing analysis attacks
Level 2
tamper-evident mechanisms
Level 1
Addressing physical non-invasive security
minimum physical protection
Fig. 1. Physical non-invasive security addressed by FIPS 140-3
In this paper, we for the first time, propose practice-oriented evaluation metrics to assess the physical non-invasive security. We classify the cryptographic modules into three levels, in accordance with the widely adopted FIPS 140-3 standard. In each level, the distinguishability between the key predictions is assessed under significance test. For FIPS 140-3 Level 3 timing analysis security, and Level 4 SPA security, the shape similarity of timing\power patterns at processing binary bits “0” or “1”) are assessed. While for DPA security, the power magnitude confusion is measured. For FIPS 140-3 Level 5, the electromagnetic emission patterns are assessed, where simple electromagnetic analysis (SEMA) security and differential electromagnetic analysis (DEMA) security are assessed similarly as SPA and DPA respectively.
2
Understanding Physical Non-invasive Attacks
Non-invasive attacks refer to attacks that exploit the implementation of target devices and identify properties of the implementation without physically damaging the target devices. These attacks can be performed relatively quickly and easily, while leaving no evidence of tampering, hence they are of particular concern to the security field. There are many forms of non-invasive attacks such as timing attacks, fault induction techniques, power and electromagnetic analysis based attacks, and so on. The following sections provide a brief introduction. 2.1
Timing Analysis
Timing Analysis attacks rely on precisely measuring the time at performing specific mathematical operations associated with a cryptographic algorithm or process. The collected timing information (often via power consumption) is analyzed to determine the relationship between the inputs and the cryptographic
Evaluation Metrics of Physical Non-invasive Security
63
keys used by the underlying algorithms or processes. The analysis of the relationship may be used to exploit the timing measurements to reveal the cryptographic key [9]. Making all computations take exactly the same amount of time would eliminate the attack, but few programs operate in exactly constant time. Writing constant-time code (particularly in high-level languages) can be difficult [8]. The effectiveness of the time analysis security should be evaluated with quantitative metrics. 2.2
Power Analysis
Attacks based on the analysis of power consumption can be divided into two general categories, Simple Power Analysis (SPA) and Differential Power Analysis (DPA). SPA involves a direct (primarily visual) analysis of electrical power consumption patterns and/or timings derived from the execution of individual instructions carried out by a cryptographic module during a cryptographic process. The patterns are obtained through monitoring the variations in electrical power consumption for the purpose of revealing the features and implementations of cryptographic algorithms and subsequently values of cryptographic keys [9]. SPA and timing analysis intersects when timing information leaked via power consumption is examined. SPA also involves the situations where power consumption samples of various operations have constant time but different amplitude patterns. DPA utilizes statistical techniques to analyze the variations of the electrical power consumption of a cryptographic module. Since SPA and DPA attacks exploit more advanced analysis techniques than timing analysis, power analysis security is often regarded as a higher level requirement in design and measurement of cryptographic modules. Countermeasures against power analysis attacks attempt to keep operationindependent and data-independent in terms of power consumption, e.g., through software, by removing conditional branches [10] and/or adding random mask [11] etc. The countermeasures are also viable through hardware, by adding random delay or exploit balanced logic styles [12,13] etc. The effectiveness of these countermeasures varies with realistic implementations. Quantifiable metrics are demanded in terms of security evaluation. 2.3
Electromagnetic Analysis
The cryptographic module under attack emits different amounts of electromagnetic (EM) emission depending on the instructions and data being executed. EM energy is closely correlated to power consumption but may be localized into a smaller area. If the global current is like a river, the EM emission is then produced by streams that flow into the river. EM emissions can be categorized into two types: direct emissions and modulated emissions [14,15]. Direct emissions are caused directly by current flow with sharp rising/falling edges. To measure direct emissions from a signal source isolated from interference from other signal sources, one uses tiny field probes
64
H. Li et al.
positioned very close to the signal source and special filters to minimize interference. Modulated emissions occur when a data signal modulates carrier signals which then generate EM emissions propagating into the space. A strong source of carrier signals are the harmonic-rich square-wave signals such as a clock, which may then be modulated in amplitude, phase or some other manner. The recovery of the data signals requires a receiver tuned to the carrier frequency with a corresponding demodulator. In some cases when the global power measurement becomes useless, local EM emission may convey important information [16]. Therefore, EM analysis security is regarded as a higher level than timing analysis and power analysis security. 2.4
Fault Induction
Fault induction attacks utilize external forces such as microwaves, temperature extremes, and voltage manipulation to cause processing errors in a predictable and useful way for attackers. External glitches inserted on the power or clock line are examples of non-invasive fault induction attacks. There are other fault induction attacks that cause some damage to the chip, falling into the category of invasive or semi-invasive attacks. Many chips nowadays are designed to resist fault induction attacks by having voltage/temperature fluctuation sensors, and the effectiveness is straightforward to evaluate. Thus fault induction security evaluation is not considered in this paper.
3
Quantitative Evaluation Metrics of Non-invasive Security
As discussed in previous sections, quantitative evaluation metrics for the physical non-invasive security are demanded to fill the gap between evaluation and attacks/countermeasures technology. We propose practice-oriented evaluation metrics in this section to quantitatively evaluate the physical non-invasive security. Fig.2 demonstrates the flow chart of the evaluation procedure. First, we classify the target cryptographic modules into three levels, in accordance with FIPS 140-3 standard. The higher level should cover evaluation contents of the lower level(s). For example, level 3 covers timing analysis security evaluation, and level 4 covers timing analysis and power analysis security evaluation, while level 5 will cover timing analysis, power analysis and EM analysis security evaluation. Second, we define the prediction function fprediction for the key guesses. Different cryptographic primitives correspond to different prediction functions, such as correlation coefficients, operation time mean values etc. The details to choose prediction functions are elaborated later on. After applying the prediction function on the target, we obtain the key guess vectorg = [g1 , g2 , ..., gS ], which denotes the key candidates sorted accordingly to their likelihood, where S denotes the key space. The highest possible candidate is ranked first.
Evaluation Metrics of Physical Non-invasive Security
65
1. Classify the evaluation target
FIPS140-3 Timing Analysis FIPS140-3 Timing analysis & Level 3 Level 4 (SPA\DPA)
analysis & FIPS140-3 timing (SPA\DPA) & Level 5 EMA
2. Define the prediction function fprediction
3. Sorted key candidates g=[g1, g2,...gS]
4. Define the i
th
order distinguishablity
5. Evaluate the distinguishablity with significance test
Fig. 2. Quantitative evaluation procedure for physical non-invasive security
Next, we define the ith order distinguishability Disti (g1 , g2 , ...gi+1 ) between the first i+1 key candidates. If not specified, a first order distinguishablity between the first two key candidates is assumed. Finally, the distinguishablity is obtained through statistical analysis, and has to be evaluated with significance test under a chosen confidence degree. Many significance tests exist and can be applied into our evaluation metrics, such as the distance of means, goodness of fit and sum of ranks [17,18]. For the sake of simplicity, we only demonstrate the distance of means tests in this paper. However, other custom procedures are also applicable. The evaluators can select specific form suitable to the experimental environment. 3.1
Assessing the Timing Analysis Security
The prediction functions in the proposed evaluation methodology are different according to the types of physical non-invasive leakage. In evaluating timing analysis security, we assess the distinguishability of physical non-invasive information between processing bit “0” and processing bit “1”. For timing information leakage vector of n experimental samples Tbit 0 = (tbit0 1 , tbit0 2 , ..., tbit0 n ) obtained when the device under test is processing binary bit “0”, and m experimental samples: Tbit 1 = (tbit1 1 , tbit1 2 , ..., tbit1 m ) obtained when the device is processing binary bit “1”, we examine the operation time vectors Tbit 0 and Tbit 1 . If n and m are sufficiently large, by virtue of the central limit theorem, the probability distribution of the two variables (tbit0 i , tbit1 i ), are approximately Gaussian. The mean values can be chosen as the prediction function for timing analysis security evaluation. The smaller value
66
H. Li et al.
corresponds to bit “0”, and the larger value for bit “1” due to the conditional branch operations. The distinguishability Dist(bit0, bit1) between the two mean values should be evaluated with significance test. The significance test of difference between the mean values can thus be calculated as equation (1) [18]. |μ0 − μ1 | ε= s0 2 s1 2 n − m
(1)
where μ0 , μ1 denote the expectations of tbit0 i , tbit1 i , s0 , s1 denote of the standard deviation of tbit0 i , tbit1 i ; n and m denote the number of samples of tbit0 i , tbit1 i respectively. The significance test evaluates the probability that the two samples have the same mean value. If the test result turns out that the difference is significantly larger than the critical value under a certain confidence degree α(normally chosen 5%, adjustable in given situation), we judge the two groups have significant different means with the degree of reliability at 1-α. The difference of means thus measures the distinguishability of timing information between processing bit “0” and processing bit “1”. If the difference between is larger than a critical value, the larger the difference, the easier to discern the key bit and therefore less secure of the cryptographic device. If the difference between is less than a critical value, then the difference is statistically insignificant. The less the difference is, the more difficult to discern the right guess, and therefore more secure of the cryptographic device under test. 3.2
Assessing the Power Analysis Security
The power analysis attacks are generally divided into SPA and DPA. SPA involves pattern recognitions and DPA involves statistic analysis. The evaluation metrics are accordingly classified. – SPA For n power samples when the device under test is processing binary bit “0”, P1...n,1...T |bit0 , as shown in Fig.3 (a), where T is the number of points that are recorded per trace, and n power samples when the device under test is processing binary bit “1”, P1...n,1...T |bit1 , as shown in Fig.3(b) we examine the shape similarity between the two vectors. There are numerous shape similarity models based on different feature factors, such as Euclidean distance, area, circularity, major axis orientation, and a set of algebraic moments [19]. Taking the Euclidean distance model as the example, we calculate the distances between ith power sample and the rest n-1 samples at processing bit “0”, as shown in the dash curves in Fig.3 (a). The distance between the ith power sample and the xth power sample di x|bit0 is calculated as in equation (2). di
x|bit0
=
T Pi,j|bit0 − Px,j|bit0 j=1
(2)
Evaluation Metrics of Physical Non-invasive Security
67
samples at processing bit “0” n
P1,1...T|bit0
P2,1...T|bit0
Pi,1...T|bit0
(a)
samples at processing bit “1” n
P1,1...T|bit1
P2,1...T|bit1
Pi,1...T|bit1
(b)
Fig. 3. Compare the similarity between the power patterns of processing bit “0” and bit “1”
If n is sufficiently large, the probability distribution of the distances are approximately Gaussian. The mean values can be chosen as the prediction function for timing analysis security evaluation. The mean value μbit0 of self-similarity for bit “0” is calculated as in equation (3). n T x=1 j=1 Pi,j|bit0 − Px,j|bit0 μbit0 = (3) n−1 Similarly we calculate the Euclidean distances between the n power samples at processing bit “0” and the n power samples at processing bit “1”, as shown in the dash-dot lines in Fig.3(b), and obtain the mean value μbit0−1 as shown in equation (4). n T x=1 j=1 Pi,j|bit0 − Px,j|bit1 μbit0−1 = (4) n Then, the distinguishability Dist(bit0, bit1) between the two mean values should be evaluated with significance test. If the test result turns out that the difference is significantly larger than the critical value under a certain confidence degree α(normally chosen 5%, adjustable in given situation), we judge the two groups have significant different means with the degree of reliability at 1- α. – DPA In the different power analysis attacks, for npower traces P1...n,1...T , the attacker hypothesizes a key and calculates the correlation factor ρW H [4] between power and intermediate data for each point at time ti :
68
H. Li et al.
ρW H =
E(W · H) − E(W ) · E(H) D(W )· D(H)
(5)
where W denotes power consumption, and H denotes Hamming weight, E() denotes the expectation, and D() denotes the variance. Thus he obtains correlation traces ρ1...T |i for each key guess keyi , where i is between 1 and the number of all possible keys kall . Correlation coefficient ρ1...T |i is chosen to be the prediction function. There is a highest ρti in each correlation trace, and the largest ρmax of all ρti indicates the correct key guess. The second highest ρ2nd max indicates the second possible key [20]. Effective countermeasures often make ρmax hard to discern, i.e., the highest two correlation factors ρmax and ρ2nd max out of two key guesses have similar values. Thus the distinguishability Dist(ρmax , ρ2nd max ) is assessed with significance test. We test the statistical significance of the difference between ρmax and ρ2nd max under a certain confidence degree (normally chosen 95%). Since the sampling distribution of correlation factor ρ may not be normal, and is better transformed through Fisher’s Z-Transformation given in equation (6). zρ =
1 1+ρ ln 2 1−ρ
(6)
The statistic zρ has an approximate normal distribution with variance zρ 2 = 1 n−3 , where n is the number of samples. The procedure to assess the statistical significance of the difference between ρmax and ρ2nd max is as following. The first step is to convert the highest correlation factors ρmax and ρ2nd max to zmax and z2nd max through equation (6). Then their normalized difference is calculated as shown in equation (7): zmax − z2nd max z = 1 1 n1 −3 + n2 −3
(7)
where n 1 and n 2 are the number of samples to get ρmax and ρ2nd max respectively. In our test, ρmax and ρ2nd max usually have the same sampling numbers, i.e., n1 = n2 . Once the difference between ρmax and ρ2nd max under Z-transformation has been obtained, their difference can be assessed with statistical significance under a given confidence degree. 3.3
Assessing the Electromagnetic Analysis Security
There are generally two types of emissions in EM analysis attacks: direct emissions and modulated emissions. As to each type of the emissions, the analysis procedure is further divided into Simple Electromagnetic Analysis (SEMA) and Differential Electromagnetic Analysis (DEMA), as shown in Fig.4. Their evaluation metrics are similar to those in SPA and DPA respectively.
Evaluation Metrics of Physical Non-invasive Security
EM analysis Security evlauation
{
direct emissions
{
modulated emissions
{
69
SEMA DEMA SEMA DEMA
Fig. 4. EM analysis security evaluation procedure
4
Experiment Results
To verify the proposed methodology on evaluating physical non-invasive security, we performed case studies on evaluation of timing analysis security and differential power analysis security. The experimental setup is shown in Fig.5. The setup for timing analysis via power consumption is the same as that of power analysis. Electromagnetic analysis set up is also similar except the oscilloscope will collect emission through an EM probe placed near the device rather than through the resistor. The experiment procedure is as follows: First, a PC generates random plain texts and instructs the cryptographic device under test to start cryptographic operations through the PC/Device interface. Second, the PC/Device interface, which contains a hardware trigger, will send a trigger signal to instruct a digital oscilloscope to collect the power consumption (or Electromagnetic emission) traces of the cryptographic device during the encryption operation. Third, the PC receives the sample traces from the oscilloscope along with the plain texts for each encryption operation. Finally the PC performs evaluation with the proposed quantitative metrics. Timing analysis attacks have been demonstrated to be very powerful against most straightforward implementations of public key ciphers. The modular exponentiation in RSA-type ciphers and scalar multiplication in Elliptic Curve Cryptosystems (ECC)-type ciphers are especially prone to timing analysis attacks. We perform experiments on ECC implemented cryptographic devices to illustrate the accuracy and feasibility of the proposed evaluation metrics. An elliptic curve is a set of points ( x, y) satisfying a bivariate cubic equation over a finite field F [10]. The operation of adding a point P to itself k times is called scalar multiplication by k and denoted as kP . Scalar multiplication is the basic key-involved operation for ECC, thus the main target in side-channel attacks. The most straightforward implementation of scalar multiplication is the binary method [10] based on the binary expansion of k = (kn−1 , ...k1 , k0 )2 where n−1 is the most significant bit of k. Table 1 illustrates the operation of the scalar multiplication with the binary method.
70
H. Li et al. Digital
PC
oscilloscope
Vcc
Vss
I/O
PC/Device interface
Reset
Clock
Resistor
Cryptographic device
Fig. 5. Power analysis setup Table 1. Scalar Multiplication – Binary Method [10] Input: k = (k n−1 , . . . , k 1 , k 0 ) 2 , P ∈E (F p ) (k = 1). Output: kP. 1. Q = P 2. For i from n−2 to 0 do 2.1 Q = 2 Q 2.2 If ki =1 then Q = Q + P 3. Return ( Q)
n−1
Notice that the conditional branches containing a point addition (Q + P ) only happen when a bit representation of k is “1”. If the sequence of field operations of point addition (Q+P ) has a different operation time than that of point doubling (2Q), the key bit can be easily deduced through timing analysis attacks. Thus a common group of countermeasures is to make the addition and the doubling operations indistinguishable, either by means of inserting dummy instructions or operations [21], or by unifying the addition formulae [22,23]. In our experiments, the devices under test are two smartcards running the public key cryptography ECC. Both cards are 8-bit microprocessors. One card (called device A) has been deployed with the most basic binary algorithm. Another card (called device B) has been deployed with dummy instructions insertion as the security enhancement. For each card, we collected 300 power traces when the device was running the point doubling and point addition. 4.1
Evaluation of Timing Analysis Security of Device A
Fig.6 demonstrates the power consumption patterns for device A. It is clearly shown that the operation of point addition is distinct from that of point doubling.
Evaluation Metrics of Physical Non-invasive Security
71
2
1
) v (
3.25 ms
3.68 ms
Doubling
Addition
0
e g -1 a t l o V
-2
-3
-4 0
0.002
0.004
0.006
Time (second)
0.008
0.01
Fig. 6. Distinguishable power trace of doubling and addition on device A
The operations of point doubling lasts 3.25 ms, and the operations of addition lasts 3.68 ms, noticeably longer than doubling. Statistical experiment results are demonstrated in Fig.7. The mean value of operation time in 300 runs is chosen to be the prediction function. Fig.7 (a) shows the distribution of 300 operation time of point additions, and the superimposed red curves indicate the normal distribution fitting. The mean value is μA = 0.0036, and standard deviation is sA = 1.27e−4 . Fig.7 (b) shows the distribution of 300 operation time of point doublings, with mean value μD = 0.0032, and standard deviation sD = 8.47e−5 . The normalized difference of mean between μA and μD is 45.6 according to equation (8), which is the final quantitative evaluation result. The result is much larger than the critical value 1.96, turning down the hypothesis that the two mean values are same. In practice, device A is vulnerable against timing analysis (as well as simple power analysis). The secret key bits “0101” can be easily read out, where “D” indicates a point doubling operation and “A” indicating a point addition. Whenever the “A” appears, key bit “1” is processed. We continue to evaluate device B with deployment of the binary balanced method through dummy operation insertion. Fig.8 demonstrates the power consumption patterns of point addition and point doubling for device B. The two power patterns are almost indistinguishable. The operation of point doubling lasts 4.83 ms, and the operation of addition 4.86 ms. 4.2
Evaluation of Timing Analysis Security of Device B
Fig.9 demonstrates the experiment results of distribution of operation time when the device B is processing point additions and point doublings. Fig.9 (a) shows the distribution of the operation time of processing point additions, with mean
H. Li et al.
Frequency
72
40 20
Frequency
0 2.8
3 3.2 3.4 3.6 3.8 4 4.2 (a) Operation Time of Addition (second) x 10−3
40 20 0 2.8
3 3.2 3.4 3.6 3.8 4 4.2 (b) Operation Time of Doubling (second) x 10−3
Fig. 7. The operation time distributions of device A at processing point additions and point doublings
Fig. 8. Indistinguishable power trace of doubling and addition on device B
value μA = 0.00479, and standard deviation sA = 1.56e−5. Fig.9 (b) shows the distribution of the operation time of processing point doublings with mean value μD = 0.00477, and standard deviation sD = 1.08e−5. The normalized difference of mean between μA and μD is calculated as 1.62, which is the final quantitative evaluation result. The normalized difference is less than the critical value, indicating the difference between point additions and doublings is statistically insignificant. The experiment result on device B conforms to the fact that device B is secure against timing analysis attacks.
Evaluation Metrics of Physical Non-invasive Security
73
Fig. 9. The operation time distributions of device D at processing point additions and point doublings
Experiment of evaluating timing analysis security verifies that the security of device A can be easily compromised in timing analysis. The normalized difference of mean between μA and μD is 45.6, demonstrating noticeable difference. While device B has much better security, in that the normalized difference of mean between μA and μD is indifferent statistically. The evaluation results conform to the fact and provide quantitative assurance. The devices are assessed back to back, without the necessity of an extra reference card. Elimination of requirement of any references makes the evaluations applicable in objective assessment of various devices by independent designers or evaluators. The accordance with FIPS 140-3 makes the evaluation metrics a valuable complement to these widely adopted standards.
5
Conclusion
Physical non-invasive security has become crucial to pervasive computing. However, there is a noticeable gap between the attacks/countermeasure and the evaluation technology. The existing evaluation certifications and standards are usually qualitative and lack of practice-oriented guidance. This paper, for the first time, presents a generic evaluation methodology to quantitatively evaluate physical non-invasive security in accordance with FIPS 140-3 standards. Effective quantitative evaluation metrics are further proposed, in which the distinguishability between the key predictions is measured under statistical significance tests. The quantitative evaluation results provide high accountability of security performance and are applicable in independent evaluations. Case studies on various smart cards demonstrate that the proposed evaluation metrics are highly feasible.
74
H. Li et al.
Acknowledgement This work was supported by the National Natural Science Foundation of China (Grant No. 60901052), and the Basic Research Project of Shenzhen (Grant No. JC200903160412A).
References 1. Zhou, Y., Feng, D.: Side-channel attacks: Ten years after its publication and the impact on cryptographic module security testing. In: Information Security Seminar (2006) 2. Micali, S., Reyzin, L.: Physically observable cryptography. In: Naor, M. (ed.) TCC 2004. LNCS, vol. 2951, pp. 278–296. Springer, Heidelberg (2004) 3. Standaert, F., Malkin, T., Yung, M.: A unified framework for the analysis of sidechannel key recovery attacks. Cryptology ePrint Archive, Report 2006/139 (2008) 4. Mangard, S.: Hardware countermeasures against DPA - A statistical analysis of their effectiveness. In: Proceedings of the RSA Conference (2004) 5. Security requirements for cryptographic modules, FIPS PUB 140-3, draft by National Institute of Standards and Technology (2007) 6. Common Criteria for information technology security evaluation, Part III: Security assurance requirements by National Institute of Standards and Technology (1999) 7. Wang, A.: Information security models and metrics. In: Proceedings of the 43rd ACM annual Southeast regional conference (2005) 8. Ravi, S., Raghunathan, A., Kocher, P., Hattangady, S.: Security in embedded systems: Design challenges. ACM Transactions on Embedded Computing Systems 3(3), 461 (2004) 9. Security requirements for cryptographic modules, FIPS PUB 140-2 by National Institute of Standards and Technology (2001) 10. Coron, J.: Resistance against differential power analysis for elliptic curve cryptosystems. In: Ko¸c, C ¸ .K., Paar, C. (eds.) CHES 1999. LNCS, vol. 1717, pp. 292–302. Springer, Heidelberg (1999) 11. Hasan, M.: Power analysis attacks and algorithmic approaches to their countermeasures for koblitz curve cryptosystems. IEEE Transactions on Computers 50, 1071–1083 (2001) 12. Tiri, K., Akmal, M., Verbauwhede, I.: A dynamic and differential cmos logic with signal independent power consumption to withstand differential power analysis on smart cards. In: IEEE 28th European Solid-state Circuit Conference (ESSCIRC) (2002) 13. Moore, S., Anderson, R., Cunningham, P., Mullins, R., Taylor, G.: Improving smart card security using self-timed circuits. In: 8th IEEE International Symposium on Asynchronous Circuits and Systems (Async). IEEE Computer Society Press, Los Alamitos (2002) 14. Agrawal, D., Archambeault, B., Rao, J., Rohatgi, P.: The em side-channel(s). In: Kaliski Jr., B.S., Ko¸c, C ¸ .K., Paar, C. (eds.) CHES 2002. LNCS, vol. 2523, pp. 29–45. Springer, Heidelberg (2003) 15. Li, H., Markettos, T., Moore., S.: Security evaluation against electromagnetic analysis at design time. In: Rao, J.R., Sunar, B. (eds.) CHES 2005. LNCS, vol. 3659, pp. 280–292. Springer, Heidelberg (2005)
Evaluation Metrics of Physical Non-invasive Security
75
16. Gandolfi, K., Mourtel, C., Olivier, F.: Electromagnetic analysis: Concrete results. In: Ko¸c, C ¸ .K., Naccache, D., Paar, C. (eds.) CHES 2001. LNCS, vol. 2162, pp. 251–261. Springer, Heidelberg (2001) 17. Coron, J.S., Kocher, P., Naccache., D.: Statistics and secret leakage. In: Frankel, Y. (ed.) FC 2000. LNCS, vol. 1962, pp. 157–173. Springer, Heidelberg (2001) 18. Miller, I., Freund, J., Johnson, R.: Probability and statistics for engineers. Prentice Hall, Englewood Cliffs (1990) 19. Berretti, S., Bimbo, A.D., Pala, P.: Retrieval by shape similarity with perceptual distance and effective indexing. IEEE Transactions on Multimedia 2(4), 225–239 (2000) 20. Li, H., Chen, T., Wu, K., Yu, F.: Quantitative evaluation of side-channel security. In: Asia-Pacific Conference on Information Processing (APCIP) (2009) 21. Chevallier-Mames, B., Ciet, M., Joye, M.: Low-cost solutions for preventing simple side-channel analysis: Side-channel atomicity. IEEE Transactions on Computers 53(6), 760–768 (2004) 22. Brier, E., Joye, M.: Weierstrass elliptic curves and side-channel attacks. In: Naccache, D., Paillier, P. (eds.) PKC 2002. LNCS, vol. 2274, p. 335. Springer, Heidelberg (2002) 23. Brier, E., Dechene, I., Joye., M.: Unified addition formulae for elliptic curve cryptosystems. In: Embedded Cryptographic Hardware: Methodologies and Architectures. Nova Science Publishers, Bombay (2004)
Trust in Peer-to-Peer Content Distribution Protocols Nicolai Kuntze, Carsten Rudolph, and Andreas Fuchs Fraunhofer Institute for Secure Information Technology (SIT) Rheinstrasse 75, 64295 Darmstadt, Germany {nicolai.kuntze,carsten.rudolph,andreas.fuchs}@sit.fraunhofer.de
Abstract. The distribution of virtual goods like multimedia data relies on the trustworthiness of the distribution system. Recent concepts for the distribution based on peer to peer networks like BitTorrent require new approaches to establish the needed level of trust in the overall functionality of the system. This paper explores the integration of hardware based trust concepts from the domain of Trusted Computing in the well know BitTorrent protocol suite.
1
Introduction
The commercial distribution of virtual goods in the Internet has relied on a client server model for the last years. A central entity provides the goods and clients just receive the content. Various systems like the well known iTunes are based on this paradigm. Aside this traditional approach of service delivery distributed solutions arose like distributed caching, Content Distribution Networks (CDNs) [7], and more recently peer-to-peer (P2P) networks as for example BitTorrent [14]. However, the (legal) use of these more efficient distribution protocols has so far been mostly applied to freely available data, like open source software. Nevertheless, there are good reasons motivating the use of efficient peer-to-peer distribution protocols also for commercial applications. First industrial applications based on the BitTorrent protocol were already available as for example BitTorrent Inc. rental service and Joost [3]. As BitTorrent Inc. used the standard protocol suite but used a DRM (Microsoft), Joost used a close client software together with secure coding and other additional obfuscation technologies. Today’s cost structure of the infrastructure operated by Internet Service Providers (ISPs) is not optimal for traditional client server distribution models. Obviously, the bandwidth on the side of the server, i.e. on the side of the backbone infrastructure is heavily used, while highly ex-pensive as its utilization is already high. On the other side it is recognized that the part of the infrastructure physically near to the end user, sometimes referred as last mile, often has unused bandwidth and also disk space and computing power. Therefore it is desirable from the point of view of the ISPs to push traffic associated with the content distribution to a certain extend into this part of the infrastructure and P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 76–89, 2010. c IFIP International Federation for Information Processing 2010
Trust in Peer-to-Peer Content Distribution Protocols
77
also to reduce the traffic between the peers. This results in distribution networks based on nodes located at the edges of the ISP networks, e.g. situated in the households of the end users. Such a network design allows for optimized bandwidth utilization in the core network by applying optimized P2P protocols that take the physical configuration of the ISP network into account and offers proper caching and data propagation methods. Additionally costs for expensive central server systems can be reduced as the complexity of these systems is diminished due to the abilities inherent to a P2P network like redundancy and load balancing. Also of interest is an improved Quality of Experience (QoE) considering a video on demand (VoD) use case. There, the network is able to store the data expected to be viewed on the device of the end user or in his neighborhood. Such functionality is based on certain consumption data known to and analyzed by the overall system operated by the ISP or by the application provider. However, existing peer-to-peer distribution protocols currently don’t have security build in. Thus, deployment in commercial applications is not straightforward. As the ISP is not the owner of the virtual goods in most of the cases his aim is to provide an interesting platform for the actual owners of the content and to allow each separate Content Provider to offer and protect their content according to their needs. It is important to see here that the goods offered may be very different in their needs as e.g. an online game has different requirements then a VoD service. Therefore different (concurrent) offerings are hosted in the same node at the same time. Sharing of one environment between different customers is already a well known business case like Web based storage services, Web Email, or resizable computing capacity as offered e.g. by Amazon. The EU research project Nanodatacenters (NaDa) develops a platform that provides a basic set of functionalities to establish a trustworthy environment at the side of the user households that can be used by the Content Providers to offer their goods. One part of this system is the development of secure and trustworthy peer to peer protocols. This paper presents a concept for the establishment of a trustworthy P2P system fit for the presented operation model exemplified as a protocol extension of the well known BitTorrent file sharing protocol. In the context of ISP based operation BitTorrent provides the benefit of the tracker based operation as here the operator has some impact on the discovery of the respective data sources. The BitTorrent protocol [4] distributes data over a large number of nodes of a P2P-network. A so-called tracker is then used to locate nodes that provide requested files. A meta file, so called torrent file, provided by the initial data provider contains initial data on the content, like size in terms of chunks and hash values. BitTorrent distinguishes between the meta file distribution, tracker protocol for providing meta information to peers, and the peer wire protocol for transfer of the actual content. Using the given data from the meta data file the tracker is then contacted using the tracker protocol. After receiving the list of nodes, some of these nodes are contacted using the peer wire protocol and
78
N. Kuntze, C. Rudolph, and A. Fuchs
requesting certain pieces of data. All nodes downloading and uploading parts of the same content are called a swarm. By controlling the node lists provided by the tracker to the requesting nodes the ISP can steer the traffic and avoid inter e.g. ISP traffic [5] but also manage the usage of his backbone infrastructure. BitTorrent is also a well known factor to the ISP infrastructure. It is essential to note that each node participating in a BitTorrent swarm first was connected to a tracker and keeps the connection to the tracker alive throughout operation. BitTorrent initially started as a centralised tracker protocol providing exact one tracker for each torrent. Due to various reasons the protocol was improved and a distributed tracker approach was introduced using Kademlia [12] as the underlying routing approach. Such an, also distributed, architecture can also be used to establish the management of the swarm. Each node registers itself to at least one tracker who also serves as a distribution point for network wide management messages. Through this network each node can be addresses and also additional support protocols for e.g. routing of messages in an ISP friendly [10] way. This approach only relies on the tracker protocol. The rest of the paper is organised as follows. In Section 2 a security analysis of the BitTorrent protocol in the NaDa use case is presented. Section 3 revises Trusted Computing as it is used for the security enhanced protocol. Section 4 introduces briefly the notation that is used to present the enhanced protocol in Section 5. After the protocol presentation a short security evaluation is presented in section 6. The paper concludes in Section 7.
2
Security Analysis
BitTorrent currently totally depends on the honesty of peers. As there is no security build in it does not come as a surprise that a variety of attacks is possible. Attacks include those presented in [16] for peer to peer protocols in general, attacks on the Distributed Hash Tables (DHT) based Kademlia routing scheme [1]or attacks on DHT itself [11] where the insertion of bogus data chunks into distributed data can also severely disrupt data distribution in BitTorrentstyle networks. Most of these attacks are not very relevant for the distribution of free content. However, if BitTorrent is to be used for the distribution of commercial content attacks can result in financial loss, degradation of quality of service or violation of privacy. In this paper we concentrate on one requirement mainly relevant for the end-user and one for the ISP. The first is concerned with the quality of service, while the second focuses on the protection of data distributed vie the network. In addition, certain aspects of information governance are also to be addresses by protecting the content against eavesdropping and the privacy and secrecy of the end user related requests. Several other important requirements exist. Those include privacy requirements like the prevention of tracking of end-user behaviour, confidentiality of network parameters, accounting, etc. These requirements are not in the focus of this paper.
Trust in Peer-to-Peer Content Distribution Protocols
79
In today’s systems for multimedia distribution these aspects are addressed by a tight coupling of the data to the node by encrypting the content especially for one particular node. The node stores one key known to the operator in the multimedia decoder hardware. This scheme does not allow for content redistribution. A trusted BitTorrent requires a more sophisticated approach. First, all nodes that form the CDN have to be identified to ensure that data cannot be introduced into the network from unknown sources and that requests can always be associated with a registered user. However, identification is not sufficient. Nodes also need to establish trust into the correct behaviour of peers in order to prevent manipulated nodes to attack the network. It has to be prevented that malicious nodes inject false data into the DHT tables or centralised tracker. Furthermore, for the distribution to work peers have to make their own resources available. thus, free-riding on the peer to peer network by suppression of re-sharing needs to be prevented.
3
Trusted Computing Essentials
Trusted Computing technology as defined by the Trusted Computing Group [13] is a technology implementing consistently behaving computer systems. This consistent behavior is enforced by providing methods for reliably checking a system’s integrity and identifying anomalous and/or unwanted characteristics. These methods depict a trusted system’s base of trust and thus are implemented in hardware, as it is less susceptible for attacks than software pendants. To successfully realize stringently reliable modules, several cryptographic mechanisms are implemented on a hardware chip, namely Trusted Platform Module (TPM). This chip incorporates strong asymmetric key cryptography, cryptographic hash functions and a random number generator that is capable of producing true random numbers instead of pseudo random ones. Additionally each trusted system is equipped with a unique key pair whose private key is securely and irrevocably stored inside the chip. The chip itself is the only entity to read and use this key for e.g. signing or encryption. This concept builds a basement for approving and establishing system integrity since it allows to truly trustworthy let a trusted system sign data and to securely encrypt data for one specific system. This is commonly used to measure system integrity and to ensure a system is and remains in a predictable and trustworthy state that produces only accurate results. 3.1
Trust for Measurement
The key concept of Trusted Computing is the establishment and extension of trust from an initially trusted security anchor up to other components of a system while boot-up. Each component loaded while booting up the system is measured before execution by computing a SHA-1 digest value of it. The first component of this cycle acts as security anchor and has to be initially trusted, since it’s integrity cannot be measured. This anchor is called Core Root of Trust
80
N. Kuntze, C. Rudolph, and A. Fuchs
for Measurement (CRTM) and is implemented as BIOS extension to be executed before any other BIOS code. Thus, the CRTM can measure the BIOS and the platform’s firmware. Each subsequent component involved in the boot-up process thereupon measures its successive component. Each measurement is stored in form of hash-chains in Platform Configuration Registers (PCRs) on the TPM. These hash chains in stored in PCRs allow to report the development of the system since the start of the CRTM. At system start, each PCR is initialized with zeros upon system start and then extended with measured data. Thus, other entities can analyze the current state of a remote system and the history since the last system start. This type of boot-up is called Trusted Boot Process. 3.2
Trust for Reporting
Another main concept of Trusted Computing is Remote Attestation, a process to prove trustworthiness of a Trusted Platform to an external party. To verify a platform’s integrity, a subset of PCRs together with log of all measurements since startup (Stored Measurement Log, SML) is sent to the external party signed by the TPM with a so called Attestation Identity Key (AIK). The PCR values can then be compared with re-calculated values using the chronological order of measured components logged in the SML. Measurements include all events related to the start of software during the boot phase of a system and later on as part of the operation of the running system. From the SML no insight on the performed actions of loaded applications can be gained as it only documents that a certain software was started. AIKs represent pseudonymous identities. Socalled privacy CAs certify that a particular AIK was generated in a TPM with a particular Endorsement Key (EK), the Root of Trust for Reporting (RTR) . The privacy CA also checks platform and EK certificates. The EK could identify a particular TPM and is therefore (for privacy reasons) not used for signing. 3.3
AIK Certification
Since each TPM is globally unique and thus identifiable and traceable, privacy issues arise when attesting a platform’s state to external parties using Remote Attestation. In order to avoid this security issue, TPM chips provide for pseudonymity by allowing to generate temporary keys for attestation. These Attestation Identity Keys (AIK) can be created at any time using the TPM MakeIdentity command and may be certified by a Trusted Third Party (TTP) to allow external parties to verify, that an AIK belongs to a TCG conform platform. AIKs can only be associated to their platform’s EK by the TTP thus providing the platform with pseudonymity towards other entities. To issue an AIK credential, the platform has to send the EK-signed public key of a generated AIK key pair together with several credentials declaring the platform’s TCG conformance to the TTP. After successful verification of the AIK and the platform’s credentials, a particular data structure is sent to the platform. This structure contains the AIK credential and can be securely loaded only into the TPM that signed the initial request using the TPM ActivateIdentity command.
Trust in Peer-to-Peer Content Distribution Protocols
4
81
Notation
In the description of the protocol steps the following notation is applied. It is differentiated between symmetric, shared keys which are denoted as K p,t describing a shared key K between the peers p and t and asymmetric keys that are p p for the public portion of a key K of peer p and Kpriv denoting denoted as Kpub the private part of key K from peer p. Within the protocol definition special data structures for AIK certificates, denoted as AIKCertp for a AIK certificate of peer p and Stored Measurement Lists, denoted as SM Lp for a SML of peer p, are used. On top of the data structures the following operations are performed. Ent cryption of data using symmetric or asymmetric keys denoted as enc{data}Spub , t stating that data data is encrypted with key Spub . Signatures are described t sig{data}Spriv accordingly. The calculation of shared keys using the DH scheme p p,t t is shown as K = Kpriv ◦ Kpub . The concept of quote signatures as they are introduced in Trusted Computing are denoted as quote{data, P CR0..n}AIK p , showing that data and a set of PCR values are signed by an AIK of peer p.
5
Enhanced Protocol
To meet the security requirements stated in the security discussion above it is required to introduce strong identities, the afore introduced concept of remote attestation to satisfy the requirements of behavioural authenticity, and confidentiality of data transferred between the involved nodes. These security aims are to be established respecting the special needs of the peer to peer use cases like video on demand. As presented before the BitTorrent protocol as the selected underlying protocol distinguishes the dispersion of the meta file to the nodes which is considered as an out of band operation, the tracker protocol, and the peer wire protocol. In the following, each of these three protocols is briefly revised and then extended using mechanisms from trusted computing. 5.1
Initial Setup and Meta File
Before the actual start of the protocol, each peer device has to have at least one valid AIK and corresponding certificates issued by a privacy CA. Keys and certificates can already be established during production or deployment. The AIK certificate states that a compliant TPM is installed on the respective device and that the privacy CA has checked EK and platform certificates. Furthermore, AIK certificates can also be used to provide additional information like that a particular TPM belongs to a specific network operator. Data to be accessed via the network is associated with a meta file. This file provides information on the initial list of trackers to be connected. In this context it is to be noted that the EK as the core identity of each TPM is assumed to be protected by the hardware itself and can not be changed
82
N. Kuntze, C. Rudolph, and A. Fuchs
Fig. 1. Meta file distribution
or revoked. Therefore the identity of the device can not be changed during its lifetime. As the node is owned by the ISP use cases involving a change of the owner are not in the focus of the underlying trust requirements. Further, the BitTorrent protocol distinguishes between centralised and distributed tracker by a differentiation in the meta file. In case of a distributed tracker for each tracker node credentials are included in form of public AIK and AIK certificate. Furthermore, each tracker needs to generate a key within it’s TPM and certify it using the AIK. Such a certificate expresses that the private part of the key can only be used within this particular TPM. In case of a central tracker we assume that this tracker is in the control of the network operator. In order to explain different variants of the protocol we assume such nodes to be trustworthy. Therefore, a reduced protocol is used without attestation of the tracker. However, the identity of the tracker is still relevant and therefore, a key t and its certificate is included in the meta file. This credential is used later Spub on in the tracker protocol and is assumed to be created and protected by the owner of the tracker. To provide means to verify the integrity of the file it is signed by the issuer. By this signature each node is able to verify that the meta file is unchanged since its creation by the issuer of the content. Therefore no entity including the involved servers can not alter the meta file. The meta file distribution scheme is depicted in Figure 1. The server playing the role of the file source is assumed to be known to all peers. 5.2
Tracker Protocol
Tracker collect information to locate nodes providing certain data. These requests include metrics from clients that help trackers to keep overall statistics about the torrent. The response of an tracker includes a peer list that helps a node to participate in the swarm. As discussed in Section 2, establishing trust between nodes within this phase of the BitTorrent interaction requires authentication and a proof on the authenticity
Trust in Peer-to-Peer Content Distribution Protocols
83
of the nodes behaviour, i.e. attestation of the state of the node. Furthermore, a symmetric session key is established between node and tracker. This symmetric key is rooted in the initial attestation session. Encrypted with this session key, the tracker provides a ticket to the node. This ticket is explained in detail in Section 5.3. Thus, mutual attestation (or attestation of the peer node in the case of a central tracker) establishes a trust relation between the overall network (represented by the tracker) and the node entering the network for the duration of the lifetime of the ticket. As explained above we propose two different extensions to the BitTorrent protocol, one with mutual attestation and a reduced version with a trusted central tracker. Figure 2 shows the protocol for the centralised case whereas Figure 3 shows the distributed approach. Both protocols have the same goal: a session shall be established that is rooted in the initial authentication and remote attestation between the nodes. At the end in each case a common symmetric key K t,p is established that is used to encrypt all following messages resp. their content. To create this common key the well know Diffie-Hellmann (DH) key exchange protocol is used [2] by transp t and Kpub between tracker and peer. To prevent mitting the public DH keys Kpub Man-In-The-Middle attacks both transmissions are either encrypted or signed. For both variants the protection of the request in terms of privacy and secrecy has to be evaluated. Based on the result of this evaluation the request has to be encrypted or not. We assume here that the request is security sensitive and therefore show how to establish the session with protection of the request. The centralised tracker approach as depicted in Figure 2 assumes that the tracker is operated under the direct control of the ISP or customer. Within the NaDa project, for example, all centralised services are operated in the protected perimeter of the respective operator. The identity of the tracker is bound to the t t t , Spriv and optionally a matching certificate. Spub and the certificate keypair Spub are provided in the signed meta file as shown above. In step one peer p transmits an encrypted request to the tracker t using the key that is provided by the meta file. The requested content or service is denoted as p as the public part of the DH key exchange protocol, request. Additionally Kpub the SML of p, and the AIK certificate of p are included to prepare key exchange and remote attestation. t then is able to compute a symmetric key K p,t (2). This can be done in parallel to the subsequent protocol execution. t for the DH key t answers in step three with a data package consisting of Kpub p t t exchange. Kpub is signed together with Kpub using Spriv to vouch for the integrity p we also grant for the freshness of the package in and origin. By injecting Kpub the view of the peer as the DH key is assumed to be freshly generated by the peer. It is to be noted that for simplification of key management the key pair t t , Spriv is used for encryption and signatures. However, different keys shall Spub be used if a crypto algorithm is used where this is problematic. t to show the freshness of Step four returns the TPM quote data using the Kpub the remote attestation data. As part of the platform specification the selection of the appropriate PCR value is fix. The quote needs to ensure that the DH keying
84
N. Kuntze, C. Rudolph, and A. Fuchs
Fig. 2. Authentication and attestation of the peer p in the case of a tracker t operated by the ISP or content provider p data Kpub was actually generated by the peer and not on any other device. Thus, we assume that this key is extended to a resettable PCR after the first step of the protocol. Note that usually only a small number of trackers is contacted at the same time and therefore this PCR extension does not induce efficiency problems. The tracker has now to decide based on the provided quote if the peer node can be assumed to be properly configured. In parallel, p can already compute K p,t (5). If the quote together with the produced SML results is accepted, t adds p to the list of active peers and returns (6) the result Data of the request encrypted by K p,t . Data also includes the ticket to be used in the subsequent peer wire protocol. The transfer of the SML is part of the first step as also the SML should be transferred encrypted and additional encryption overhead is to be prevented. The extension for the distributed protocol is shown in Figure 3. In this case mutual remote attestation allows for both communication partners to verify the identity and authenticate the behaviour. To reduce the latency of the protocol we reuse the DH keys again for Nonces to prove freshness as we assume that each communication partner has control over the freshness of their DH keying information. For efficiency generation of the DH key may be deferred to idle periods of the respective node. Step one is identical to step one of the centralised case except that a TPMgenerated key is used for encryption. As AIKs cannot be used directly to encrypt t also a second key and a cerdata the meta file has to provide aside the AIKpub tificate that states that this key generated by the TPM and cannot be migrated. t , and the by K p,t encrypted SML Step three transmits the TPM quote of t, Kpub and AIK credential of t. p returns his quote in step four. Again, both parts of the DH keying information must be bound to the platform, e.g. by extending them to resettable PCRs. After the first four steps both communication partners verify the received quotes and SML lists. If the requirements of t are satisfied t transmits the requested result and ticket (6) encrypted by K p,t . In steps (2) and (5) DH
Trust in Peer-to-Peer Content Distribution Protocols
85
Fig. 3. Mutual authentication and attestation between tracker t and peer p in the case of distributed tracker
operations to calculate the shared key take place. It is to be noted that step (2) can be executed in parallel so that it does not consumes additional time. The validation of the SML is non-trivial. It can use a data base for each suitable SML. More efficient is a scheme using a substitute in form of a credential issued by the ISP or a representative. Such a system state ticket states that a certain PCR value is compliant to the desired state as defined by the operating party. Therefore, in this case it is not required to transfer the SML for each attestation. 5.3
Peer Wire Protocol
The peer wire protocol (PWP) also requires the establishment of a trust relationship between the peers. Tickets established in the tracker protocol give evidence of the previous attestation by the tracker. Thus, trust establishment in the peer wire protocol can be reduced to secure authentication of both peers. Each node participating at the peer to peer network has at least established one connection to a tracker where attestation was performed. This process is described in the previous section. Tracker only provide data on nodes that were attested. The data transmitted in the tracker protocol is composed of the address of pB (e.g. IP and port), the AIK certificate of pB and the access ticket. This ticket is encrypted by the symmetric key negotiated between t and pB. It contains the AIK certificate of pA, the requested resource (e.g. the video requested), and the time of invalidation of the ticket. This scheme is similar to an existing proposal on TPM-based tickets [8,9]. pA is transmitted to pB. In step one of the enhanced PWP the ticket and Kpub Again, DH keying information shall provide freshness. pB answers (2) with his pB pB and a signature on his Kpub . For this we use the TPM quote command. Kpub pA Step three returns the signature on the Kpub also using the quote command.
86
N. Kuntze, C. Rudolph, and A. Fuchs
Fig. 4. Information flows between the entities of the trusted peer wire protocol
Note that the choice of PCR registers is irrelevant as the platform shall only be authenticated. The DH keys need to be bound to the particular peers. As several instances of the PWP probably occur in parallel, using resettable PCRs is not possible. The ticket identifies a particular AIK to be used for the TPM Quote. If this AIK is bound to the use within the PWP on the platform it cannot be used for quote commands invoked by other applications. This property of the application needs to be guaranteed in the state of the peer attested in the tracker protocol. After step three the signatures are verified and the symmetric key K pA,pB is computed on both sides (4). All further messages are then encrypted by this key (5). The enhanced PWP is shown in Figure 4. PWP handshake is completed by sending a sequence of data to the contacted peer that consists out of pstrlen, which string length of pstr, as a single raw byte, (ii) pstr, the string identifier of the protocol, (iii) eight reserved bytes, (iv) info hash, which is a 20-byte SHA1 hash of the info key in the metainfo file. This is the same info hash that is transmitted in tracker requests. Finally (v) a 20-byte string used as a unique ID for the client. This ID is later be used by the contacted host to give the connection a unique identifier. In the standard BitTorrent protocol the contacted client signals the acceptance of the connection by not closing the socket. It is not required that the contacted peer sends data to the requester during the handshake. To establish the trusted PWP additional data on the authenticity and a reply by the connected host is required. Therefore this different behaviour needs to be signaled to the other host. This can be done by setting a flag in the reserved eight bytes. The presented scheme is then added to this basic handshake. For protection of the established symmetric key, the platform uses the TPM to seal the symmetric key to the trustworthy state of the node. In case of a
Trust in Peer-to-Peer Content Distribution Protocols
87
reconnection between two nodes first the already established key is used. If the state of one node has changed e.g. due to a software update a new attestation is required and the symmetric key is replaced by a new one. For the case of a reconnection a special PWP variant is required. Between two nodes the key exchange is only performed once as long as the system state is assumed not to be changed. Such a change may happen due to software updates. Therefore, for performance considerations both nodes store the key together with the AIK resp. ID of the node. Later contacts between these nodes are initiated first with an PWP handshake that is extended by Nonce, that the contacted node has to return encrypted. If this fails, the presented protocol is executed. In case of distributed tracker it is to be considered that pA and pB are not necessarily connected to the same tracker. In this case different schemes are possible to solve the missing trust relation. Either t connects and attests each node that is known to t or t performs a search for the respective tracker where pB is connected to and receives an appropriate ticket.
6
Security Evaluation
The presented protocol provides a comprehensive solution for the challenge of establishing trust in the peer-to-peer protocol BitTorrent. The goal for this extension lies within the attestation of every peer participating in the file exchange, such that the QoS of the data delivery meets commercial requirements. Within the standard BitTorrent protocol, there are already mechanisms included, that counteract an attacker’s attempt to alter the data received at one peer from the others. This hash value of the file that resides in the torrentdescription file has been unaltered for the trusted BitTorrent. However the possibility to disrupt or degrade the QoS of BitTorrent through malicious behaviour of one of the networks nodes is prevented. The alliance of trustworthy peers is maintained by the tracker, that will require each new peer entering the network to not only authenticate itself reliably – through the strong association of a TPM’s key with a certain physical platform – but also to attest its current configuration. The tracker may therefore firstly enforce strong access control to the network of peers based on the utilized peer’s key, and secondly analyse the platform’s configuration with respect to the trustworthiness of the client. The tracker may therefore prohibit malicious peers to enter the network, that would disrupt or degrade the QoS through malicious data flooding to the rest of the network or even the analysis of the current data distribution within the network, increasing the overall network load, but requesting huge amount of or very expensive file transfers from other peers. The extension to the protocol between peer and tracker incorporates a standard Quote-Attestation of the TPM with an authenticated DH-KeyExchange. The major challenge here is the binding of the resulting DH-channel to the attested platform. In the case of trusted BitTorrent, this will be validated through an analysis of the SML at the trackers side. The certificates for the deployed software will guarantee for this. The second challenge is the enforcement of freshness
88
N. Kuntze, C. Rudolph, and A. Fuchs
within the DH run and subsequent protocol. For the trusted BitTorrent approach this is tackled through the use of fresh asymmetric key pairs on each run, where the public portion will be used as anti-replay nonce. Performance-wise the tracker can keep the same key parameter and therefore the creation of a new key can be performed within reasonable time. The trusted peer wire protocol uses the same primitives of DH and TPMQuote in order to establish trust among peers. Further it includes a Kerberoslike ticket through which the authorization of the requesting agent’s platform is granted. The suit of Kerberos authorization tickets is well evaluated and the time information included in the ticket will prevent any replay after provision time has ended. The binding of the ticket to a specific peer is being performed through the TPM-binding of the data to a specific platform, such that the peers software also cannot be replayed to several other peers. The propose protocol does provide a reasonable approach for increasing the QoS of a BitTorrent based file distribution. In case of high load at certain platforms, where more TPM-Attestation have to be performed than the TPM can provide, it is possible to include a more scalable solution [15]. Experience has shown that security protocols are error-prone and that a formal validation or verification of such protocols can reveal previously unknown attacks or increase assurance for secure protocols. Such a formal security validation would also be desirable for the trusted version of BitTorrent. However, existing approaches (e.g. from AVISPA) cannot be directly applied for several reasons. First, trusted BitTorrent aims at the establishment of trust relations between several parties and with respect to the status of the platforms involved. Such TPM-based properties cannot be directly described using the HLPSL of AVISPA. Furthermore, the protocol includes several relevant interfaces. Depending on the goals of the attacker, the interface between TPM and platform can be as relevant as the communication network between different platforms. Adequate attack scenarios have to be distinguished in order to validate the protocol in a realistic setting. Currently, more flexible specification and validation approaches based on the SH Verification Tool [6] are explored and extended on order to apply them to the protocols of trusted BitTorrent.
7
Conclusion
We presented an extension to the BitTorrent protocol that introduces strong identities and attestation of the state of communicating nodes. Through this extension to the protocol behaviour and in combination with trusted computing primitives malicious or manipulated nodes can be detected and suppressed from the peer to peer network. In the design of the extensions we considered aside the security requirements also possible optimisations w.r.t resource consumption. Further research will be concerned with modifications of the presented protocols to give precise measurements on the consumed additional resources. Based on this analysis modifications in the protocols will be evaluated with respect to their performance. Furthermore, a security evaluation using the SH Verification
Trust in Peer-to-Peer Content Distribution Protocols
89
Tool will be part of these steps to show which security requirements are fulfilled. This tool was already used to analyse parts of the TPM specification [6]. Based on the presented trusted BitTorrent we will evaluate possible application scenarios in the NaDa architecture. Hereby we focus on the establishment of trust relations and their use by virtualised environments running on a node.
References 1. Baumgart, I., Mies, S.: S/Kademlia: A practicable approach towards secure keybased routing. In: Proceedings of the International Workshop on Peer-to-Peer Networked Virtual Environments (2007) 2. Diffie, W., Hellman, M.: New directions in cryptography. IEEE Transactions on information Theory 22(6), 644–654 (1976) 3. Einhorn, M., Madison, N.: How Advertising and Peer-to-Peer are Transforming Digital Media and Copyright. Journal of the Copyright Society (2007) 4. Erman, D., Ilie, D., Popescu, A.: Bittorrent session characteristics and models. Traffic Engineering, Performance Evaluation Studies and Tools for Heterogeneous Networks 61(84), 61 5. Fang, W., Peterson, L.: Inter-AS traffic patterns and their implications. GlobecomNew York 3, 1859–1868 (1999) 6. Gurgens, S., Rudolph, C., Scheuermann, D., Atts, M., Plaga, R.: Security Evaluation of Scenarios Based on the TCG’s TPM Specification. In: Biskup, J., L´ opez, J. (eds.) ESORICS 2007. LNCS, vol. 4734, pp. 438–453. Springer, Heidelberg (2007) 7. Krishnamurthy, B., Wills, C., Zhang, Y.: On the use and performance of content distribution networks. In: Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement, pp. 169–182. ACM, New York (2001) 8. Kuntze, N., Leicher, A., Schmidt, A.: Implementation of a trusted ticket system. In: Proceedings of the IFIP Security 2009 (2009) 9. Kuntze, N., M¨ ahler, D., Schmidt, A.U.: Employing trusted computing for the forward pricing of pseudonyms in reputation systems. In: Axmedis 2006, Proceedings of the 2nd International Conference on Automated Production of Cross Media Content for Multi-Channel Distribution, Volume for Workshops, Industrial, and Application Sessions (2006) 10. Laoutaris, N., Rodriguez, P., Massoulie, L.: ECHOS: edge capacity hosting overlays of nano data centers (2008) 11. Liang, J., Naoumov, N., Ross, K.: The index poisoning attack in p2p file sharing systems. In: INFOCOM 2006. Proceedings of 25th IEEE International Conference on Computer Communications, pp. 1–12 (2006) 12. Maymounkov, P., Mazieres, D.: Kademlia: A peer-to-peer information system based on the xor metric. In: Druschel, P., Kaashoek, M.F., Rowstron, A. (eds.) IPTPS 2002. LNCS, vol. 2429, p. 2. Springer, Heidelberg (2002) 13. Mitchell, C., et al.: Trusted Computing, p. 1 (2005) 14. Pouwelse, J., Garbacki, P., Epema, D., Sips, H.: The bittorrent p2p file-sharing system: Measurements and analysis. In: Castro, M., van Renesse, R. (eds.) IPTPS 2005. LNCS, vol. 3640, pp. 205–216. Springer, Heidelberg (2005) 15. Stumpf, F., Fuchs, A., Katzenbeisser, S., Eckert, C.: Improving the scalability of platform attestation. In: Proceedings of the 3rd ACM workshop on Scalable trusted computing, pp. 1–10. ACM, New York (2008) 16. Wallach, D.: A survey of peer-to-peer security issues. LNCS, pp. 42–57. Springer, Heidelberg (2003)
Generic Constructions of Biometric Identity Based Encryption Systems Neyire Deniz Sarier Bonn-Aachen International Center for Information Technology Computer Security Group Dahlmannstr. 2, D-53113 Bonn Germany
[email protected] Abstract. In this paper, we present a novel framework for the generic construction of biometric Identity Based Encryption (IBE) schemes, which do not require bilinear pairings and result in more efficient schemes than existing fuzzy IBE systems implemented for biometric identities. Also, we analyze the security properties that are specific to biometric IBE namely anonymity and identity privacy. Considering these notions, we present generic constructions for biometric IBE and ID-KEM based on weakly secure anonymous IBE schemes, error correcting codes and generic conversion schemes. Finally, we describe concrete applications of our framework and compare them to the existing fuzzy IBE systems in terms of time complexity. Keywords: Biometric IBE, Generic Construction, IND-CCA, Anonymity, Error Correcting Codes.
1
Introduction
In Eurocrypt’04, Sahai and Waters proposed a new Identity Based Encryption (IBE) system called fuzzy IBE, which provides error tolerance property for IBE in order to use biometric attributes as the identity instead of an arbitrary string like an email address. This new system combines the advantages of IBE with using biometrics as an identity, where IBE avoids the need for an online Public Key Infrastructure (PKI), which is the most inefficient and costly part of public key encryption. The use of biometrics as the identity in the framework of IBE simplifies the process of key generation at the Private Key Generator (PKG). Since biometric information is unique, unforgettable and non-transferable, the user only needs to provide his biometrics at the PKG to obtain his secret key instead of presenting special documents and credentials to convince the PKG about his identity. Also, biometrics is attached to the user, hence the user does not need to remember any password, to use any public key or even an e-mail address since the public key of the user is always with him to be used for encryption during an ad hoc meeting. Finally, biometric data could be easily integrated with fuzzy IBE due to its error tolerance property, which is required for the noisy nature of biometrics. The main feature of fuzzy IBE is the construction of the P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 90–105, 2010. c IFIP International Federation for Information Processing 2010
Generic Constructions of Biometric IBE Systems
91
secret key based on the biometric data of the user which can decrypt a ciphertext encrypted with a slightly different measurement of the same biometrics. Specifically, fuzzy IBE allows for error tolerance in the decryption stage, where a ciphertext encrypted with the biometrics w could be decrypted by the receiver using the private key corresponding to the biometrics w , provided that w and w are within a certain distance of each other. Besides, fuzzy IBE could be applied in the context of Attribute-Based Encryption (ABE), where the sender encrypts data using a set of attributes such as {university, faculty, department} and the ciphertext could only be decrypted if the receiver has the secret key associated to all of these attributes or sufficient number of them. In current fuzzy IBE schemes, the private key components are generated by combining the values of a unique polynomial evaluated on each attribute with the master secret key. This way, different users, each having some portion of the secret keys associated to the attributes of a given ciphertext c cannot collude to decrypt c, which is defined as collusion resistance. The basic fuzzy IBE schemes guarantee a weak level of security for identity based setting i.e. Indistinguishability against Chosen Plaintext Attack (ID-IND-CPA), but they could be combined with well-known generic conversion systems to obtain a high level of security i.e. Indistinguishability against Chosen Ciphertext Attack (ID-IND-CCA). Besides, the biometrics is considered as public information, hence the compromise of the biometrics does not affect the security of the system. Thus, in existing systems, biometrics w of the receiver is sent together with the corresponding ciphertext, which could effect the privacy of the user’s actions negatively. 1.1
Related Work
The first fuzzy IBE scheme is described by Sahai and Waters in [18], where the size of the public parameters is linear in the number of the attributes of the system or the number of attributes (or features) of a user. More efficient fuzzy IBE [2,13], Attribute-Based Encryption (ABE) [17] and biometric IBE [19] schemes are achieved with short public parameter size by employing the Random Oracle Model (ROM). To achieve ID-IND-CCA security, these schemes could be combined with well known generic conversion schemes such as Fujisaki-Okamoto [12] or REACT [16]. The signature analogue of fuzzy IBE, i.e. fuzzy IBS is first defined in [24] and further improved in [20]. Similarly, a threshold Attribute Based Signature (t-ABS) scheme and its extension to threshold attribute based anonymous credential systems is presented in [21], where the authors also define the security notions of weak/full signer attribute privacy for t-ABS. The only work that considers privacy of biometric attributes in fuzzy IBE is the master thesis of [23], which adapts the Boneh-Franklin IBE scheme [4] to function as an error tolerant IBE scheme, where the IBE scheme in [4] is anonymous. Recently, other anonymous IBE schemes [5,1] for the standard IBE setting (i.e. non-biometric identities) are described, which do not require bilinear pairings and their security is based on the standard quadratic residuosity problem. Besides, these schemes encrypt a message bit by bit, thus they can be used to encrypt short session keys due to the large bandwidth consumption. To achieve ID-IND-CCA security,
92
N.D. Sarier
the schemes can implement the KEM/DEM construction of Bentahar et al. [3], which takes as input a weakly secure IBE scheme and a hash function to output an ID-IND-CCA secure KEM that is combined with an IND-CCA secure DEM. 1.2
Motivation and Contributions
Currently, the secrecy of biometric data is viewed with skepticism since it is very easy to obtain biological information such as fingerprint, iris or face data through fingerprint marking or using a camcorder. However, biometrics is a sensitive information, as in the case of biometric remote authentication, it should not be easy to obtain the biometric data by compromising the central server, where the biometrics of each user is often associated with his personal information. In particular, a user could use its biometrics on a number of applications such as identification, authentication, signing, etc. Thus, the secrecy of identitybiometrics relation should be maintained, which is defined as identity privacy [8,22]. Current fuzzy IBE and biometric IBE systems do not consider anonymity and privacy of user biometrics at the same time, hence, it is vital to describe an efficient and anonymous error-tolerant encryption system for biometric identities in order to avoid traceability of the user’s actions. Although the fuzzy IBE scheme of [23] provides anonymity, the scheme combines each biometric attribute with the identity (i.e. Name, e-mail address) of the user to avoid the collusion attacks. This approach is not only against identity privacy but also against the main principle of fuzzy IBE or biometric IBE, where the identity of the user should only consist of his biometric data. The contributions of this paper are twofold. First, we analyse the security properties of biometric IBE schemes and present a new method for preventing collusion attacks. Next, we present generic constructions for biometric IBE and ID-KEMs that provide either entropic security or ID-IND-CCA security depending on the primitives used, which do not require bilinear pairings. For this purpose, we combine fuzzy sketches, error correcting codes and/or modify well known generic conversion schemes to function in the error-tolerant setting. Also, we will describe concrete applications of our generic constructions using anonymous IBE schemes [5,1] that encrypt each message bit by bit and do not depend on bilinear pairings. To avoid collusion attacks and to guarantee the security notions that we present, the anonymous IBE schemes are modified according to our new method, thus, we achieve more efficient biometric IBE schemes compared to current fuzzy IBE systems implemented for biometric identities in the ROM.
2 2.1
Preliminaries and Definitions Fuzzy Identity Based Encryption
In [18,2], the generic fuzzy IBE scheme is defined as follows. – Setup(l): Given a security parameter l, the Private Key Generator (PKG) generates the master secret key ms and the public parameters params.
Generic Constructions of Biometric IBE Systems
93
– Key Generation(w, ms): Given a user’s identity w = (w1 , ..., wn ) and ms, the PKG returns the corresponding private key Dw . – Encrypt(w , m): A probabilistic algorithm that takes as input an identity w = (w1 , ..., wn ), params and a message m ∈ M , outputs the ciphertext U . – Decrypt(U, Dw ): A deterministic algorithm that given the private key Dw and a ciphertext U encrypted with w such that |w ∩ w | ≥ d, returns either m or ⊥. Here d denotes the error tolerance parameter of the scheme. The security of a biometric IBE scheme is defined using the following game between an adversary and a challenger. Experiment ID-IND-ATK(l, IBE, A=(A1 , A2 )) (params, ms) ←Setup(l) (s, w∗ , m0 , m1 ) ← AO 1 (params) with |m0 | = |m1 | R ∗ b ← {0, 1}, U ← Encrypt(w∗ , params, mb ) ∗ ∗ b ← AO 2 (w , U , params) If b = b return 1 else return 0 ID-IND-ATK The advantage of the attacker A is AdvA,IBE = |P r[b = b] − 12 |. Hence, a biometric IBE scheme is ID-IND-ATK secure if the advantage of A is negligible in the security parameter l. If ATK = CCA, then A has access to a decryption oracle in addition to the encryption and private key extraction oracles available to A when ATK = CPA.
2.2
Error Correcting Codes and Fuzzy Sketches
Let H = {0, 1}N = FN 2 be the Hamming space of length N ,where F2 = {0, 1}. An Error Correcting Code (ECC) over H is a subset C ⊂ H, where elements of C are called as codewords. An (N, S, d) binary linear error correcting code C is k a vector subspace of FN 2 . When C contains 2 codewords, then C is denoted as [N, k, t], where t is the correction capacity of C. The main idea of fuzzy sketches is given a public data PAR = c⊕b, one tries to correct the corrupted codeword PAR ⊕ b = c ⊕ (b ⊕ b ). If the Hamming distance disH (b,b’) is small, recovering c from PAR ⊕ b is possible [7]. An important requirement for such a scheme is that the value PAR should not reveal too much information about the biometric template b, which is obtained as described in section 2.4. 2.3
Robust Sketch and Robust Fuzzy Extractors
Since the correction is performed by combining the biometrics b with the public value PAR of the signer, the presence of an active adversary who maliciously alters the public string PAR leads an adversary even to obtain the secret b entirely depending on the utilized sketch or fuzzy extractor [6]. This attack can be avoided by using a robust fuzzy extractor, which is resilient to modification of the public value PAR [6]. The generic robust fuzzy sketch described in [6] replaces the value PAR with PAR∗ = PAR, H(b, PAR) , where H is a hash function.
94
N.D. Sarier
By applying a strong extractor, one can convert any robust sketch to a robust fuzzy extractor. Formally, an (M, l, t) fuzzy extractor is defined as follows [9]. Let M = {0, 1}v be a finite dimensional metric space with a distance function dis : M × M → Z+ . Here, b ∈ M and dis measures the distance between b and b , where b, b ∈ M. An (M, l, t) fuzzy extractor consists of two functions Gen and Rep. – Gen: A probabilistic generation procedure that takes as input b ∈ M and outputs an biometric identity string ID ∈ {0, 1}l and a public parameter P AR, that is used by the Rep function to regenerate the same biometric string ID from b such that dis(b, b ) ≤ t. – Rep: A deterministic reproduction procedure that takes as input b and the publicly available value P AR, and outputs ID if dis(b, b ) ≤ t. In [9], the authors describe a concrete fuzzy extractor using a [n, k, 2t + 1] BCH error correction code, Hamming Distance metric and a one-way hash function H : {0, 1}n → {0, 1}l . Specifically, – The Gen function takes the biometrics b as input and returns ID = H(b) and public parameter P AR = b⊕Ce (ID), where Ce is a one-to-one encoding function. – The Rep function takes a biometric b and P AR as input and computes ID = Cd (b ⊕ P AR) = Cd (b ⊕ b ⊕ Ce (ID)). ID = ID if and only if dis(b, b ) ≤ t. Here Cd is the decoding function that corrects the errors upto the threshold t. 2.4
Collusion Attacks
Any biometric IBE/IBS scheme requires the biometric measurement of the receiver or the signer, respectively. For this purpose, the biometrics of the user is captured using a sensor and the raw biometric data is further processed to extract the feature vector and to obtain the biometric template b of the user. In a biometric encryption scheme, feature extraction is applied on the raw biometric data to obtain the feature vector (or the attributes) and then, each attribute is associated with a unique integer wi ∈ Z∗p to form the identity w = (w1 , ..., wn ) [18,2]. Here, n denotes the size of the attributes of each user. Since some of the attributes could be common in some users, a unique polynomial is selected for each user and included in the key generation algorithm to bind the private key to the user. This way, different users cannot collude in order to decrypt a ciphertext that should only be decrypted by the real receiver. In the biometric cryptosystems such as BIO-IBS [9] and BIO-IBE of [19], the biometric template b is computed using the feature vector and the hash of b is used as the identity ID. Here, the template b is assumed to be a fixed length binary string, so each feature forming the original biometric template (namely the feature vector) are quantized to generate multiple bits per feature that are concatenated to obtain the binary template b. Particularly, the framework for biometric template generation consists of (1) extracting features; (2)
Generic Constructions of Biometric IBE Systems
95
quantization and coding per feature and concatenating the output codes; (3) applying error correction coding (ECC) and hashing [10]. During this process, many quantizers produce and use side-information, which could be published to be used later in the reconstruction of the binary template b . As different from existing fuzzy IBE systems, the BIO-IBE [19] requires the use of the biometric template b obtained from the feature vector of the user, where feature extraction is the most costly part of the biometric template generation. Since feature extraction is already performed in any fuzzy IBE scheme, one can easily apply a robust fuzzy extractor on the feature vector to bind the private key components to the user’s identity and thus avoid collusion attacks. Instead of choosing a unique polynomial for each user, we use the robust fuzzy extractor to obtain a unique biometric string ID via error correction codes from the biometric template b of the user in such a way that an error tolerance t is allowed. In other words, we will obtain the same biometric string ID even if the fuzzy extractor is applied on a different b such that disH (b,b’)< t. Here, dis() is the distance metric used to measure the variation in the biometric reading and t is the error tolerance parameter of the fuzzy extractor. In the anonymous fuzzy IBE scheme of [23], collusion attacks are avoided by combining each biometric feature wi with the identity (i.e. Name,e-mail) of the user. However, this approach is against the nature of fuzzy IBE, where the identities should only consist of the biometric data of the user. Besides, an important privacy property that we will present in the next section is not satisfied despite the anonymity of the scheme. One can correct this fuzzy IBE scheme with a similar approach introduced in [19], namely, the identity is obtained from the biometric information of the user using a feature extraction algorithm followed by a fuzzy extraction process, where the result of the former procedure (i.e. w = (w1 , ..., wn )) is combined with the output of the latter (i.e. ID) to obtain the biometric attribute set BID = H(w1 , ID), ..., H(wn , ID) to be used in the key generation phase. This way, the privacy of biometric-identity relation and the resistance against collusion attacks is maintained. Here, H is an cryptographic hash function.
3
A Generic Construction Based on Robust Sketch
The first idea for an efficient biometric IBE scheme without using bilinear pairings is to combine any IBE scheme with an Error Correcting Code (ECC) and a robust sketch. Particularly, given IBE=(KeyGen, Enc,Dec) is an ID-IND-CPA secure IBE scheme that encrypts a message (i.e. the codeword c) bit by bit, an ECC() with correction capacity t and a robust sketch of [6] with PAR∗ = PAR, H(m, PAR) , the construction is described as follows. – Setup(l): Given a security parameter l, the PKG generates the master secret key ms and the public parameters of the system. – KeyGen(w, ms): Given a user’s biometric feature vector w and ms, it returns the corresponding private key Dw .
96
N.D. Sarier
– Encrypt(w , m): An algorithm that takes as input a biometric vector w , Enc algorithm of the IBE, a message m ∈ M and a robust sketch, outputs the ∗ IBE ciphertext U, V, W = EncIBE w (c; r), PAR = Encw (c),PAR, H(m, PAR) , where PAR = c ⊕ m for a random codeword c ∈ C. For the case that the underlying IBE scheme is not anonymous, the biometric vector w of the receiver is attached to the ciphertext. – Decrypt(Dw ): A deterministic algorithm that given the private key Dw of the Dec algorithm, an error correcting procedure ECC() and a ciphertext encrypted with w such that d ≤ |w ∩ w | , the algorithm computes c = DecIBE w (U ) and corrects the error via c=ECC(c ). Next, m = c⊕ V is obtained and if W = H(m, V ), m is returned, else ⊥ is returned. 3.1
Entropic Security vs. Indistinguishability
As it is noted in [11], semantic security cannot be achieved for fuzzy sketches, when the adversary generates the two strings m1 , m2 such that |m1 | = |m2 | and thus knows that the challenge ciphertext is the encryption of one of m1 , m2 , the adversary can easily distinguish by computing mi ⊕ V and verifying W = H(mi , V ) from the challenge ciphertext. Thus, fuzzy sketches guarantee entropic security, which is weaker than Shannon security and assumes that the adversary is sufficiently uncertain about the challenge message. In the context of our generic conversion, integration of a robust sketch can only satisfy OW-CCA (Onewayness against Chosen Ciphertext Attack) in the ROM, which is a weak security level. Therefore, we present constructions that provide IND-CCA security in the following sections.
4
Security Properties
In addition to the standard security level (IND-CCA) that any encryption scheme should achieve, biometric IBE schemes have to guarantee the following properties that are particularly important for biometric cryptosystems, since a user could use its biometrics on a number of applications such as identification, authentication, signing, etc. Thus, the traceability of the user’s actions should be prevented through the anonymity of the ciphertexts and the secrecy of the identity-biometrics relation. 4.1
Anonymity
Informally, Recipient Anonymity (RA) or key privacy means that the adversary must be unable to decide whether a ciphertext was encrypted for a chosen identity, or for a random identity. In other words, an adversary cannot tell who the recipient is by looking at the ciphertext, which could be used to thwart traffic analysis. If the ciphertext could be anonymized by anyone using the public key of the recipient, i.e. not just by the encryptor, the encryption scheme is defined as universally anonymous. In current fuzzy IBE systems, the biometric vector w
Generic Constructions of Biometric IBE Systems
97
of the receiver is attached to the ciphertext since set overlap is used as the distance metric between the identities w and w . Hence, a different system should be designed to achieve anonymity. The formal definition is as follows: Experiment ExpIBE-RA-CPA A (ms, params) ← Setup(l) (w0 , w1 , s, m) ← A(params) s.t. |w0 ∩ w1 | < d R b ← {0, 1} U ∗ ← Encrypt(m, params, wb ) b ← A(s, U ∗ , params) If b = b return 1 else return 0 IBE-RA-CPA The advantage of the attacker A is AdvA,IBE = |P r[b = b] − 12 |. A biometric IBE scheme IBE is said to be IBE-RA-CPA-secure if the respective advantage function is negligible for all polynomial time adversaries (PTAs) A.
4.2
Identity Privacy
For biometric authentication, this notion guarantees the privacy of the sensitive relationship between the user identity (i.e. ID= Name or e-mail address) and its biometrics against a malicious service provider or a malicious database [8,22]. For biometric IBE setting, this notion can be adapted for having privacy even against the trusted authority (PKG) or the encryptor. Thus, identity privacy is a stronger notion than anonymity, namely, identity privacy implies anonymity, which is shown in the following lemma. The privacy of biometrics-identity relation is achieved for many fuzzy IBE systems, which depend only on biometric identities except for the fuzzy IBE scheme in [23], which combines the identity (i.e. Name) of the receiver with his biometric features to avoid collusion attacks. This approach is not only against identity privacy but also against the main principle of fuzzy IBE. However, this scheme could be corrected using our method described in section 2.4. This notion is formally defined as follows: Experiment ExpIBE-IP-CPA A ms, params ← Setup(l) (s, m, ID, w0 , w1 ) ← A(params) s.t. |w0 ∩ w1 | < d R b ← {0, 1}, U ∗ ← Encrypt(m, params, wb , ID) b ← A(s, U ∗ , params) If b = b return 1 else return 0 IBE-IP-CPA The advantage of the attacker A is AdvA,IBE = |P r[b = b] − 12 |. A biometric IBE scheme IBE is said to be IBE-RA-CPA-secure if the respective advantage function is negligible for all PTAs A.
Lemma 1. Identity privacy implies anonymity. Proof. Assume that a given biometric IBE scheme is not anonymous, then using this scheme we construct another biometric IBE scheme that does not guarantee identity privacy.
98
N.D. Sarier
Given any biometric IBE scheme which is not anonymous and has the encryption algorithm Encrypt, define a new biometric IBE scheme with an encryption algorithm that appends the identity information (Name, e-mail) to the ciphertext. Since the new biometric IBE scheme is also not anonymous, the link between the identity and biometrics is not kept secret. Thus identity privacy is not satisfied.
5
Generic Construction of Biometric IBE
In this section, we described generic constructions converting any one way secure IBE scheme that encrypts a message bit by bit into an ID-IND-CCA secure encryption scheme in the error-tolerant setting. Due to page limitations, the proofs will be presented in the full version of the paper. 5.1
Based on Fujisaki-Okamoto (FO) Conversion
Fujisaki and Okamoto proposed a simple conversion scheme called as a hybrid scheme εhy from weak asymmetric-key encryption (AK) and symmetric-key encryption (SK) schemes into a public-key encryption scheme which is secure in the sense of IND-CCA. Basically, εhy is defined in [12] as follows. εhy (m; σ) = AEpk (σ; H(σ, m)||SEG(σ) (m)
In εhy , σ is generated at random, H and G are two cryptographic hash functions with H: AKMS x SKMS → COINS and G: AKMS → SKS ,where AKMS denotes asymmetric-key message space, SKMS denotes symmetric-key message space, and SKS is the symmetric-key space. The idea is , first encrypting the redundancy σ with the random coin H(σ, m) under public key pk using the probabilistic scheme AE and then encrypting the message under the symmetric key G(σ) using the scheme SK. In [12], it is proven that if AE is an one-way encryption scheme, then εhy is IND-CCA secure in the ROM. However, it is shown that if AE scheme satisfies IND-CPA security, then there is a significant improvement in the security reduction, where IND-CPA implies also one-way encryption [4]. Finally, in [14], the authors describe the FO conversion for IBE encryption, which we will extend for our setting as below. According to our framework, we present an ID-IND-CCA secure application that works in error-tolerant IBE setting as follows. Here c ∈ C is a random codeword and IBE=(KeyGen, Enc,Dec) is an ID-IND-CPA secure IBE scheme that encrypts a message (i.e. the codeword c) bit by bit. – Setup(l): Given a security parameter l, the PKG generates the master secret key ms and the public parameters of the system. – KeyGen(w, ms): Given a user’s biometric feature vector w and ms, it returns the corresponding private key Dw . – Encrypt(w , m): A probabilistic algorithm that takes as input biometrics w , Enc algorithm of the IBE scheme, a message m ∈ M and a random codeword
Generic Constructions of Biometric IBE Systems
99
c ∈ C, outputs the ciphertext U, V, W = EncIBE w (c; H1 (σ, m)), H2 (c) ⊕ σ, H3 (σ) ⊕ m . For the case that the underlying IBE scheme is not anonymous, the biometric vector w of the receiver is attached to the ciphertext. – Decrypt(Dw ): A deterministic algorithm that given the private key Dw of the Dec algorithm, an error correcting procedure ECC() and a ciphertext encrypted with w such that |w ∩ w | ≥ d, first computes c = DecIBE w (U ) and error corrects c=ECC(c ). Next, σ = H2 (c) ⊕ V and m = H3 (σ) ⊕ W is obtained. Finally, by computing H1 (σ, m) and using it in reencryption, the correctness is checked and m is returned. 5.2
Based on REACT
As it is noted in [16], Fujisaki-Okamoto transformation converts any one-way cryptosystem into a CCA secure encryption scheme, but it is not optimal due to the re-encryption operation during the decryption phase. In [16], an efficient and IND-CCA secure generic conversion scheme is presented, which takes as input a OW-PCA secure encryption scheme and avoids the disadvantages of FO transformation via εhy (m; R) = AEpk (R)||SEG(R) (m)||H(R, m, AEpk (R), SEG(R) (m))
Similar to FO, REACT is also implemented for IBE in [14]. When used in biometric IBE setting, one should modify REACT for IBE as U, V, W = EncIBE w (c), G(c) ⊕ m, H(c, m, U, V )
Thus, the only difference to the FO transformation adapted to the error-tolerant setting occurs in the decryption stage where only one hash computation, i.e. H(c, m, U, V ) is verified instead of a full reencryption. Here, c ∈ C denotes a random codeword.
6
A Generic Biometric ID-KEM Construction
A Key Encapsulation Mechanism (KEM) consists of three algorithms: Key generation, encryption and decryption algorithms, where a KEM outputs a random session key to be used by the Data Encapsulation Mechanism (DEM) in the symmetric encryption. Current identity-based KEM’s [3] are not suitable for error prone identities, thus we present a generic construction for a biometric ID-KEM that takes any IBE scheme IBE=(KeyGen, Enc,Dec) which encrypts a message bit by bit. Here, H1 , H2 and H denote cryptographic hash functions with H1 : {0, 1}∗ → {0, 1}z1 , H2 : {0, 1}∗ → {0, 1}z2 and H : {0, 1}∗ → {0, 1}z . – Setup(l): Given a security parameter l, the PKG generates the master secret key ms and the public parameters of the system. – KeyGen(w, ms): Given a user’s biometric feature vector w and ms, and returns the corresponding private key Dw .
100
N.D. Sarier
– Encapsulate(w , m): An algorithm that takes as input a biometric vector w , Enc algorithm of the IBE scheme, a message m ∈ M and a random codeword c ∈ C, it returns U, V, K = EncIBE w (c; H1 (m)), H(c) ⊕ m, H2 (m) . Here, K ∈ KID-KEM is an encapsulation key from the key space of the ID-KEM. For the case that the underlying IBE scheme is not anonymous, the biometric vector w of the receiver is attached to the ciphertext. – Decapsulate(Dw ): A deterministic algorithm that given the private key Dw of the Dec algorithm, an error correcting procedure ECC() and a ciphertext (U, V ) encrypted with w such that d ≤ |w ∩ w |, it computes c = DecIBE w (U ) and corrects the error via c=ECC(c ). Next, m = H(c) ⊕ V is obtained and H1 (m) is computed to verify U = EncIBE w (c; H1 (m)). Finally, the algorithm returns either the encapsulated key H2 (m), else ⊥ is returned. The security of a biometric ID-KEM is defined using the following game between an adversary and a challenger. Experiment ID-IND-CCA(l, ID-KEM, A) (params, ms) ←Setup(l) (s, w∗ ) ← AO 1 (params) (K0 , U ∗ , V ∗ ) ← Encapsulate(w∗ , params, c, m) R (K1 ) ← KID-KEM ∗ ∗ ∗ b ← AO 2 (w , U , V , Kb ) If b = b return 1 else return 0 ID-IND-CCA The advantage of the attacker A is AdvA,ID-KEM = |P r[b = b] − 12 |. Hence, a biometric ID-KEM is ID-IND-CCA secure if the advantage of A is negligible in the security parameter l.
Theorem 1. Suppose there exists a CCA adversary A which distinguishes IDKEM with advantage in less than qH12 , qH random oracle calls qD decryption queries. Then there exists an algorithm R which inverts IBE with probability 2 ≥ qH +q − q2Dz . H +qD 12
Proof. Given an ID-IND-CCA secure biometric ID-KEM, the goal of the reduction algorithm R is to invert the ID-OW-CPA secure IBE scheme using an adversary A running against ID-KEM. The challenger of R outputs the public parameters of IBE, which is passed to the adversary A in order to simulate the setup phase of ID-KEM. A responds with the challenge biometric identity w∗ , which is relayed to the challenger of R, which returns the encryption U ∗ of a random message c∗ ∈ C. R outputs U ∗ together with a randomly chosen V ∗ and a random key K0 to simulate the challenge phase of ID-KEM and answers the random oracle and decryption queries of A as follows. 1. H1 -queries: On each new input m, R picks random h1 and h2 from the ranges of H1 and H2 , returns h1 to A and inserts the tuple (m, h1 , h2 ) to the H12 List.
Generic Constructions of Biometric IBE Systems
101
2. H2 -queries: On each new input m, R picks random h1 and h2 from the ranges of H1 and H2 , returns h2 to A and inserts the tuple (m, h1 , h2 ) to the H12 List. 3. H-queries: On each new input (c), R returns a random h and adds the tuple (c, h) to the HList. 4. Private Key Extraction queries: For any identity w such that |w ∩ w∗ | < d, the extration query is passed to the challenger of R. 5. Decryption queries: On each new input (w, U, V ), – If |w ∩ w∗ | < d, R runs the private key extraction oracle and answers A as the real decapsulation oracle would. – If |w ∩ w∗ | ≥ d but (U, V ) = (U ∗ , V ∗ ), R computes for each pair in the HList m = H(c) ⊕ V . Next, R checks for each computed m, EncIBE w (c; H1 (m)) = U using the simulation of H1 as above. If the check is successful, then R simulates the H2 oracle to return H2 (m). If not, R returns reject. Finally, A outputs its guess b . R will pick at random an entry from HList and returns this to the challenger. Similar to the computation of the reduction cost 2 of theorem 6 in [3], we obtain ≥ qH +q − q2Dz H +qD 12
7
Applications
In this section, we present two concrete applications based on the anonymous IBE schemes of [5,1], which do not require bilinear pairings and encrypt a message bit by bit. Thus, they could be used as an input to our generic constructions with the following modifications to avoid collusion attacks. 7.1
Based on the Scheme of Boneh et al. [5]
The first space efficient IBE scheme is introduced in [5], which is ID-IND-CPA secure in the standard model based on the difficulty of the Quadratic Residuosity (QR) problem and the encryption of a n-bit message results in a single element in Z/N Z plus n + 1 additional bits. 1. Setup(l): Generate two primes (p, q) and compute N = pq, where N is a R RSA composite. Select a random u ← J(N )/QR(N ). Here, J(N ) denotes the x x set {x ∈ Z/N Z : ( N ) = 1}, where ( N ) is the Jacobi symbol of x in Z/N Z. Also, QR(N ) is the set of quadratic residues in J(N ). The public parameters are params = (N, u, H), where H is a hash function H : BID → J(N ), where BID = W × ID. We assume that the features wj ∈ W are ordered as in [15]. The master key is msk = (p, q, K), namely the factorization of N together with a random key K for a pseudorandom function FK : W × ID → {0, 1, 2, 3}. 2. Keygen(msk, w): It takes as input msk, a biometric vector w with length n. The algorithm outputs a private key DBID = (r1 , ..., rn ) for decrypting encryptions of n-bit messages as follows. For j= 1,...,n do:
102
N.D. Sarier
– Rj ← H(wj , ID )∈ J(N ) and t ← FK (wj , ID)∈ {0, 1, 2, 3} – let a ∈ {0, 1} such that ua Rj ∈QR(N ) – let z0 , z1 , z2 , z3 be the four square roots of ua Rj ∈ Z/ N Z and set rj ← zt 3. Enc(params, w , c): The encryption algorithm that takes as input biometrics w of the receiver, params and a codeword c = c1 ...cn ∈ C. It generates a random s ∈ Z/N Z and sets S ← s2 mod N . Then, Q (N, u, 1, S) is computed to obtain (s) the polynomial τ and k ← ( τN ). Here, Q is a deterministic algorithm that satisfies some properties [5] and takes as inputs (N, u, Rj , S), where N ∈ Z+ , and u, Rj , S ∈ Z/N Z. It outputs polynomials fj , f¯j , gj , τ ∈ Z/N Z[x]. Finally, for j = 1, ..., n do: – Compute Rj ← H( wj , ID) and run Q (N, u, Rj , S) to obtain gj g (s) – Compute ej = cj · ( jN ) The ciphertext is U = (S, k, e, L), where e = e1 ...en and L is a label that contains information about how each ej is associated to the index of wj ∈ W. 4. Dec(U, DBID ): The decryption algorithm takes as input the ciphertext U and the private key DBID = (r1 , ..., rn ) and recovers c = c1 ...cn as follows. For j = 1, ..., n , set Rj ← H(wj ,ID) and run Q (N, u, Rj , S) to obtain fj , f¯j If rj2 = Rj set cj ← ej · (
fj (rj ) N ),
else if rj2 = uRj set cj ← ej · k · (
f¯j (rj ) N )
The security of the Anonymous IBE depends on the difficulty of the interactive quadratic residuosity (IQR) problem in the standard model and the encryption of a binary string results as a ciphertext of size log2 N + n + 1, where N is a RSA modulus and n is length of c and w. In case that the number of biometric features are less than the length of the codeword, than either the extraction algorithm could be used to extract more features or the technique in [5] is used which computes the hash of the unique identity of the receiver together with the indices j = 1, ..., n. Since the modified scheme is also secure in the sense of ID-IND-CPA, it is input to one of our generic constructions to obtain either an ID-IND-CCA secure encryption scheme or an ID-IND-CCA secure KEM. The main drawback of the scheme of Boneh et al [5] is its inefficiency since the complexity is quartic in the security parameter. Recently, Ateniese and Gasti [1] proposed an efficient and universally anonymous IBE scheme based on the quadratic residuosity assumption in the ROM. Similar to the modification presented above, if the key generation of the scheme in [1] is adapted for biometric identities, we are able to integrate this modified IBE scheme into one of our generic constructions. 7.2
Based on the Scheme of Ateniese et al. [1]
The second application of our generic construction is based on the scheme of [1], whose security relies on the quadratic residuosity assumption in the ROM. Similar to the scheme of [5], an n-bit message (n is the length of c) is encrypted bit
Generic Constructions of Biometric IBE Systems
103
by bit resulting in a ciphertext of 2n(120+1024) bits if necessary optimizations are applied. Thus, it could be used as an input to our generic constructions with the following modifications to avoid collision attacks. 1. Setup(k0 ): Let H be a full domain hash function H : BID → Z∗N [+1] with BID = W×ID and k0 a security parameter. Generate two primes (p, q) and compute N = pq, where N is a k0 -bit Blum integer and p, q are two k0 /2-bit primes each congruent to 3 modulo 4. The public parameters are params = (N, H) and the master secret key is msk = (p, q). We assume that the features wj ∈ W are ordered as in [15]. 2. Keygen(msk, w, n): It takes as input msk, a biometric vector w with length n. The algorithm outputs a private key DBID = (r1 , ..., rn ) for decrypting encryptions of n-bit messages as follows. For j= 1,...,n do: x – aj ← H(wj , ID) Thus, the jacobi symbol ( N ) = +1}. ∗ 2 – let rj ∈ ZN such that rj ≡ aj mod (N ) or rj2 ≡ −aj mod (N )
3. Enc(params, w , c): The encryption algorithm that takes as input biometrics w of the receiver, params and a message c = c1 ...cn ∈ C. For j = t v 1, ..., n, choose at random tj , vj ∈ Z∗N such that ( Nj ) = ( Nj = cj } and comaj a pute aj = H( wj , ID). Next, compute (fj , gj ) = (tj + tj , vj − vjj ) and mask the ciphertext using one of the constructions in [1]. Next, the encryptor sends U = (Z1j , αj1 , ..., αjl )||(Z2j , β1j , ..., βlj ||L)||M IDc , where L is a label that contains information about how each component of the ciphertext is associated to the index of wj ∈ W and M IDc is a message identifier for c. 4. Dec(U, DBID ): The decryption algorithm is performed as described in [1].
8
Comparison
To show the efficiency of our constructions, we will compare our results to the existing fuzzy IBE schemes secure in the ROM. In [1], the authors implement different anonymous IBE schemes to present the average times of encryption of a short session key. Using these values presented in [1], we compare our results to any pairing based fuzzy IBE system in Table 1. For simplicity, we use different variables to represent the approximate times, where x and y denote the encryption and decryption times for Boneh-Franklin IBE [4] scheme implemented for a unique identity such as an e-mail address. Specifically, x is the time to compute two exponentiations within their respective groups if the bilinear pairing is precomputed and y is the time for one pairing computation, which is the dominant operation in terms of computation cost. For fuzzy IBE systems, since the identity is represented as a feature vector of length n such that 20 < n < 100 depending on the biometric modality, the required times are computed as multiples of x and y. When compared to the exact times of the scheme [1] that we implement
104
N.D. Sarier Table 1. Comparison of time complexity Encryption Decryption time time Boneh-Franklin IBE∗ [4] x y Pairing based Systems† nx dy Our Construction‡ 4x + FE y+ ECC ∗:non-biometric identities; †:for biometric identities; ‡:Based on the scheme of [1];
for our generic construction, the encryption of a message of the same size requires approximately 4x, whereas the decryption time is again y. Finally, for our construction, a fuzzy extraction procedure FE for encryption and an error correcting procedure ECC for decryption stage is required, which can be efficiently implemented as in [9]. Finally, d is the error tolerance parameter.
9
Conclusion
In this paper, we present generic constructions for biometric IBE schemes and describe the relevant security notions. In order to provide anonymity, we assume that biometrics consists of an ordered set of features as in face biometrics [15]. An interesting future work can be the design of generic constructions of anonymous biometric IBE schemes, where biometrics can be represented as an unordered set of features, which is the case for some biometric modalities.
Acknowledgement The author is grateful to her supervisor Prof. Dr. Joachim von zur Gathen for his valuable support, encouragement and guidance.
References 1. Ateniese, G., Gasti, P.: Universally Anonymous IBE Based on the Quadratic Residuosity Assumption. In: Fischlin, M. (ed.) RSA Conference 2009. LNCS, vol. 5473, pp. 32–47. Springer, Heidelberg (2009) 2. Baek, J., Susilo, W., Zhou, J.: New constructions of fuzzy identity-based encryption. In: ASIACCS’07, pp. 368–370. ACM, New York (2007) 3. Bentahar, K., Farshim, P., Malone-Lee, J., Smart, N.P.: Generic Constructions of Identity-Based and Certificateless KEMs. J. Cryptology 21(2), 178–199 (2008) 4. Boneh, D., Franklin, M.K.: Identity-Based Encryption from the Weil Pairing. SIAM J. Comput. 32(3), 586–615 (2003) 5. Boneh, D., Gentry, C., Hamburg, M.: Space-Efficient Identity Based Encryption Without Pairings. In: FOCS’07, pp. 647–657. IEEE, Los Alamitos (2007) 6. Boyen, X., Dodis, Y., Katz, J., Ostrovsky, R., Smith, A.: Secure Remote Authentication Using Biometric Data. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 147–163. Springer, Heidelberg (2005)
Generic Constructions of Biometric IBE Systems
105
7. Bringer, J., Chabanne, H., Cohen, G.D., Kindarji, B., Z´emor, G.: Optimal Iris Fuzzy Sketches. In: BTAS’07, pp. 1–6. IEEE, Los Alamitos (2007) 8. Bringer, J., Chabanne, H., Izabach`ene, M., Pointcheval, D., Tang, Q., Zimmer, S.: An Application of the Goldwasser-Micali Cryptosystem to Biometric Authentication. In: Pieprzyk, J., Ghodosi, H., Dawson, E. (eds.) ACISP 2007. LNCS, vol. 4586, pp. 96–106. Springer, Heidelberg (2007) 9. Burnett, A., Byrne, F., Dowling, T., Duffy, A.: A Biometric Identity Based Signature Scheme. International Journal of Network Security 5(3), 317–326 (2007) 10. Chen, C., Veldhuis, R.N.J., Kevenaar, T.A.M., Akkermans, A.H.M.: Multi-bits biometric string generation based on the likelyhood ratio. In: BTAS’07, pp. 1–6. IEEE, Los Alamitos (2007) 11. Dodis, Y., Smith, A.: Correcting errors without leaking partial information. In: STOC’05, pp. 654–663. ACM, New York (2005) 12. Fujisaki, E., Okamoto, T.: Secure integration of asymmetric and symmetric encryption schemes. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 537–554. Springer, Heidelberg (1999) 13. Furukawa, J., Attrapadung, N., Sakai, R., Hanaoka, G.: A Fuzzy ID-Based Encryption Efficient When Error Rate Is Low. In: Chowdhury, D.R., Rijmen, V., Das, A. (eds.) INDOCRYPT 2008. LNCS, vol. 5365, pp. 116–129. Springer, Heidelberg (2008) 14. Kitagawa, T., Yang, P., Hanaoka, G., Zhang, R., Watanabe, H., Matsuura, K., Imai, H.: Generic Transforms to Acquire CCA-Security for Identity Based Encryption: The Cases of FOpkc and REACT. In: Batten, L.M., Safavi-Naini, R. (eds.) ACISP 2006. LNCS, vol. 4058, pp. 348–359. Springer, Heidelberg (2006) 15. Li, Q., Sutcu, Y., Memon, N.D.: Secure Sketch for Biometric Templates. In: Lai, X., Chen, K. (eds.) ASIACRYPT 2006. LNCS, vol. 4284, pp. 99–113. Springer, Heidelberg (2006) 16. Okamoto, T., Pointcheval, D.: REACT: Rapid Enhanced-Security Asymmetric Cryptosystem Transform. In: Naccache, D. (ed.) CT-RSA 2001. LNCS, vol. 2020, pp. 159–175. Springer, Heidelberg (2001) 17. Pirretti, M., Traynor, P., McDaniel, P., Waters, B.: Secure Attribute-Based Systems. In: ACM CCS’06, pp. 99–112. ACM, New York (2006) 18. Sahai, A., Waters, B.: Fuzzy Identity-Based Encryption. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 457–473. Springer, Heidelberg (2005) 19. Sarier, N.D.: A New Biometric Identity Based Encryption Scheme. In: TrustCom’08, pp. 2061–2066. IEEE, Los Alamitos (2008) 20. Sarier, N.D.: Biometric Identity Based Signature Revisited. In: EuroPKI’09. Springer, Heidelberg (2009) (to appear) 21. Shahandashti, S.F., Safavi-Naini, R.: Threshold Attribute-Based Signatures and Their Application to Anonymous Credential Systems. In: Preneel, B. (ed.) Progress in Cryptology – AFRICACRYPT 2009. LNCS, vol. 5580, pp. 198–216. Springer, Heidelberg (2009) 22. Tang, Q., Bringer, J., Chabanne, H., Pointcheval, D.: A Formal Study of the Privacy Concerns in Biometric-Based Remote Authentication Schemes. In: Chen, L., Mu, Y., Susilo, W. (eds.) ISPEC 2008. LNCS, vol. 4991, pp. 56–70. Springer, Heidelberg (2008) 23. van Liesdonk, P.P.: Anonymous and Fuzzy Identity-Based Encryption. Master’s thesis, Technische Universiteit Eindhoven (2007) 24. Yang, P., Cao, Z., Dong, X.: Fuzzy Identity Based Signature. Cryptology ePrint Archive, Report 2008/002 (2008), http://eprint.iacr.org/
Design and Analysis of a Generalized Canvas Protocol Mari´ an Novotn´ y ˇ arik University, Institute of Computer Science, Pavol Jozef Saf´ Jesenn´ a 5, 041 54 Koˇsice, Slovakia
[email protected] Abstract. The Canvas protocol was developed by Harald Vogt [10] and should provide data integrity in Wireless Sensor Networks. However, Dieter Gollmann published [5] an attack on the protocol. This example supports a widespread belief that design of security protocols is notoriously error-prone. Therefore, it is required to use formal methods to analyze their security properties. In the paper we present design and analysis of a generalized Canvas protocol. We consider the fallacy of the Canvas scheme in different models of the attacker and present a solution for correcting the scheme. We discuss a motivation for generalization of the Canvas protocol and introduce a k-generalized version of the scheme for some parameter k ≥ 2. We build a formal model of the k-generalized Canvas protocol in the applied pi-calculus. This model includes a model of the network topology, communication channels, captured nodes, and capabilities of the attacker. In the semantic model of the applied picalculus we specify the data integrity property of the scheme. We prove that the proposed k-generalized Canvas scheme, in the presence of an active adversary, provides data integrity of messages assuming that at least one honest node exists on each path of the length k − 1 in the communication graph of a sensor network. Finally, we discuss the usability of the proposed formal model for other WSN security protocols.
1
Introduction
The development of Wireless Sensor Networks (WSNs) was originally motivated by military applications. However, WSNs are now used in many civilian applications including environment monitoring, home automation, and traffic control. Recent advances in electronics and wireless technologies have enabled the development of large scale sensor networks which consist of many low-power, low-cost, and small-sized sensor nodes. According to above mentioned applications of sensor networks, it is important to ensure security properties such as confidentiality, authenticity, and data integrity. Traditional security techniques as protocols for key establishment and authentication cannot be applied directly, because sensor devices are limited
This work was partially supported by APVV grant SK-SI-0010-08 and Slovak VEGA grant 1/0035/09.
P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 106–121, 2010. c IFIP International Federation for Information Processing 2010
Design and Analysis of a Generalized Canvas Protocol
107
in their computation, energy, and communication capabilities. Moreover, they are often deployed in accessible areas, where capture by an attacker is possible. A sensor device is not considered as tamper-resistant in literature. Making all devices of a sensor network tamper-proof would be impossible in general due to increased costs. This way, the attacker can copy all secrets from a captured device and fully determine its operation. Furthermore, the typical communication in a sensor network is not point-to-point, but one-to-many or many-to-one. Therefore, design of WSN security protocols has become a challenge in the computer security research field. Many protocols originally designed for WSNs have been developed [11]. We focus on the Canvas scheme [10] which should provide data integrity in a sensor network. Since design of security protocols is notoriously error-prone, it is necessary to model and analyze their security properties formally. The seminal work on formal analysis of WSN security protocols was done in the paper [7]. The authors used the model checking tool AVISPA [2] and modeled and analyzed TinySec [11] combined with LEAP [11] protocol in various communication scenarios. They analyzed protocols in the standard Dolev-Yao model of the attacker. In this model, the communication network is described undetailed. On the other hand, in order to analyze WSN security protocols we need a formal model which adequately expresses the network topology and communication channels. Development of more detailed model of the attacker was formulated as a challenge in the computer security research field [5]. We propose a formal model of a generalized Canvas scheme in the applied pi-calculus, which consists of a model of the network topology, communication channels, captured nodes, and capabilities of the attacker. Moreover, we show a technique how to formulate and prove security properties of the Canvas scheme in the proposed formal model. This paper is organized as follows. The next section describes the Canvas protocol, discusses the fallacy of the scheme in different models of the attacker, and provides a solution for correcting the scheme. In Section 3 we discuss a motivation for generalization of the Canvas protocol and propose a generalized Canvas scheme. In Section 4 we present a formal model of the proposed scheme in the applied pi-calculus. In Section 5 we formulate and analyze the data integrity property of the proposed scheme in the semantic model of the applied pi-calculus. The last section presents our conclusions and suggestions for future work and discusses the usability of the proposed formal model for other WSN security protocols.
2
The Canvas Protocol
A sensor network can be represented by a communication graph G = (V, E), where nodes from V represent sensor devices and edges from E ⊆ V × V established communication links. A path in a graph G is a sequence of distinct nodes from V such that from each of its nodes there is an edge from E to the next node in the sequence. A length of a path is the number of edges in the path. Let π l (G) denote the set of all paths of a length l in a graph G. We define a set of i-hop
108
M. Novotn´ y
D
KDF
F KAD
A
KBD KAE
KAC
KDE
KCD
KCF
KBE
KEF
KAB
B KBC
C
KCE
E
Fig. 1. A simple communication graph with established keys in the Canvas scheme
neighbors Ni (v) of a node v ∈ V as the set of nodes u ∈ V such that exists a path ρ ∈ π i (G) starting in v and ending in u. The Canvas protocol was designed by H. Vogt and published in [8,9,10]. It should provide data integrity or data origin authentication [6] in a sensor network under assumption that captured nodes are isolated, i. e., captured nodes are not direct neighbors in a communication graph. Each node shares secret keys with nodes that are one or two hops away as shown in Fig. 1. Message authentication codes – MACs [6] are used to protect the integrity of a message between nodes which share the secret key. Let KAB denote the key shared between nodes A and B, and h(m, KAB ) denote the MAC of a message m using the shared key KAB . For the sake of simplicity, we explain the functionality of the Canvas scheme on a simple sensor network (Fig. 1). The node A wants to initiate the transmission of a message m which must contain its identification. It selects two nodes B ∈ N1 (A), C ∈ N2 (A) on a valid communication path determined by a routing algorithm. The node A computes authenticators h(m, KAB ), h(m, KAC ) and sends the message m, h(m, KAB ), C, h(m, KAC ) to the node B. In message routing we consider two cases when a node receives a message. In the first one, the node processes the message which was just initiated by an original sender. The node B receives a message m1 , . . . , m4 from A. It checks whether m1 contains the identification of the node A and compares the authenticator h(m1 , KAB ) with received m2 . If the tests succeed, the node B accepts the message. Then, it nominates a next node in the route following the node m3 = C, for example the node D ∈ N2 (B). Then, the node B computes authenticators h(m1 , KBC ), h(m1 , KBD ) and finally sends the routed message m1 , A, m4 , h(m1 , KBC ), D, h(m1 , KBD ) to the node C. In the general case of message routing – following the example – the node C receives a message m1 , . . . , m6 from B. It verifies whether A = m2 is a two-hop neighbor, i. e., A ∈ N2 (C), and h(m1 , KAC ) = m3 ; the sender B is a one-hop neighbor, i. e., B ∈ N1 (C), and h(m1 , KBC ) = m4 . If the tests succeed, the node B accepts the message. The next hop D in the route has been already chosen by B. However, the node C selects the next-next hop E ∈ N2 (C) from the set of 2-hop neighbors on the valid path. Finally, it sends the routed message m1 , B, m6 , h(m1 , KCD ), E, h(m1 , KCE ) to the node D. Similarly, the node D continues in routing of the message.
Design and Analysis of a Generalized Canvas Protocol
109
The Security Fallacy of the Scheme. D. Gollmann showed an attack on the Canvas protocol in the paper [5]. He assumes an attacker model in which the attacker is able to capture a sensor device, gain control over it, and reprogram it. On the other hand, only nodes that were presented in the previous phases of the sensor network are allowed to participate in the network and the attacker cannot have access to the network with his own device. Moreover, captured devices can communicate only via established communication links of the sensor network. There is no channel between them and the adversary. In our opinion, it is problematic to model a cooperative strategy of captured nodes formally. This way, we consider this model unsuitable for a formal analysis. Let the nodes A, C from Fig. 1 be compromised and have predefined cheating strategy. They want to cheat the node E with a fake message m in which some honest node is marked as the originator. The honest node D initiates sending of a message m, i. e., nominates next hops A, B in the route, computes corresponding authenticators h(m, KAD ), h(m, KBD ), and sends the routed message to A. The compromised node A nominates C as the next hop following B. It computes authenticators h(m, KAB ), h(m , KAE ) and sends them along with h(m, KBD ) in the routed message to B. The node B cannot distinguish between the received fake authenticator h(m , KAE ) and the correct value h(m, KAC ). The node B follows routing of the message m, selects the node E as the nextnext hop, computes MACs h(m, KBC ), h(m, KBE ), and sends them along with the fake authenticator h(m , KAE ) in the routed message to the node C. The compromised node C follows predefined malicious strategy and receives the authenticator h(m , KAE ) for the fake message m from B. It selects the node F as the next-next hop, computes h(m , KCE ), h(m , KCF ) and sends them along with h(m , KAE ) in the routed message to E. The node E checks whether the node C is a one-hop neighbor, the node A a two-hop neighbor, and all received authenticators. Then, it accepts the fake message m even though compromised nodes A, C are isolated. We propose a model of the attacker, which differs from the above mentioned model. The adversary is able to capture a device and copy all stored data including secrets from the device. Moreover, the attacker can use pre-established communication links of the captured devices by using his own device. Furthermore, we can define the initial knowledge of the attacker about the network topology and communication links. In this model, the attack on the Canvas scheme is simpler and explains the fallacy of the scheme better. On the other hand, the model is stronger (we can easily simulate an attack from the above mentioned model) and more suitable for a formal analysis. First, the attacker obtains all secrets from the captured nodes A, C including the keys KAE , KCE , KCF . Then, he computes authenticators h(m , KAE ), h(m , KCE ), h(m , KCF ) and prepares the routed message of a fake message m of the false route A → C → E → F . Via the established channel between C and E he sends the routed message to the node E parades as C. The node E checks whether the node C is a one-hop neighbor, the node A is a two-hop neighbor, and all received authenticators.
110
M. Novotn´ y
Then, the node E accepts the fake message m and follows to propagate the message m to the node F . In order to fix the scheme we need to avoid invalid routes in the sensor network as was suggested in [5]. However, it is sufficient to check whether previous hops in the route are on a valid communication path. This way, a node v during receiving a routed message from a previous hop p1 and a previous-previous hop p2 not only checks whether p1 ∈ N1 (v) and p2 ∈ N2 (v), but it needs to verify whether p2 p1 v is a valid path, i. e., p2 p1 v ∈ π 2 (G). Note that the knowledge of a node about the local topology was specified as an assumption in [10] and it is used implicitly in the routing algorithm by selecting a next-next hop on a valid path. Thus, we do not add new requirements for previous phases of the protocol. However, we specify explicitly what is necessary to assume and check in the operational phase of the Canvas protocol.
3 3.1
Generalized Canvas Scheme Motivation
Our aim is to generalize the Canvas scheme, in order to protect the data integrity of the message witnessed by k previous hops in the routing. We assume that each node v has established shared keys with nodes from the sets of neighbors N1 (v), . . . , Nk (v). Moreover, the node v knows information about its local topology up to the distance k. This way the node v can check the validity of a path of the length k ending in v. The k-generalized Canvas scheme should provide data integrity under the assumption that at least one node which is not captured exists on each path of the length k − 1 in the communication graph. We distinguish between two kinds of sensor devices – protected and unprotected. The attacker is unable to copy secrets from a protected device. This property can be realized by making the protected device tamper-resistant or placing the protected device on a safe location, where capture is problematic. On the other hand, an unprotected device can be captured by the attacker, who can also copy secrets from the device and gain control over it. During the deployment and initialization of a sensor network, it should be ensured, that at least one protected node exists on each path of the length k − 1 in the communication graph. This can be realized by appropriate geometrical covering of an area of the sensor network by protected devices during the deployment. The initialization phase of the sensor network is realized with respect to the required property and the communication graph is modified when necessary. Another possibility is to randomly distribute protected and unprotected devices with sufficient ratio of protected ones and maintain a communication graph with respect to the required property. Finally, the last idea is based on a planned deployment of the sensor network with minimization of the number of protected devices due to increased costs. Building a topology of a sensor network with the minimal number of protected devices could be a problem of independent interest in the field of combinatorial optimization.
Design and Analysis of a Generalized Canvas Protocol
3.2
111
A Proposed Scheme
Let us denote a concatenation of strings s1 , s2 as s1 ||s2 and a string representation of an integer i ≤ k as i . We define a chain of message authentication codes of a message m under keys K1 , . . . , Kn as h( 1 ||m, K1 ), if n = 1; H(m, K1 , . . . , Kn ) = h( n ||m||H(m, K1 , . . . , Kn−1 ), Kn ), otherwise. Message initiation. Let us assume that there exists a routing algorithm, which selects a routing path ρ = A0 . . . An . The node A0 wants to initiate the transmission of a message m = A0 ||m which contains its identification. It selects k nodes A1 , . . . , Ak on the valid communication path starting in A0 by the routing algorithm. It computes an authenticator h( 1 ||m, KA0 Ai ) for each i ≤ k and sends the message m, A0 , . . . , Ak , h( 1 ||m, KA0 A1 ), . . . , h( 1 ||m, KA0 Ak ) to the node A1 . Message routing. We consider k cases when a node receives a message. In the first k − 1 cases, the node processes the message routed up to k − 1 hops since the initiation. The last case is more general, the node receives the message which has been routed at least k − 1 steps and has to forward it towards selected destinations. – 1-hop after initiation. The node A1 receives a message m, A0 , . . . , Ak , h1 , . . . , hk from A0 . It checks whether m contains the identification of the node A0 and the path A0 A1 is valid, i. e., the node A0 is its direct neighbor. Then, it compares the authenticator h( 1 ||m, KA1 A0 ) with h1 . If the tests succeed, the node A1 accepts the message. It nominates a next node in the route following the node Ak , i. e., the node Ak+1 in the selected path ρ. Then, it computes the authenticator hk+1 = h( 1 ||m, KA1 Ak+1 ) designated for the node Ak+1 . It also updates received authenticators, i. e., for each j ∈ {2, . . . , k} the node computes hj = H(m, KA0 Aj , KA1 Aj ) = h( 2 ||m||hj , KA1 Aj ). Finally, it sends the routed message m, A0 , . . . , Ak+1 , h2 , . . . , hk+1 to the node A2 . – i-hop after initiation. In this paragraph we describe general scenario of routing of a message up to k − 1 steps since the initiation that includes the first step mentioned above. The node Ai receives a message m, A0 , . . . , Ak+i−1 , hi , . . . , hk+i−1 from the node Ai−1 . It checks whether m correctly contains the identification of the node A0 and the path A0 . . . Ai is valid. Then, it compares the chain of MACs H(m, KA0 Ai , . . . , KAi−1 Ai ) with received hi . If the tests succeed, it nominates the next node Ak+i in the route following the node Ak+i−1 and computes the corresponding authenticator hk+i = h( 1 ||m, KAi Ak+i ). It updates all received authenticators, i. e., for each j ∈ {i + 1, . . . , k} it computes hj = H(m, KA0 Aj , . . . , KAi Aj ) = h( i + 1 ||m||hj , KAi Aj ) and if i > 1 for each j ∈ {k + 1, . . . , k + i − 1} computes hj = H(m, KAj−k Aj , . . . , KAi Aj ) = h( i − j + k + 1 ||m||hj , KAi Aj ). Finally, it sends the message m, A0 , . . . , Ak+i , hi+1 , . . . , hk+i to the node Aj .
112
M. Novotn´ y
– Normal routing of a message at l-th step since the initiation, where l > k −1. The node Al receives a message m, Al−k , . . . , Al+k−1 , hl , . . . , hl+k−1 from the node Al−1 . It checks whether the path Al−k . . . Al is valid. Then, it computes the chain of authenticators H(m, KAl−k Al , . . . , KAl−1 Al ) and compares it with received value hl . If the tests succeed, it accepts the message. Then, it nominates the next node Al+k following the node Al+k−1 in the route and computes the authenticator hl+k = h( 1 ||m, KAl Al+k ) designated for the node Al+k . It also updates received authenticators, i. e., it computes hj = H(m, KAl−k+1 Aj , . . . , KAl Aj ) = h( k+l+1−j ||m||hj , KAl Aj ) for each j ∈ {l + 1, . . . , l + k − 1}. Finally, it sends the message m, Al−k+1 , . . . , Al+k , hl+1 , . . . , hl+k to the node Al+1 . Note that during the update of an authenticator H(m, K1 , . . . , Kj ) = h( j ||m|| H(m, K1 , . . . , Kj−1 ), Kj ) from received H(m, K1 , . . . , Kj−1 ) a node cannot verify the validity of H(m, K1 , . . . , Kj−1 ). However, the node needs to check the right type, i. e., the right size of the received authenticator in order to avoid a type-flaw attack. For the sake of simplicity, we do not define the process of completing the routing. In the case, when a node does not want to continue in routing of a message, it does not select a next node following the last chosen and also skips the corresponding authenticator. However, the node has to forward the message with updated authenticators to already selected next node. Similarly, already chosen nodes – up to the last one – continue to complete the routing.
4 4.1
A Formal Model of the k-Generalized Canvas Scheme The Applied-Pi Calculus
The applied pi-calculus [1] is a language for describing concurrent processes and their interactions. It is based on the pi-calculus, but is intended to be less pure and therefore more convenient to use. Moreover, the applied pi-calculus allows us to define less usual communication and cryptographic primitives by defining function symbols and some equivalences on terms. We briefly describe the syntax and the operational semantics of the applied pi-calculus from the paper [3]. In the set of function symbols we distinguish between constructors and destructors. Constructors are used to build terms. On the other hand, destructors do not appear in terms, but only manipulate terms in processes. Moreover, we distinguish between private and public function symbols. Public function symbols can be used by an adversary, but he is forbidden to use private ones. The set of terms is built from names, variables and constructors applied to other terms. Note that the terms are untyped and the calculus is monadic. Syntax and Informal Semantics. Plain processes are defined as follows. The nil process 0 does nothing; νa.P generates a fresh name a and then behaves as P ; if M = N then P else Q behaves as P if M = N and as Q otherwise; P |Q executes P and Q in parallel; !P generates an unbounded number of copies of P ; event M.P executes an event M and then behaves as P ; N (x).P receives
Design and Analysis of a Generalized Canvas Protocol
113
E, P ∪ {0} −→ E, P E, P ∪ {!P } −→ E, P ∪ {P, !P } E, P ∪ {P |Q} −→ E, P ∪ {P, Q} E, P ∪ {νa.P } −→ E ∪ {a }, P ∪ {P {a /a}}, where a ∈E E, P ∪ {N M .Q, N (x).P } −→ E, P ∪ {Q, P {M/x}} E, P ∪ {if M = M then P else Q} −→ E, P ∪ {P } E, P ∪ {if M = N then P else Q} −→ E, P ∪ {Q}, if M =N E, P ∪ {event M.P } −→ E, P ∪ {P } E, P ∪ {let x = g(M1 , . . . , Mn ) in P else Q} −→ E, P ∪ {P {M /x}} if g(M1 , . . . , Mn ) −→ M 10. E, P ∪ {let x = g(M1 , . . . , Mn ) in P else Q} −→ E, P ∪ {Q} if there exists no M such that g(M1 , . . . , Mn ) −→ M
1. 2. 3. 4. 5. 6. 7. 8. 9.
Fig. 2. Operational semantics
a message M on a channel N and then behaves as P {M/x}, where x is bound to the input message M ; N M .P outputs a message M on a channel N and then executes P . Note that channels can be arbitrary terms, not only names. We abbreviateif M = N then P when Q = 0, a batch of parallel compositions n n P1 | . . . |Pn as i=1 Pi , and a sequence of executions P1 . . . Pn as i=1 Pi . The name a is bound in the process νa.P . The variable x is bound in P in the processes N (x).P and let x = M in P . A process is closed if it has no free variables; it may have free names. The process let x = g(M1 , . . . , Mn ) in P else Q tries to evaluate g(M1 , . . . , Mn ); if it succeeds, then x is bound to the result and P is executed, else Q is executed. More precisely, the semantics of a destructor g of arity n is given by a set def(g) of rewrite rules of the form g(M1 , . . . , Mn ) −→ M , where M1 , . . . , Mn , M are terms without names, and the variables of M also occur in M1 , . . . , Mn . We extend these rules by g(M1 , . . . , Mn ) −→ M if and only if there exist a substitution σ and a rewrite rule g(M1 , . . . , Mn ) −→ M in def(g) such that Mi = σMi for all i ∈ {1, . . . n}, and M = σM . Operational Semantics and Traces. We use the definition of operational semantics of the applied pi-calculus from the paper [3]. This semantics is superficially different from [1] where is defined using structural congruence relation and reduction relation on processes. However, it provides simplification in a definition of the data integrity property and in a proof that the property holds. A semantic configuration is a pair E, P where the environment E is a finite set of names and P is a finite multiset of closed processes. The environment E must contain at least all free names of processes in P. The semantic configuration {a1 , . . . , an }, {P1 , . . . , Pm } corresponds intuitively to the process νa1 . . . νan (P1 | . . . |Pm ). The semantics of the calculus is defined by a reduction relation −→ on semantic configurations as shown in Fig. 2. Note that the equality in conditional rules 6–7 means syntactic equality. We say that a trace T = E0 , P0 −→n En , Pn satisfies message (N, M ) and denote T m (N, M ) if and only if the trace T contains a reduction E, P ∪ {N M .Q, N (x).P } −→ E, P ∪ {Q, P {M/x}} for some E, P, x, P, Q.
114
M. Novotn´ y
Intuitively, the trace satisfies message (N, M ) when the message M has been sent on the channel N . We say that a trace T = E0 , P0 −→n En , Pn satisfies event M and denote T e M if and only if T contains a reduction E, P ∪ {event M.P } −→ E, P ∪ {P } for some E, P, P . Intuitively, the trace satisfies event M when the event M has been executed. We say that a trace T = E0 , P0 −→q Eq , Pq is a subtrace of a trace T = E0 , P0 −→n En , Pn and denote T T if and only if q ≤ n and the trace T is equal to the trace T up to q-th reduction, i. e., E0 = E0 , P0 = P0 , . . . , Eq = Eq , Pq = Pq . 4.2
A Formal Model of the Scheme
Public Function Symbols. For the sake of clarity in the formal model of the scheme, we use formatted routed messages R1 , . . . , Rk with fixed number of fields. We introduce public constructors Rk /3k + 1, Ri /2k + i + 1, for all i < k. Public constructors Tn /n, for all 2 ≤ n ≤ k + 1 are used for creating n-tuples. However, we denote tuples using standard notation as ( , . . . , ). In addition, we R1 introduce inverse, unary function symbols – public destructors F1R1 , . . . , F2k+2 for selecting a field in the routed message R1 . This way, we add rewrite rules FiR1 (R1 (x1 , . . . , xi , . . . , x2k+2 )) −→ xi . Similarly, we add rewrite rules for public R destructors Fi j in order to select i-th field in a formatted message Rj and for public destructors FiTn in order to select i-th field in n-tuple. Note that we use formatted messages only for clarity. They have similar properties as tuples and the attacker can modify the tags R1 , . . . , Rk . Therefore, the tags do not provide any security protection. In order to model message authentication codes we introduce a binary function symbol – a public constructor h/2, with no corresponding destructor. The fact that h(m, K) = h(m , K ) only when m = m and K = K models that h is collision-free. The absence of a destructor for h models the one-wayness of h. We do not introduce a special function symbol for the chain of message authentication codes. We use the notation H(m, K1 , . . . , Kn ) as an abbreviation of the recursively defined term H(m, K1 , . . . , Kn ) as h((1, m), K1 ), if n = 1, and H(m, K1 , . . . , Kn ) = h((n, (m, H(m, K1 , . . . , Kn−1 ))), Kn ), otherwise. For this purpose, we add public constant constructors 1/0, . . . , k/0 into the set of function symbols. Note that the concatenation of strings is represented by tuples. Both string representations of the depth of the chain of MACs and MACs have known size. This way, one can select a field of the concatenated message similar to tuples. Lemma 1. H(m, K1 , . . . , Kn ) = H(m , K1 , . . . , Kn ) if and only if m = m , n = n and Ki = Ki for all i ≤ n. Proof. The direction ⇐ is trivial. We prove the opposite direction by induction according to the depth n of the term H(m, K1 , . . . , Kn ). If n = 1, then from the definition H(m, K1 ) = h((1, m), K1 ). If n > 1 then H(m , K1 , . . . , Kn ) =
Design and Analysis of a Generalized Canvas Protocol
115
h((n , (m , H(m , K1 , . . . , Kn−1 = h((1, m), K1 ). Therefore n = 1 and ))), Kn ) h((1, m), K1 ) = h((1, m ), K1 ) only when m = m and K1 = K1 . Let us assume that for j < n is the statement true and n > 1. We have H(m, K1 , . . . , Kn ) = h((n, (m, H(m, K1 , . . . , Kn−1 ))), Kn ). If n = 1, then h((1, m ), K1 ) = h((n, (m, H(m, K1 , . . . , Kn−1 ))), Kn ). Therefore it must hold that n > 1 and from the equation h((n, (m, H(m, K1 , . . . , Kn−1 ))), Kn ) = h((n , (m , H(m , K1 , . . . , Kn −1 ))), Kn ) we obtain two equalities Kn = Kn and (n, (m, H(m, K1 , . . . , Kn−1 ))) = (n , (m , H(m , K1 , . . . , Kn −1 ))). Consequently, it holds H(m, K1 , . . . , Kn−1 ) = H(m , K1 , . . . , Kn −1 ), m = m , and n = n . Finally, from the induction hypothesis we obtain m = m , n = n and Ki = Ki for all i ≤ n.
Processes of the k-Generalized Canvas protocol. We define a formal model of the k-generalized Canvas scheme for a sensor network and a fixed security parameter k ≥ 2. The network is represented by a communication graph G = (V, E), where |V | = nG . We distinguish between two kinds of nodes: captured and honest. Let a set of captured nodes be C ⊆ V and a set of honest nodes V \ C. Note that the communication graph and the set of captured nodes are static and do not change during the operational phase of the scheme. An active adversary is represented by any closed process interacting with the below defined process Network(G, C, k), which has a set of public names in its initial knowledge, can use public function symbols, and does not contain events. Actions of the attacker are not explicitly defined. However, the initial knowledge of the attacker contains a free name of the public “attacker” channel cA . In the beginning, the attacker obtains identifications and channels of captured nodes from the process Network(G, C, k). The attacker can use these channels for receiving messages. Moreover, he retrieves identifications and communication channels of nodes which are direct neighbors of captured nodes. The attacker can communicate via these channels. He also gains all established keys of the captured nodes shared with their neighbors up to the distance k and information about the local topology of the captured nodes. On the other hand, the attacker is forbidden to communicate via private channels. We define the whole process of the sensor network Network(G, C, k) for a security parameter k and a communication graph G = (V, E) with respect to a set of captured nodes C as Network(G, C, k) = νidv1 . . . νidvnG . νcv1 . . . νcvnG . νK1 . . . νKt . nG (Topology | Select | Select | Channel | Key | i=1 Node). First, for all nodes v1 , . . . , vnG ∈ V there are generated names idv1 , . . . , idvnG for their identification and fresh names cv1 , . . . , cvnG of their communication channels. There are also created all fresh keys K1 , . . . , Kt individually shared in each pair of nodes from V when their distance is up to k. Then, the whole process consists of the parallel composition of processes: – Topology distributes mainly information about the local topology of nodes. First, the process executes an event CAPTURED(idu ) for each captured node
116
M. Novotn´ y
u ∈ C and an event HONEST(idv ) for each honest node v ∈ V \ C. Then, the process sends: • a message (idv , cv ) on the “attacker” public channel cA , for each captured node v ∈ C and for each v ∈ V \C, such that exists u ∈ C and u ∈ N1 (v); • a message (idv0 , . . . , idvk ) on the “attacker” public channel cA , for all nodes v0 , . . . , vk ∈ V , if v0 ∈ C and v0 . . . vk ∈ π k (G); • a message (idu , idv , Ki ) on the “attacker” public channel cA , for each key Ki shared between a captured node u ∈ C and a node v ∈ V ; • a message (idv , cv ) on the private channel pTop , for each node v ∈ V .
–
–
–
–
–
Later, the process provides information about the local topology of a node. For each l ∈ {1, . . . , k} and all nodes v0 , . . . , vl ∈ V , the process contains the parallel composition of !pVl (idvl , . . . , idv0 )true, if vl . . . v0 ∈ π l (G) and !pVl (idvl , . . . , idv0 )false otherwise. This way a node x0 can check the validl ity of a path xl . . . x0 of the length l via the private channel pV (xl , . . . , x0 ). Select chooses k nodes on a valid path non-deterministically. For all nodes v0 , . . . , vk ∈ V , such that v0 . . . vk ∈ π k (G), the process contains the parallel composition of !pS (idv0 )(idv1 , . . . , idvk ). This way, a node x can receive a nondeterministic choice of k nodes on a valid path starting in x via the private channel pS (x). Select chooses a next node which follows k nodes on a valid path nondeterministically. For all nodes v0 , . . . , vk ∈ V , such that v0 . . . vk ∈ π k (G), the process contains the parallel composition of !pS (idv0 , . . . , idvk−1 )idvk . A node x0 can receive a nondeterministic choice of a next node which follows k nodes x0 , . . . , xk−1 on valid path via the private channel pS (x0 , . . . , xk−1 ). Key provides access to established shared keys. In the beginning of the process Network(G, C, k), exactly one key is generated for each pair of nodes when the distance between them is up to k. For each key Ki shared between nodes u, v ∈ V , such that the distance between them is up to k, the process contains the parallel composition of !pK (idu , idv )Ki |!pK (idv , idu )Ki . A node x can receive the key shared with a node y via the private channel pK (x, y). Channel provides a name of the communication of a node for its nG channel direct neighbor. The process is defined as i=1 !pCh (idvi )cvi . A node can receive the name of communication channel of a node x via the private channel pCh (x). Node describes the behavior of a sensor device as shown in Fig. 3. First, the process obtains its identification id and the name of channel c for receiving messages via the private channel pTop (line 1). Then, the process consists of the parallel composition of processes:
– Message initiation (lines 2–5). The process creates a new message m and marks the initiation of the message in the event INIT(m, id) (line 3). Via private channels, it receives nondeterministic selections of nodes A1 , . . . , Ak on the valid path idA1 . . . Ak , corresponding keys K1 , . . . , Kk individually shared with selected nodes, and the communication channel c1 of the next hop A1 . Finally, it sends the routed message R1 on the channel c1 (line 5).
Design and Analysis of a Generalized Canvas Protocol
117
– i-hop after initiation (lines 6–11), where i < k. The process receives a routed message Ri on its channel c from a sender Ai−1 . It checks whether the identification of a node A0 is correctly included in the received message as an originator of the message, i. e., A0 = o and the routed message is designated for the node, i. e., id = Ai . A next-hop in the route is assigned in the variable Ai+1 (line 7). The node checks whether the path A0 . . . Ai is a valid path of the length i (line 8). Then, the process obtains keys Kj individually shared with all previous hops Aj , where j ∈ {0, . . . , i − 1}. It computes the chain of MACs H((o, m), K0 , . . . , Ki−1 ) and compares it with received hi . If the test succeeds, it marks the acceptation of the message m originated from the node o in the event ACCEPT(m, o, id) (line 10). The process chooses the next-hop Ai+k , which follows the last already chosen hop Ak+i−1 in the route. Then, it obtains keys Kj individually shared with all next nodes Aj , where j ∈ {i + 1, . . . , k + i}. It retrieves a name of the channel ci+1 of the next-hop Ai+1 and sends the routed message Ri+1 on the channel ci+1 (line 11). Note that the depth of the chain of MACs designated for nodes Ai+1 , . . . , Ak has the same value i + 1. The depth of the chain of MACs designated for nodes Ak , . . . , Ak+i decreases from i + 1 to 1. – Normal routing (lines 12–17). The node receives a routed message Rk on its channel c from a sender A−1 . The received message Rk contains an original message (o, m) from the originator o (line 13). The process checks whether the routed message is designated for the node, i. e., id = A0 , and the path A−k . . . A0 is valid (line 14). Then, the process receives keys Kj individually shared with all previous hops Aj , where j ∈ {−k, . . . , −1}. It computes the chain of MACs H((o, m), K−k , . . . , K−1 ) and compares it with received h0 (line 15). If the test succeeds, it marks the acceptation of the message m originated from the node o in the event ACCEPT(m, o, id) (line 16). Then, the process chooses the next hop Ak , which follows the last hop in the route Ak−1 (line 16). Then, it obtains keys Kj individually shared with the next hops Aj , where j ∈ {1, . . . , k} (line 16). It retrieves the channel c1 of the next-hop A1 and sends the routed message Rk on the channel c1 (line 17). Note that the depth of the chain of MACs designated for nodes A1 , . . . , Ak decreases from k to 1.
5
A Formal Analysis of the Data Integrity Property
Definition 1 (Data integrity). We say that a trace T = E0 , P0 −→n En , Pn satisfies the data integrity property if and only if in all subtraces T T hold: (T e HONEST(z) ∧ T e ACCEPT(x, y, z)) ⇒ (T e INIT(x, y) ∨ T e CAPTURED(y)). Intuitively, a trace satisfies the data integrity property when during all reductions of the trace if an honest node z accepts a message x originated from a node y, then the node y has already initiated the message x or the node y is captured.
118
M. Novotn´ y N ode 1. pTop (id, c) . 2. 3. 4. 5.
( //Message initiation !νm . event INIT(m, id) . k K Ch pS (id)((A1 , . . . , Ak )) . (A1 )(c1 ) . i=1 p (id, Ai )(Ki ) . p c1 R1 ((id, m), id, A1 , . . . , Ak , h((1, (id, m)), K1 ), . . . , h((1, (id, m)), Kk )) ) |
k−1 6. i=1 ( //i-hop after initiation 7. !c(Ri ((o, m), A0 , . . . , Ak+i−1 , hi , . . . , hk+i−1 )) . i
8. if o = A0 then if id = Ai then pV (A0 , . . . , Ai )(x) . if x = true then i−1 K 9. j=0 p (id, Aj )(Kj ) . if hi = H((o, m), K0 , . . . , Ki−1 ) then k+i K 10. event ACCEPT(m, o, id) . pS (Ai , . . . , Ak+i−1 )(Ak+i ) . j=i+1 p (id, Aj )(Kj ) . Ch 11. p (Ai+1 )(ci+1 ) . ci+1 Ri+1 ((o, m), A0 , . . . , Ai+k , h((i + 1, ((o, m), hi+1 )), Ki+1 ), . . . , h((i + 1, ((o, m), hk )), Kk ), . . . , h((1, (o, m)), Kk+i )) ) | 12. ( //Normal routing 13. !c(Rk ((o, m), A−k , . . . , Ak−1 , h0 , . . . , hk−1 )) . k
14. if id = A0 then pV (A−k , . . . , A0 )(x) . if x = true then −1 K 15. j=−k p (id, Aj )(Kj ) . if h0 = H((o, m), K−k , . . . , K−1 ) then k K 16. event ACCEPT(m, o, id) . pS (A0 , . . . , Ak−1 )(Ak ) . j=1 p (id, Aj )(Kj ) . Ch 17. p (A1 )(c1 ) . c1 Rk ((o, m), A−k+1 , . . . , Ak , h((k, ((o, m), h1 )), K1 ), . . . , h((2, ((o, m), hk−1 )), Kk−1 ), h((1, (o, m)), Kk )))
Fig. 3. The process Node
Lemma 2. For an arbitrary communication graph G, a set of captured nodes C, a security parameter k ≥ 2 and for all traces T of the corresponding process Network(G, C, k) in the presence of an active adversary, – T m (c, m ) and T m (pK (r, s), K), Ri – Fk+i+2 (m ) = H((o, m), K1 , . . . , Ki ), where i ≤ k and K ∈ {K1 , . . . , Ki }, e – T HONEST(r) and T e HONEST(s), imply that T e INIT(m, o), or T e ACCEPT(m, o, s), or T e ACCEPT(m, o, r). Proof. A message m of the form Ri , where i ∈ {1, . . . , k}, was sent on some channel c. It contains a term H((o, m), K1 , . . . , Ki ), where K = Kj for some j ∈ {1, . . . , i}. The key Kj is shared between two honest nodes r, s. With respect to the definition of the chain of message authentication codes and Lemma 1, the occurred term H((o, m), K1 , . . . , Ki ) is uniquely created from the term H((o, m), K1 , . . . , Kj ). According to the definition of Network(G, C, k), the key Kj is not published on the “attacker” channel cA . With respect to the definition of the process Node, creating and sending of the term H((o, m), K1 , . . . , Kj ) (Fig. 3 lines 5, 11, 17) by nodes r, s can be done after marking corresponding events. The term H((o, m), K1 , . . . , Kj ) could be created by honest nodes r, s: – in the message initiation (Fig. 3 line 5). Then i = j = 1, (r = o, or s = o) and the event INIT(m, o) must be executed. – in the message routing (Fig. 3 lines 11, 17). Then, the event ACCEPT(m, o, s), or the event ACCEPT(m, o, r) must be executed.
Design and Analysis of a Generalized Canvas Protocol
119
Let us assume that not one from the events ACCEPT(m, o, r), ACCEPT(m, o, s), INIT(m, o) occurs in the trace T . Therefore, the term H((o, m), K1 , . . . , Kj ) must be created by the attacker. For this purpose, the key Kj must be in his knowledge. On the other hand, the key Kj is not published on the “attacker” channel cA in the process Topology, since the nodes r, s are honest. Moreover, the attacker is forbidden to use private channels pK (r, s), pK (s, r). He is not able to deduce Kj from eavesdropping the communication in the trace T , because the key Kj can be sent by honest nodes r, s (Fig. 3 lines 5, 11, 17) only in a term h( , Kj ) and in the set of function symbols there is no destructor for the function h/2. Therefore, at least one event from INIT(m, o), ACCEPT(m, o, s), ACCEPT(m, o, r) must occur in the trace T . Theorem 1. For an arbitrary communication graph G, a set of captured nodes C, and a security parameter k ≥ 2, assuming that on each path of the length k − 1 in G there exists at least one honest node, it holds that all traces T of the corresponding process Network(G, C, k) in the presence of an active adversary satisfy the data integrity property. Proof. We prove the theorem by contradiction. Let us assume that the statement is not true. Therefore, there exists a communication graph G , a set of captured nodes C , and a parameter k ≥ 2, such that on each path of the length k −1 in G there exists at least one honest node. There also exists a closed process that represents the active adversary interacting with the process Network(G , C , k). For the whole process there exists a trace which does not satisfy the integrity property. Hence, there must exist its subtrace T = E0 , P 0 −→n En , P n , such that exist m , o , id and T e ACCEPT(m , o , id ), T e HONEST(id ), T e INIT(m , o ), T e CAPTURED(o ). From the trace T , we take subtraces T , T T in order to have two traces T = E0 , P 0 −→q Eq , P q and T = E0 , P 0 −→q−1 Eq−1 , P q−1 , where q ≤ n. Moreover, there exists id ∈ Eq−1 such that T e ACCEPT(m , o , id ), T e HONEST(id ), and there is no x ∈ Eq−1 such that T e HONEST(x) e and T ACCEPT(m , o , x). From the trace T , it holds T e INIT(m , o ) e and T CAPTURED(o ). Intuitively, the honest node id is the first honest node that accepts the message m originated from o exactly at q-th reduction step in the trace T . Therefore, in the trace T , which is a subtrace of T of the length q − 1 reductions, the message m originated from o is not accepted by any honest node x. Note that the node id can be the same node as id . According to the definition of the process Node, the node id receives its name id and a channel name c on the private channel pTop . More formally, there exists c ∈ Eq−1 such that T m (pTop , (id , c )). We consider all cases, when the event ACCEPT(m , o , id ) could occur in the trace T : – i-hop after initiation, where i ≤ k − 1. According to the definition of the appropriate part of the process Node (Fig. 3 lines 6–9), there must exist K0 , . . . , Ki−1 ∈ Eq−1 , such that holds T m (pK (id , o ), K0 ) and T m (c , Ri ((o , m ), o , . . . , H((o , m ), K0 , . . . , Ki−1 ), . . .)). With respect to the
120
M. Novotn´ y
definition of the process Topology from T e CAPTURED(o ) we obtain e T HONEST(o ). However, together with T e ACCEPT(m , o , o ), e e T ACCEPT(m , o , id ), T INIT(m , o ), this contradicts Lemma 2. – Normal routing. According to the definition of the process Node (Fig. 3 , . . . , K−1 , A−k , . . . , A−1 ∈ Eq−1 , such lines 13–15), there must exist K−k m K that holds T (p (id , Aj ), Kj ), for all j ∈ {−k, . . . , −1} and T m (c , Rk ((o , m ), A−k , . . . , A−1 , id , . . . , H((o , m ), K−k , . . . , K−1 ), . . .)). We consider all possibilities according to the honesty of previous hops A−k , . . . , A−1 in the route: • All previous hops are captured, i. e., T e CAPTURED(Aj ) for all j ∈ {−k, . . . , −1}. With respect to the definition of the process Node k (Fig. 3 line 14), we have T m (pV (A−k , . . . , A−1 , id ), true). According to the definition of the process Topology, the path A−k . . . A−1 id is the valid path of the length k. Nevertheless, the existence of the valid path A−k . . . A−1 of the length k − 1 which consists of all captured nodes contradicts the assumption. • At least one previous hop Aj is honest, i. e., T e HONEST(Aj ), for some j ∈ {−k, . . . , −1}. Nevertheless, facts T e ACCEPT(m , o , id ), e e ACCEPT(m , o , Aj ), and T INIT(m , o ) contradict Lemma 2. T
6
Conclusion
In the paper we presented design and analysis of a k-generalized Canvas protocol. We discussed a motivation for generalization of the Canvas protocol and proposed a k-generalized version of the scheme. The design of the scheme combines the property of the communication graph of the sensor network with the used message authentication codes. In particular, for the case k = 2 we improved the Canvas scheme, since in the routed message only two authenticators are sent, fewer than three in the original scheme. Similar problem was studied in [12] where Zhu et al. proposed the scheme which protects against false data injection attacks. In future work we would like to consider application of the proposed k-generalized Canvas scheme for this and similar problems stated in literature. We built a formal model of the k-generalized Canvas protocol in the applied pi-calculus. This model includes a model of the network topology, communication channels, captured nodes and capabilities of the attacker. Development of this kind of model was formulated as a challenge in the computer security research field [5]. In the semantic model of the applied pi-calculus we specified the data integrity property of the scheme. Finally, we proved that proposed k-generalized Canvas scheme in the presence of an active adversary provides the data integrity of messages. We proved the property for a security parameter k ≥ 2, an arbitrary communication graph and a set of captured nodes assuming that at least one honest node exists on each path of the length k − 1 in the communication graph. The proposed formal model could be applied to other WSN security protocols as well. In future work we are planning to analyze other WSN security protocols focusing on different phases of the sensor network in order to model
Design and Analysis of a Generalized Canvas Protocol
121
the abilities of an adversary in more detail. The applied pi-calculus allows us to model various cryptographic primitives. Moreover, the Proverif tool [4] can be used for automatical verification of correspondences [3]. Unfortunately, an automatical analysis could be done for a concrete communication graph and a set of captured nodes.
References 1. Abadi, M., Fournet, C.: Mobile values, new names, and secure communication. In: Proceedings of the 28th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 104–115. ACM, New York (2001) 2. Armando, A., et al.: The Avispa Tool for the automated validation of internet security protocols and applications. In: Etessami, K., Rajamani, S.K. (eds.) CAV 2005. LNCS, vol. 3576, pp. 281–285. Springer, Heidelberg (2005) 3. Blanchet, B.: Automatic Verification of Correspondences for Security Protocols. Journal of Computer Security 17(4), 363–434 (2009) 4. Blanchet, B.: An Efficient Cryptographic Protocol Verifier Based on Prolog Rules. In: Proceedings of 14th IEEE Computer Security Foundations Workshop, pp. 82– 96. IEEE Computer Society, Washington (2001) 5. Gollmann, D.: Protocol analysis for concrete environments. In: Moreno D´ıaz, R., Pichler, F., Quesada Arencibia, A. (eds.) EUROCAST 2005. LNCS, vol. 3643, pp. 365–372. Springer, Heidelberg (2005) 6. Menezes, A., van Oorshot, P., Vanstone, S.: Handbook of Applied Cryptography. CRC Press, Boca Raton (1996) 7. Tobarra, L., et al.: Model Checking Wireless Sensor Network Security Protocols: TinySec + LEAP. In: Orozco-Barbosa, L., et al. (eds.) Wireless Sensor and Actor Networks. IFIP, vol. 248, pp. 95–106. Springer, Boston (2008) 8. Vogt, H.: Exploring Message Authentication in Sensor Networks. In: Castelluccia, C., Hartenstein, H., Paar, C., Westhoff, D. (eds.) ESAS 2004. LNCS, vol. 3313, pp. 19–30. Springer, Heidelberg (2005) 9. Vogt, H.: Increasing Attack Resiliency of Wireless Ad Hoc and Sensor Networks. In: Proceedings of the Second International Workshop on Security in Distributed Computing Systems (ICDCSW 2005), vol. 2, pp. 179–184. IEEE Computer Society, Washington (2005) 10. Vogt, H.: Integrity preservation for communication in sensor networks. Technical Report 434, Institute for Pervasive Computing. ETH Z¨ urich (2004) 11. Xiao, Y., Du, X.: A Survey on Sensor Network Security. In: Li, Y., et al. (eds.) Wireless Sensor Networks and Applications. Signals and Communication Technology Series, pp. 403–421. Springer, Heidelberg (2008) 12. Zhu, S., Setia, S., Jajodia, S., Ning, P.: Interleaved hop-by-hop authentication against false data injection attacks in sensor networks. ACM Transactions on Sensor Networks 3(3), article 14 (2007)
Efficient Mutual Authentication for Multi-domain RFID Systems Using Distributed Signatures Michael Braun1 , Ulrike Meyer2 , and Susanne Wetzel3 1
University of Applied Sciences Darmstadt, Germany 2 RWTH Aachen University, Germany 3 Stevens Institute of Technology, Hoboken, NJ, US
Abstract. The use of RFID technology in complex and distributed environments often leads to a multi-domain RFID system in which security issues such as authentication of tags and readers, granting access to data, and revocation of readers turn into an administrative challenge. In this paper, we propose a new public-key-based mutual authentication protocol that addresses the reader revocation problem while maintaining efficiency and identity privacy. In addition, our new protocol integrates fine-grained access control and key establishment with mutual authentication. The core of our solution is the use of the concepts of key-splitting and distributed signatures to solve the validation and revocation problem. We show that our protocols can be implemented on RFID tags using lightweight implementations of elliptic curve cryptography. Keywords: RFID Security, Elliptic Curve Cryptography, Authentication, Data on Tag, Secret Sharing, Distributed Signatures, Key Splitting, Identity Privacy.
1
Introduction
Radio Frequency Identification (RFID) technology has become a ubiquitous part of our daily lives. Prominent applications include logistics and electronic travel documents. While in early applications only a unique identifier was stored on an RFID tag, a more recent trend leans towards storing more information on the tag. For example, the new electronic passports include sensitive data such as fingerprints as well as the facial image of the passport holder. As a consequence, security challenges have evolved from protecting the identifier and preventing tag cloning to enabling fine-grained access control to the data stored on the tag and enabling secure data exchange between the reader and the tag. Common approaches to meet these challenges are either based on symmetrickey techniques (e.g., [1,2,7,17]) or the use of public-key technology (e.g., [6,9,13]). While symmetric-key-based approaches are generally more efficient than publickey mechanisms, key management issues make them difficult to use in practice. Typically, today’s public-key-based mechanisms require the use of certificates and as a consequence the verification and validation of chains of certificates. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 122–137, 2010. c IFIP International Federation for Information Processing 2010
Efficient Mutual Authentication for Multi-domain RFID Systems
123
The former requires signature verification on the tag which was shown to be feasible in practice [6]. However, the validation (checking the expiration date and the revocation status) of certificates is often not addressed [6] or still proves challenging. For example, the specification of the electronic travel documents [9] does not include any revocation mechanisms. In addition, checking the expiration date of a certificate is based on the tag approximating the current time with the most recent effective date of all valid certificates received. This possibly results in stolen or lost readers being able to read sensitive data of the tag as long as the tag’s approximate time is before the expiration date of the certificate of the respective reader. Also, tags that are read infrequently and thus have an old approximate time can be read by readers with expired certificates as long as the tag’s time is before the expiration date of the reader’s expired certificate. While [9] does not specify any access control mechanisms for data on electronic travel documents, the specification for the German personal identification card [9] defines a reader’s access control rights as part of its certificate. State-of-theart mechanisms (regardless of whether symmetric or public-key-based) define key establishment procedures on top of the authentication to subsequently allow for a secure data exchange between the reader and the tag. It is in this context that this paper proposes a new public-key-based mutual authentication protocol that addresses the validation and revocation problem while maintaining efficiency and identity privacy integrating fine-grained access control and key establishment. The core of our solution is the use of the concepts of key-splitting and distributed signatures to address the validation and revocation problem during authentication. The rest of this paper is organized as follows: In Section 2 we provide a highlevel overview of our system model, the building blocks we use, and discuss some additional related work. In Section 3 we describe our protocol in case a tag is to be read while it is in its home domain. In Section 4 the protocol is extended to support authentication in visited domains. Section 5 evaluates the feasibility of our protocol on RFID tags.
2 2.1
Our Approach System Model
Our RFID system model consists of one or more domains which in turn include three types of entities: tags, readers, and authentication centers (see Figure 1). In particular, a tag T and a reader R belong to an administrative domain D which is controlled by an authentication center A—which in the following is referred to as home domain. While a tag is typically attached to an object that may roam to other administrative domains, also referred to as visited domains, a reader will always remain in its home domain only. Furthermore, we assume that a reader is always connected to its home authentication center via a secure channel and authentication centers of different domains are interconnected securely. Each tag stores data in blocks grouped according to certain access controls. These access controls are read and/or write conditions which are set and controlled
124
M. Braun, U. Meyer, and S. Wetzel Domain of A∗ A∗
Domain of A A
Domain of A A
R
R R
T T
T
Fig. 1. Our RFID System Model
by the tag’s authentication center. Different tags from the same domain may have different access controls. Similarly, different readers from the same domain may have different access rights for different tags (of its own or other domains). In our model, each authentication center has a single public key and each tag stores the public key of its home authentication center. 2.2
Building Blocks for Our Protocols
Reader-to-Tag Authentication and Revocation: The key concepts used to achieve reader-to-tag authentication and revocation are key splitting and distributed signatures. Generally, the concept of key splitting refers to a private key being split into several key parts which are distributed to multiple parties in such a way that only specific combinations of these parties can together reconstruct the full private key. Based on key splitting of a private signature key it is possible to construct distributed signature schemes such that a valid signature can only be generated if the specific combination of parties contribute to the process. In the context of this paper, the private key to be split corresponds to the public key of an authentication center. Assuming an authentication center A∗ controls n∗ readers and is connected to ∗ other authentication centers in the system, then the authentication center computes n∗ + ∗ unique splits of its private key into two parts. For each such pair it keeps both parts to itself and distributes one part to either a reader or some other authentication center. The splitting is done such that no combination of readers and other authentication centers can reconstruct the full private key without A∗ contributing its corresponding key part. In addition, each authentication center A splits the key part
Efficient Mutual Authentication for Multi-domain RFID Systems
125
it received from A∗ into n pairs of key parts and distributes one part of each pair to one of its n readers. For our new protocols we use the concept of distributed signatures in a novel way which enables reader authentication to the tag and solves the revocation and validation problem of reader certificates. Specifically, when a tag is in its home domain, reader authentication is based on a two-party signature generated by the tag’s home authentication center and the reader itself. A similar approach was previously used in the context of WLANs [16]. When a tag is in a visited domain, reader authentication is based on a novel multi-party signature scheme in which the tag’s home authentication center, the visited authentication center, and the reader each contribute their key part to the signature generation process. As detailed in Sections 3 and 4, using the key-splitting and multi-party signature approach allows the construction of challenge-response reader-to-tag authentication protocols that have several advantages over the current stateof-the-art in which a certificate is issued for each reader. The new protocols simultaneously allow a tag to authenticate the reader, determine the reader’s access rights, and check the revocation status of not only the reader but also that of the visited domain. In particular, a tag needs to handle only one key (i.e., the public key of its home authentication center) and needs to verify only one signature regardless of whether the tag is in its home or in a visited domain. While revocation in current certificate-based solutions require a tag to check the validity of a certificate (or even a chain of certificates in case the tag is in a visited domain), the new protocols implicitly allow for revocation checking as the visited authentication centers simply will not participate in the authentication (which is based on distributed signatures) of revoked readers. In addition, the home authentication center can revoke an entire domain by not participating in authentication sessions of a particular visited domain. Key Agreement, Identity Privacy, and Tag-to-Reader Authentication: In order to achieve tag-to-reader authentication, allow for identity privacy, and establish a symmetric (short-lived) session key, our new protocols are based on a construction originally introduced in [6]. The construction in [6] is based on a combined challenge-response exchange and a Diffie-Hellman key agreement. The protocol roughly works as follows: Upon receiving the public Diffie-Hellman component from the tag, the reader signs both its public Diffie-Hellman component and that of the tag using its public key. Receiving the reader’s signature and public Diffie-Hellman component, the tag can then check the authenticity of the exchange of the public Diffie-Hellman components and is thus assured of the reader’s authenticity, i.e., that no man-in-the-middle is present. This, however, assumes that each tag has an authentic copy of every reader’s public key which is a major drawback in the context of multi-reader and even more so multi-domain systems. Then, the tag will use the established Diffie-Hellman key to encrypt a message which includes the response to a reader-issued challenge (computed using the tag’s private key) and a certificate composed of the tag’s identity and public key. Upon receiving the message from the tag, the reader first decrypts the message. A correct decryption guarantees the authenticity of the shared session
126
M. Braun, U. Meyer, and S. Wetzel
key. Furthermore, the reader learns the identity of the tag from the certificate. The authenticity of the certificate combined with the verification of the response (using the tag’s public key) ensures the authenticity of the tag. Our construction, which is further detailed in Sections 3 and 4, is designed to address the major shortcoming of [6]. That is, while we make use of the Diffie-Hellman key exchange and the tag-to-reader authentication, we eliminate the need to store each reader’s public key on each tag using the ideas of key splitting and distributed signatures described above. It is important to note that [6] does not address revocation of pre-stored public keys of the readers. In addition, our solution further improves on [6] by solving an issue that was not even addressed there, namely the introduction of access right management. Our scheme provides identity privacy that is equivalent to the granularity at which a tag’s access conditions are specified. In particular, if all tags have the same access conditions, then our scheme provides full tag identity privacy as in [6]. It is important to note that the key splitting as used in our protocols does not require an encrypted channel for key transfer between the authentication center and the reader. Instead, the key is generated directly by the entities that use the key, namely the reader and the tag. 2.3
Other Related Work
The problem of certificate validation checking in the context of public-key-based reader-to-tag authentication has been addressed in some prior work. This includes the use of short-lived certificates, the use of hash-chain-based mechanisms, and the use of server-based authentication [13]. The first two approaches require time-synchronization which is questionable both with respect to security and practicality. In addition, for the second approach it is unclear how it can easily be extended to multiple domains. Finally, in the last approach the tag either needs to verify more than two signatures when roaming to visited domains or needs to pre-store more than one certificate. Our protocol addresses and overcomes all of these shortcomings. (2, ) threshold DSS signature schemes for ≤ 3 have first been suggested in [12] and make use of one party acting as a trusted third party. This approach was extended in [10] to (t, n) threshold signatures with n ≤ 2t + 1. Since our construction requires an (n, n) signature scheme, it is not possible to directly use the schemes in [10,12]. However, it is possible to modify the blinding in [12] to suit our purposes. In particular, while [12] blinds the shares of each of the two signers with random numbers and uses the third party to blindly construct a full signature, our construction makes use of the fact that an entity has full knowledge of all parts of all splits it computes1 . A (2, 2) DSS signature scheme was presented in [15]. This scheme requires a semantically secure homomorphic cryptosystems which is used to exchange data 1
Note that our signatures are not multi-party signatures in the traditional sense. In traditional multi-party signature schemes each party is assumed to know only its own key split.
Efficient Mutual Authentication for Multi-domain RFID Systems
127
between the two signers. The necessity of a semantically secure homomorphic cryptosystem excludes the use of standard protocols such as TLS and IPsec for securing the communication between the signing entities and as such limits the practicality of the scheme. It furthermore is not obvious how this protocol can be extended to an (n, n) signature scheme.
3
Authentication in the Home Domain
In this section, we present our new mutual authentication protocol for the case that a tag is to be read by a reader in the tag’s home domain. The protocol involves the tag T , the reader R and the tag’s home authentication center A. The tag stores the public key of its home authentication center. Reader-to-tag authentication is based on a two-party signature scheme in which the reader and the home authentication center jointly generate a signature. In the following, we first describe the key splitting between A and R and the novel two-party signature scheme based on ECDSA. We then describe how the two-party signatures are used in our new protocol. 3.1
Two-Party Signatures
We first briefly recall key and signature generation for the ECDSA scheme before we proceed to the actual key splitting and two-party signature generation. Note that our two-party signature generation also works with other DSA-based signature schemes. Exemplary, in the appendix we describe the two-party signature generation for the German version of the ECDSA signature scheme, the so-called ECGDSA. ECDSA Signatures: Let P be the base point of an elliptic curve with prime order q. Let d be the private signature key. The corresponding public signature key is Q = d · P . An ECDSA signature of a hashed message h(m) is defined to be a pair (r, s) where the first component r is the affine x-coordinate of the point k −1 · P modulo q for a randomly selected ephemeral key k. Furthermore, the second component s satisfies the equation s = k · (h(m) + d · r) mod q. Key Splitting and Initial Setup: Let Q denote the public signature key of the authentication center A. The corresponding private signature key is denoted by d. A splits the private signature key d between itself and all of its readers. For this purpose, the authentication center A picks a reader’s key part dR uniformly at random and mutually different for different readers. A then computes the corresponding part dA such that dA = d−1 R · d mod q. A provides the private key part dR to the reader R and keeps the pair (dA , dR ) for itself. Signature Generation: To jointly generate a signature on the hash value h(m) of a message m in a distributed manner, both parties, i.e., the authentication center A and the reader R, contribute to the ephemeral key k. The reader R
128
M. Braun, U. Meyer, and S. Wetzel
chooses its part kR uniformly at random and transmits it to A over the secure channel.2 The authentication center A also picks a random value kA and completes the ephemeral key generation by multiplying both parts k = kR · kA mod q. The authentication center A now knows all parts of the private signature key dA , dR and of the ephemeral key kA , kR , whereas the reader knows the parts dR and kR only. The authentication center A starts the signature generation by calculating r as the affine x-coordinate of k −1 · P = (kA · kR )−1 · P modulo q and sA = (kA − 1) · kR · h(m) + (kA · dA − 1) · kR · dR · r
mod q
which satisfies s = sA + sR where s = k · (h(m) + d · r) mod q is the second signature component and sR = kR · (h(m) + dR · r)
mod q.
Afterwards, the authentication center A sends sA to the reader R, which completes the signature (r, s) by calculating sR and adding it to sA . Security Analysis: An attacker cannot generate sR without knowledge of dR and kR . In fact, (r, sR ) is an ECDSA signature with private key dR , ephemeral −1 key kR and base point P = kA · P . The corresponding public key is Q = −1 dR · (kA · P ) = dR · P . Two (or more) collaborating readers R and R are not able to generate a valid signature (r, s) since they cannot reconstruct the secret key d from their parts dR and dR . 3.2
The Protocol
Figure 2 illustrates the message flows and message contents for our new protocol. In the following, we explain how tag-to-reader authentication, reader-to-tag authentication, and key agreement are provided by the protocol. Finally, we discuss the relationship between the granularity of access rights to tags and the identity privacy our protocol provides. Reader Authentication: Reader authentication and checking its revocation status is based on a signature generation distributed between reader R and authentication center A. The value to be signed is dhT , which is randomly generated by the tag (2) and sent to the reader as part of (3). The reader forwards dhT to the authentication center as part of (6). Before generating its part of the signature, the authentication center first checks if the reader has been revoked. If this is the case, the authentication center sends an authentication failure to the tag. Otherwise, the authentication center computes its part (r, sA ) of the digital signature (r, s) on the message m including the random value dhT (7), (8) and sends it to the reader as part of (9). The reader R completes the digital 2
As mentioned in the introduction, we assume a secure channel between A and R, which is established prior to the authentication of the tag.
(12) verify (r, s) with Q (13) compute DH key K with dhR (14) compute resp with dT
(2) compute dhT
T (dT , Q)
(15) E
(resp,cert )
T −−−−−K−−−−−−−− →
←−−−−−−−−−−−−−−−−−
(11) (r,s),dhR ,chall,rights
(3) dhT ,idclass
−−−−−−−−−−−T→
←−−−−−−−−−−−
(9) (r,sA ),rights
(6) kR ,dhT ,dhR ,idclass
−−−−−−−−−−−−−−−−T→
−−−−−−−−−−−−−−−−−→
(1) establish secure channel
Fig. 2. Authentication Protocol
(16) compute DH key K with dhT (17) decrypt resp, certT with K (18) verify certT verify resp with certT
(10) compute sR on m = dhT ||dhR ||rights||idclassT s := sA + sR
(4) compute dhR (5) pick kR
R (dR )
(7) pick kA (8) compute (r, sA ) on m = dhT ||dhR ||rights||idclassT
A (dR , dA )
Efficient Mutual Authentication for Multi-domain RFID Systems 129
130
M. Braun, U. Meyer, and S. Wetzel
signature by computing a value sR such that s = sA + sR mod q (10). After receiving (11), the tag T verifies the signature (r, s) with the help of the public signature key Q. If the signature is valid, the reader is authenticated to the tag and the tag knows that the reader is not revoked, since R was able to compute a valid signature on the challenge dhT . Tag Authentication: To authenticate the tag T to the reader R, a challengeresponse-protocol is applied as it is described in [6]. The reader chooses a random challenge chall and transmits this value to the tag as part of (11). The tag computes the corresponding response resp with its private key dT (14) and sends the response and its certificate back to the reader. The reader can then verify the response based on the tag’s certificate certT . Key Agreement: One major goal of the new protocol is to allow for the agreement on a common key K between the tag and the reader and subsequently use this key to establish a secure communication channel between the two. For the generation of this key K, the Diffie-Hellman protocol is used. The tag computes its Diffie-Hellman part dhT uniformly at random (2) and sends this value to the reader (3). The corresponding part chosen by the reader in (4) is denoted by dhR . Later, both parties T and R compute K from dhT and dhR (10), (13). Note that the tag’s value dhT is also used as challenge for the reader authentication as described before. The Diffie-Hellman key exchange is authenticated by including both values in the message that is signed in a distributed way by the authentication center and the reader. Upon receiving (11), the tag learns whether the reader has obtained its correct public Diffie-Hellman key part and whether itself has obtained the correct public Diffie-Hellman key part of the reader. Rights: The rights of a reader are selected by the authentication center. To select the proper rights, the authentication center uses the identity of the reader as well as the class identity of the class the tag belongs to (as illustrated in the protocol in Figure 2). Note that the reader cannot claim another reader’s identity to the authentication center as the reader authentication will then fail: the authentication center will not use the key split dA corresponding to the reader’s key split. Including the rights in the message m guarantees to the tag that the rights were indeed set by the authentication center and were not changed by the reader. The identity of the tag needs to be included in the signed message to ensure that the reader does not obtain rights for another tag and presents them to the victim tag. Identity Privacy: The protocol as illustrated in Figure 2 contains two messages that are crucial in the context of protecting the identity of a tag. These messages are message (3) which contains the identity of the class a tag belongs to (idclassT ) and message (15) which contains the encrypted certificate of the tag, and thereby its identity. In (15), the tag and the reader already share an authenticated symmetric encryption key, i.e., the tag’s identity is not revealed to anyone but authenticated readers. The class of a tag indicates the tag type with
Efficient Mutual Authentication for Multi-domain RFID Systems
131
respect to the access rights different readers have to the data stored on the tag, and thereby allows the authentication server to determine the rights of a reader. The identity protection our protocol provides against unauthenticated readers and passive eavesdroppers is therefore proportional to the number of tags in a specific class.
4
Authentication in a Visited Domain
In this section, we detail our new authentication protocol for the case that a tag is in a visited domain. In this case, the tag T , its home authentication center A∗ , the authentication center of the visited domain A, and a reader R in the visited domain are involved in the protocol. Reader-to-tag authentication is based on a signature which is distributively generated by A∗ , A, and R. In the following, we first explain how the key splitting and the novel signature scheme introduced in the last section can be extended to a multi-party signature scheme and then describe how we make use of it in our new protocol. 4.1
Multi-party Signatures
The private key corresponding to A∗ ’s public key is denoted by d∗ and split by A∗ in two parts (d, dA∗ ) satisfying d∗ = d · dA∗ mod q. A∗ provides d to A and keeps d and dA∗ for itself. In addition, A splits d into two parts (dA , dR ) and provides dR to reader R while keeping both parts for itself. For the signature generation, the authentication center A∗ chooses the ephemeral key part kA∗ and obtains the key part k from the authentication center A in the visited domain. In turn, k is determined as k = kR · kA mod q by the authentication center A such that A knows kR and kA while the reader only knows its part kR . In a first step, the authentication center A∗ computes the first signature component r∗ as the affine x-coordinate of the point (k ∗ )−1 · P modulo q. The goal is now to determine the second signature component s∗ = k ∗ · (h(m) + d∗ · r∗ ) through distributed signature generation. The authentication center A∗ starts by computing sA∗ = (kA∗ − 1) · k · h(m) + (kA∗ · dA∗ − 1) · k · d · r∗
mod q.
The remaining part s = s∗ − sA∗ satisfies the equation s = k · (h(m) + d · r∗ ) mod q, which means that s is a valid second signature component on the base point −1 kA ∗ · P . Hence, the authentication center A and the reader R can compute s in
132
M. Braun, U. Meyer, and S. Wetzel
a distributed way like in the protocol described in the last Section 3, i.e., the authentication center A computes sA = (kA − 1) · kR · h(m) + (kA · dA − 1) · kR · dR · r∗
mod q
while the reader R completes s = sA + sR by calculating sR = kR · (h(m) + dR · r∗ )
mod q.
Finally, the reader R completes the overall signature s∗ by computing s∗ = sA∗ + s = sA∗ + sA + sR . 4.2
The Protocol in the Visited Domain
In order to embed the two-party signature generation into our protocol, we only have to replace protocol steps (4) - (10) in Figure 2 by the extended steps (4) (10) and (A) - (E) as illustrated in Figure 3. The rest of the protocol description remains unchanged. Especially, the RFID tag has to execute exactly the same operations as if it was read in its home domain with the only difference that the signature to be verified by the tag is now denoted by (r∗ , s∗ ).
5
Implementation Aspects
In this section we show that our protocols can in fact be implemented on RFID tags, i.e., they can meet the low power consumption and limited chip area constraints of an RFID tag. The main operations a tag has to carry out in our protocols are: symmetric encryption, elliptic curve Diffie-Hellman key exchange, ECDSA signature verification, and response generation for tag authentication. In the following, we provide upper bounds on the gate equivalents (GEs) required for implementing these operations on RFID tags. It is reasonable to expect that an actual implementation of our protocols can leverage on synergies between the single operations with the result that the overall size of the footprint of our protocols will be smaller than the sum of the footprints of the individual operations. 5.1
Symmetric Encryption
A lot of research has been done in the area of block ciphers for resourceconstrained devices (see [4,8,11,14]). There are efficient implementations that require less than 3000 GE. The approaches for block cipher implementations on RFID tags can be divided into two classes. Either new algorithms are designed based on very lightweight operations such as xor, shifts, and vector products, or existing algorithms are optimized such that they become suitable for resourceconstrained devices. Revising standard algorithms (such as the AES) for efficient hardware realization often leads to implementations which are less compact than implementations of proprietary algorithms. However, relying on proprietary algorithms bears a higher risk of flaws in their security design.
(10) compute sR on m = dhT ||dhR ||rights||idclassT s∗ := sA∗ + sA + sR
(4) compute dhR (5) pick kR
R (dR )
∗
(8) compute (r , sA ) on m = dhT ||dhR || ||rights||idclassT
(7) pick kA
A ←−−−−−− −−−−−−−
(E) (r ∗ ,s ∗ ),rights
(B) kA ,kR ,dhT ,dhR ,idA ,idclass
,rights
T −−−−−−−−−−−−−−−−−−−−−− −−−−→
(A) establish secure channel
− −−−−−−−−−−−−−−−−−→
Fig. 3. Multi-Party Signature Generation
←−−−−−A −−−−−−−−−−
(9) (r ∗ ,s ∗ +sA ),rights
(6) kR ,dhT ,dhR ,idclass
−−−−−−−−−−−−−−−−T→
(1) establish secure channel
−−−−−−−−−−−−−−−−−→
A (dR , dA )
(C) pick k∗ (D) compute (r ∗ , sA∗ ) on m = dhT ||dhR || ||rights||idclassT
A∗ (d, dA∗ )
Efficient Mutual Authentication for Multi-domain RFID Systems 133
134
5.2
M. Braun, U. Meyer, and S. Wetzel
Scalar Multiplication
Scalar multiplication is a main operation in the elliptic curve Diffie-Hellman key exchange, the ECDSA signature verification, and in the response generation. The authors of [3] introduce an efficient implementation of scalar multiplication on curves with binary characteristic and provide a proof-of-concept by implementing the tag-to-reader authentication on a prototype RFID tag. The implementation is based on Montgomery’s method for scalar multiplication, which we denote by (X2 , Z2 ) ← Mul(k, x1 ) in the following. For the affine x-coordinate of a point P1 = (x1 , y1 ) and a scalar k, Montgomery’s method computes (X2 , Z2 ) such that x2 = X2 /Z2 is the affine x-coordinate of the point P2 = k · P1 . The advantage of this algorithm is that it does not require any expensive inversions in a finite field. The multiplication of two finite field elements can be implemented in hardware by simple linear feedback shift register operations. The overall size of the elliptic curve engine for scalar multiplication in [3] is about 13000 GE. 5.3
Elliptic Curve Diffie-Hellman Key Exchange
The tag first selects a random λ and computes dhT = (Xλ , Zλ ) ← Mul(λ, xP ) where xP denotes the x-coordinate of the base point P . The reader also chooses a random value μ and computes its own Diffie-Hellman part dhR = xμ where xμ is the affine x-coordinate of (xμ , yμ ) = μ · P . After receiving dhR = xμ , the RFID tag computes (Xμλ , Zμλ ) ← Mul(λ, xμ ) and uses K = Xμλ as symmetric encryption key. After encrypting the response resp and its certificate certT with K, the tag transmits EK (resp, certT ) together with the value Zμλ to the reader. Then using dhT = (Xλ , Zλ ) the reader first calculates the affine x-coordinate xλ = Xλ /Zλ , computes (Xμλ , Zμλ ) ← Mul(μ, xλ ), and finally reconstructs the shared key K = Xλ /Zλ · Zμλ . 5.4
ECDSA Signature Verification
The major task for the RFID tag in our new protocol is the signature verification. In [6], a hardware efficient method for verifying ECDSA signatures is proposed. The signature verification of a hashed message h(m) can be reduced to three executions of Montgomery’s method Mul and evaluating a short polynomial of degree 2. Following this approach, we avoid expensive inversions in the binary field and the computation of long integers modulo the order of the base point P . During signature generation and verification, a hash function h is applied to the message m = dhT ||dhR ||rights||idclassT . Since the digital signature will be used for reader-to-tag authentication, the security requires no collision resistance, which means that the output length of at least 80 bits offers a sufficient security level for our purpose. In [5], an overview of hardware-efficient implementations of hash functions is given. The authors show that a construction of hash functions based on block ciphers is a reasonable approach and can be implemented with approximately 4000 GE. Using the same block cipher as for symmetric encryption is expected to result in a reduction of gate equivalents.
Efficient Mutual Authentication for Multi-domain RFID Systems
5.5
135
Response Generation for Tag Authentication
The challenge-response procedure in our new protocol is based on a DiffieHellman key exchange. The response generation requires one scalar multiplication. The reader generates a random point P1 = (x1 , y1 ) by multiplying the base point P with a random value ξ and sends the x-coordinate chall = x1 as challenge to the tag. The RFID tag runs (X2 , Z2 ) ← Mul(dT , x1 ) where dT indicates the tag’s private key. The corresponding response is resp = (X2 , Z2 ). A detailed evaluation of the tag-to-reader authentication is provided in [3].
6
Conclusion and Future Work
In this paper, we introduced new mutual authentication and key agreement protocols targeted at multi-domain RFID systems. The protocols are based on public-key primitives and allow for a simple reader revocation that neither relies on time synchronization between tag and reader nor on certificate revocation status checks. The new protocols are efficient in the sense that they require only one signature verification to be performed by the tag where the signature verification key is the same regardless of whether the domain in which the tag is read is its home domain or any other visited domain. In addition, our protocols allow the tag’s identity to be hidden from unauthorized readers. Future work includes (1) implementing the protocols and evaluating their practical performance particularly in the multi-domain case and (2) specifying how rights can efficiently be encoded for different application scenarios.
References 1. Avoine, G., Buttyan, L., Holczer, T., Vajda, I.: Group-Based Private Authentication. In: IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks. IEEE, Los Alamitos (2007) 2. Avoine, G., Dysli, E., Oechslin, P.: Reducing Time Complexity in RFID Systems. In: Preneel, B., Tavares, S. (eds.) SAC 2005. LNCS, vol. 3897, pp. 291–306. Springer, Heidelberg (2006) 3. Bock, H., Braun, M., Dichtl, M., Heyszl, J., Hess, E., Kargl, W., Koroschetz, H., Meyer, B., Seuschek, H.: A Milestone Towards RFID Products Offering Asymmetric Authentication Based on Elliptic Curve Cryptography. In: RFIDSec 2008 — Proceedings of the 4th Workshop on RFID Security, Budapest, Hungary, July 9-11 (2008) 4. Bogdanov, A., Knudsen, L.R., Leander, G., Paar, C., Poschmann, A., Robshaw, M.J.B., Seurin, Y., Vikkelsoe, C.: PRESENT: An Ultra-Lightweight Block Cipher. In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 450–466. Springer, Heidelberg (2007) 5. Bogdanov, A., Leander, G., Paar, C., Poschmann, A., Robshaw, M.J.B., Seurin, Y.: Hash Functions and RFID Tags: Mind the Gap. In: Oswald, E., Rohatgi, P. (eds.) CHES 2008. LNCS, vol. 5154, pp. 283–299. Springer, Heidelberg (2008) 6. Braun, M., Hess, E., Meyer, B.: Using Elliptic Curves on RFID Tags. International Journal of Computer Science and Network Security 2, 1–9 (2008)
136
M. Braun, U. Meyer, and S. Wetzel
7. Buttyan, L., Holczer, T., Vajda, I.: Optimal Key-Trees for Tree-Based Private Authentication. In: Danezis, G., Golle, P. (eds.) PET 2006. LNCS, vol. 4258, pp. 332–350. Springer, Heidelberg (2006) 8. Feldhofer, M., Dominikus, S., Wolkerstorfer, J.: Strong Authentication for RFID Systems Using the AES Algorithm. In: Joye, M., Quisquater, J.-J. (eds.) CHES 2004. LNCS, vol. 3156, pp. 357–370. Springer, Heidelberg (2004) 9. Bundesamt f¨ ur Sicherheit in der Informationstechnik. Advanced Security Mechanisms for Machine Readable Travel Documents: Extended Access Control (EAC), Password Authenticated Connection Establishment (PACE), and Restricted Identification (RI), Version 2.02 (2009) 10. Gennaro, R., Jarecki, S., Krawczyk, H., Rabin, T.: Robust Threshold DSS Signatures. In: Maurer, U.M. (ed.) EUROCRYPT 1996. LNCS, vol. 1070, pp. 354–371. Springer, Heidelberg (1996) 11. Hong, D., Sung, J., Hong, S., Lim, J., Lee, S., Koo, B.-S., Lee, C., Chang, D., Lee, J., Jeong, K., Kim, H., Kim, J., Chee, S.: HIGHT: A New Block Cipher Suitable for Low-Resource Device. In: Goubin, L., Matsui, M. (eds.) CHES 2006. LNCS, vol. 4249, pp. 46–59. Springer, Heidelberg (2006) 12. Langford, S.K.: Threshold DSS Signatures without a Trusted Party. In: Coppersmith, D. (ed.) CRYPTO 1995. LNCS, vol. 963, pp. 397–409. Springer, Heidelberg (1995) 13. Li, M., Poovendran, R., Falk, R., K¨ opf, A., Sampigethaya, K., Robinson, R., Lindelman, S., Braun, M., Seuschek, H.: Multi-Domain RFID Access Control Using Asymmetric Key Based Tag-Reader Mutual Authentication. In: ICAS2008 — Proceedings of the 26th international Congress of the Aeronautical Sciences, Anchorage, USA, September 14-19 (2008) 14. Lim, C., Korkishko, T.: mCryption — A Lightweight Block Cipher for Security of Low-cost RFID Tags and Sensors. In: Song, J.-S., Kwon, T., Yung, M. (eds.) WISA 2005. LNCS, vol. 3786, pp. 243–258. Springer, Heidelberg (2006) 15. MacKenzie, P., Reiter, M.K.: Two-Party Generation of DSA Signatures. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, p. 137. Springer, Heidelberg (2001) 16. Meyer, U., Cordasco, J., Wetzel, S.: An Approach to Enhance Inter-Provider Roaming through Secret Sharing and its Application to WLANs. In: WMASH’05 — Proceedings of the 3rd ACM International Workshop on Wireless Mobile Applications and Services on WLAN Hotspots, New York, NY, USA, pp. 1–13. ACM, New York (2005) 17. Molnar, D., Wagner, D.: Privacy and Security in Library RFID: Issues, Practices, and Architectures. In: Proceedings of the ACM Conference on Computer and Communications Security. ACM, New York (2004)
Efficient Mutual Authentication for Multi-domain RFID Systems
A
137
Two-Party ECGDSA Signature
The German version of the elliptic curve digital signature algorithm ECGDSA can also be used for distributed signature generation. The private signature key d and the public signature Q satisfy the equation Q = d−1 · P . The inversion of the private signature key d leads to a simplified signature generation algorithm. In particular, the ephemeral key k does not need to be inverted anymore. The signature generation works as follows. The signer randomly chooses an ephemeral key k and computes the first signature component r as the affine x-coordinate of the point k · P modulo q. The second second component is obtained by s = d · (k · r − h(m)). The private key and ephemeral key will be split and distributed between the authentication center A and the reader R the same way it has been described in Section 3 and 4 for ECDSA. Hence, the authentication center knows all parts of the private signature key dA , dR and of the ephemeral key kA , kR , where the reader knows the parts dR and kR only. For the distributed signature generation, the authentication center A computes r, the affine x-coordinate of k · P = (kA · kR ) · P modulo q, and its part sA = dR · kR · r · (dA · kA − 1) + dR · h(m) · (1 − dA ). The reader R finishes the signature s = d · (k · r − h(m)) = sA + sR by computing sR = dR · (kR · r − h(m)).
Practical Schemes for Privacy and Security Enhanced RFID (Extended Abstract) Jaap-Henk Hoepman1,2 and Rieks Joosten1 1 TNO Information and Communication Technology
[email protected],
[email protected] 2 Radboud University Nijmegen
[email protected] Abstract. Proper privacy protection in RFID systems is important. However, many of the schemes known are impractical, either because they use hash functions instead of the more hardware efficient symmetric encryption schemes as a efficient cryptographic primitive, or because they incur a rather costly key search time penalty at the reader. Moreover, they do not allow for dynamic, fine-grained access control to the tag that cater for more complex usage scenarios. In this paper we propose a model and corresponding privacy friendly protocols for efficient and fine-grained management of access permissions to tags. In particular we propose an efficient mutual authentication protocol between a tag and a reader that achieves a reasonable level of privacy, using only symmetric key cryptography on the tag, while not requiring a costly key-search algorithm at the reader side. Moreover, our protocol is able to recover from stolen readers.
1
Introduction
Radio Frequency Identification (RFID) is a technology that allows to wirelessly identify and collect data about a particular physical object from a relatively short distance. The data is stored on so-called tags attached to the object, and is collected using so-called readers. RFID tags can be very small, can be attached invisibly to almost anything, and can transmit potentially unique identifying information. Therefore, proper privacy protection within RFID based systems is of paramount importance [11, 17]. Yet RFID is also an enabler for the vision of an Internet-of-Things where the physical and the virtual become interconnected in one single network. This will spark all kinds of applications beyond our current imagination. Unfortunately, the current trend in RFID related policy aims to mandate a kill-switch on all RFID tagsthat will silence such a tag forever once it leaves the shop. Such a killswitch is a very coarse, all-or-nothing approach to protecting privacy. It would be far better to develop an approach that allows the user to have fine grained and dynamic control over who can access his tags, and when. The research reported on in this paper takes a step into that direction. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 138–153, 2010. c IFIP International Federation for Information Processing 2010
Practical Schemes for Privacy and Security Enhanced RFID
1.1
139
State of the Art
Because of the privacy risk associated with the large scale use of RFID tags, many proposals exist to provide a certain level of privacy protection for a particular application of RFID. We give a brief overview of the state of the art, focusing on authentication and access control. For details we refer to the full paper [14], to Juels [17] (and the excellent bibliography1 maintained by Gildas Avoine) for a much more extensive survey of proposed solutions, and [19] for a more formal analysis of the privacy properties actually achieved by some of the proposed authentication protocols. Early proposals use relabelling of tag identifiers [24], or re-encryption techniques [18, 2, 12] that randomly encrypt the identifier from time to time, so that it can only be recovered by authorised readers, while being untraceable for others. Another approach is to implement some form of authentication between tag and reader, and to allow only authorised tags to retrieve the tag identifier. In a public key setting this would be easy, but RFID tags are generally considered to be too resource poor to accommodate for that. Therefore, several identification and authentication protocols using hash functions or symmetric key cryptography have been proposed [29, 9]. In particular, Dimitriou [8] presents a technique for achieving forward privacy in tags. All readers should be on line, connected with one central database, so they can be synchronised and the response of a tag can be looked up immediately in the database. In a symmetric key setting the reader cannot know the identifier of the tag a priori, or obtain the identifier of the tag at the start of the protocol because of privacy concerns. One can give all readers and tags the same symmetric key, but this has the obvious drawback that once the key of one tag is stolen, the whole system is corrupted. To increase security, tags can be given separate keys, but then the reader must search the right key to use for a particular tag. The core challenge is therefore to provide, possibly efficient, trade offs and solutions for key search and key management. Molnar and Wagner [20] propose a tree-based key hierarchy to achieve such a trade-off. They also introduce the concept of delegation that allows a tag owner to enable another party to access a tag over some period of time. In another approach, Avoine, Dysli, and Oechslin [3] show how a time-memory trade off can be exploited to make the search for the key to use more efficient. We note that none of these systems are practical for RFID systems where millions of tags possess unique secret keys. Spiekermann et al. [25] observe that although there are many protocols and proposals for limiting access to RFID tags (either by killing them completely or by requiring the reader to authenticate), few systems have been proposed that allow effective and fine grained control over access permissions. The RFID Guardian [23] is a notable exception. The main idea is to jam all reader to tag communication, except for requests that satisfy a pre-defined privacy rule. We base our work on (relatively) new insights regarding the amount of hardware required to implement symmetric key cryptosystems as compared to hash 1
www.avoine.net/rfid/
140
J.-H. Hoepman and R. Joosten
functions [22], which shows that symmetric cryptography is the preferred choice for lower cost tags. 1.2
Our Contribution
Our contribution is to propose a model and corresponding protocols that allow effective, efficient and fine grained control over access permissions for RFID tags, that respect the privacy of the users. The model is enforced by the tags themselves. The protocols use authentication as a basic component, and we propose a novel combination of (universal) re-encryption [18, 12] with symmetric cryptography based authentication [16] to obtain a reasonable level of privacy protection without using public-key cryptography on the tag, and without the need for a time consuming key-search algorithm. Although such key-search algorithms are highly popular in the research community because of their superior privacy properties, we believe they are unreasonable for large scale applications that may involve millions of tags (and hence keys). Finally, our protocols are resistant to stolen reader attacks, using techniques from [4]. A detailed description of the properties of our authentication protocol is presented in Sect. 4. The model is loosely based on the ”Resurrecting Duckling” paradigm of Anderson and Stajano [27, 26]. Our model is general enough to capture several RFID use case scenarios, like supply chain management, ticketing and ambient home intelligence. See the full paper [14] for details. The essence of the model is that a potentially dynamic system of access permissions is defined. We generalise the concept of an RFID tag, and view such a tag as a container of several data objects on which a reader wishes to execute certain functions. This extends the notion of an RFID tag containing just a unique identifier to slightly smarter data container. We believe that labelling a physical object with a unique identifier on an RFID tag, and storing all relevant data on the object in a central database is going to prove too limitative in the future. For privacy reasons it is better to require physical proximity to read the data on the tag instead of having that data available in a database all the time. This research is related to the PEARL2 project. The paper is structured as follows. In Sect. 2 we present our system model. We then continue to implement this model using data structures (Sect. 3), an authentication and session key establishment protocol (Sect. 4) and subsequent protocols (Sect. 5). The security proofs appear in Sect. 6 and we present some conclusions and further research in Sect. 7. The scenarios on which the model is based, and an analysis of the mapping of the system model on the use cases are omitted due to space constraints but can be found in the full paper [14].
2
System Model
The system model describes the different entities in the system, their mutual relationships, and the operations that they can perform on each other. 2
www.pearl-project.org
Practical Schemes for Privacy and Security Enhanced RFID
2.1
141
Notation
We use k to denote a symmetric key, possibly sub-scripted to denote its owner, and use s to denote a symmetric session key. We use P K for a public key and sk for the corresponding private key. Hash functions are denoted by h(·). We write ⊕ for the exclusive-or operation, and ; for concatenation of bit strings. {m}k denotes the encryption of message m with symmetric key k using some symmetric cipher, typically AES. [m]k denotes a message authentication code (MAC) for message m derived from a symmetric cipher (for instance CMAC [21, 6]) using key k. Finally, [{m}]k denotes the authenticated encryption of m with key k, for instance by appending the MAC of the ciphertext [5]. 2.2
Tags and Readers
A tag t is a piece of hardware that contains data. At the very minimum, tags store a bit string that can be read and sometimes written. Usually, tags store several values that can be grouped together as tuples because of their logical use. More complex, smart card like tags, contain ISO 7816 [15] like file structures. We assume that for the anti-collision protocol random identifiers are used (or else all bets to achieve some level of privacy are off). The system model follows the object oriented (OO) metaphor, so that tags are said to contain objects, each of which is a group of bit strings whose structure is defined by the class that it instantiates. For every class, each tag contains at most one instantiating object. Every class defines a set of methods, each of which specifies a kind of operation that may take place on objects that instantiate that class. Simple methods specify how to read or perhaps write values in a tuple of a certain type stored on a particular tag. More complex cases methods might invalidate a ticket on a tag, or increase an electronic purse balance. Every method is defined in precisely one class. Every tag always contains one instance Ω of the tag management class, initially with default settings. The tag management class implements functions to manage tag access and ownership. This allows us to implement tag and class management operations in a similar way as methods on ordinary objects, thus simplifying the implementation. Details are provided in Sect. 5. We assume readers are at least on-line some of the time to obtain fresh data and keys from the central back office. 2.3
Domains and Principals
We use the term domain to refer to a (legal) entity that is capable of bearing responsibilities. Thus, companies, organisations and governments are considered to be domains, as well as individual (adult) persons. We use the term principal, or actor, to refer to a resource (e.g. a person, or a running application within a computer) that is capable of acting under the responsibility of a domain. We assume that at any particular point in time d acts on behalf of precisely one domain D. Thus, if a principal d acts on behalf of a domain D at a given point
142
J.-H. Hoepman and R. Joosten
in time, then D is responsible for everything that d does at that time. We use D to denote the set of all domains. 2.4
Ownership
We use the term owner(ship) to refer to the responsibilities associated with controlling tags, objects, etc. Since responsibilities are born by domains, ownership can only be assigned to domains. Ownership can be transferred by the owning domain to another (accepting) domain. Thus, the tag owner T for a tag t is a domain that bears the responsibility for controlling access to t, i.e. for issuing and revoking the associated permissions. Also, it controls the permissions associated with other tag related functionality, such as the creation of objects or the transferal of tag ownership. We use T ⊆ D to denote the set of tag owners. We write t ∈ T to indicate that tag t is owned by T . The class owner is responsible for controlling access to objects that instantiate this class, i.e. for issuing and revoking permissions for executing methods defined by that class. We write c ∈ C to mean that class c is owned by domain C (i.e. its class owner). Note that if a class owner C owns a class c, then (initially) it also owns every object o ∈ c. Thus, object ownership is (initially) implied by class ownership. However, ownership of individual objects may be transferred to other domains later on. If that happens, the class owner is not necessarily the owner of all objects of that class. 2.5
Permissions
Every permission, i.e. the right to access a tag or the right to execute a method on an object, is issued by the domain that owns the tag or the object, to any domain of its choosing. One of our main contributions is the distinction we make between accessing (i.e. communicating with) tags and accessing (i.e. executing methods on) objects on a tag. A consequence of this distinction is that it requires two rather than one permission to access an object on a tag: one permission is needed for accessing the tag on which the object is stored (which is granted by the tag owner), and the other permission is required to execute the appropriate method on that object (which is granted by the object owner). 2.6
Operations on a Tag
The most basic operation the model must support is calling a method on an object of a certain class stored on a particular tag. For this, two permissions are required: first, the domain must be allowed to access the tag, and secondly the domain must be allowed to execute the method on (the class of) the object. Note that access to a method is initially granted at the class level. So access rights for a particular method initially apply to all objects of that class.
Practical Schemes for Privacy and Security Enhanced RFID
143
The creation of permissions is done off-tag, as is the distribution thereof. Tag ownership is controlled through the functions TakeTagOwnership, TransferTagOwnership and RelinquishTagOwnership. Tag access is controlled through the following functions: GrantTagAccess and RevokeTagAccess. These functions are only executable by the tag owner. Object management is controlled through the following functions: InstallObject, UpdateObject, UpdateClassKey and DeleteObject. For more information we refer to Sect. 5 and the full paper [14]
3
Data Structures
In this section we describe the data structures stored by the tags, and the keys and permissions used by the domains to access the data on a tag. In the next section we describe the implementations of the operations that can be performed on a tag. 3.1
Keys
To implement permissions, the system uses the the following types of keys. Some keys (the domain key pairs P KD , skD ) are asymmetric keys, the other keys are symmetric keys. Tag access keys ka . Access to tags is controlled using tag access keys ka . These keys are unique to a tag, and derived from the tag identifier t using a master access key kA through key diversification [1] by ka = {t}kA . Master access keys kA . Each domain has a master access key kA . Readers in a domain use this master access key kA to derive tag access keys from tag identifiers. Each tag thus stores, for each domain that is allowed to access it, a different tag access key. Domain key pairs P KD , skD . Each domain keeps a unique ElGamal public/private domain key pair P KD , skD . These keys are used in the authentication protocol to preserve privacy of the tag identifier t. To thwart stolen reader attacks, readers get a new pair of keys every once in a while. These keys are stored in the array E[]. Class keys kc . For each class there exists a unique class key kc . The class key is used to encode access permissions to the class methods. A tag stores, for each object, the corresponding class key to verify such permissions. Class owners know all the class keys of the classes they own. Changing the class key of an individual object can be utilised to transfer ownership of that particular object. Conceptually, however, this makes the object member of another class (albeit with the same structure and methods as the class it originally was a member of). 3.2
Other Data Stored on the Tag
A tag t also performs a bit of bookkeeping. Firstly, it records a time stamp now t that approximates the current date and time (see below), initially −∞. Tags
144
J.-H. Hoepman and R. Joosten
also store several objects, each of a class c together with the key kc . Also, a tag t keeps an access set At that stores, for each domain D that is granted access to the tag, the following three items. x – An encrypted tag identifier id , equal to the ElGamal encryption (t·P KD , gx) of the tag identifier t. – The epoch e in which the encrypted tag identifier was created (for explanation see Sect. 4). – The diversified tag access key ka , which equals {t}kA for the master key kA used by domain D. – A boolean flag indicating whether this domain is the owner of the tag.
We interpret the access set as a dictionary indexed by domains (as a domain can have at most one such tuple in the access set), and write At [D] = (id , ka , b). There is at most one domain that is the owner of the tag. We write owner t for that domain (which equals ⊥ if the tag is not owned by a domain). Initially, At = ∅. Finally, the tag stores the current session key s, which initially and in between sessions equals a default value (denoted ⊥, but which actually is a valid key), and which is set to a certain value as the result of a successful mutual authentication (in which case the authenticated reader holds the same session key). It also stores the domain of the reader that was authenticated in Γ (which equals ⊥ in between sessions). We usually omit the subscript from now , owner and A. 3.3
Permissions
To grant a domain D access to a method f on an object of class c up to time Δ, the class owner C generates a permission token kc,f,D,Δ = {f, D, Δ}kc and sends this to the domain D. This permission token expires as soon as the current time exceeds Δ. Tags use now as their estimate of the current time to verify this. They do not need to have their own clock, and this estimate does not have to be synchronised with other tags. This is updated after each successful call of a method on the tag (which includes the current time as asserted by the caller). It is also set to the current time when the first domain takes ownership of the tag. A similar method is also used by the European RFID passports [7, 13].
4
Mutual Authentication and Establishing a Session Key
A basic step underlying the protocols that implement the operations that access a tag, is to mutually authenticate a tag and a reader, and to establish a session key among them. Below we present a protocol that is efficient for both the reader and the tag. In principle it combines elements of three different known authentication protocols to strike a balance between tag and reader efficiency, achieve a robustness against a reasonably large class of adversaries, and achieve a certain level of privacy as well. In fact it combines a standard, ISO/IEC 9798-2 [16] based
Practical Schemes for Privacy and Security Enhanced RFID
145
symmetric key authentication protocol, with (universal) re-encryption [18, 12] to avoid the costly key search, and a counter based approach to invalidate keys from stolen readers [4]. To further enhance privacy, users may perform a separate re-encryption of all identifiers on a tag at any time. To be precise, the protocol achieves the following properties mutual authentication. The reader and the tag are mutually authenticated. soft privacy. Tags can only be traced in between two successful re-encryptions (including the re-encryption performed during an authentication). Except for the reader performing the re-encryption, no other reader or eavesdropper can link the presence of the tag after the re-encryption with an observation of this tag before the re-encryption. resilience to tag compromise. Tags do not contain global secrets. Hence a tag compromise does not affect any other tags in the system. resilience to reader compromise. Stolen readers (or otherwise compromised readers) will not be able to recognise or access tags, once those tags have been in contact with another valid reader after the compromise [4]. A similar property is achieved by the European biometric passports [7, 13]. reader efficiency. The reader performs a constant number of operations. tag efficiency. The tag performs only a constant number of symmetric key cryptography operations. The protocol we present below explicitly checks the correctness of the responses, that may contain additional information for that purpose, to positively authenticate the other party. Another option is to rely on implicit authentication through the session key that is established as well: if the authentication fails, both parties will have different values for the session key, and therefore subsequent protocol steps will fail. Note that in the description of the protocols we do not explicitly describe the behaviour of a principal if it detects such an error. Instead we use the convention that if an internal check fails, the principal continues to send the expected messages at the appropriate times, with the appropriate message format, but with random message content. This is necessary to preserve privacy, as observed by Juels et al. [19]. Our protocol (see Fig. 1) is an extension of the the ISO/IEC 9798-2 [16] standard, using diversified keys [1] to avoid sharing keys over many tags. To compute the diversified tag access key ka from the master access key kA it stores, the reader needs to learn the tag identifier t. This cannot be sent in the clear for privacy reasons. The solution is to encrypt the tag identifier t against the public key of the reader to obtain id , and let the reader re-encrypt [18] that value with every authentication run. This way the tag does not have to perform any public key operations. Note that the re-encrypted value is only used as the new tag identifier after a successful authentication of the reader. This avoids denial-of-service attacks. Finally, the re-encryption keys stored by the readers are updated every time a reader is stolen. Every time this happens, a new epoch is started. Stolen readers no longer receive keys for future epochs. Tags that authenticate successfully, receive a new encrypted identity, encrypted against
146
J.-H. Hoepman and R. Joosten Reader d ∈ D
Tag t D
−−−−−→ ((u, v), (y, z)), e , r verify e ≤ (skD , P KD ) := E[e ] ; verify y/z skD = 1 t := u/v skD ; (skD , P KD ) = E[] generate random x, x x u := t · P KD mod p ; v := g x mod p x mod p ; z := g x mod p y := P KD id := ((u , v ), (y , z )) ; ka := {t }kA
id;e;r
←−−−−−−−
D (id, e, ka , b) := A[D ] generate random r
[{id ;;r ;q;δ;s}]k
a generate session key s and random q −−−−−−−−−−−−−− −→ decrypt using ka into id , e , r , q , δ , s A[D ] := ⊥ verify r = r , now < δ now := δ ; A[D ] := (id , e , ka , b)
decrypt using ka into q , s¯ verify q = q ; return (s ⊕ s¯ , t )
s}k {q ;¯
←−−−−−−a−−−
generate session key s¯ return (s ⊕ s¯, D )
Fig. 1. Authentication and session key agreement
the most recent epoch key. This makes it impossible for compromised readers to track this tag. At the reader side the protocol returns the tag identifier and the session key to be used. AuthenticateR(skD , P KD , kA ) denotes a call to such an authentication protocol run in the protocols below. At the tag side, the protocol returns the session key, as well as the authenticated domain. We write AuthenticateT () for this call. 4.1
Re-encryption
The protocol uses re-encryption, or rather universal re-encryption [12], as follows. We use the ElGamal encryption scheme [10] over a cyclic group G of order q. To be concrete, and to achieve semantic security [28], we choose two primes p and q such that q(p − 1) (i.e., q is a divisor of (p − 1)) and choose as G the cyclic subgroup of Zp with order q, and pick a generator g for G. These are global, system wide, constants. Each domain has, for each epoch, its own public/private key pair (P KD , skD ) where skD is a random integer between 1 and q − 1, and P KD = g skD . The tag x , g x ) , where x is a identifier t is encrypted, using ElGamal, as (u, v) = (t · P KD random value in [0, q − 1]. To allow re-encryption by readers that do not know the corresponding private key, each tag stores with each encrypted tag identifier
Practical Schemes for Privacy and Security Enhanced RFID
147
x a corresponding re-encryption factor (y, z) = (P KD , g x ) , where x is a new random value in [0, q − 1]. Note that this is basically an encryption of the value 1 against the same key. Because ElGamal enjoys the homomorphic property that the multiplication of the encryption of two ciphertexts equals the encryption of the multiplication of the corresponding plaintexts, we see that (uy, vz) in fact equals the encryption of tag identifier t. The encrypted identifier now becomes id = ((u, v), (y, z)) . Readers store the key pairs for the epochs in an array E[], storing the keys for epoch e at E[e]. This array is filled with epoch keys up to and including the current epoch , and grows in size over time. To re-encrypt, a reader that knows the corresponding, most recent public epoch key P KD does the following. It generates new random values a and a in a a [0, q − 1] and computes (u , v ) = (t · P KD , g a ) and (y , z ) = (P KD , g a ) and sends id = ((u , v ), (y , z )) to the tag. Readers that do not know the current epoch key can use the re-encryption factor to compute a new encrypted identifier as follows. Again two random factors a and a in [0, q − 1] are generated, and then the reader computes (u , v ) = (u · y a , v · z a ) and (y , z ) = (y a , z a ) and again sends id = ((u , v ), (y , z )) to the tag To decrypt, one simply verifies that y/z skD = 1 and computes u/v skD , using the appropriate epoch key stored in E[]. To avoid the need to search for the right key, the tag sends, together with is encrypted identifier, the epoch in which it was last updated3 .
5
Protocols
Below we will describe protocols that implement the operations from Sect. 2.6. We take a rather generic approach. Instead of implementing special protocols for each of these operations, we in fact model all these operations either as calls on normal objects (DeleteObject and UpdateObject), or as special methods of the tag management object Ω (all other operations). That is, we present pseudocode for the body of each of these operations as if they were methods of a certain object, operating on the state of the object and or operating on the state of the tag. Due to space constraints, we only describe the tag-ownership operations. 5.1
Calling a Method
To call a method f on an class c, the reader d belonging to domain D and the tag t first set up a session using the protocol in Fig. 2. If this is successful, the reader and the tag share the same session key. Both initialise their message sequence counter (m and n) to 0. The actual method call follows the protocol in Fig. 3. This protocol can be executed several times in a row, to execute several methods within a single 3
This is not an additional privacy concern as the tag will broadcast the same encrypted tag identifier anyway, until it is successfully updated (in which instance its epoch will be set to the most recent epoch, which contains a large number of tags).
148
J.-H. Hoepman and R. Joosten Reader d ∈ D Tag t (s , t ) := AuthenticateR(E[], kA , ) ↔ (s, Γ ) := AuthenticateT () n := 0 m := 0 Fig. 2. Setting up a session
Reader d ∈ D
Tag t [{n;c;f ;Δ;p}]s
p := kc,f,D,Δ −−−−−−−−−−−−−→ decrypt and verify using s into n , c , f , Δ , p verify now < Δ verify n = m look up object of class c and keep kc verify p = {f , Γ, Δ }kc [{n+1;x}]
−−−−−−−−−s−−→
decrypt and verify using s into n , x verify n = m + 1
[{m+2;result}]s
decrypt and verify using s ←−−−−−−−−−−−−− execute f (Γ, x) into m , r verify m = n + 2 n := n + 3 m := m + 3 Fig. 3. Calling method f (x) on class c using permission kc,f,D,Δ valid until Δ
session. Each message includes the current value of the message counter, and each message is encrypted and MAC-ed with the session key. The message counters are incremented with every subsequent message within a session. The receiver verifies the included message counter to prevent replay attacks. For each method call, the reader sends the corresponding permission token, which is verified by the tag using the class key kc of the class whose method is called. It also verifies whether the permission token is still valid, using its own estimate of the current time now , and whether the permission token is bound to the domain that was authenticated in the first phase. Then the reader sends the method call parameters, and the tag responds with the method result. If the method is supposed to return no result, a random value is sent instead. Note that the method is called with the name of the calling domain as the first parameter. To call a method on an object for which no permission tokens are necessary (which is the case for some of the methods of the tag management object, see below), basically the same protocol is used. In this case however, the caller does not have to send a permission token, and the tag only verifies that the requested method on that object is indeed callable without permission. Finally, to close a session, the protocol in Fig. 4 is executed.
Practical Schemes for Privacy and Security Enhanced RFID Reader d ∈ D
149
Tag t [{stop}]s
−−−−−−−−−−→ decrypt and verify using s s := ⊥ Γ := ⊥ Fig. 4. Closing a session
5.2
Tag Ownership Functions
The following methods on the tag management object Ω implement transfer of ownership. To relinquish ownership of a tag, the tag owner can execute the following method. The functionality of RelinquishTagOwnership may be extended to include the deletion of all RelinquishTagOwnership(caller): objects (other than the tag manageverify owner = caller ; ment object), and the resetting of inA := ∅ (hence owner = ⊥); formation in the tag management s := ⊥. object. To become the owner of an unowned tag, a domain calls the following method, where the caller of TakeTagOwnerTakeTagOwnership(caller , D, id , ka ): ship from domain D has received the verify owner = ⊥ ; tag identifier t out-of-band. He then A[D] := (id , ka , true) ; generates a random x, computes id = x , g x ) and computes (u, v) = (t · P KD ka = {t}kA using its own master access key kA , before calling the method. Note that this protocol is susceptible to hijacking and eavesdropping on the new owner’s access key, if the default session key ⊥ is used (which is the case when the tag has no owner). To transfer ownership of tag t from tag owner T to domain T , a new entry for the new tag owner must be set in A with a new encrypted tag identifier and a new diversified access key (and in fact all other entries in the access set need to be deleted). The tag identifier does not change. This process is in fact a three party protocol that is implemented by two method calls. The first runs as follows. Note that this function can only be exTransferTagOwnership(caller ): ecuted in sessions of the authentic tag verify owner = caller ; owner. After execution of this funcA := ∅ (hence owner = ⊥) ; tion, the session is not terminated (i.e. the session key is not reset). While in this state, the tag is shipped to the new owner T and the values of the tag identifier id, the session key s and the message counter n are sent to T out of band. Then, T calls TakeTagOwnership (without prior authenticating and hence starting a new session!), thus becoming the new tag owner (preferably when the old owner is out of reach so it cannot eavesdrop on the new values sent to the tag).
150
6
J.-H. Hoepman and R. Joosten
Security Analysis
We first give a security analysis of the authentication protocol from Sect. 4 against the most important security properties mentioned in that section. We then analyse the security of the method invocation protocol from Sect. 5.1. The adversary we consider has full control over the communication medium: he can block, intercept, duplicate, modify and fabricate arbitrary messages. He can, however, not create valid MACs for messages if he does not know the key, and cannot encrypt or decrypt messages for which he does not know the symmetric key. The adversary can corrupt arbitrary tags and hence know their full state including any keys they store. The adversary can also corrupt arbitrary readers. However, such readers are known to be corrupted and the system is notified of any such corruption. Let γ be the security parameter (implicitly defined by the size of G (see 4.1) and the choice of the size of the symmetric keys). We first prove the security of the authentication protocol. Lemma 6.1. Let a call AuthenticateR(skD , P KD , kA ) from a reader from domain D return (σ, t ). Let tag t call AuthenticateT () which returns (σ , D ). Then σ = σ only if t = t and D = D . No other entity not in domain D knows σ. Proof. Consider the protocol in Fig. 1. Suppose σ = (s⊕ s¯ ) = (s ⊕ s¯) = σ . Then the reader accepted the message {q ; s¯}ka . Hence ka = {t }kA as computed by the reader equals ka . As ka is retrieved from A[D ] and kA is only known to D this proves D = D Also the tag must have accepted the message {id ; ; r ; q; δ; s}ka using its own key ka . Again for ka = {t }kA we must have ka = ka . Because only t holds ka = {t}kA we must have t = t . To know σ one needs to know both s and s¯. This requires one to know ka . Clearly t knows this. Otherwise, it requires one to know kA (and t). This is only known to members of D. This proofs the final statement of the lemma.
Privacy after authentication or full re-encryption is guaranteed by the following lemma. Lemma 6.2. Let t be a tag, whose tag identifier t for domain D gets re-encrypted from id to id (either by authentication or by a full re-encryption). Let id be the encrypted tag identifier for domain D of an arbitrary tag t = t. Then there exists no adversary (that has no access to the private keys of domain D) with resources polynomially bounded in γ that can decide whether id and id or id and id are encrypted tag identifiers of the same tag. Proof. In [12] it is shown that, given our use of ElGamal over our choice of group G, there does not exist an adversary with resources polynomially bounded in γ that can properly match the re-encryptions of two ciphertexts with the original input ciphertexts. The adversary linking either id or id with id would trivially solve this problem too, and hence cannot exist either.
Resilience to reader compromise is shown by the following lemma.
Practical Schemes for Privacy and Security Enhanced RFID
151
Lemma 6.3. A reader from domain D reported stolen in epoch e cannot decide whether two tags that have successfully authenticated with an unstolen reader from domain D in epoch e > e corresponds with a tag observed before. Proof. At the start of epoch e , we have = e , and all readers in domain D that are not reported stolen receive new epoch keys (skD , P KD ) that are stored in E[]. If a tag authenticates with this reader, according to the protocol, it receives ). Let two tags a new encrypted identifier encrypted with the keys (skD , P KD meet such a reader, obtaining encrypted tag identifiers id a and id b in exchange for their old identifiers id a and id b . If subsequently these tags meet a reader from domain D that was reported stolen in epoch e < e , this reader does not ) and hence cannot decrypt id a or id b . Therefore, own the key pair (skD , P KD by Lemma 6.2, the reader cannot link the encrypted identifiers id a and id b .
Finally, we show security of the method invocation protocol. Lemma 6.4. A tag t only executes a method f of class c with class key kc if a reader in domain D with – At [D] = ⊥ when it starts the session, and – permission token kc,f,D,Δ = {f, D, Δ}kc with Δ > now t (when the permission is verified) issued the command to the execute this method in the session it started. Moreover, the tag will do so at most once. Proof. Checking the protocol, we see that a tag t executes method f on class c with class key kc when – it receives a message correctly encrypted and mac-ed with its session key s, containing the parameters and the expected message counter m + 1, and before that – has received a message correctly encrypted and mac-ed with its session key s, containing f , c, Δ and a permission token kc,f,D,Δ = {f, D, Δ}kc with Δ > now t , and the expected message counter m. The authentication protocol guarantees (see Lemma 6.1) that only if D is a member of At when starting a session, the reader and the tag share the same session key s. Therefore, in the current session the tag only accepts messages constructed by such a reader in domain D. This proves that it must have issued the command to the execute this method in the session it started, and also that it held the appropriate permission token. Moreover, due to the use of message counters, the current session only accepts a particular message encrypted for this session at most once. This proofs the final statement of the lemma.
7
Concluding Remarks and Further Research
Although our model accommodates a multitude of use cases, in the course of this research we have identified several capabilities that our current implementation
152
J.-H. Hoepman and R. Joosten
lacks. Access to tags and objects is bound to specific domains, and a domain with certain permissions cannot delegate them to another domain. Although access to a tag can be revoked instantaneously, permission tokens to access objects cannot be revoked (although their validity can be constrained by using short validity periods). Domains are granted access to specific tags one by one by the respective tag owners. Permission tokens to call a method on an object are however not tag specific (unless each object of the same class is given a separate class (or rather object) key. The distinction between a permission to access a tag and a permission to call a method on an object is confusing and perhaps unfortunate. Finally, to re-encrypt an identifier, one needs to own the corresponding access key. This severely limits the options for owners to re-encrypt their tags. On the other hand, not requiring such an access key puts tags wide open to denial-ofservice attacks that feed them with bogus identifiers. We welcome discussion and feedback on these issues.
References [1] Anderson, R.J., Bezuidenhoudt, S.J.: On the reliability of electronic payment systems. IEEE Trans. on Softw. Eng. 22(5), 294–301 (1996) [2] Avoine, G.: Privacy ussues in RFID banknotes protection schemes. In: 6th CARDIS, Toulouse, France, September 2004, pp. 43–48 (2004) [3] Avoine, G., Dysli, E., Oechslin, P.: Reducing time complexity in rfid systems. In: Preneel, B., Tavares, S. (eds.) SAC 2005. LNCS, vol. 3897, pp. 291–306. Springer, Heidelberg (2006) [4] Avoine, G., Lauradoux, C., Martin, T.: When compromised readers meet RFID. In: Workshop on RFID Security (RFIDsec), Leuven, Belgium, June 30–July 2, pp. 32–48 (2009) [5] Bellare, M., Namprempre, C.: Authenticated encryption: Relations among notions and analysis of the generic composition paradigm. In: Okamoto, T. (ed.) ASIACRYPT 2000. LNCS, vol. 1976, pp. 531–545. Springer, Heidelberg (2000) [6] Black, J., Rogaway, P.: CBC MACs for arbitrary-length messages: The three-key constructions. In: Bellare, M. (ed.) CRYPTO 2000. LNCS, vol. 1880, pp. 197–215. Springer, Heidelberg (2000) [7] BSI. Advanced security mechanisms for machine readable travel documents – extended access control (eac). Tech. Rep. TR-03110, BSI, Bonn, Germany (2006) [8] Dimitriou, T.: A lightweight RFID protocol to protect against traceability and cloning attacks. In: IEEE International Conference on Security and Privacy for Emerging Areas in Communication Networks, SECURECOMM 2005 (2005) [9] Engberg, S.J., Harning, M.B., Jensen, C.D.: Zero-knowledge device authentication: Privacy & security enhanced RFID preserving business value and consumer convenience. In: 2nd Ann. Conf. on Privacy, Security and Trust, Fredericton, New Brunswick, Canada, October 13–15, pp. 89–101 (2004) [10] Gamal, T.E.: A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Trans. on Inf. Theory 31(4), 469–472 (1985) [11] Garfinkel, S.L., Juels, A., Pappu, R.: RFID privacy: An overview of problems and proposed solutions. IEEE Security & Privacy, 34–43 (May 2005) [12] Golle, P., Jakobsson, M., Juels, A., Syverson, P.F.: Universal re-encryption for mixnets. In: Okamoto, T. (ed.) CT-RSA 2004. LNCS, vol. 2964, pp. 163–178. Springer, Heidelberg (2004)
Practical Schemes for Privacy and Security Enhanced RFID
153
[13] Hoepman, J.-H., Hubbers, E., Jacobs, B., Oostdijk, M., Wichers Schreur, R.: Crossing borders: Security and privacy issues of the european e-passport. In: Yoshiura, H., Sakurai, K., Rannenberg, K., Murayama, Y., Kawamura, S.-i. (eds.) IWSEC 2006. LNCS, vol. 4266, pp. 152–167. Springer, Heidelberg (2006) [14] Hoepman, J.-H., Joosten, R.: Practical schemes for privacy & security enhanced RFID, CoRR abs/0909.1257 (2009) [15] ISO 7816. ISO/IEC 7816 Identification cards – Integrated circuit(s) cards with contacts. Tech. rep., ISO International Organisation for Standardisation (ISO) JTC 1/SC 17 [16] ISO 9798-2. ISO/IEC 9798 Information technology – Security techniques – Entity authentication – Part 2: Mechanisms using symmetric encipherment algorithms. Tech. rep., ISO JTC 1/SC 27 [17] Juels, A.: RFID security and privacy: A research survey. IEEE Journal on Selected Areas in Communications 24(2), 381–394 (2006) [18] Juels, A., Pappu, R.: Squealing euros: Privacy protection in RFID-enabled banknotes. In: Wright, R.N. (ed.) FC 2003. LNCS, vol. 2742, pp. 103–121. Springer, Heidelberg (2003) [19] Juels, A., Weis, S.: Defining strong privacy for RFID. In: 5th Ann. IEEE Int. Cont. on Pervasive Computing and Communications Workshops – Pervasive RFID/NFC Technology and Applications (PerTec), pp. 342–347 (2007) [20] Molnar, D., Wagner, D.: Privacy and security in library RFID: issues, practices, and architectures. In: Atluri, V., Pfitzmann, B., McDaniel, P.D. (eds.) ACM Conference on Computer and Communications Security, Washington D.C., USA, October 25–29, pp. 210–219. ACM, New York (2004) [21] NIST 800-38B. Recommendation for block cipher modes of operation: The CMAC mode for authentication. Tech. Rep. NIST Special Publication 800-38B, National Institute of Standards and Technology, U.S. Department of Commerce (May 2005) [22] Oswald, E.: Suggested algorithms for light-weight cryptography. Tech. rep., ECRYPT (September 2006) [23] Rieback, M.R., Gaydadjiev, G., Crispo, B., Hofman, R.F.H., Tanenbaum, A.S.: A platform for RFID security and privacy administration. In: LISA, pp. 89–102. USENIX (2006) [24] Sarma, S.E., Weis, S.A., Engels, D.W.: RFID systems, security & privacy implications (white paper). Tech. Rep. MIT-AUTOID-WH-014, Auto-ID Center. MIT, Cambridge, MA, USA (2002) [25] Spiekermann, S., Evdokimov, S.: Critical RFID privacy-enhancing technologies. IEEE Security & Privacy 11(2), 56–62 (2009) [26] Stajano, F.: The resurrecting duckling - what next? In: Christianson, B., Crispo, B., Malcolm, J.A., Roe, M. (eds.) Security Protocols 2000. LNCS, vol. 2133, pp. 204–214. Springer, Heidelberg (2001) [27] Stajano, F., Anderson, R.: The resurrecting duckling: Security issues for ad-hoc wireless networks. In: Christianson, B., Crispo, B., Roe, M. (eds.) 7th Int. Workshop on Security Procotols. LNCS, pp. 172–194 (1999) [28] Tsiounis, Y., Yung, M.: On the security of elgamal based encryption. In: Imai, H., Zheng, Y. (eds.) PKC 1998. LNCS, vol. 1431, pp. 117–134. Springer, Heidelberg (1998) [29] Weis, S.A., Sarma, S.E., Rivest, R.L., Engels, D.W.: Security and privacy aspects of low-cost radio frequency identification systems. In: Hutter, D., M¨ uller, G., Stephan, W., Ullmann, M. (eds.) Security in Pervasive Computing. LNCS, vol. 2802, pp. 201–212. Springer, Heidelberg (2004)
MoteAODV – An AODV Implementation for TinyOS 2.0 Werner Backes and Jared Cordasco Stevens Institute of Technology Castle Point on Hudson, Hoboken, NJ 07030 USA {wbackes,jcordasc}@cs.stevens.edu
Abstract. Reliable, inexpensive, on-the-fly networks can be established using mobile ad-hoc network (MANET) technology. Such networks can be used in a wide variety of scenarios ranging from connecting powerful computers to connecting so-called “smart dust” devices. However, the core of MANET technology, the routing protocols, were never designed for the extremely low power devices that are desired for today’s applications. In this paper, we propose a new implementation of the Ad-hoc OnDemand Distance Vector routing protocol (AODV), named MoteAODV, that addresses this shortcoming. In addition, we also introduce an implementation, MoteAODV+AES, which allows for the addressing of security concerns in routing protocols on such limited devices. We also provide performance benchmarks and a comprehensive security analysis of our proposed solutions.
1
Introduction
Mobile ad-hoc networks (MANETs) allow for wireless communication without the need for a central infrastructure, using low-cost resource constrained devices in sometimes hostile environments. Even though devices in MANETs may move around considerably, they can still communicate with each other. At the root of these unique properties are the routing algorithms that make communication possible between MANET nodes that are possibly out of direct radio range. As a result, wireless ad-hoc networks are becoming increasingly popular and applications of MANETs are manifold. Initial proposals for routing protocols in MANETs such as Dynamic Source Routing (DSR) [13], Destination-Sequenced Distance-Vector routing (DSDV) [21], and Ad-hoc On-Demand Distance Vector routing (AODV) [22] do not consider an implementation on extremely resource constrained devices such as sensor motes [6]. In fact, much of the hardware currently under consideration for wireless sensor networks (a special form of MANET) was not yet developed when these proposals were set forth. Since these mote devices were first developed, protocols like Trickle [14] and the Collection Tree Protocol (CTP) [10] appeared. While these protocols allow the motes to carry out some simple tasks in simplified scenarios, these protocols do not provide the robustness and flexibility of protocols designed P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 154–169, 2010. c IFIP International Federation for Information Processing 2010
MoteAODV – An AODV Implementation for TinyOS 2.0
155
for more general MANETs. In order to use motes for these more advanced purposes, more general routing protocols are required. When deciding which routing protocol to use, there are several considerations. First, one must choose between proactive and reactive protocols. In proactive protocols, each node maintains a route to all other nodes in the network. This often involves exchanging complete routing tables during routing updates. Reactive protocols, however, only maintain routes to nodes for which there is active communication. When communication with a new node is needed, the node performs route discovery for that destination. While proactive protocols allow for faster initiation of new connections (no waiting for route discovery), they require significantly more bandwidth for route maintenance. In addition, routing table storage requirements grow in proportion to the size of the network. Therefore, for resource constrained devices it is best to use a reactive protocol. Additional consideration has to be given to the use of source-routed or distancevector protocols. In source-routed protocols, a node knows the complete route its data will travel to arrive at the destination. In a distance-vector protocol, however, the node only knows the next hop. With the source-routing approach, a node has more control over the path its data travels, but it also has to perform a new route discovery whenever the route breaks due to node mobility or failure. Distancevector protocols are designed to route around failures without notifying the source if at all possible. This provides greater flexibility and will often result in fewer control messages being sent through the network. These two advantages of the distance-vector approach make it ideal for use on resource constrained devices. Thus, research into implementing more advanced protocols should focus on reactive distance-vector protocols such as AODV. Prior work in this context includes TinyAODV [29], an implementation of AODV for version 1.x of the TinyOS operating system. TinyAODV does not support timer-based events such as HELLO messages or expiring routes. Our first contribution in this paper is a new implementation of AODV for TinyOS 2.0 called MoteAODV, that addresses these shortcomings. In our explanation of MoteAODV, we detail the issues that must be addressed when implementing the AODV protocol on these resource limited mote devices, specifically the Crossbow TelosB mote [27]. Original MANET routing protocols were not designed to address security issues. Subsequent protocols were introduced [3,4,11,12,15,19,23,24,30] to address these concerns. In particular, SAODV [30] suggests the use of public key cryptography to secure AODV routing. However, due to their resource constraints, mote devices are not capable of using complex public key signature schemes to secure the routing messages, as proposed in [30]. Instead, it is necessary to use hash functions and symmetric key encryption to provide message integrity and prevent eavesdropping by outside attackers. As our second contribution in this paper we describe our new implementation of the Advanced Encryption Standard (AES) on the TelosB motes with a focus on improving performance while creating an implementation that can run alongside our MoteAODV implementation within the memory and storage restrictions of the devices.
156
W. Backes and J. Cordasco
The remainder of the paper is organized as follows. Section 2 gives a brief overview of the AODV protocol. Section 3 then details our implementation for the TelosB mote. In Section 4 we describe MoteAODV+AES—a version of MoteAODV secured with pre-shared keys. We then provide protocol level results in Section 5. Section 6 gives a security analysis of the new protocol using a novel attacker model. Finally, we conclude and describe future work in Section 7.
2
AODV
AODV is an on-demand (reactive), distance-vector routing protocol for ad-hoc networks. Each node only maintains routes for nodes that it actively communicates with. When the node wishes to initiate communication with a node for which it does not currently have a valid route, it must perform route discovery. The first step in route discovery for a particular destination D involves the source node S broadcasting a Route Request packet (RREQ) to its neighbors. In the RREQ, S specifies a destination sequence number (DSN) which indicates how “fresh” a route is desired. Neighbors rebroadcast the RREQ successively until it either reaches a node having a DSN for D that is fresh enough (greater than or equal to the one in the RREQ), or it reaches D. In order to speed up route discovery and minimize control traffic in the network, intermediate nodes must respond to RREQs if they have a fresh enough route. As the RREQ is forwarded, each node keeps a record of the RREQ-ID to avoid loop resending of the same packet. The node also prepares a reverse route to S based on the RREQ. This reverse route is then used for unicasting the Route Reply (RREP) after it is generated at either an intermediate node, or at D. This establishes the route bi-directionally between S and D1 . A RREP acknowledgment (RREP-ACK) is optionally sent from S to D. In addition to the RREQ, RREP, and RREP-ACK messages, HELLO messages are recommended for link-state monitoring. Nodes periodically broadcast HELLO messages to inform their neighbors that they are within range of direct radio broadcasts. After a specified number of HELLO messages from a neighbor are missed, a node sends Route Error (RERR) messages to all its neighbors who had established routes forwarding data through the missing node. To increase performance, the node may attempt local route repair prior to the sending of RERR messages. For more detailed information on the AODV protocol see [22].
3
MoteAODV
MoteAODV—our implementation of the AODV protocol—is aimed at low-power sensor devices such as the Crossbow TelosB motes [27] or the Crossbow Mica2 motes [17]. The main issues in programming or working with this kind of device are the limited amounts of main memory (RAM), programming flash, and the 1
If an intermediate node responds, a gratuitous RREP sent to D is also required for a bi-directional route.
MoteAODV – An AODV Implementation for TinyOS 2.0
157
low-power CPU. The various combinations2 thereof make it difficult to state definitively which platform is the most resource constrained. Implementation choices, e.g., ability to trade memory usage for code size, further complicate the issue. Our implementation is designed for the Crossbow TelosB motes. We have decided to base our AODV implementation on TinyOS 2.0 [29] instead of version 1.x due to the limited support in 1.x for our hardware at this point in time. In particular, the limitations of TinyAODV [29] (which is part of the TinyOS 1.x distribution) led us to re-implement AODV rather than porting TinyAODV to TinyOS 2.0. In general, TinyAODV does not support any timer-based events of AODV protocol. In particular, its limitations include never expiring routes and the lack of HELLO messages to observe link state changes. In contrast, the MoteAODV is optimized for sensor devices with a low-power CPU and limited memory resources and designed to support the timer-based features of AODV. In this section, we describe how the timer-based events can be implemented with little overhead, by balancing memory and computational efficiency in our data structures which are optimized for the most commonly performed operations. In addition, MoteAODV also supports the use of micro-acknowledgments to detect broken links as an alternative to HELLO messages. 3.1
Timer-Based Events
In this section we introduce and detail the techniques we used to implement and emulate the timer-based mechanisms for handling expiring routes and HELLO messages as defined in the AODV standard [20]. These features, which are not implemented by TinyAODV, are designed to keep the routing information up-todate and therefore allow the AODV protocol to recover from routing changes due to mobility or failure in a more timely fashion. We do not discuss the AODV protocol in detail here, but rather explain the techniques and methods used in MoteAODV to support these important features with minimal overhead. In order to do so, we need to adapt the AODV protocol as the computational overhead caused by excessive use of timers would overload the low-power CPU of the TelosB motes. The solution is to replace separate timers for individual events with periodic timers. An advantage of using periodic timers is the option of extending the interval in between timer ticks in case a higher number of computations has to be performed, e.g., for an implementation of the TAODV protocol [16], or for debugging purposes. As a result, the minimum time interval that can be measured is also determined by the time in between these ticks. Therefore, all AODV timings have to be adjusted. In our setting, we are using timers recurring every 1000 ms as a basis for the conversion of the configuration parameters proposed in RFC 3561 [20]. Table 1 gives some examples for converting time intervals into timer ticks. It is important to note that we compute the proposed time interval for NODE TRAVERSAL TIME in our conversion to timer ticks 2
TelosB motes have 10kb of main memory and 48kb of programming flash with a 16 bit CPU, whereas Mica2 motes have only 4kb of main memory, but 128kb of programming flash with an 8 bit CPU.
158
W. Backes and J. Cordasco Table 1. Conversion of proposed configuration parameters
Parameter Name ACTIVE ROUTE TIMEOUT MY ROUTE TIMEOUT HELLO INTERVAL NODE TRAVERSAL TIME NET TRAVERSAL TIME PATH DISCOVERY TIME
Proposed Value 3000ms 2 · ACTIVE ROUTE TIMEOUT 1000ms 40ms 2 · NODE TRAVERSAL TIME ·NET DIAMETER 2 · NET TRAVERSAL TIME
Timer Ticks 3 2 · ACTIVE ROUTE TIMEOUT 1 1 3 2 · NET TRAVERSAL TIME
for NET TRAVERSAL TIME using a NET DIAMETER of 35. All other parameters have been converted accordingly. For reasons of modularity, we are using two periodic timers in our implementation of the AODV protocol, one timer for updates to the routing and RREQ tables and another timer for other AODV-related events, including HELLO messages. These recurring timers3 are implemented as follows: Routing table timer: (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11)
foreach (rt ∈ routing table) do rt.lifetime = rt.lifetime − 1 if (rt.lifetime == 0) then delete rt from routing table else if (rt.lifetime < DELETE PERIOD) then rt.state = ROUTE ENTRY INVALID foreach (rq ∈ RREQ table) do rq.lifetime = rq.lifetime − 1 if (rq.lifetime == 0) then delete rq from RREQ table
AODV timer: (1) (2) (3) (4) (5) (6) (7) (8) (9)
foreach (rp ∈ RREP wait table) do rp.lifetime = rp.lifetime − 1 if (rp.lifetime == 0) then delete rp from RREP wait table foreach (nb ∈ neighbor table) do nb.hello miss = nb.hello miss + 1 if (nb.hello miss ≥ ALLOWED HELLO LOSS) then report broken link to neighbor nb delete nb from neighbor table
It is important to note that the periodic timers only decrease the lifetime or increase the counters. Other methods like the processing of HELLO messages reset or initialize the counters, e.g., the missed messages counter for the neighbor for which the node received a HELLO message. The AODV timer checks whether the lifetime or the counter have reached a threshold. If so, it notifies the protocol about a broken link in case too many HELLO messages from a particular neighbor are lost. The routing table is updated and, according to the AODV protocol, appropriate RERR messages are issued. The extended lifetime of a route table entry is defined as the sum of MY ROUTE TIMEOUT and DELETE PERIOD. This allows us to use a single value to easily determine the validity period of a route table entry and finally remove the entry after the delete period has expired (as defined in the AODV standard). The rate and the number of retries for RREQ messages is used as defined in the AODV standard in order to reduce the number of routing messages. The RREQ and RREP tables are introduced to emulate this behavior with recurring timers. We are using the RREQ table to track and limit the RREQs a sender is allowed to issue to a destination. The RREP table tracks the issued 3
We are using the conversion table with a 1000 ms to 4000 ms increase in the timer interval in practice.
MoteAODV – An AODV Implementation for TinyOS 2.0
159
RREQs and the time a node waits for the RREP message to arrive. These tables are checked or initialized when a RREQ is to be issued and modified when a RREP message is processed. 3.2
Efficient Data Structures
Using efficient data structures plays a major role in minimizing computational overhead. To implement the aforementioned tables, used to minimize the workload within each timer tick, we introduce a simple data structure. Our new data structure allows a fast enumeration of all table entries and an efficient delete of specific table entries. The limited amount of memory on the motes forces us to limit the maximum amount of table entries and therefore makes a dynamic structure, like a double linked list, impractical. The size of each table is decided at compile time and can be adjusted by modifying the appropriate constants in the source code. Figure 1 shows an initialized, but empty table. The data structure uses an index array t array to access the actual table entries t entries and the position t pos free in the index array where one can find the next unused table entry. This allows us to efficiently implement the functionality needed by the periodic timers, namely, to enumerate all used table entries with little overhead and to delete a specific table entry in constant time. In addition, we are also able to append an entry to the table in constant time. These constant time table operations are implemented as follows: Delete table entry at position d: (1) (2) (3) (4)
t pos free = t pos free − 1 tmp = t array[d] t array[d] = t array[t pos free] t array[t pos free] = tmp
Append table entry e: (1) (2) (3)
tmp = t array[t pos free] t entries[tmp] = e t pos free = t pos free + 1
However, focusing on these table operations in order to minimize the load for the periodic timers also has disadvantages. The delete operation, for example, changes the order of the table entries. Other operations such as inserting an entry at a specific position within the table take linear time because the order of the other table entries needs to be preserved.
t_pos_free
next free index
index array
table entries
Fig. 1. Data structure for tables
160
3.3
W. Backes and J. Cordasco
Hello Messages vs. Micro-acknowledgments
The AODV standard [20] proposes HELLO messages as one method to monitor changes of the link state of neighbor nodes. In general, HELLO messages are the preferred method of detecting route errors caused by the mobility or failure of network nodes. However, sending out HELLO messages on a constant basis not only increases the power usage (therefore decreasing the lifetime of the battery powered mote), but it also increases the level of exposure of the entire network. In some scenarios (mostly military) this increased risk of being detected is not acceptable. In order to address this challenge, we have developed a new transparent micro-acknowledgment mechanism which eliminates the need for HELLO messages. In order to implement the micro-acknowledgment functionality, we developed a new programming interface called PacketSend which we derived from the built-in TinyOS interface AMSend. The addition of the sendError event allows us to signal the sender of a message that the message could not be delivered to its destination. The new extended interface PacketSend provides the following methods: command error_t send(am_addr_t addr, message_t* msg, uint8_t len) command error_t sendAck(am_addr_t addr) command error_t cancel(message_t* msg) event void sendDone(message_t* msg, error_t error) event void sendError(am_addr_t dest_addr) command uint8_t maxPayloadLength() command void* getPayload(message_t* msg)
The micro-acknowledgment mechanism works as follows. For each message a source sends to its destination using the new PacketSend interface, the destination sends back an acknowledgment package using the sendAck command. For simplicity we use a different channel for the acknowledgment packets than for the routing or data messages. The PacketSend interface keeps a table entry with a packet counter for each destination the source sends messages to. This counter is increased for every outgoing packet and decreased for every incoming acknowledgment packet the sender receives from the destination. The event sendError is triggered if the packet counter for a destination exceeds a predefined threshold. In some cases packets are lost, e.g., caused by a temporary high load which overflows the message buffers. In order to avoid the buildup of the packet counter over time, due to short-term problems, we use a recurring timer that decreases each packet counter. This mechanism allows us to detect link failures due to mobility or node failures and it is stable enough to handle moderate loss of packets due to short-term factors.
4
Securing MoteAODV Using Pre-shared Keys
The AODV protocol was not designed with security in mind. MoteAODV therefore, introduces extended routing messages that contain a hash value in order to protect the integrity of the AODV packets. These routing messages (including the hash value) are then encrypted using a pre-shared key. We implemented several hash functions for MoteAODV, including MD5 [25] and SHA-256 [2].
MoteAODV – An AODV Implementation for TinyOS 2.0
161
MoteAODV uses as default AES [7, 1] with 128 bit keys in CTR mode [8, 9] to encrypt the messages. It is important to note that the MoteAODV implementation supports AES-128 in software including all block cipher modes of operation [8, 9]. This gives us great flexibility in terms of both the key management and the actual use of AES. In the following sections we detail the optimizations and give a performance analysis for the MoteAODV implementation of AES-128 for TelosB motes. We then analyze the performance of the MD5 and SHA-256 implementations in MoteAODV. 4.1
AES-128 for TelosB Motes
In this section we present ways to optimize the AES implementation for the 16 bit processor TI MSP430 [18] of the TelosB motes. Rijndael block ciphers [7] in general, or AES in particular, are designed to work with 8 bit processors. Optimizations are known for the typical 32 bit processors used in today’s PCs [26]. Unfortunately, these optimizations cannot be applied to the TelosB mote implementation due to the limited instruction set of the 16 bit TI MSP430 CPU [18]. In addition, the majority of these optimizations for AES-128 use lookup tables which would take up a significant amount of the very limited main memory (10 KB for the TelosB mote). The core of our AES-128 implementation is therefore based on the 8 bit textbook implementation [7] using a limited number of tables to save memory. The lookup tables that are unavoidable are the sbox table for encryption and the inverse sbox table for decryption, which each take up 256 bytes of memory. In order to speedup multiplication, we include another 256 byte lookup table. While traditional improvements would be to extend the lookup tables for the use of 16 bit operations, the limited amount of available memory does not allow this form of optimization. Consequently, access to the lookup tables is limited to 8 bit operations. In most cases, this prevents us from using 16 bit operations efficiently. Using simple source code transformations only, we improve on AES key expansion4 and AES add round key by using 16 bit operations. Two 8 bit assignment or xor operations can be replaced by one 16 bit operation. In addition, a modification of AES mix columns using one additional temporary variable gives us an additional improvement on the TelosB mote (see Appendix for details). Further optimization is possible by using assembler code to re-implement parts of the AES-128 functions. We are able to achieve an additional optimization by making extensive use of the 16 bit capabilities of the TI MSP430 CPU in the TelosB motes. The MSP430 has a very simple but limited instruction set. The majority of register operations take up 1 processor cycle, but accessing memory is expensive and usually takes 3 cycles per memory operation. It is important to note that the number of cycles does not depend on whether it is an 8 bit or a 16 bit operation. The special operation swpb [register] which swaps the upper and lower byte of a register can be used to efficiently convert two 8 bit values into a 16 bit value. Some operations can be improved by rearranging the 4
Function names are chosen similar to the textbook implementation [7].
162
W. Backes and J. Cordasco
Table 2. Timings and memory usage for AES-128 implementation on TelosB motes operation encrypt block decrypt block encrypt/decrypt (CTR) main memory program flash
text book 1.994 ms 2.365 ms 3.541 ms 1 kb 4.5 kb
improved 1.638 ms 1.996 ms 2.900 ms 1 kb 4.2 kb
assembler 1.300 ms 1.686 ms 2.377 ms 1 kb 4.7 kb
instructions and computations within the function in order to take advantage of the processors capability. In, e.g., AES sub bytes shift rows, the results of the byte-wise memory access to the sbox table are combined into a 16 bit register that can then be written more efficiently (see Appendix for details). Minimizing the number of cycles and the amount of registers used, including minor assembler improvements to the key expansion, increases the performance of our implementation of AES-128 significantly. Table 2 shows the average running time for our different AES implementations. The original message used for encryption/decryption in CTR mode was 20 bytes in length. The time was measured using the TinyOS timer module and each operation was performed 5000 times. Our assembler implementation gives us more than 30% reduction in the running time for the encryption/decryption of a message in CTR mode. Compared to the improved (non-assembler) version, our assembler implementation still results in approximately a 20% reduction in running time. Further improvements for the MSP430 CPU are difficult because, as mentioned above, the CPU’s limited instruction set makes a conversion from 8 bit to 16 operations and vice versa difficult. The main memory usage could be reduced by hard-coding the lookup tables using a switch-case statement, but the programming flash usage would increase significantly. This technique could therefore be used for Mica2 motes that have less main memory, but almost three times the programming flash of the TelosB motes. 4.2
Hash Functions MD5 and SHA-256
We implemented the hash functions MD5 [25] and SHA-256 [2] for the TelosB motes in order to integrity protect routing messages. Unlike our AES-128 implementation for the TelosB motes, we only implemented SHA-256 according to the standard [2]. For MD5 we implemented the textbook version [26] and developed a slower, but more compact version, which consumes less programming flash by using a small portion of the main memory. Table 3 shows the main memory and programming flash usage of our MD5 and SHA-256 implementations. The running times in Table 3 are the average time for hashing one block including the time needed for the padding of a message. The performance drop of our compact MD5 implementation can be explained by the increased number of memory access operations. On a TI MSP430 CPU, these operations are significantly slower than register based operations. On the other hand, the faster textbook implementation of MD5 takes up about 20% of the TelosB programming flash.
MoteAODV – An AODV Implementation for TinyOS 2.0
163
Table 3. Timings and memory usage for the MD5 and SHA-256 implementation on TelosB motes MD5 (text) MD5 (compact) 1.582ms 4.703ms – 272 byte 9kb 4kb
hash a message main memory program flash
SHA-256 9.163ms 256 byte 2 kb
S
D
S
S
D D
(a)
(b)
(c)
Fig. 2. Test networks with (a) low mobility, low range (b) low mobility, high range and (c) high mobility, high range
5
Overall Protocol Performance
In this section we detail the protocol level performance results we have obtained in our testing. These tests were performed in three different network scenarios. Our first scenario represents the connectivity of nodes in a network with low mobility and short radio range (Figure 2a). The second scenario represents a network of nodes with low mobility and an increased radio range (Figure 2b). Our third testing scenario represents the topology of a network with nodes having a high rate of mobility and a long radio range (Figure 2c). For each of these networks, we test both MoteAODV and MoteAODV+AES. For nodes using MoteAODV+AES to send a packet, a SHA-256 hash value for the packet was computed and appended to the message. This new, larger packet is then encrypted using AES-128 in CTR mode. Upon receiving such a message, a node decrypts the packet and checks the hash value. Packets that do not verify in this way are dropped. 5.1
Route Discovery
The results for successful route discovery are shown in Table 4. These results and all that follow are the results of averaging ten separate measurements. As can be seen in the timings, the addition of the AES and hash computations, along with the increased message size, causes a 2.9-fold increase in discovery time for Scenarios (a) and (b), and a 3.7-fold increase in Scenario (c). The increase in Scenario (c) is caused by the high number of connections for each of the nodes which allows for a high number of possible routes to the destination. The additional computations in MoteAODV+AES, in particular the computation
164
W. Backes and J. Cordasco Table 4. Timings for successful route discovery Scenario (a) (b) (c)
MoteAODV 220.1 ms 112.9 ms 59.4 ms
MoteAODV+AES 642.3 ms 333.0 ms 223.1 ms
of the SHA-256 hash value, cause delays within the processing of the routing messages. While in all scenarios there is a significant increase in route discovery time, it still takes less than one second and there is an increase in security as discussed later in Section 6. 5.2
Link Failure Recovery
Earlier we described the use of micro-acknowledgments for the silent detection of link failure. While this may be preferred in certain applications, the AODV standard recommends HELLO messages and as such they are the preferred mechanism for general networks. Therefore, our tests focus on the use of HELLO messages for link failure detection. As mentioned above, if a node fails to receive the required number of HELLO messages it assumes the link is dead. The standard recommends a missed HELLO threshold of five HELLO INTERVAL periods [20]. However, since our implementation sends HELLO messages less often due to the limited CPU power of the motes, we also tested with a threshold of three periods. The results for detection of link failure are shown in Table 5. These tests were not performed in the three separate scenarios because the overall network topology does not affect the detection of link failure between two individual nodes. As the results show, there is little overhead for MoteAODV+AES with regard to link failure detection. Also, the detection times decrease in direct relation to the size of the threshold which shows that there are no underlying components that would prevent proportionally faster detection when the threshold is decreased. After link failure is detected, a node must discover an alternate route. Due to the impact of the topology on the route discovery, specifically the length of the alternate route, we performed different tests for each of the network scenarios presented above. The results are summarized in Table 6. Once again, we see a significant increase in overhead for MoteAODV+AES as in the original route discovery results. Additionally, we see that taking out nodes downstream (i.e., a node that is closer to the destination) results in longer times for alternate route discovery. Taking out a central node in Scenario (b) makes the alternate route significantly longer and therefore increases the time necessary for discovery Table 5. Times for detection of link failure Threshold Time to detection 5 * HELLO INTERVAL (MoteAODV) 22.688 sec 5 * HELLO INTERVAL (MoteAODV+AES) 23.425 sec 3 * HELLO INTERVAL (MoteAODV) 12.024 sec
MoteAODV – An AODV Implementation for TinyOS 2.0
165
Table 6. Timings for alternate route discovery after link failure Scenario Failure Type (a) Close to source (a) Close to dest (b) Central node (c) Disable all x-links
MoteAODV MoteAODV+AES 160.5 ms 425.7 ms 209.9 ms 601.0 ms 138.2 ms 382.6 ms 138.2 ms 201.5 ms
compared to the initial route discovery. Similarly, disabling all of the cross links in Scenario (c) results in a longer alternate route and consequently longer discovery times. The results presented in this section should be considered in light of the security mechanisms used. In particular SHA-256 contributes a significant portion to the MoteAODV+AES overhead (see Table 3). Optimizing the SHA256 implementation or using a faster hash function will reduce the protocol’s overhead considerably.
6
Security Analysis of MoteAODV+AES
In determining suitable use case scenarios for MoteAODV+AES, we must consider the security provided by the protocol. In order to assess the security of MoteAODV+AES, we use the attacker model presented in [5] to briefly identify the necessary attacker capabilities to compromise the protocol. As specified in the model, attackers have two main capabilities which we must account for: communication and computation. We investigate communication capabilities equivalent to an ordinary node (Type I) and with limited sending and long range receiving (Type II). Since we are using a symmetric primitive with a group key, we consider two types of computational capabilities, specifically two categories of attacker knowledge: inside attackers (knowledge of key material) and outside attacker (no knowledge of key material). It is important to note that with multiple colluding attackers only one inside node needs to be compromised or malicious as key material then spreads via collusion. We first address insider attacks. With the group key, a node can decrypt transmitted messages and generate properly encrypted messages that others will accept as valid. The communication capabilities of the attacker(s) determine(s) the influence they can have with these messages. However, the communication capabilities in no way limit the types of attacks possible as an inside attacker already eliminates all security guarantees and reduces the protocol to the equivalent of MoteAODV. Such and attack can be prevented by tamper-proof and self-erasing motes which prevent nodes from being successfully compromised or disclosing key material, a topic which is outside the scope of the routing protocol and this paper. Outside attackers are limited by the infeasibility of performing cryptographic operations without the group key. As per [5], this limits their computational capabilities. The only messages that an attacker can generate are messages it has overheard. Therefore, attackers can only perform message replay attacks.
166
W. Backes and J. Cordasco
However, when an honest node receives a RREQ with a RREQ-ID it has already seen, it discards the message. Thus, an attacker will have to deliver its relayed message prior to the delivery of the authentic routing message. An attacker with Type I communication cannot exploit this as its neighbors either received the message at the same time or will receive it in the next hop transmission. Considering attackers with Type II and higher communication capabilities, it is tempting to declare that since they cannot decrypt the packets they are replaying, they have no way of using them to compromise the protocol. However, it is reasonable to assume that an attacker can make an educated guess as to the contents of the encrypted packets (whether via timing, or due to low amounts of network traffic, or some other means). Such an attacker can take messages and replay them in other areas of the network. If the attacker were to replay a RREQ message in an area of the network significantly closer to the destination5 (prior to the RREQs actual propagation to that area), the destination would receive a RREQ with a significantly lower hop count. If the attacker is also able to make an educated guess to identify the corresponding RREP, it can perform the replay attack in the opposite direction. After doing so the attacker will have successfully caused the advertisement of a route with a hop count significantly lower than the actual hop count. Our analysis shows several possible attacks on the MoteAODV+AES protocol. The probability of such attacks depends on the actual application and the specific attacker. With regard to the packet replay attack, networks with a low level of traffic may allow for easier identification of routing packets, but allow for fewer opportunities to perform the attack. Networks with a higher traffic volume may make identification more difficult, but would open up more opportunities to perform the attack. The size of the network can also have an effect. Small networks have a shorter window of attack as RREPs will arrive at the source faster, while larger networks have a larger window due to the increased route length. Lastly, there are no penalties for the attacker if they make an incorrect guess as packets that do not verify are quietly dropped. For evidence of the practicality of this type of attack consider the use of guessed ARP packet replay to break WEP and WPA (TKIP) wireless network keys [28]. All of these factors must be taken into account when deciding if MoteAODV+AES is appropriate for a particular scenario.
7
Conclusion and Future Work
In this paper we introduced MoteAODV, an implementation of the AODV routing protocol for the TinyOS 2.x operating system. Unlike TinyAODV, an implementation of the AODV protocol for an earlier, out-dated version of TinyOS, MoteAODV supports timer-based events. In order to limit the computational overhead, we introduced a new method using recurring timers to implement these features. To minimize the risk of detection of the sensor network, we propose the use of micro-acknowledgment’s replacing HELLO messages to monitor 5
In relation to where the message was overheard.
MoteAODV – An AODV Implementation for TinyOS 2.0
167
link state changes. We provided a performance analysis for our AES-128, MD5 and SHA-256 implementation on the Crossbow TelosB motes and detailed the improvements of our AES-128 implementation by taking advantage of the 16 bit capabilities of the TI MSP430 CPU. For Mica2 motes we propose to hardcode lookup tables in order to reduce the main memory usage. Using different network scenarios (different connectivity and mobility) we analyzed the performance of MoteAODV for route discovery and link failure recovery with and without AES-128 for encryption and SHA-256 for the message integrity. Our results show that the overhead for encryption is acceptable and in most cases outweighs the disadvantages of having unprotected routing messages. The performance can be further improved by optimizing our SHA-256 implementation or using a more efficient hash function. Finally we provide an assessment of the security of MoteAODV+AES using a novel attacker model. Future work includes reducing the overhead caused by the hash functions by optimizing our implementations for the 16 bit processor of the TelosB motes. We are also in the process of implementing the trust-based routing protocol TAODV using the techniques and methods of MoteAODV.
Acknowledgments This work is supported in part by the US Army, Picatinny, under Contract No. W15QKN-05-D-0011.
References 1. Announcing the Advanced Encryption Standard (AES). Federal Information Processing Standard 197 (2001) 2. Secure Hash Standard. Federal Information Processing Standard 180-2 (2002) 3. Baruch Awerbuch, C.N.-R., Holmer, D., Rubens, H.: An On-Demand Secure Routing Protocol Resilient to Byzantine Failures. In: ACM Workshop on Wireless Security (WiSe), Atlanta, Georgia (September 2002) 4. Buchegger, S., Boudec, J.-Y.L.: Nodes Bearing Grudges: Towards Routing Security, Fairness, and Robustness in Mobile Ad Hoc Networks. In: Proceedings of the Tenth Euromicro Workshop on Parallel, Distributed and Network-based Processing, Canary Islands, Spain, January 2002, pp. 403–410. IEEE Computer Society, Los Alamitos (2002) 5. Cordasco, J., Wetzel, S.: An Attacker Model for MANET Routing Security. In: Proceedings of The 2nd ACM Conference on Wireless Network Security (WiSec 2009), pp. 87–93 (2009) 6. Crossbow Wireless Module Portfolio, http://www.xbow.com/Products/productdetails.aspx?sid=156 7. Daemen, J., Rijmen, V.: The Design of Rijndael. Springer, New York (2002) 8. Dworkin, M.: Recommendation for Block Cipher Modes of Operation - Methods and Techniques. NIST Special Publication, 800–838A (2001) 9. Dworkin, M.: Recommendation for block cipher modes of operation: The CCM mode for authentication and confidentiality. NIST Special Publication, 800–838C (2004)
168
W. Backes and J. Cordasco
10. Fonseca, R., Gnawali, O., Jamieson, K., Kim, S., Levis, P., Woo, A.: TEP 123: Collection Tree Protocol. Technical Report 123 (2006), http://www.tinyos.net/tinyos-2.x/doc/ 11. Hu, Y.-C., Johnson, D.B., Perrig, A.: SEAD: Secure Efficient Distance Vector Routing for Mobile Wireless Ad Hoc Networks. Ad Hoc Networks I, 175–192 (2003) 12. Hu, Y.-C., Perrig, A., Johnson, D.B.: Ariadne: A Secure On-Demand Routing Protocol for Ad Hoc Networks. In: MobiCom ’02: Proceedings of the 8th Annual International Conference on Mobile Computing and Networking, New York, NY, USA, pp. 12–23. ACM Press, New York (2002) 13. Johnson, D.B., Maltz, D.A.: Dynamic Source Routing in Ad Hoc Wireless Networks. In: Mobile Computing, vol. 353. Kluwer Academic Publishers, Dordrecht (1996) 14. Levis, P., Patel, N., Shenker, S., Culler, D.: Trickle: A Self-Regulating Algorithm for Code Propagation and Maintenance in Wireless Sensor Networks. In: Proceedings of the First USENIX/ACM Symposium on Networked Systems Design and Implementation (NSDI), pp. 15–28 (2004) 15. Marti, S., Giuli, T.J., Lai, K., Baker, M.: Mitigating Routing Misbehavior in Mobile Ad Hoc Networks. In: Mobile Computing and Networking, pp. 255–265 (2000) 16. Meka, K., Virendra, M., Upadhyaya, S.: Trust Based Routing Decisions in Mobile Ad-hoc Networks. In: Proceedings of the Workshop on Secure Knowledge Management (SKM 2006) (2006) 17. Mica2 Mote Product Details, http://www.xbow.com/Products/productdetails.aspx?sid=174 18. TI MSP430 Microcontroller, http://www.ti.com/msp430 19. Papadimitratos, P., Haas, Z.: Secure Routing for Mobile Ad Hoc Networks. In: Proceedings of SCS Communication Networks and Distributed Systems Modeling and Simulation Conference, CNDS (2002) 20. Perkins, C., Belding-Royer, E., Das, S.: Ad hoc On-Demand Distance Vector (AODV) Routing, RFC 3561 (July 2003) 21. Perkins, C., Bhagwat, P.: Highly Dynamic Destination-Sequenced Distance-Vector Routing (DSDV) for Mobile Computers. In: ACM SIGCOMM’94 Conference on Communications Architectures, Protocols and Applications, pp. 234–244 (1994) 22. Perkins, C., Royer, E.: Ad-Hoc On-Demand Distance Vector Routing. In: MILCOM ’97 Panel on Ad Hoc Networks (1997) 23. Perrig, A., Canetti, R., Tygar, D., Song, D.: The TESLA Broadcast Authentication Protocol. Cryptobytes 5(2), 2–13 (2002) 24. Perrig, A., Szewczyk, R., Wen, V., Culler, D.E., Tygar, J.D.: SPINS: Security Protocols for Sensor Networks. In: Mobile Computing and Networking, pp. 189– 199 (2001) 25. Rivest, R.: The MD5 Message-Digest Algorithm (April 1992) 26. Schneier, B., Diffie, W.: Applied cryptography: protocols, algorithms, and source code in C (1996) 27. TelosB Mote Product Details, http://www.xbow.com/Products/productdetails.aspx?sid=252 28. Tews, E., Weinmann, R.-P., Pyshkin, A.: Breaking 104 Bit WEP in Less Than 60 Seconds. LNCS, pp. 188–202. Springer, Heidelberg (2008) 29. TinyOS Webpage, http://www.tinyos.net/ 30. Zapata, M.G., Asokan, N.: Securing Ad Hoc Routing Protocols. In: WiSE ’02: Proceedings of the ACM workshop on Wireless security, New York, NY, USA, pp. 1–10. ACM Press, New York (2002)
MoteAODV – An AODV Implementation for TinyOS 2.0
169
Appendix Comparison of the textbook and improved implementation of AES mix columns. AES mix columns (textbook) (1) (2) (3) (4) (5) (6)
t = st[0] ∧ st[1] ∧ st[2] ∧ st[3] u = st[0] st[0] ∧= AES times 02(st[0] ∧ st[1] ∧= AES times 02(st[1] ∧ st[2] ∧= AES times 02(st[2] ∧ st[3] ∧= AES times 02(st[3] ∧
st[1]) ∧ t st[2]) ∧ t st[3]) ∧ t u) ∧ t
AES mix columns (improved) (1) (2) (3) (4) (5) (6) (7)
u = st[3] ∧ st[0] t = (v=st[0] ∧ st[1]) ∧ (w=st[2] ∧ st[3]) st[0] ∧= AES times 02(v) ∧ t st[1] ∧= AES times 02(st[1] ∧ st[2]) ∧ t st[2] ∧= AES times 02(w) ∧ t st[3] ∧= AES times 02(u) ∧ t ...
Assembler optimized version of AES mix columns. AES mix columns (assembler) (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (12) (13) (14) (15) (16) (17)
mov @%0, r10 mov 2(%0), r11 mov r10, r12 mov r11, r13 swpb r12 swpb r13 mov r10, r14 xor r13, r14 xor r10, r12 xor r11, r13 mov r12, r15 xor r13, r15 mov.b r14, r9 add %1, r9 mov.b @r9, r9 swpb r9 mov.b r13, r7
// st[0], st[1] into r10 // st[2], st[3] into r11
// // // // // // //
r12 is r10 swapped r12 is r11 swapped compute u and st[1] xor st[2] compute v and w v in r12, w in r13 compute t (16 bit)
// compute times 02(u)
(18) (19) (20) (21) (22) (23) (24) (25) (26) (27) (28) (29) (30) (31) (32) (33) (34) (35) (36)
add %1, r7 mov.b @r7, r7 // add r7, r9 // xor r15, r9 // xor r9, r11 // swpb r14 mov.b r14, r7 add %1, r7 mov.b @r7, r9 // swpb r9 mov.b r12, r7 add %1, r7 mov.b @r7, r7 // add r7, r9 // xor r15, r9 // xor r9, r10 // mov r10, @%0 mov r11, 2(%0) ...
compute times 02(w) combine to 16 bit xor with t xor with st[2],st[3]
times 02(st[1] xor st[2])
compute times 02(v) combine to 16 bit xor with t xor with st[2],st[3]
Assembler optimized version of AES sub bytes shift rows. AES sub bytes shift rows (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (12) (13) (14) (15) (16) (17)
mov.b @%0, r11 mov.b 5(%0), r15 add %1, r11 add %1, r15 mov.b @r11, r11 mov.b @r15, r15 swpb r15 add r15, r11 mov.b 4(%0), r12 mov.b 9(%0), r15 add %1, r12 add %1, r15 mov.b @r12, r12 mov.b @r15, r15 swpb r15 add r15, r12 mov.b 8(%0), r13
// read st[0] // read st[5]
// compute sbox[st[0]] // compute sbox[st[5]] // combine to 16 bit // read st[4] // read st[9]
// compute sbox[st[4]] // compute sbox[st[9]] // combine to 16 bit // read st[8]
(18) (19) (20) (21) (22) (23) (24) (25) (26) (27) (28) (29) (30) (31) (32) (33) (34) (35) (36) (37)
mov.b 13(%0), r15 // add %1, r13 add %1, r15 mov.b @r13, r13 // mov.b @r15, r15 // swpb r15 add r15, r13 // mov.b 12(%0), r14 // mov.b 1(%0), r15 // add %1, r14 add %1, r15 mov.b @r14, r14 // mov.b @r15, r15 // swpb r15 add r15, r14 // mov r11, @%0 // mov r12, 4(%0) mov r13, 8(%0) mov r14, 12(%0) ...
read st[13]
compute sbox[st[8]] compute sbox[st[13]] combine to 16 bit read st[12] read st[1]
read sbox[st[12]] read sbox[st[1]] combine to 16 bit store 16 bit results
Random Number Generation Based on Fingerprints ˇ ıha, and Ludˇek Smol´ık Shkodran Gerguri, V´ aclav Maty´ aˇs, Zdenˇek R´ Faculty of Informatics, Masaryk University, Botanick´ a 68a 60200 Brno, Czech Republic
Abstract. Current research often focuses on the design of new methods that extend the well-established role of biometrics in authentication and identification into key management and cryptography. Methods have been proposed that involve biometric-governed access to cryptographic keys, as well as methods that utilize biometric samples to derive keys for specialized encryption algorithms. The aim of this paper is to present a possible method for random number generation from repeated measurements of fingerprints as an alternative approach to the proposed applications of biometrics in cryptography, and to analyze some of its properties. Such method could provide a valuable source of ranomness in mobile devices equipped with a fingerprint scanner.
1
Introduction
Biometric systems have become a well-established technology in modern authentication and identification solutions. The ready availability of biometric scanners, and their widespread integration into increasingly larger numbers of consumer products such as low-cost laptops and mobile phones have presented a viable alternative to traditional systems based on passwords. With the technology available, the research focus has been on improving the matching algorithms that govern the identity decision process, with the aim of decreasing the False Accept and False Reject Rates (i.e., the percentage of users incorrectly authenticated as some valid user, or rejected as an invalid one, respectively). More recently, researchers also began exploring the possibility of further applications of biometrics beyond simple authentication and identification mechanisms. The focus has been on reliable methods of key management using biometrics, in an effort to replace traditional methods based on passwords. We believe biometrics have another potential application. Inherent to each biometric measurement is a variability, which is the result of different measurement conditions and ways in which the user presents his or her features to the scanner. This variability effectively represents randomness, which, if extracted, could then be used as a seed for pseudorandom number generators, or as a random number itself. Surprisingly, there has been little research done on the suitability of biometrics as a direct source of randomness. Sczepanski et al. have devised a general P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 170–182, 2010. c IFIP International Federation for Information Processing 2010
Random Number Generation Based on Fingerprints
171
method [10] for random number generation from a large dataset of decimal values, and evaluated the performance of galvanic skin response and neurophysical brain signals. To the best of our knowledge, this has been the only such method proposed so far. The aim of this paper is to present a possible approach towards random number generation using biometrics, with fingerprints as the biometrics of choice. Specifically, the main goal of this method is to provide on-demand session key generation capabilities, typically for symmetric key generation, and to authenticate the user in the process – we do not aim for continuous, high bitrate as from some other random number generators. We then analyze several entropycontributing factors of the method and provide the results of our analysis. The focus here is on experimental analysis; mathematical proofs of security are beyond the scope of the paper. The main goal of this paper is not an introduction of a (new) fundamental mathematical theory for entropy extraction from biometric data, but rather an initial investigation of user accessible randomness source, with an experimental study within common environments like mobile phones. We have chosen the biometric data as a new and promising information source and we have developed a simple algorithm for extraction of the inherent randomness introduced by user interaction with the mobile device. We are aware that our treatment of the subject is far from perfect and we see our analysis as one of the initial steps for a probably new kind of usage of biometric information. It should be noted that this paper is an extension of [3], where the method and its first analysis have been presented. The rest of the paper is structured as follows: Section 2 provides a short overview of some of the recent research in biometric key management and biometric encryption. Section 3 introduces the proposed method and provides a brief overview of the method proposed by Sczepanski et al., with an emphasis on the differences between the two methods. Section 4 analyzes the entropy contributing factors in terms of entropy, and provides the results. Finally, we conclude in Section 5.
2
Existing Work
Several biometric key management methods have been proposed so far. These can be generally divided into two categories: key locking and key generation. Key locking methods combine information extracted from a biometric sample with the secret key to obtain a hardened template from which it is impossible to determine either the key or the biometric sample used. The hardened template is then stored on a storage medium that needs not necessarily be secure; to “unlock” the key from the template, the user authenticates himself or herself to the system, and the extracted features are combined with the template to release the original key. Sometimes, such methods are called biometric cryptography. Perhaps the most profound key locking scheme presented is that of [5]. There, Juels and Watenberg propose a new cryptographic primitive, the so-called fuzzy commitment, as an extension of bit commitment to binary strings, and provide a
172
S. Gerguri et al.
set of model schemes that employ the new primitive, including one for biometric key locking. A more recent approach towards reliable key locking mechanism was presented by Hao et al. in [4]. The authors proposed method uses the IrisCode, a 2048-bit representation of an iris image, to securely lock a secret key on a smart card. The method is especially noteworthy because of its simplistic design, good FAR and FRR (0.47% and 0%, respectively), and its easy extension to a threefactor authentication, where a password is required in addition to the user’s IrisCode and the smart card on which the locked key is stored. A similar method to that of Hao et al. was proposed by Li et al. in [7]. The method employs a set of transforms to obtain an iris feature vector, which is then combined with the secret key. The obtained iris feature vector, however, is different from the IrisCode used in [4], and binary addition is used instead of the exclusive OR operation. Key generation methods do not store any information on an external storage; instead, the key material is generated from the freshly obtained biometric sample “on the fly”. Instead of locking the key with a biometric sample, the system is trained to reproduce the same key every time a legitimate user presents his or her features to the system. This usually means that no storage is required, as there is no additional information to be stored. Feng and Wah have proposed a method for key generation using online handwritten signatures in [2]. The method checks the static features of a handwritten signature (such as shape) to filter out trivial impostors, and quantized dynamic features (such as pen pressure and pendown time) to generate a matching private DSA key to a stored public key that has been enrolled during the training phase. Ram´ırez-Ruiz et al. proposed a different approach, based on FingerCodes, a method of fingerprint representation based on texture, in [9]. The method utilizes Support Vector Machines (SVMs) as a key generation mechanism – in the training phase, the SVMs are trained on a dataset of user’s fingerprints to produce the desired bits of the secret key. The key is then generated when the user presents his or her finger to the system. Casta˜ no´n et al. proposed a conceptually similar method based on iris image in [8]. The method employs Generalized Regression Neural Networks to generate corresponding bits of the secret key using a set of feature vectors extracted from the user’s iris image.
3
The Proposed Method
Current biometric key management schemes compensate for the inherent variability in one of the following ways: either through the use of a suitable errorcorrecting code, proximity mapping with a threshold, or through the use of classifiers such as SVM or neural networks. These are either applied to the secret key material to be stored, or to the obtained biometric information itself to link slightly differing biometric samples to the same user. Since the variability effectively represents randomness, however, biometrics present opportunities for use in random number generation mechanisms as a source of randomness, if such variability can be extracted in a meaningful way.
Random Number Generation Based on Fingerprints
173
This concept has been first explored by Sczepanski et al. in [10]. Their method is based on the observation that measurements of physical phenomena yield values that fluctuate randomly in their rightmost decimal digits. The values are partitioned into numbered intervals and then used to generate bits based on interval membership, one bit per value. The authors have tested the method on neurophysical brain signals and galvanic skin response, and statistical tests show that the resulting binary sequences have good randomness properties. The generic construction of the method also makes it possible for the method to be used with any biometrics where the results of the measurements can be quantized to decimal values in a meaningful manner. However, the method requires large datasets of values to generate longer bistrings, and its security is dependent on the security of the measurement process of the biometrics used. Out of all existing biometric technologies, fingerprint scanning is by far the most widespread due to its ease of use, low price and high accuracy. This has lead to the proliferation of mobile devices equipped with fingerprint readers, making the fingerprint scanning the ideal candidate for such application. Therefore, we designed our method primarily with fingerprints as the biometrics in mind, but the method is generic enough in its construction to be usable with any other biometrics available. Our focus was on low computational complexity to make the method suitable for mobile devices equipped with a fingerprint reader. The basic rationale behind the method is to extract various changes and differences that occur between two consecutive measurements, as in reality no two fingerprint images, even coming from the same finger, are ever the same. Differences can be introduced in the change of shape of fingerprint area, or its position inside the image, as a result of user interaction with the scanning device. The resulting value is then mapped to a different value with uniform distribution to allow for direct use as a seed for pseudorandom number generators. The basic proposed method goes as follows: 1. Obtain a set of fingerprint images F = {f1 , f2 , . . . , fn }; n ≥ 2. 2. Apply the exclusive OR (XOR) operation on the set of obtained fingerprints to compute the binary difference vector dif f = F = f1 ⊕ f2 ⊕ . . . ⊕ f n . 3. Apply a suitable hash function on the difference vector to obtain a binary vector with uniform distribution: uni = h(dif f ). Unlike key management schemes, which have to consider the structure of the biometrics to choose the best representation of the processed features, our method works on the raw data of a fingerprint image, i.e. it treats the fingerprint as a binary sequence. This is because the variability in the measurement process will be captured in the fingerprint image, and even small changes are likely to affect a high number of bits. Ultimately, working with binary sequences eliminates the process of complex feature extraction and subsequent binarization. The number of fingerprints to obtain is a system parameter, and can be set arbitrarily; however, we have yet to establish the effect that a larger number of fingerprints has on the resulting binary vector. The XOR operation serves as the extractor of variability – the resulting difference binary vector encodes change
174
S. Gerguri et al.
between the consecutive fingerprints on respective bit positions. The difference vector will likely not come from a uniformly distributed set of values, which is a requirement for cryptographic applications. Therefore, the method utilizes a hash function1 as a primitive randomness extractor to map the difference vector, which comes from a nonuniformly distributed set, to a value from a uniformly distributed set. The resulting binary vector is then ready for use. Alternatively, if the amount of entropy contained in a single fingerprint image is proven to be high, the method can be modified to use parts of an image to generate multiple random binary sequences. In such a case, only a specific subsequence of the binary representation of the fingerprint images, containing the required minimum amount of entropy, would then be XORed and hashed to produce a single random binary sequence. One of the main advantages of the proposed number generation procedure are the low computational requirements – only the XOR logical operation and a suitable hash function are required for the method implementation. The XOR operation is straightforward to implement in hardware, and the hash function can be implemented in either hardware or software at choice. This provides for a very flexible application, as the proposed method can be fully implemented in computationally restricted devices with no access to proper random number generators.
4
Analysis
To establish the theoretical entropy and security levels of the proposed method, it is crucial to identify factors that contribute to the variability in the measurement process. These can, in theory, be environmental, behavioral, or coming from the device itself. Environmental factors are specific to the time and place where the measurement process takes place, and include conditions like moisture levels, lighting conditions, or temperature levels. Behavioral factors refer to the user’s habits of presenting his or her features to the reader. Finally, the scanning device itself produces electronic noise2 that introduces perturbations into the obtained samples. For the purpose of our analysis, we focused on the effects of behavioral factors that affect the fingerprint scanning process, as well as the amount of electronic noise the reader is capable of producing. Concerning the user-contributed variability, we identified the effects of behavioral factors on fingerprint images to be: – fingerprint position, – fingerprint rotation, – fingerprint area size. Since we treat the fingerprint sample as an image, the behavioral factors will affect its appearance – different placement of the finger on the scanner during two 1 2
The hash function may be replaced by any suitable randomness extractor. We use the term “electronic noise”’ to refer to all contributing electrical noise sources in the reader components.
Random Number Generation Based on Fingerprints
175
consecutive measurements will result in two different images, with the position and rotation of the fingerprint itself inside the images being different. Habits in presenting the fingerprint to the scanner as well as applying varying amounts of pressure will also expose different areas of the finger to the fingerprint reader, and the resulting fingerprints will vary in both shape and space they occupy inside the image. Additionally, higher pressure levels will deform the skin in contact with the reader, and the ridges and valleys may become stronger or weaker as a result. Therefore, we have taken the difference between two fingerprint images as a result of these factors and calculated the expected amount of variability they provide in terms of uncertainty measure, the information entropy. We also calculated the corresponding minimum entropies to lower-bound the amount of uncertainty these factors can provide.
4.1
Behavioral Factors
The dataset upon which the calculations were conducted consisted of 218 8bit grayscale fingerprint images of the same finger, scanned consecutively. These were acquired using the Sagem MSO 300 scanner, with the resolution of 416×416 pixels. In an effort to put a lower bound on the amount of computation an attacker has to perform, we presented the finger to the reader in such a manner so as to minimize the difference between the individual measurements. To simulate real-world operation of the proposed method with a system parameter n = 2, we calculated every possible pair of fingerprints from the dataset, yielding a total of 23653 pairs. These were then used to calculate the difference in position, angle, and the number of pixels inside the fingerprint convex hull, and in turn the entropies and min-entropies of that difference (with the exception of fingerprint rotation, where we had to remove one fingerprint due to missing reference point in the image; in that case, the total number of pairs was 23436). Additionally, we examined the difference in gray levels of the fingerprints, and also calculated the amount of entropy the fingerprint reader noise can provide. In the case of fingerprint shift, we used both automated and semi-automated methods to calculate the difference. The automated approach consisted of systematic alignment of one fingerprint on top of another, until the best pixel match occurs. The difference between the coordinates of the starting and end position of the alignment was then taken as a shift vector. The shift vectors were calculated for every pair of fingerprint images, and their frequency was recorded; these were then used to calculate the shift vector probabilities and the corresponding expected and minimum entropy. In addition to that, we also calculated the entropy for vectors grouped by length into intervals of length 5, to simulate partial knowledge about the shift in position of the fingerprint. For the semi-automated approach, we manually measured the coordinates of a preselected reference point inside the fingerprint area. The difference between the coordinates, calculated for every possible pair of fingerprints, was then taken as the shift vector for the pair, with the rest of the process being analogous to
176
S. Gerguri et al.
Table 1. Entropy of fingerprint shift, calculated using both the automated (A) and semi-automated (SA) method. Results are given in bits. Fingeprint Shift Entropy Entropy Minentropy Vectors (A) 10.88 6.18 Vectors (SA) 13.34 10.93 Vector Lengths (A) 2.97 2.07 Vector Lengths (SA) 4.77 3.78
Error 0.06 0.07 0.01 0.03
Minerror 0.06 0.26 0.01 0.02
the fully automated one. Table 1 lists the entropy levels calculated using both the automated and semi-automated method. The theoretical maximum entropy for a system of 23653 shift vectors is approximately 14.53 bits – this corresponds to each shift vector occurring exactly once across all pairs of fingerprints. As can be seen from the results, fingerprint rotation exhibits good variability; the system of shift vectors, calculated using the semi-automated approach, exhibited almost maximum entropy. Grouping together shift vectors within a given length interval reduces the entropy accordingly, since doing so correctly represents partial knowledge about the shift between the two fingerprints, and thus less uncertainty. The lower entropy calculated using the automated approach is due to the fact that manual measurements can more accurately describe a shift between two positions, since the coordinates in both fingerprint images always refer to the same point. When the fingerprints are being aligned automatically, however, the decision whether a match occurred is governed by the size of the area in which the two fingerprints overlap. As the two fingerprints are likely to have different shapes and may be rotated by different angles, the calculated alignment may result in regions from one fingerprint image being aligned with different regions in the other fingerprint image, making the calculated shift vector incorrect. Fingerprint rotation was calculated in both angular degrees and pixels. Two reference points per fingerprint image were chosen, and the difference in their coordinates was then taken as the inner vector of the fingerprint. The inner vectors were then used to calculate the rotation in angles, rounded up to degrees. Pixel rotation was calculated from the rotation vector, obtained as the difference between two inner vectors. The corresponding vector lengths (rounded up to pixels) were taken as the amount of pixels a fingerprint has been rotated, compared to the second fingerprint in the pair. Table 2 lists the calculated entropy levels for both angles and rotation vectors. Most of the rotation between two fingerprints occurred within a few degrees, showing very little variability. This is likely a direct consequence of the design of fingerprint readers – the actual scanning area is not much larger than a single finger and usually delimited by rectangular border that does not allow for much rotation in the first place. As a result, the calculated entropy is low, and fingerprint rotation appears to have little effect on the amount of uncertainty a pair of fingerprints can provide.
Random Number Generation Based on Fingerprints
177
Table 2. Entroy fingerprint rotation. Results are given in bits. Fingeprint Rotation Entropy Entropy MinError entropy Degrees 3.65 2.77 0.02 Pixels 4.60 3.60 0.03
Minerror 0.02 0.02
We concluded our analysis of user-induced variability by examining the effects of pressure. First, we verified that pressure translates into the size of the area the fingerprint occupies inside the captured image. To test our hypothesis, we collected five sets of 200 fingerprints each, with all fingerprints belonging to the same set being captured while the user applied a specific amount of force. Standard electronic kitchen scale, with the reader on top, was used to measure and control the amount of pressure applied during individual measurements. Next, we calculated the number of pixels inside the convex hull of the fingerprints, and used these values along with the corresponding pressure level to test the hypothesis of the two being dependent. Statistical tests did rejected our hypothesis on a significance level α = 0.05 that the size of the fingerprint area is independent on the amount of force applied on the scanning device, with a strong linear correlation between the two. With the hypothesis verified, we proceeded to calculate the difference in pixel size of the convex hulls of the fingerprint area. This was done by calculating the pixel size of convex hull of every fingerprint from the original dataset, consisting of 218 fingerprint images, and then calculating the difference in pixel sizes for each of the 23653 different pairs. Finally, we examined the variability in the gray levels of the fingerprint. As the actual fingerprints vary both in shape and size, it is impossible to make a pixel-by-pixel comparison of gray levels, and thus we opted for average gray level, calculated over all pixels inside the fingerprint area, to abstract from the difference in the fingerprints other than the gray level itself. The calculated gray levels were then paired up accordingly and their difference calculated for every pair. Table 3 gives the results for the entropy of both the difference in pixel size of the fingerprint area and the average gray levels. Similar to fingerprint rotation, difference in pixel size exhibits good variability, with the difference ranging up to tens of thousands of pixels. This number is likely to increase with the resolution of the scanner used to acquire the images, as the fingerprint area will comprise of more pixels due to the increase in resolution. Table 3. Entropy of fingerprint pizel size difference and average gray level difference. Results are given in bits. Pixel Size and Average Gray Level Entropy Entropy MinError entropy Pixel size 13.46 11.36 0.07 Average gray level 6.57 5.03 0.04
Minerror 0.28 0.04
178
S. Gerguri et al.
Average gray levels and their difference, on the other hand, exhibited much lower variability, which resulted in lower entropy. It is important to recognize, however, that the average values only approximate a normalized value for every pixel in the fingerprint area. Real pixels are likely to vary in gray levels depending on their location, and both ridges and valleys in the fingerprint area will contain pixels with gray levels that will be skewed from the calculated average. 4.2
Factor Independence
With the entropy of the effects of individual factors established, we investigated the relationships between them. In particular, we were interested in discovering whether fingerprint position, rotation, pixel size and average gray levels are independent. The concrete relationship has practical implications for the calculated entropy levels, as the entropy of independent factors can be added together. The factors were measured on the original dataset of 218 fingerprints. Fingerprint position was measured in terms of reference point coordinates that were used to calculate the shift vectors for fingerprint pairs. Since a coordinate is effectively a vector of length 2, we split the coordinates into two values, describing the position on X and Y axis, respectively. Fingerprint rotation was determined using the inner vector of the fingerprint, relative to a vector of the same length describing the Y axis. Both pixel size and average gray level were measured exactly the same as described in the previous subsection. The obtained values were subsequently used as random variables, paired up, and tested for independence on a significance level of α = 0.05. For most of the pairs, the independence hypothesis was rejected at the given significance level. The only pairs which the hypothesis was not rejected for were X and Y coordinates; X coordinates and pixel size; and pixel size and fingerprint rotation. Last, we determined the correlation coefficients for the dependent factors; these are listed in table 4. As can be seen, most of the pairs are weakly correlated, with only pixel size and average gray level being strongly correlated; the only other pair showing stronger correlation is that of the X coordinate and the rotation. 4.3
Reader Noise
While the effects of fingerprint shift and the varying size of the fingerprint area result in the most visible changes in the fingerprint image, the electronic noise Table 4. Correlation coefficients for the individual factors X X Y Rotation Pixel Size Average GL
Correlation coefficients Y Rotation
1.000 -0.481 0.155
1.000 0.129 -0.364 0.347
-0.481 0.129 1.000 -0.194
Pixel Size Average GL 0.155 -0.364 0.347 -0.194 1.000 -0.761 -0.761 1.000
Random Number Generation Based on Fingerprints
179
produced by the fingerprint scanner during the scanning process has a potential to provide the most uncertainty through random subtle changes to every pixel in the image. Therefore, our next step was to evaluate the amount of entropy the electronic noise, produced by the scanning device, can contribute to the overall amount of entropy in a fingerprint image. We used the Crossmatch Verifier 300 LC fingerprint reader during this experiment, as, unlike the Sagem MSO 300, it allows for continuous, empty scanning to be captured on video. Readers should therefore be aware of the fact that the images produced for the purpose of electronic noise analysis come from a different reader than those used in the experiments with behavioral factors. As the original 218 fingerprint images have a lower resolution, it is also reasonable to expect the amount of entropy contained in the electronic noise of these would be lower. For the purpose of entropy estimation, we assume pixel independence of all positions inside the captured image. In practice, this may not be the case and neighbouring pixel positions are likely going to be dependent. However, precise relationship between individual positions is difficult to establish and are outside the scope of this paper. The calculated entropy and min-entropy should therefore be viewed as a theoretical upper bound the electronic noise can provide in such an image. To measure the variability in electronic noise, we recorded a one minute session of the scanning process with no finger attached to the scanner. The produced video had the 640 × 480 pixel resolution, and a framerate of 5 frames per second. We then split the recorded video into individual frames. With a frame rate of 5 fps, we were able to obtain 300 images from the one minute video of the “empty scanning” session. Next, we recorded the gray levels and their corresponding frequencies separately for every pixel position across all 300 images. The obtained frequencies were used to calculate gray level probabilities for the given pixel position, and in turn the entropy and min-entropy for the pixel position itself. Finally, the calculated entropies were added up together to form the overall entropy and min-entropy of electronic noise in an image produced by the scanner. More formally, the process goes as follows: 1. For a given position (x,y) in the fingerprint image, obtain the gray level of the pixel on that position. 2. Repeat step 1 for all 300 fingerprints, recording the frequencies of the obtained values. 3. Calculate the probability of pixel X = (x,y) taking on gray level l as P (X = l) = fN(l) , where f (l) denotes the frequency of l for pixel X, and N is the number of fingerprints. 4. Calculate the entropy for a given pixel position as H(X) = Σx − P (X = x) · log2 x. Additionally, we calculated the conditional entropy of electronic noise, given the knowledge of average gray levels in the neighbouring pixels. First, we recorded gray levels for both the given pixel position as well as all its neighbouring pixels.
180
S. Gerguri et al.
An average of gray levels of neighbouring pixels was then calculated, rounded up to integers; the obtained average was then recorded both separately and jointly with the gray level for the given pixel position. This process was repeated for all the 300 fingerprints, and the recorded frequencies were used to calculate the joint probability of a pixel and the average of its neighbours taking on particular values, as well as the probability of the average of neighbours taking on particular values, in the same manner as above. Finally, the obtained probabilities were used to calculate the conditional probability of the pixel position. A more formal description is given below: 1. Obtain the gray level of the pixel on position (x,y). 2. Next, obtain the gray levels l1 , l2 , . . . , ln of pixels on adjacent positions, and calculate their average laver = Σni li . Round the average to whole integers. 3. Repeat step 1 and 2 for all 300 fingerprints, recording the frequencies of the obtained values. 4. Calculate the probability of the neighbours taking on an average gray level of laver as P (Y = laver ) = fn (lNaver ) , where fn (laver ) denotes the frequency of laver for the neighbouring pixels, and N is the number of fingerprints. 5. Calculate the joint probability of pixel X = (x,y) taking on gray level l and its neighbours taking on value laver as P (X = l, Y = laver ) = f (l,lNaver ) , where f (l, laver ) denotes the frequency of l and laver occurring concurrently for pixel X and its neighbours, respectively. 6. Calculate the conditional probability of pixel (x,y) taking on gray level l under the condition of its neighbours taking on gray level laver as P (X = =laver ) l|Y = laver ) = P (X=l,Y P (Y =laver ) . 7. Calculate the conditional entropy of pixel (x,y): H(X|Y ) = Σx,y P (X = x, Y = y) · log2 (X = x|Y = y). The results are listed in table 5. While the figures may appear very large at first, the higher resolution of the image means that each pixel position contains approximately 2 bits of entropy on average. Furthermore, the calculated amount of entropy is only correct under the assumption of pixel independence; if the pixels are dependent, the overall entropy of the image will be lower. Nevertheless, scanner noise appears to have a solid potential to contribute substantial amount of uncertainty to the produced binary sequences. This corresponds to our findings for sources of randomness in mobile phones [6,1]. One might ask why we do not just use the internal electronic noise in the scanner itself as a good randomness source. We have to stress that we have consciously introduced the user and his controlled action, e.g., the fingerprint scan, in order to eliminate the unbiased interaction between the user and the “machine”. It is not surprising that the electronic noise of the scanner produces much higher entropy (table 5) than the well shaped ridges and valleys pattern on the fingerprints does. But such scanner noise is measured without the direct users control and with a limited user influence. Our main idea of source of randomness is hidden strictly in the user introduced interaction with the scanner, contributing a small but still considerable amount on usable entropy. The second
Random Number Generation Based on Fingerprints
181
Table 5. Entropy of electronic noise in an image produced by a fingerprint scanner. Results are given in bits.
Normal Conditional
Scanner Noise Entropy Entropy MinError entropy 6.4 · 105 4.4 · 105 2.4 · 104 5 4.4 · 10 1.7 · 104
Min-error 2.9 · 104 -
important improvement for future applications would be the interconnection between the randomness generation and a synchronous biometric authentication of the user.
5
Conclusion
As could be seen, analysis of the proposed method is not a straightforward task. The number of entropy-contributing factors is high, and it is difficult to precisely establish the effect they have on the produced binary sequences. Furthermore, behavioral factors are largerly dependent on each other, and so the calculated entropies cannot simply be added together. On the other hand, the electronic noise the scanning device produces seems to contain a lot of uncertainty, but as we are unclear on the relationship between neighbouring pixels in electronic noise, the calculated entropy levels are only correct under the assumption of pixel independence. Overall, the results indicate the proposed method is promising, but to allow for practical application, precise entropy levels of the produced binary sequences have to be established. Still, our method presents a possible approach towards a new direction in the applications of biometrics in security for mobile devices, which could become a viable alternative to traditional random number generators in situations where such mechanisms are not be available. Acknowledgments. We acknowledge the support of the research project PICOS (Privacy and Identity Management for Community Services), No. 215056. We would like to thank Dr. Ulman and Dr. Kozubek, from the Centre for Biomedical Image Analysis at Masaryk University, for initial consultation on the possibilities of automated image matching, and for providing us with a sample program for the calculation of image alignment for two scanner images. We also thank the anonymous reviewers of our initial submission for their comments and feedback.
References 1. Bouda, J., Krhovjak, J., Matyas, V., Svenda, P.: Towards true random number generation in mobile environments. In: Jøsang, A., Maseng, T., Knapskog, S.J. (eds.) NordSec 2009. LNCS, vol. 5838, pp. 179–189. Springer, Heidelberg (2009) 2. Feng, H., Wah, C.C.: Private key generation from on-line handwritten signatures. Information Management & Computer Security, 159–164 (2002)
182
S. Gerguri et al.
ˇ ıha, Z., Smol´ık, L.: Generating random sequences from 3. Gerguri, S., Maty´ aˇs, V., R´ fingerprints. In: MEMICS 2008, pp. 51–59 (2008) 4. Hao, F., Anderson, R., Daugman, J.: Combining crypto with biometrics effectively. IEEE Transactions on Computers 55(9), 1081–1088 (2006) 5. Juels, A., Wattenberg, M.: A fuzzy commitment scheme. In: Proceedings of the Sixth ACM Conference on Computer and Communications Security (1999) ˇ 6. Krhovj´ ak, J., Svenda, P., Maty´ aˇs, V.: The source of randomness in mobile devices. In: Proceeding of the 12th Nordic Workshop on Secure IT Systems, pp. 73–84. Reykjavik University, Kringlan 1, 103 Reykjavik (2007) 7. Li, X., Wu, X., Qi, N., Wang, K.: A novel cryptographic algorithm based on iris feature. In: International Conference on Computational Intelligence and Security, vol. 2, pp. 463–466 (2008) 8. Casta n´ on, L.E.G., Reigosa, M.P., Nolazco-Flores, J.A.: Biometric-iris random key generator using generalized regression neural networks. In: Ali, M., Dapoigny, R. (eds.) IEA/AIE 2006. LNCS (LNAI), vol. 4031, pp. 530–539. Springer, Heidelberg (2006) 9. Ram´ırez-Ruis, J.A., Pfeiffer, C.F., Nolazco-Flores, J.A.: Cryptographic keys generation using fingercodes. In: Sichman, J.S., Coelho, H., Rezende, S.O. (eds.) IBERAMIA 2006 and SBIA 2006. LNCS (LNAI), vol. 4140, pp. 178–187. Springer, Heidelberg (2006) 10. Szczepanski, J., Wajnryb, E., Amig´ o, J.M., Sanchez-Vives, M.V., Slater, M.: Biometric random number generators. Computers & Security 23 (February 2004)
Improvements of pan-European IDM Architecture to Enable Identity Delegation Based on X.509 Proxy Certificates and SAML Sergio Sánchez García and Ana Gómez Oliva DIATEL — EUITT — Universidad Politécnica de Madrid, Ctra. Valencia Km.7, 28031 Madrid, Spain {sergio,agomez}@diatel.upm.es
Abstract. To foster the secure use of telematic services provided by public institutions, most European countries – and others in the rest of the world – are promoting electronic identification systems among their citizens to enable fully reliable identification. However, in today’s globalized environment, it is becoming more common for citizens and entities of a given country, with their own electronic credentials under the legal framework of their country, to seek access to the public services provided by other countries with different legal frameworks and credentials. At present, a number of projects in the European Union are attempting to solve the problem through the use of pan-European identity management systems that ensure interoperability between the public institutions of different Member States. However, the solutions adopted to date are inadequate, for they do not envision all possible cases of user interaction with institutions. Specifically, they fail to address a very important aspect provided in different national legal systems, namely delegation of identity, by which a citizen can authorize another to act on his or her behalf in accessing certain services provided by public institutions. This paper provides a thorough analysis of problems of delegation and proposes an architecture based on X.509 Proxy Certificates and SAML assertions to enable delegation in provision of services in the complex and heterogeneous environment presented by the public institutions of the European Union as a whole. Keywords: Identity delegation, Proxy Certificates, SAML, X.509, eID, eIDM, electronic identity, electronic identity management systems.
1
Introduction
In the development of the information society, public authorities are playing an important role by promoting the implementation of new e-government services to enable citizens to perform administrative transactions quickly and easily. Given that dealings between citizens and the government are often of a strictly personal nature, there is now a growing demand for electronic or digital identity systems to unequivocally identify people on the Internet. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 183–198, 2010. © IFIP International Federation for Information Processing 2010
184
S. Sánchez García and A. Gómez Oliva
In recent years, initiatives are under way in all Member States of the European Union (EU), for the introduction of electronic identities (eID) in public services for the adoption of systems to manage them. In most EU countries, the electronic identity systems implemented are based on the use of electronic identification cards, also called eID cards, which are beginning to take the place of the identity cards now used in some countries. These cards include a chip that can both store citizens’ identity information and interact with certain validation applications. Although the introduction of a digital identity solves the principal problem of remote authentication of citizens, this solution is not sufficient on its own to achieve equivalence between administrative acts executed with traditional methods with those that can be undertaken by electronic methods, as there are other problems related to the different legal frameworks and different ways identity is used in each country. Of these problems, the most significant and most relevant one, owing both to its complexity and the fact that it is in demand from the public, is identity delegation. In fact present law in many Member States of the EU allows for delegation to another party in dealings with public institutions: for example, a citizen can delegate to a specialized service provider all interactions with the public institutions necessary in order to pay taxes. However, the present problem of identity delegation in the public administration has hardly been addressed in scientific literature, perhaps owing to the more immediate need to deploy identity management systems in each country. Once this first phase of deployment has been completed, it is time to consider solutions that enable solving this problem not only at a national level, but a solution that is scalable for use in the complex and heterogeneous environment presented by the public institutions of the European Union as a whole. In Europe, circumstance occurs that although a citizen’s electronic identity allows for operations within the system of one’s own country, this is not the case when that system becomes that made up of all the countries of the European Union. Even though a German citizen traveling in Belgium can present his or her German identity card to prove their identity in dealings with the Belgian authorities, they cannot do the same thing with electronic identity, as the electronic identity and identity management systems in the two countries are not compatible. Hence one of the central problems in the use of a digital identity is interoperability between identity systems at a pan-European level. Generically, owing to the diversity of identity management systems, when the user of a given system – whether a citizen, an enterprise or the government itself – seeks to communicate with governments outside the scope of his or her own local identity management system, management systems must be linked to each other and understand each other so that the identity of the user of one system can be understood and accepted by the other system. This paper offers solutions to the problem of identity delegation, thus allowing citizens and entities to delegate to another person or entity certain interactions with public institutions. First, it provides a complete solution to the problem of identity delegation at national level, then, being based on the present state of affairs in identity management systems at a pan-European level, where agreement in
Improvements of pan-European IDM Architecture
185
principle exists, proposing a model for interoperability between identity systems at a pan-European level that includes delegation. This will show the scalability and applicability of the model presented for communications with identity delegation among citizens and institutions from different EU countries. The paper also discusses the pilot project in progress for implementing the solution.
2
Digital Identity and Delegation of Digital Identity
The concept of digital identity or network identity, as it is called by the Liberty Alliance [1] has emerged from users’ interaction with services offered on the Internet. When users interact with these services, they often personalize them according to their own preferences or needs: apart from establishing data access control such as user and password, they will define other parameters such as, for example, the information they wish to see displayed, the arrangement of items on the page offering the service or a method for notifying changes in the service. Users normally establish an account and personalize it for each of the service providers to which they accede. Thus, a given user will have multiple accounts with multiple parameters. According to the Liberty Alliance, the Network Identity of a user is the total sum of attribute sets of all a user’s accounts. Specifically, the draft Liberty ID-FF Architecture Overview [2] defines network identity as the global set of attributes composed from a user’s account(s). For any given identity, there are usually several digital identities that may be unique or not. A digital identity is, by definition, a subset of identity and can be considered the manifestation of identity on the Internet. The concept of identity delegation is defined by the Modinis IDM Study Team [3] as the process in which an identified entity issues a mandate to another identified entity. On the basis of this definition, we can see that the act of delegating is a cession by a person or entity of part of its rights to another in order to enable the latter to act on behalf of the former before a third party. In terms of citizens and public institutions, delegation basically involves one citizen granting another citizen authorization or a mandate that the latter can use, in the name of the former, to access services provided by institutions. Academic literature offers several examples of systems of delegation conceived for different purposes and using different technologies. Notable among these technologies for their affinity to our purpose in this paper, are those presented in Komura et al. [4], Alrodhan et al. [5], Gomi et al. [6] and Welch et al. [7]. According to Peeters et al. [8] at least three parties are involved in the process of delegation: the delegator, the delegatee and the service provider. The delegator is a person or entity that shares, by means of what is usually called a delegation assertion, one or more of its privileges in accessing a service with another person or entity. The delegatee is the person who receives the privileges of the delegator, that is, the delegation assertion, and the service provider is the party which, as its own name indicates, provides certain services on demand to the delegatee after the delegation assertion has been presented. In addition to these generic entities, and depending on the delegation process used, other entities may emerge, such as the identity provider or delegation authorities.
186
S. Sánchez García and A. Gómez Oliva
Taking this set of basic entities as a point of departure, Alrodhan et al. [5] presents a classification of delegation in two elementary models: the model of direct delegation and the model of indirect delegation. Direct delegation is when the delegator delegates all or a subset of his or her privileges to the delegatee, who makes use of them to access a service. The same process applies in indirect delegation, but through a series of intermediate delegatees. We would highlight a series of aspects of delegation that were mentioned in Alrodhan et al. [5]. The first is that delegation does not mean authorization. That is, even if a service provider accepts the delegation, it need not accept the privileges requested by the delegatee. It is always at the discretion of the service provider whether or not to accept the request made by the delegatee. Secondly, the delegation assertion must always prove consent on the part of the delegator, as the latter may impose certain conditions on the act of delegation such as a period of validity or permission to engage in indirect delegation. Finally, any solution must always seek to preserve the privacy of the delegator.
3
Proxy Certificates, SAML and Their Integration
As shown in the preceding section, a number of options for handling identity information are available (SAML, I-Card, etc.), each with its own benefits and drawbacks. However, the range of alternatives narrows if we wish to enable dynamic identity delegation and attribute-based restrictions. The authors have opted for the following features: 1. Use of Proxy Certificates, owing mainly to their ease of integration in present identity processes in European countries – most use public key certificates for authenticating users – and their possibilities for dynamic generation and 2. Use of SAML assertions with attribute statements for the transport of user attributes because this is the dominant trend in standardization and use. We shall now discuss these technologies and how they can be integrate. 3.1
X.509 Proxy Certificates
X.509 Proxy Certificates [9] emerged as a result of certain needs that were not adequately met by X.509 public key certificates. The most obvious example is perhaps dynamic delegation, that is, the cession of a set of privileges by one entity to another for a very specific period of time. It is true that this type of delegation can be provided by other elements in the X.509 world, such as attribute certificates [10], but their use is not convenient owing mainly to the high degree of processing and the amount of time needed to generate them. Identity certificates or public key X.509 certificates and Proxy Certificates have the same format, as they both link a public key to a name or Subject Name, which allows Proxy Certificates to be used easily by libraries and protocols with no need for new implementations. However, unlike public key certificates, the entity that generates the Proxy Certificate is not a Certification Authority (CA)
Improvements of pan-European IDM Architecture
187
but rather an entity identified with a public key certificate or another Proxy Certificate, which facilitates enormously the process of certificate generation and makes the process of interacting with CAs superfluous. All Proxy Certificates must contain a critical extension called PCI (Proxy Certificate Information) which not only identifies the certificate as a Proxy Certificate but also enables the certificate generator to express its desires with respect to the delegation of rights and to limit the number of Proxy Certificates that can be generated on the basis of the same. For the former, the PCI extension has a framework for the transport of delegation policies expressed in any policy language, with the sole restriction that the parties must be able to interpret the language and, hence, the policy defined. The process to generate X.509 Proxy Certificate for delegation involves the following steps: 1. The delegatee generates a pair of keys, a public and a private one. 2. The public key is used by the delegatee to form a Proxy Certificate request to be sent to the delegator through an authenticated channel with an integrity guarantee. 3. The delegator checks that the request is correct and, if all is in order, the Proxy Certificate is generated. The certificate must be signed either with the private key of the generator or the private key of another Proxy Certificate. 4. The delegator sends the Proxy Certificate generated to the delegatee through an authenticated channel with an integrity guarantee. It is evident that the process of generating Proxy Certificates is quicker and easier than that of X.509 public key certificates. The main advantage is that the process does not require the intervention of a CA. 3.2
SAML
This section provides a brief introduction to the SAML 2.0 [11], which is an XML-based language used to exchange authentication and authorization information between different entities in a network. SAML allows an entity to make assertions of security information on a subject through use of statements. Hence, an assertion linked to a subject may contain three different types of statements: – Authentication statements: These indicate whether a user has been authenticated or not. If authentication has been completed successfully, they must, at least, indicate the method of authentication used and the specific time the authentication took place. – Authorization decision statements: This specifies what the subject is eligible to do. It contains recommendations on access control, such as when a subject can or cannot access a resource. – Attribute statements: These contain a specific set of subject-related attributes. For example, name, age and present employment. The exchange of requests and responses of SAML assertions is performed with different communication protocols by means of binding. The most common
188
S. Sánchez García and A. Gómez Oliva
method is to transport SAML messages over HTML, although SOAP is also commonly used. 3.3
Integration of SAML Attribute Statements and Proxy Certificates
One of the most important features of the architecture presented herein for identity delegation in public institutions is the integration of SAML attribute statements and X.509 Proxy Certificates. The idea emerged from study of the GridShib project [12]. The objective of the project is to enable interoperability between the Globus Toolkit® by Globus Alliance [13] and Shibboleth® by Internet2 [14] to attain secure exchange of attributes between Grid virtual organizations and institutions of higher education. The GridShib project proposes an approach called X.509 binding for SAML [15]. This is a way of embedding SAML assertions in X.509 certificates, whether they are public key certificates or Proxy Certificates. It uses a non-critical extension of the X.509 v3 certificate, to which a single Object Identifier (OID) is assigned, that may be defined in ASN.1 as a SEQUENCE of <saml:Assertion>. In broad outline, every certificate can contain a non-critical extension that in turn contains a SAML assertion or a reference to it. If it has not been generated by the same entity that signed the certificate, the assertion must have been signed. If the entities match, the assertion signature is unnecessary, as the certificate signature covers the extension and, hence, the assertion. Linking the SAML assertions by means of a non-critical extension allows third parties to override the extension and therefore, enable normal use of the certificate in any environment. This method of integrating SAML assertions in X.509 certificates, specifically in Proxy Certificates, constitutes one of the foundations for solving the problem of delegation as conceived for the pan-European identity management infrastructure proposed by the authors in the section that follows. Specifically, the use of Proxy Certificates generated dynamically, exploiting the capacities of extensions and integration with SAML, offers the advantage of easy implementation of services with attribute-based delegation of identity and authorization, providing a flexibility of use that had barely been considered in previous architectures. Such flexibility has become a necessity owing to the frequent role representatives or agents play in traditional methods.
4
Proposed Delegation Model
Below we present the architecture conceived for delegation and its mode of operation. The proposal begins from the starting point explained in Welch et al. [7], which presents a system for dynamic identity delegation by using X.509 Proxy Certificates in Grid environments, while adapting them to the use of Identity Providers and Service Providers in an electronic Identity Management System and integrating in X.509 certificates the part related to use of SAML attribute assertions and their transport.
Improvements of pan-European IDM Architecture
189
For the presentation of participating entities and of the model of communication and performance, we shall start from a hypothetical case of use by a person, a German citizen for example, who seeks to obtain a service from an official institution but, for a number of reasons, is forced to delegate to a management company, who will perform all administrative steps on his or her behalf. At first, the participating entities would be as follows: – Delegator: The person or entity that cedes part of his or her privileges to another. In our example, it is a citizen who seeks to receive a service. In our example, the German citizen. – Delegatee: The person or entity that receives the privileges from the delegator. In our example, the management company. – Service Provider: The entity responsible for providing a certain service, either to the delegatee or the delegator. If the service provider supports providing services to delegatees, it must be capable of verifying that the delegation process has been performed correctly. – Identity Provider: The entity responsible for authenticating users and generate authentication or attribute assertions. In our example, it would be the entity responsible for authenticating users in German public institutions. The model of communication and interaction in providing a service with delegation is illustrated step-by-step in the figures below. The information flow sequence is as follows: The steps shown in 1 and 2 depict the interaction of a citizen delegator with the Identity Provider and the initiation of communication with the delegatee. Figure 3 shows the final model of service provision with delegation of identity and revocation queries 1. The delegator presents his or her credentials to the Identity Provider with intention of being authenticated. Said credentials may be, for example, an X.509 public key certificate such as one presently used in some European Union countries. The delegator also requests a SAML assertion with an attribute statement that includes attributes needed for provision of a service through a delegatee. 2. The Identity Provider, after verifying the credentials of the delegator and that everything is in order, provides a signed SAML assertion with the set of attributes requested. It is the delegator’s task to check that the attributes and the Identity Provider’s signature are correct.
Fig. 1. Model of service provision with delegation: authentication
190
S. Sánchez García and A. Gómez Oliva
Fig. 2. Model of service provision with delegation: delegation of identity
(a) The delegator asks the delegatee to access the service in his or her name. (b) The delegatee, with the intention of obtaining a token to authorize said person to act as a delegatee vis-a-vis the service provider, generates a pair of keys – a public key and a private one – and sends the delegator the public key, while keeping the private key properly protected. The Delegator shall build a Proxy Certificate for the key received, thus generating the delegation token. The Proxy Certificate will include, through a noncritical extension and in a manner that is similar to that proposed in [15], the SAML assertion with the attribute statement received from the Identity Provider and signed by the latter. Thus, the Proxy Certificate will also include, through a non-critical extension, identification of the service or services for which delegation is granted, so that the service provider can determine not only if the delegator has delegated access to services but also the services to which access has been delegated. To identify services, URIs (Uniform Resource Identifiers) [16] are used to achieve unequivocal identification. The use of URIs also provides another advantage, given their hierarchical structure: the delegator can specify if the delegation applies to only one service or to a set of services with a single provider . 3. The delegator sends the delegatee the Proxy Certificate generated. 4. Once the delegatee is in possession of the Proxy Certificate, it also has the token that will allow it to request the service from the Service Provider. The Service Provider checks the validity of the Proxy Certificate and verifies that the validation path is correct. The Proxy Certificate is linked to the delegator by the signature, so the Service Provider will know in whose name the delegatee is acceding to the service. On this basis, and that of the SAML assertion with the attribute statement and the URI of the allowed services included in the pertinent extensions, the Service Provider can make decisions of authentication and authorization that will enable it to determine whether to provide the service. 5. Assuming that everything is in order, the Service Provider delivers to the delegatee information on service requested. 6. The delegatee then delivers to the delegator the results of the service. As we can see, step 2 (Fig. 1) consists of a signature verification that involves interaction of the delegator with the PKI to verify whether the certificate of
Improvements of pan-European IDM Architecture
191
the Identity Provider has been revoked. In addition, after step 4, (Fig. 3) the Proxy Certificate is verified. As defined in the RFC 3820 [9], a process must be undertaken in such a way that to complete verification of this type of certificate we must check, first of all, that the certificate of the entity generating it, in our example the public key certificate of the delegator, is valid under the verification procedures of PKI as defined in the RFC 3280 [17]. Moreover, for a Proxy Certificate to be considered valid, the following must be carried out: 1. For all x in {1, ..., n-1}, the subject of certificate x is the issuer of proxy certificate x+1 and the subject distinguished name of certificate x+1 is a legal subject distinguished name to have been issued by certificate x. 2. Certificate 1 is valid proxy certificate issued by the end entity certificate whose information is given as input to the proxy certificate path validation process. 3. Certificate n is the proxy certificate to be validated. 4. For all x in {1, ..., n}, the certificate was valid at the time in question. 5. For all certificates in the path with a length constraint field, the number of certificates in the path following that certificate does not exceed the length specified in that field. Nevertheless, and bearing in mind the above, there is still a problem with using Proxy Certificates: no procedures have yet been defined for revoking this type of certificates. There are applications in which, owing to the specific and restricted use of these certificates, they are unnecessary. However, in our case, owing to the numerous possible types of use, this type of mechanism is indispensable. Thus, the architecture includes a new entity, a Proxy Certificate Revocation Authority. Like Revocation Authorities in the present PKI, it maintains a listing of certificates, specifically Proxy Certificates, that have been revoked. In ADMISSION project we propose the use of Proxy Certificate Revocation Authorities for each one of the national eIDMs to manage the status of the Proxy Certificates that have been issued by the entities in it. Each of the Proxy Certificate Revocation Authorities has a revocation list in which every issuer of Proxy Certificates is associated to a list of certificate identifiers issued by it that have been revoked. It would also enable querying and updating of the list. Owing to its functionality, it has been decided that the Proxy Certificate Revocation Authority will be included as a Trusted Third Party (TTP) in the PKI infrastructure being used. tThe process of querying the revocation status of the Proxy Certificate by the Service Provider is depicted as steps 4a and 4b, yielding the final proposal for a communication model as shown in Fig. 3. At present, the authors herein are working on the implementation of a pilot project based on the proposed infrastructure for managing identity and providing services both with and without delegation of identity in the a City Council in the region of Madrid, with a view to proving the viability of the solution and its possibilities. The pilot project is being implemented in a real scenario at a small scale, involving a circle of trust with several Service Providers (SPs) and an Identity Provider. We have selected a number of telematic services that the
192
S. Sánchez García and A. Gómez Oliva
Fig. 3. Model of service provision with delegation of identity and revocation queries
city council will soon offer on the Internet: applications for tax rebates and exemptions, applications for authorizations (such as permits to set up a newsagent, pavement cafes, bars in the public highway, to allow use of cranes, etc) and applications for operating licenses. Each of these services is offered through a different Service Provider that can process demands from citizens and delegatees, but all within the same circle of trust. To enable access to these services, identification of citizens is to be performed with an X.509 digital certificate embedded in their National Identity Card (eID Card) or another digital certificate issued by a Certification Authority accepted for transactions in national public institutions. Verification of citizens’ identity is performed by the Identity Provider of that circle of trust. We are now capturing the attribute requirements necessary for citizens to access services and defining SAML assertions with attribute statements on this basis. Simultaneously, we are working on the implementation of identity delegation in the same testing environment with a view to achieving a complete identity management solution with support for delegation.
5
Scalability and Applicability of the Proposed Solution at a pan-European Level
Nowadays, Europeans are living in an environment that is not only increasingly digitalized, but which is increasingly globalized. A citizen of France can work for a German company and perform his or her work in Belgium and do so problemfree, in theory; such a person must be able to interact with the company and with different public administrations online. This global environment leads to a series of problems that arise when we ask questions like the following: How could a person with a French electronic identification card access online services provided by German public administration? And what about the person’s employment data as a worker in Belgium? Further, how can German public institutions manage the identity data of the French national?
Improvements of pan-European IDM Architecture
5.1
193
Problems of Interoperability
Answers to the questions posed above are no simple matter. On the basis of action plans launched by the European Union, in recent years a number of initiatives have focused on achieving pan-European interoperability between identity management systems established in each European Union country. Although most of these initiatives are nothing more than theoretical proposals that solve some problems without providing a comprehensive solution, some do go further and propose architectures that are now in the pilot stage. One of the first studies or projects related to interoperability of identity management systems was the Modinis eIDM Study [18], which studied the use of electronic identity management systems in the European Union and analyzed the most significant consequences of using these eIDM systems. Another interesting system is the TLS-Federation [19]. This project aimed at providing a regulatory and interoperable working framework for identity management at a pan-European level. It focused on employing technologies and standards that were sufficiently well-known and on protecting of the user side against possible scenarios of identity theft. The GUIDE project (Creating a European Identity Management Architecture for eGovernment) [20] sought to develop a model for identity interoperability within the European Union, so as to enable Member States to trust the identity of an entity – whether individuals or companies – in another State. The underlying concept involves a federated network of identity management that requires membership in circles of trust based on operational agreements, thus yielding a federation of service providers and identity providers. The objective of GUIDE was to define an architecture to enable the joining of these federations into a large circle of trust with a view to creating a single identity environment throughout the European Union. Another proposal for a pan-European identity management system is STORK (Secure idenTity acrOss boRders linKed) [21]. This recently-begun project seeks to develop and test common specifications for mutual and secure recognition of national electronic identities (eID) of participating countries. Their specific objectives include defining common models and specifications for the mutual recognition of eIDs between countries, verifying in a real environment easy and secure eID solutions to be used by individuals and companies and achieving coordination with other initiatives of the European Union in order to maximize the usefulness of eID services. As part of the research project ADMISSION, we have analyzed the problem of identity management at all levels of public institutions, from the local level to Europe as a whole. After a detailed study of identity management at the local, regional, provincial and national levels, we reached the conclusion that problems of interoperability that exist between the member countries of the European Union in managing citizens’ identities are also found in the interaction between different levels of institutions, even within a single country. We propose herein a model of interoperability that may be applied not only at a pan-European level, but also at lower levels, i.e., nationally, regionally or locally. It would guarantee
194
S. Sánchez García and A. Gómez Oliva
Fig. 4. Infrastructure proposed in ADMISSION project
interoperability in identity management at all levels. The model builds on the beneficial features identified in the identity management systems discussed herein and solves the problems detected in them. Federation, achieved by establishing circles of trust at each level and between levels, as shown in Fig. 4, is the basis of the proposed system. The chart shows how each level of government – local, regional and national – has a circle of trust that links together one or more Identity Providers (IdP) and Service Providers (SP) at that level. To attain reliable authentication of individuals, it will use token mapping: that is, it will allow for maintaining present systems and map currently used authentication elements to common elements in order to guarantee interoperability of services. This is a fundamental principle, as the deployment of services offered by public institutions has grown in an uncoordinated fashion for quite some time, and they often provide services that are highly valued by citizens. Thus, the system uses the concept of proxy as an interface between identity management systems to ensure interoperability both at the same level – for instance, local interoperability between two or more city councils – and between levels; for example, between a city council and a hierarchically higher level: a provincial, regional or national institution. Exchange of authentication tokens will use X.509 certificates, the use of which is familiar to all official institutions. 5.2
Problems of Electronic Signatures
In addition to the problems of interoperability between different identity management systems discussed above, there are other interoperability problems that
Improvements of pan-European IDM Architecture
195
have a greater impact for because they are directly related to our delegation solution, namely electronic signatures. The ultimate interoperability situation for e-signatures and any other use of eIDs can be stated as: – An eID holder shall be able to use the eID to sign a piece of information towards any counterpart, even internationally. The eID holder independently selects the eID to use. – The receiver (relying party) of a signed document shall be able to accept signatures from all counterparts, regardless of the eID used by the counterpart. – A third party, receiving a document signed by other parties, shall be able to verify the signatures no matter the eIDs used by the other parties. The relaying party role is clearly the one facing the complexity. The eID holder has one trusted party to rely on: the Certification Authority (CA). The relaying party must check all signatures, handling the relevant signature formats (includig all necessary modes) for multiple signatures, all necessary hash and crypto algorithms and the eIDs of all signers. Although the technical validation of signatures has its challenges with respect to scaling, the real problem to the relaying party is the assessment of the risk implied by accepting the signature, determined by the legal situation, the quality of the cryptography used, the liability situation, and the trustworthiness of the CA. With the objective of solving these problems, the European project PEPPOL [22] is developing guidelines, specifications and pilot solutions to overcome the lack of interoperability between national schemes for electronically signing tender documents. 5.3
Explanation of Scalability
As is clear from the foregoing, the possible use of our delegation solution in a pan-European scenario is not a simple matter, as things stand today. Nevertheless, we can say that the solution proposed to interoperability problems in identity management is following the same trends as other European initiatives undertaken to date. This solution fits perfectly into our interoperability proposal and, therefore, allows for setting up a model of identity delegation that can be used at a pan-European level. As we have mentioned, the interoperability model is based on the establishment of circles of trust at different levels of public administrations in each country and between all countries. As X.509 certificates present in the citizen identity cards are usually applicable at all levels of administration, it would be no problem to generate delegation at one level – whether local, regional or national – or between levels in one country. The main problem may arise in relation to revoking Proxy Certificates of the delegation, but as proposed above, inclusion of the Proxy Certificate Revocation Authority as a Trusted Third Party in the national PKI infrastructure provides a solution. A different problem arises if one wishes to establish our model at a panEuropean level: that is, we wish to set up an identity delegation system that would work between citizens and institutions of different countries. The main
196
S. Sánchez García and A. Gómez Oliva
Fig. 5. Global infrastructure for interoperability and identity delegation
drawback lies in the above-mentioned problem of interoperability of electronic signatures, given that our delegation solution is based on the generation of Proxy Certificates that, as we have seen are directly signed by the delegator. A delegatee or a Service Provider in a country other than that of the delegator would find it difficult to verify the Proxy Certificate used in the delegation. Nevertheless, it would seem clear that the work and interest shown by the European Union in initiatives and action plans like the i2010 eGovernment Action Plan [23] in achieving total interoperability and a more global environment in European public administration obliges us to assume that total interoperability will be in place in the medium term for Europe-wide electronic signatures, thus making our delegation fully viable. Figure 5 shows a diagram of the pan-European global interoperability solution to support identity delegation, assuming that interoperability of electronic signatures has been attained. As we can see, two national environments and a pan-European environment are depicted, each with their IdP and SP and linked together through proxies that enable pan-European interoperability in identity management. Further, the PKI is depicted in each of the national environments through the Certification Authority (CA), and their communication with the Proxy Certificate Revocation Authority (PCRA), as required in our delegation solution given that no pan-European PKI exists, we have assigned the national PKIs the same level and assumed a relation of trust between them. With a view to enabling the architecture to accommodate countries that lack their own PKI, the diagram depicts, also at the same level, a CA with its own PCRA at the pan-European level, thereby facilitating the addition of new countries.
6
Conclusions
The solutions to identity management problems in international environments will undoubtedly facilitate citizens’ access to services in an ever more globalized world, while opening the door to ever more sophisticated and secure telematic
Improvements of pan-European IDM Architecture
197
services. With this in mind, the EU has set in motion a number of initiatives to develop and implement a pan-European identity management infrastructure. It is committed to solutions that will not force modifications in the national digital identification systems as developed by each country in accordance with its own needs and laws. But such solutions must be sufficiently reliable and robust to win acceptance in every country of Europe. Although the range of solutions available is broad, important issues remain to be solved in most of them, such as the lack of integration with the private sector, the absence of single data sources to ensure the uniqueness and coherence of information on entities, the lack of solutions for identity delegation and problems related to the use of certain standards. Therefore, the project undertaken by the authors’ research group is oriented towards seeking solutions to these problems at two distinct levels. First, the solutions should have an echo in Europe; thus, we are in regular contact with the leading groups working in this field. Second, we are seeking to extrapolate our solutions to our national public institutions, where problems of interoperability between identity management systems at different institutional levels are similar to those in Europe. Consequently, we aim to make contributions that can support progress towards total interoperability in identity management both at national and pan-European levels to enable provision of services in a way that is simple and fully transparent to users. To address one of the main inadequacies of identity management systems proposed to date, our model integrates in the Global infrastructure for interoperability a solution for dynamic identity delegation based on X.509 Proxy Certificates and SAML assertions with attribute statements, thus yielding a pan-European identity management infrastructure with support for identity delegation.
References 1. Liberty Alliance Project, http://www.projectliberty.org 2. Wason, T.: Liberty ID-FF Architecture Overview. Version: 1.2-errata-v1.0. Liberty Alliance Project (2005), http://www.projectliberty.org/liberty/content/download/318/2366/file/ draft-liberty-idff-arch-overview-1.2-errata-v1.0.pdf 3. The Modinis IDM Study Team; Modinis Study on Identity Management in eGovernment: Common Terminological Framework for Interoperable Electronic Identity Management. Version 2.01. eGovernment Unit, DG Information Society and Media, European Commission, November 23 (2005) 4. Komura, T., Nagai, Y., Hashimoto, S., Aoyagi, M., Takahashi, K.: Proposal of Delegation Using Electronic Certificates on Single Sign-On System with SAMLProtocol. In: SAINT ’09. Ninth Annual International Symposium on Applications and the Internet, July 20-24 (2009) 5. Alrodhan, W., Mitchell, C.J.: A Delegation Framework for Liberty. In: Proceedings of the 3rd Conference on Advances in Computer Security and Forensics (ACSF’08), pp. 67–73 (2008) 6. Gomi, H., Hatakeyama, M., Hosono, S., Fujita, S.: A delegation framework for federated identity management. In: Proceedings of the 2005 workshop on Digital identity management, Fairfax, VA, USA, November 11 (2005)
198
S. Sánchez García and A. Gómez Oliva
7. Welch, V., Foster, I., Kesselman, C., Mulmo, O., Pearlman, L., Tuecke, S., Gawor, J., Meder, S., Siebenlist, F.: X.509 Proxy Certificates for Dynamic Delegation. In: 3rd Annual PKI R&D Workshop (2004) 8. Peeters, R., Simoens, K., De Cock, D., Preneel, B.: Cross-Context Delegation through Identity Federation. In: Brömme, A., Busch, C., Hühnlein, D. (eds.) Proceedings of the Special Interest Group on Biometrics and Electronic Signatures. LNI, vol. P-137, pp. 79–92. Bonner Köllen Verlag (2008) 9. Tuecke, S., Welch, V., Engert, D., Pearlman, L., Thompson, M.: Internet X.509 Public Key Infrastructure Proxy Certificate Profile. RFC3820, IETF (June 2004) 10. Farrell, S., Housley, R.: An Internet Attribute Certificate Profile for Authorization, RFC 3281, IETF (April 2002) 11. Ragouzis, N., Hughes, J., Philpott, R., Maler, E., Madsen, P., Scavo, T.: Security Assertion Markup Language (SAML) V2.0 Technical Overview - Committee Draft 02 (March 25, 2008), http://docs.oasis-open.org/security/saml/Post2.0/ sstc-saml-tech-overview-2.0.pdf 12. GridShib, http://gridshib.globus.org/ 13. Globus Toolkit, http://www.globus.org/toolkit/ 14. Shibboleth, http://shibboleth.internet2.edu/ 15. https://spaces.internet2.edu/display/GS/X509BindingSAML 16. Berners-Lee, T., Fielding, R., Masinter, R.: Uniform Resource Identifier (URI): Generic Syntax. RFC 3986, IETF (January 2005) 17. Housley, R., Polk, W., Ford, W., Solo, D.: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 3280, IETF (April 2002) 18. ModinisIDM, https://www.cosic.esat.kuleuven.be/modinis-idm/twiki/bin/view.cgi/ Main/WebHome 19. Bruegger, B.P., Hühnlein, D., Schwenk, J.: TLS-Federation - a Secure and RelyingParty-Friendly Approach for Federated Identity Management, http://porvoo14.dvla.gov.uk/documents/tls_federation_final.pdf 20. GUIDE, Creating a European Identity Management Architecture for eGovernment, http://istrg.som.surrey.ac.uk/projects/guide/overview.html 21. STORK, Secure idenTity acrOss boRders linked, http://www.eid-stork.eu/ 22. PEPPOL, Pan-European Public Procurement Online, http://www.peppol.eu/ 23. Commission of the European Communities; i2010 eGovernment Action Plan: Accelerating Government in Europe for the Benefit of All. Brussels (April 2006), http://ec.europa.eu/idabc/servlets/Doc?id=25286
Fraud Detection for Voice over IP Services on Next-Generation Networks Igor Ruiz-Agundez, Yoseba K. Penya, and Pablo Garcia Bringas University of Deusto Bilbao, Basque Country {igor.ira,yoseba.penya,pablo.garcia.bringas}@deusto.es http://www.deusto.es
Abstract. The deployment of Next-Generation Networks (NGN) is a challenge that requires integrating heterogeneous services into a global system of All-IP telecommunications. These networks carry voice, data, and multimedia traffic over the Internet, providing users with the information they want in any format, amount, device, place or moment. Still, there are certain issues, such as the emerging security risks or the billing paradigms of the services offered, which demand deeper research in order to guarantee the stability and the revenue of such systems. Against this background, we analyse the security requirements of NGN and introduce a fraud management system based on misuse detection for Voice over IP services. Specifically, we address a fraud detection framework consisting of a rule engine built over a knowledge base. We detail the architecture of our model and describe a case study illustrating a possible fraud and how our system detects it, proving in this way, its feasibility in this task. Keywords: Next-Generation Networks, Fraud Detection, Voice over IP services, Security requirements.
1 Introduction Next-Generation Networks (NGN) do not belong to the past, and neither solely do they to the far future. This special kind of net has been evolving over the last years, parallel to the evolution the Internet, and, nowadays, they are one of the backbones of the so-called Future Internet. Therefore, telecommunication network operators are challenged to shift their current networks to NGN by creating an integrated global system that supplies heterogeneous services across network providers, network backbones, and geographical regions [1]. More accurately, NGN is a broad term describing the telecommunication core and access networks that will be deployed in the next years. They have been progressing to carry voice, data, and multimedia traffic over common transmission links and routers using a packet-based transport method [2]. Their aim is to provide users with the information they want, in any format, device, place or moment and at any quantity [3]. NGN are characterised by the following main features: – Packet-based transfer of all the data – Separation of control functions P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 199–212, 2010. c IFIP International Federation for Information Processing 2010
200
I. Ruiz-Agundez, Y.K. Penya, and P. Garcia Bringas
– Decoupling and aggregation of services providing technologically-independent open interfaces – Broadband capabilities with quality of service (QoS) and transparency – User mobility and diverse identification schemes with an unified service perception Some of the services enabled by the apparition of these networks, such as voice telephony or call centres, were already present within traditional telecommunication networks but not in an integrated way, unifying simultaneously all of them. Moreover, NGN also facilitate novel services such as multimedia, virtual private networks, e-commerce, distributed virtual reality, and data connectivity [4]. Unfortunately, the charging models and specifications are not yet completely defined. In this way, the deployment of NGNs poses a new scenario of risks and security problems. Together with classical security risks (e.g. denial of service (DoS), sniffing, spoofing or spam), which are already adapted to NGN’s special conditions, brand new threats will emerge. Standing out in this latter group, fraud is considered to be the most harmful. Fraud from employees, consumers, third-party, computer crime, insurance or financial fraud increases every year [5]. More accurately, in our target area, telecommunications, the increment reached the 52% from 2003 to 2005 [6]. In order to face these risks, Fraud Management Systems (FMS) detect and analyse fraud and suggest counteractions. Traditional FMS, however, are service specific and depend on the underlying network infrastructure. As NGN introduce new services and infrastructures, FMS need to evolve too. They help in the identification of fraud signals using an automate procedure of deceit detection. The also raise alerts and countermeasures based on pre-defined rules. The FMS collect data from multiple formats and sources, adapting the data to be treated by the system by filtering and assembling processes. When data is normalised, the detection step starts generating alerts on suspicious cases. The detection can be performed by different techniques of Artificial Intelligence. Against this background, the contribution of this paper is three-fold: First, we present the security requirements of NGN and detail a taxonomy of fraud on telecommunications. Second, we propose an approach that uses a standard rule engine to support fraud detection based on the knowledge provided by an expert on the service to be protected. Last but not least, we describe a case experiment that tests our FMS’s ability against fraud attempts and we discuss the obtained results. The remainder of the paper is structured as follows. Section 2 introduces the related work on security requirements on NGN and defines different approaches to face fraud using a Fraud Management System. Section 3 describes the proposed system architecture and its specific requirements. It details a fraud management system based on misuse detection for Voice over IP services of the NGN. Section 4 presents a case study for the evaluation of the system architecture. Finally, Section 5 concludes and draws the avenues of future work.
2 Related Work Technology and security advance in parallel; this reason complicates foreseeing future risk scenarios and, consequently, the ways to face them. As the technology evolves, so
Fraud Detection for Voice over IP Services on Next-Generation Networks
201
do the security needs. Many taxonomies [7] [8] have tried to classify these threats with different terminology. In this way, we consider that security risks can be catalogued by their effect on the system or the client. For instance, the system may suffer a service continuity interruption, ranging from attacks as Denial of Service (DoS) or physical attacks to the network or service provider hardware. Moreover, there may be abuses based on logical attacks such as insufficient validation of the services or abuses of functionality (using a service for not expected task). This latter thread is related with information disclosures due to predictable resource location, information leakage, or directory indexing. Furthermore, intrusions may compromise network systems by executing unauthorised commands, taking advantage from architectural or design vulnerabilities. Privacy of the clients or the stored data may be exposed too by several techniques like sniffing, spoofing, spamming or phising. Access to services can be bypassed with authentication attacks (e.g. brute force or password inference) or with authorization attacks (e.g. credential prediction or insufficient authorization schemes). Note that we focus here on the possible risks that fraud can cause to service providers, customers and stakeholders. Fraud is defined as “a deliberate act of obtaining access to services and resources by false pretences and with no intention of paying” [9]. Other authors [10] define fraud as the intentional act of giving a false statement about an important fact. Whenever such false statement is believed by the victim (a person or an organization), the victim relies and acts upon the untrue representation and, finally, it suffers loss of money or property as a result of relying and acting upon this untrue representation. There are also definitions of fraud [11] that provide formal analyses of notions of fraud using modal operators. 2.1 Approaches to Face Fraud Dealing with fraud is a very complex task mainly due to its transversal nature to the operators structure [12]. Traditional fraud techniques are evolving and adapting to the new network infrastructure. We have to consider them because basic ideas remain despite the underlying technology. Moreover, we have to focus on the specific risks around the NGN. Although there is not a standard procedure for classifying the different types of fraud on NGN there have been some attempts [13] to do it. Deception in telecommunications include subscription frauds, where the cheater accesses the services without being subscribed. Users can also suffer line or identify theft, being charged for services used by others. Telecommunication operators can oversee users that exceed their download quote and rate performing illegal service redistribution, sometimes for an economic profit. Finally, cloning or unauthorised access to services may lead to compromising privacy. Anyway, the most common types of fraud on telecommunications are subscription fraud and identity theft [14]. After those, voice mail fraud and calling card fraud prevail. The analysis of the different fraud techniques points out that the tendency is a convergence of the fraud, which increases the complexity of its detection [2]. Fraud Management Systems have proved to be a suitable tool to detect fraud in different networks with diverse techniques: self-organising maps (SOM) [2], general data mining [15], rule-based systems [16], profiling through Artificial Intelligence
202
I. Ruiz-Agundez, Y.K. Penya, and P. Garcia Bringas
techniques like neural networks or decision trees [12], based on the hierarchical regimeswitching models [17], Bayesian networks [18], fuzzy rules [19] or other data mining techniques [20]. There also exist works on how to discover new rules to detect fraud in telecommunications [21] and on the privacy concerns of applying detection techniques to users data [22]. Nevertheless, to our knowledge, there is none that works on fraud detection for VoIP services in NGN with use cases.
3 Misuse Detection for Fraud Management Systems Misuse detection in the scope of fraud prevention protects a system from already known fraudulent techniques or attacks [23]. An expert defines the already known vulnerabilities and takes measures to cover these eventualities. Other techniques, based on statistical measures of user behaviour, need to train the systems over a length of time to reach to a certain success threshold. On the contrary, one of the main advantages of misuse detection is that it does not need any data processing training [24]. On the other hand, the main drawback of this approach is that the expert needs to define the vulnerabilities that the system can manage in advance. Nevertheless, the expert can look for known patterns of abuse that might occur by increasing the main sensibility of the system. These patterns depend on the problem environment and the knowledge of the expert is crucial. 3.1 The System Architecture Figure 1 shows the general architecture of the Fraud Management System. The service consumer uses the service elements (e.g. IPTV, VoIP, WLAN, etc.), which generate vendor specific billing data. If needed, this data is transcoded into Internet Protocol Detail Record (IPDR) format and captured by the recorder. When required, these IPDR entries can be stored or transmitted to the business support system. The FMS is hosted in this business support system and receives data in IPDR format for its analysis, starting in this way the fraud detection process. Each IPDR is sent to the rule engine that contains the expert knowledge on fraud in order to detect possible violations using misuse detection techniques. If the FMS suspects a possible fraud, it reports the incident to the response module. As seen in section 3.3, this final module can trigger a fraud notification alarm to the system operator or it can block all the present and future connections of a suspicious client. 3.2 The Internet Protocol Detail Record The Internet Protocol Detail Record (IPDR) intends to be the standard protocol for exchanging service usage and for managing control information between IP networks, hosting elements and operations or business support systems. It provides a standardised framework that enables Next-Generation Network providers to operate efficiently [25]. This standard is defined by the Internet Protocol Detail Record Organization and the TeleManagement Forum. It is designed to enable cost-effective usage measurement and exchange for next-generation services across the entire value chain.
Fraud Detection for Voice over IP Services on Next-Generation Networks
203
Fig. 1. Schematic architecture of the system
Moreover, the IPDR covers the billing requirements of NGN providing converged billing, avoiding provider dependence and reducing the required interfaces. Real-time billing is allowed, and therefore charging is performed faster. Finally, it offers great flexibility to represent existing and future services with scalability possibilities. As fraud detection is closely related to billing, IPDR is also used for fraud detection [26]. Since it is the most adequate format to represent the obtained data, it is the base of the fraud detection analysis. IPDRs are mainly generated at the end of each call or connection resulting in either a normal or abnormal completion of the call. Alternatively, they may be generated during the progress of call or connection. This generation is triggered by events at the beginning of a call, the answer of a call, during long calls, etc. According to its service specifications [25], IPDR is capable of collecting usage characteristics of any IP-based network or application service. All service specifications have five common attributes in their records. The first one describes the person in charge of the usage of a service, defining user identification. The second attribute tells when a certain service is used. The third attribute defines what service is being measured (e.g. quality of service, state information, event codes, connection state, etc.). The next attribute contents information to allow traceability by providing context, source, and destination, defining in this way the place the service is consumed. The final attribute informs about the reason that triggered the event. Even though IPDR specifies services for Internet Protocol Television (IPTV), Public Wireless LAN (WLAN) access, Streaming Media (SM), Voice over IP (VoIP) or any other service specified by the service designer, in this paper we focus on the service specification of VoIP. Specifically, a VoIP call is started by a calling party or initiator and received by one or more call parties or recipients. The participating elements for the call include service elements, gatekeepers, and endpoints or users. The VoIP IPDRs contain the identifiers of all call participants, the time the call was started and ended, the call progress state, the final call completion codes for each call, and the call payment type. Section 4 presents real examples of VoIP IPDR.
204
I. Ruiz-Agundez, Y.K. Penya, and P. Garcia Bringas
3.3 Task Environment of the System We will define the task environment as shown in Table 1, which outlines the challenge we are facing: defining the Performance, Environment, Actuator and Sensors (also known as PEAS) [27]. First, we specify the performance measure of the system. We will consider that the actions performed by the system will be resolved with efficacy if we are able to detect fraudulent data records in our system. In the case of the efficiency, we will consider that the problem is resolved efficiently if we are able to detect a fraud in our system with the maximum certainty, with the minimum possible computational cost, and with the minimum response time. However, maximum certain ability and minimum possible cost may be goals in conflict, so there are trade-offs involved. Second, we will study our knowledge about the environment. We know that our environment is formed by the specification of the IPDR. The previous Section 3.2 gives a detailed description of this data records and in Section 4.2 and Section 4.3 we present two separate examples of this records. This data is encoded in XML format and it is transferred to an environment class created with an object-oriented representation. We also know the effects that the possible actions may have in the system. So far, the FMS can send a fraud notification alarm to the system operator or block all the present and future connections of a suspicious client. Third, we will study FMS actuators, which send a notification alarm and block connections. Sensors, on the contrary, are the information that the system receives from the out site. In our case, the inputs are the set of IPDRs that the system collects from the billing information. Section 4.1 describes how the dataset of the performed experiments is obtained. Table 1. PEAS description of the task environment for the Fraud Management System based on Misuse Detection for Next-Generation Networks Agent Type
Fraud Management System Fraud detection Certainty Performance Measure Computational cost Response time Environment Specification of the IPDR Notification alarm Actuators Blocking connections Sensors IPDR collector
3.4 The Structure of the System So far, we have described the FMS from the point of view of its behaviour. Now, we will address the design of the program that implements the system function by mapping perceptions into actions. We also know that our FMS works on a computing device or architecture. This architecture provides perceptions from the sensors to run an appropriate process that chooses which actuator to run from the available ones.
Fraud Detection for Voice over IP Services on Next-Generation Networks
205
The skeleton of our system is based on agent programs, also known as autonomous software programs [28], which uses the current perceptions as input from the sensors and returns an action to the actuators. This agent selects an action to perform on the basis of the current perception, the current IPDR. We can catalogue the agent as a simple reflex agent because its decision making is based only on the current input data [27]. Listing 1 shows the program of the agent. Even though the proposed agent is very simple, it works according to the performance measure, because the decision making is made only on the basis of the current perception (the environment is fully observable).
1 2 3 4 5 6 7 8 9 10 11
// KB, a knowledge base. Based on rules, a set of condition−action rules t, // a counter, initially 0, indicating time // @param p, // @return Action public Action KB−AGENT(Percept percept) { TELL(KB, makePerceptSentence(percept,t)); action = ASK(KB, makeActionQuery(t)); TELL(KB, makeActionSentence(action,t)); t = t + 1; return Action; } Listing 1. Knowledge-based FMS
3.5 Rule Engine Our system uses an existing framework, Drools, that provides a full set of tools to define our knowledge base. Drools is a rule engine that uses a rule-based approach to implement an expert system and can be more accurately classified as a production rule system. The term rule engine is sometimes considered ambiguous [29] because any system using rules, in any form, can be seen as a rule engine. Nevertheless, we understand it as a full production rule system, this is, a Turing-complete system that represents knowledge with propositional and first-order logic (which is sufficiently expressive to represent a good deal of common-sense knowledge [27]). The core of the system is an inference engine that processes rules and facts by matching them with production rules in order to infer conclusions. The production rules include a condition clause and an actions clause that will trigger when the conditions clause happens to be true. In our experiment, the person in charge of defining the rules is an expert in the domain of the security in telecommunications. Therefore, these rules are defined with previous knowledge and are limited to the scope of the misuse detection in this specific domain. Anomaly detection, or other boundary cases, is not under the scope of this experiment. The rules are stored in a production memory and the facts, or input data, in a working memory. Facts are asserted in the working memory, where they may then be modified or retracted. If the system has a large number of rules, many rules may happen to be true. In this case, an agenda manages the execution order of the rules in conflict.
206
I. Ruiz-Agundez, Y.K. Penya, and P. Garcia Bringas
4 Case Study In this section, we describe the experiment performed with the FMS. Section 4.1 presents the design of this case study. Section 4.2 details a legitimate use case example. Section 4.3 describes a fraudulent use case example. Finally, section 4.4 discusses the results of the experiments. 4.1 Design The purpose of this experiment is the definition of a case study based methodology [30] which can be applied to any fraudulent scenario. We have considered that there are prefixed use case scenarios on the use of the VoIP services. The input data to the FMS follows the schema of the service specifications [31]. VoIP service sessions have two or more participants over a partial or complete Internet-based connection. The session or call is started by one of the participants (call initiator) and it is received by one or more participants (call recipients). The call is managed by different elements, such as services, gatekeepers and endpoints (or end users). These sessions can be IP to IP, Public switched Telephone Network (PSTN) to IP, IP to PSTN, cellular to IP or any other combination. In each use case the resulting IPDR is different but maintains a fixed structure. Based on this structure, we have inferred general use cases for each scenario. Each structure has the same flow and the same IPDR attributes. In our experiments, we are only interested in the IPDRs; hence, we have studied the attributes involved in each use case. These attributes have a wide range of possible valid values and their presence is known beforehand. In this way, based on the structure of each use case, we study the attributes and their possible values in order to simulate the content of the IPDR and obtain valid data for our experiment. 4.2 Legitimate Use One of the use cases we have considered in our experiment is the legitimate use of the VoIP services. In particular, we have performed a use case in which the call initiator has a cellular phone and the call recipient has an IP telephone [31]. The basic flow of this example is similar to the one presented in Section 4.3. Listing 2 shows an example of the IPDR for this use case. In our scope of fraud detection, the main attributes of this record are the destination identification, the unique call identification, the personal identification number, the start access time and end time, the call duration, the average latency and the incoming codec. 4.3 Fraudulent Use In order to test our FMS against illegitimate use we implemented one of the classical telephone service fraud, inspired on the blue box phreaking tool. This tool is an electronic device that simulates a telephone operator’s dialling console [32]. Originally it was used to replicate telephone tones to switch log-distance calls
Fraud Detection for Voice over IP Services on Next-Generation Networks
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
207
2009−07−07T13:21:08.031+02:00 <seqNum>1 <subscriberID>Vendor Phone−1027365692 author.gateway.123 192.168.1.197 <startTime>2009−07−07T18:29:35.448+02:00 <endTime>2009−07−07T18:51:31.448+02:00 60 CC 555−066−0023 52s70uj5−1507−2954−xspx−7b86x2a23q66 445594063997989 <esnIngress>49916516 NormalCallClearing 555−467−0100 6333276 <serviceConsumerType>EU <startAccessTime>2009−07−07T18:29:14.448+02:00 1337000 105 V H G726 192.168.1.205 <portNumber>4724 MT43AGR5 Listing 2. Cellular to IP use case IPDR
and to route the user’s call bypassing the normal switching mechanism. The main use of the blue box was to make free telephone calls. These systems are nowadays based on digital technologies and they do not use in-band signalling, which the blue box originally emulated. Nevertheless, for the purpose of our experiment, we have assumed that the essential idea of this tolls is still working in spite of the underlying technology has changed. Based on this box principle, we address the following scenario. There is a client that is going to commit fraud in a voice service call. We suppose that he makes a phone call and does not pay for it, or at least he pays less time of consumption than the real amount he really has consumed. Figure 2 illustrates the basic flow of this example. It starts with the call of the client to the local access number for the gateway (1). The gateway queries a network element that verifies the subscribers account (2-3). The user is asked to enter a PIN and a destination phone number (4-5). After that, the gateway consults the gatekeeper on ways to route the call and establishes a connection between the terminal and gateway (6). The gateway places the call to the PSTN by out-pulsing the destination number (7). At this point, the
208
I. Ruiz-Agundez, Y.K. Penya, and P. Garcia Bringas
Fig. 2. Fraudulent use case
client tries to commit fraud by deceiving the gateway and by making it think that he hangs down (8). However, the connection is still alive and the fraudulent user is able to maintain a conversation with the destination number without being charged or being charged less than what it should. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
2009−07−07T13:21:08.078+02:00 <seqNum>3 <subscriberID>Vendor Phone−573460227 author.gateway.123 192.168.1.210 <startTime>2009−07−07T20:42:36.053+02:00 <endTime>2009−07−07T20:56:42.053+02:00 60 CC 555−680−9802 12l93my3−1546−3231−rmoi−2h61q7z54l47 861425764477418 <esnIngress>59148223 NormalCallClearing 555−906−5415 2315855 <serviceConsumerType>EU <startAccessTime>2009−07−07T20:41:40.053+02:00 66666666 80 V H G711Alaw 192.168.1.244 <portNumber>15745 OS38SJT3 Listing 3. Fraudulent use case IPDR
Fraud Detection for Voice over IP Services on Next-Generation Networks
209
Listing 3 shows the IPDR of this use case. The main attributes that indicate fraud in this record are the start access time, the end time, and the call duration. The goal of this fraud is to falsify the ending time of the call, making it briefer than it real was. Nevertheless, and in this use case, the call duration will represent the real call duration value. If we use these three variables and analyse non correspondences between them, we are able to detect fraudulent use cases. Listing 4 shows a rule to detect this fraudulent use of a phone service. It is based on the incoherence of the call duration time. For this case, it checks that the difference between the start access time and the ending time have the same value as the call duration attribute. If the values are not equal the system detects a fraudulent use of the voice service. Other rules could be applied to this IPDR, looking for other fraud evidences. The attributes subscriberID, callCompletionCode, incomingCodec or any other could be combined in many different ways creating new heuristic rules to feed the FMS.
1 2 3 4 5 6 7 8 9
10
rule ”Incoherent CallDuration time” when // Variable declaration $ipdrVoIPType : EnlargeIPDRVoIPType( ) // Get the call duration and check that does NOT equals to endTime− startAccessTime eval(!($ipdrVoIPType.getCallDuration().equals($ipdrVoIPType.checkCallDuration()))) then System.err.print( ”Alert! Incoherent CallDuration time for the IPDR with ” ); System.err.print( ”seqNum ” + $ipdrVoIPType.getSeqNum() + ” and uniqueCallId ” + $ipdrVoIPType.getUniqueCallId() ); end Listing 4. Incoherent call duration time detection rule
4.4 Results In order to assess the validity of the proposed architecture in section 3.1, we have performed different kinds of tests in our test-bed environment. Since synthetic fraud data has been proved to be more suitable than authentic data when it comes to testing and training of fraud detections systems [33], we have tested a representative subset of VoIP IPDR records, both legitimate and fraudulent cases from a generated dataset. This generation followed a structured process to ensure the data validity. Table 2 shows a partial outcome, with three data records, of a bigger execution result. The system inserts a VoIP IPDR record into the system for its analysis. Once the system performs the analysis, it reports the result based on the expert knowledge represented within the rule-set. In the case of these experiments, if the call duration is coherent, the system informs that the record is valid. In case of an incoherent call duration, the system prompts an alert and takes the pertinent measures through its actuators as described in section 3.3. Since the results confirm that the proposed system is valid to perform misuse detection for Voice over IP services, the architecture design is ratified. Therefore, the fraud
210
I. Ruiz-Agundez, Y.K. Penya, and P. Garcia Bringas Table 2. Execution results Sensors Actuators uniqueCallId Other parameters Notification alarm 52s70uj5-1507-2954-xspx-7b86x2a23q66 See IPDR in Listing 2 no action 12l93my3-1546-3231-rmoi-2h61q7z54l47 See IPDR in Listing 3 triggered 55r56gz4-3990-6841-xywy-4b38l1e72i58 Yet another IPDR no action
management system works as expected detecting fraud based on the expert knowledge. The system expansion is guaranteed by adding more rules by the domain expert. Other rules would use different attributes and relations, enabling new detection capabilities.
5 Conclusion In this paper, we introduce a misuse-detection-based system to detect fraud on Voice over IP services on Next-Generation Networks, in order to improve fraud management systems for NGN. We believe that detecting potential security risks contributes to the deployment of these networks by providing extra stability. Besides, the investments on infrastructures and development by telecommunication operators are stepped up. This approach relies on a previous analysis of NGN security requirements. To this end, we present the related work on security requirements on NGN and define different approaches to face fraud.We have also studied all the existing specifications of IPDR, from the Internet protocol television to the Voice over IP. We believe that misuse detection is the best approach to build a fraud management system that controls these risks. Our analyses show that this paradigm is suitable and is able to react when a fraud attempt occurs. Future work will focus on the automatic modelling of more use cases and on the automatic generation of new detection rules. Furthermore, as the architectural design of our fraud management system is modular, we intend to spread the system detection capabilities to other services besides the Voice over IP services.
References 1. Mao, Z., Douligeris, C.: A distributed database architecture for global roaming in nextgeneration mobile networks. IEEE/ACM Trans. Netw. 12(1), 146–160 (2004) 2. Bella, M.B., Eloff, J., Olivier, M.: A fraud management system architecture for nextgeneration networks. Forensic Sci. Int. 185(1), 51–58 (2009) 3. Liu, Y., Liang, X.: New regulations to the next generation network. In: WRI International Conference on Communications and Mobile Computing. CMC 2009, January 2009, vol. 2, pp. 172–174 (2009) 4. Crimi, J.C.: Next Generation Network (NGN) services. In: Telcordia Technologies (2000) 5. KPMG Forensic: Fraud survey, http://www.kpmg.com/ 6. Communications Fraud Control Association: Global telecom revenues increase 12% and fraud increases 52% from 2003-2005 (2006), http://www.cfca.org/ 7. Web Application Security Consortium: Threat classification, http://www.webappsec.org/
Fraud Detection for Voice over IP Services on Next-Generation Networks
211
8. Howard, J., Longstaff, T.: A common language for computer security incidents. Technical Report Sandia Report: SAND98-8667, Sandia National Laboratories (1998) 9. Kvarnstrom, H., Lundin, E., Jonsson, E.: Combining fraud and intrusion detection - meeting new requirements. In: Fifth Nordic Workshop on Secure IT systems, NordSec 2000 (2000) 10. Simmons, M.R.: Recognizing the elements of fraud (1995), http://www.facilitatedcontrols.com/fraud-investigation/ fraudwww.shtml 11. Mcnamara, P., Firozabadi, B.S., hua Tan, Y., Lee, R.M.: Formal definitions of fraud. In: Norms, Logics and Information Systems - New Studies in Deontic Logic and Computer Science, pp. 275–288. IOS Press, Amsterdam (1999) 12. Cortesao, L., Martins, F., Rosa, A., Carvalho, P.: Fraud management systems in telecommunications: A practical approach (April 2005) 13. Bihina Bella, M.A., Olivier, M.S., Eloff, J.H.P.: A fraud detection model for Next-Generation Networks. In: Browne, D. (ed.) Southern African Telecommunication Networks and Applications Conference 2005 (SATNAC 2005) Proceedings, Champagne Castle, South Africa, September 2005, vol. 1, pp. 321–326 (2005) 14. Communications Fraud Control Association: Announces results of world wide telecom fraud survey (March, 2003), http://www.cfca.org/ 15. Alves, R., Ferreira, P., Belo, O., Lopes, J., Ribeiro, J., Cortesao, L., Martins, F.: Discovering telecom fraud situations through mining anomalous behavior patterns. In: Workshop on Data Mining for Busines Applications, 12th ACM SIGKDD International Conference on Knowledge Discovery Data Mining (August 2006) 16. McGibney, J., Hearne, S.: An approach to rules-based fraud management in emerging converged networks. In: IEEE/IEI Irish Telecommunications Systems Research Symposium (2003) 17. Hollm´en, J., Tresp, V.: Call-based fraud detection in mobile communication networks using a hierarchical regime-switching model. In: Advances in Neural Information Processing Systems, pp. 889–895 (1999) 18. Kou, Y., Lu, C., Sirwongwattana, S., Huang, Y.: Survey of fraud detection techniques. In: Proceedings of IEEE Intl. Conference on Networking, Sensing and Control (2004) 19. Est´evez, P., Held, C., Perez, C.: Subscription fraud prevention in telecommunications using fuzzy rules and neural networks. Expert Systems with Applications 31(2), 337–344 (2006) 20. Weiss, G.: Data mining in telecommunications (2005) 21. Rosset, S., Murad, U., Neumann, E., Idan, Y., Pinkas, G.: Discovery of fraud rules for telecommunications—challenges and solutions. In: KDD ’99: Proceedings of the fifth ACM SIGKDD international conference on Knowledge discovery and data mining, New York, NY, USA, pp. 409–413. ACM, New York (1999) 22. Lundin, E., Jonsson, E.: Anomaly-based intrusion detection: privacy concerns and other problems. Computer Networks 34(4), 623–640 (2000) 23. Jones, A., Sielken, R.: Computer system intrusion detection: A survey. In: University of Virginia, Computer Science Department, Tech. Rep. (1999) 24. Kumar, S., Spafford, E.: A pattern matching model for misuse intrusion detection. In: Proceedings of the 17th National Computer Security Conference (1994) 25. TeleManagement Forum: IPDR Service Specification. Design Guide (September 2008), http://tmforum.org/edn 26. McGibneya, J., Schmidtb, N., Patelb, A.: A service-centric model for intrusion detection in next-generation networks. Computer Standards & Interfaces 27(5), 513–520 (2005) 27. Russell, S., Norvig, P.: Artificial Intelligence: A Modern Approach. Prentice-Hall, Englewood Cliffs (2003) 28. Wooldridge, M., Jennings, N.: Intelligent agents: Theory and practice. Knowledge Eengineering Review 10(2), 115–152 (1995)
212
I. Ruiz-Agundez, Y.K. Penya, and P. Garcia Bringas
29. Chisholm, M.: How to Build a Business Rules Engine Extending Application Functionality through Metadata Engineering. Elsevier Inc., Amsterdam (2004) 30. Kitchenham, B., Pickard, L., Pfleeger, S.: Case studies for method and tool evaluation. IEEE software 12(4), 52–62 (1995) 31. TeleManagement Forum: Service Specification - Voice over IP (VoIP) (November 2004), http://tmforum.org/edn 32. Goldstein, E.: The Best of 2600: A Hacker Odyssey (Kindle Edition). Wiley, Chichester (2008) 33. Lundin, E., Kvarnstrom, H., Jonsson, E.: A synthetic fraud data generation methodology. In: Deng, R.H., Qing, S., Bao, F., Zhou, J. (eds.) ICICS 2002. LNCS, vol. 2513, pp. 265–277. Springer, Heidelberg (2002) 34. Axelsson, S.: Intrusion detection systems: A survey and taxonomy. Chalmers University of Technology, Dept. of Computer Engineering, G¨oteborg, Sweden, Technical Report 99–15 35. Baluja, W., Llanes, A.: Estado actual y tendencias del enfrentamiento del fraude en las redes de telecomunicaciones. Ingenier´ıa Electr´onica, Autom´atica y Comunicaciones XXVI, 46–52 (2005) 36. Bihina Bella, M.A., Eloff, J.H.P., Olivier, M.S.: Using the IPDR standard for NGN billing and fraud detection. Research in progress paper (June/July 2005), http://mo.co.za/abstract/ipdrfraud.htm 37. Choi, M.J., Hong, J.W.K.: Towards management of next generation networks. IEICE Trans. Commun. E90-B(11), 3004–3014 (2007) 38. Hearne, S., McGibney, J., Patel, A.: Addressing fraud detection and management in nextgeneration telecommunications networks (2004) 39. JBoss: Drools documentation, http://jboss.org/drools/ 40. Takuji, T.: Backend systems architectures in the age of the next generation network. NEC Technical Journal 1(2), 51–55 (2006) 41. Vincent, J., Mintram, R., Phalp, K., Anyakoha, C.: AI solutions for MDS: Artificial Intelligence techniques for Misuse Detection and localisation in telecommunication environments (2007)
Proxy Smart Card Systems Giuseppe Cattaneo1 , Pompeo Faruolo1 , Vincenzo Palazzo2, and Ivan Visconti1
2
1 Universit` a di Salerno, Italy {cattaneo,pomfar,visconti}@dia.unisa.it Bit4ID s.r.l, via Coroglio, 57 BIC Citt` a della Scienza - 80124 Napoli
[email protected] Abstract. The established legal value of digital signatures and the growing availability of identity-based digital services are progressively extending the use of smart cards to all citizens, opening new challenging scenarios. Among them, motivated by concrete applications, secure and practical delegation of digital signatures is becoming more and more critical. Unfortunately, secure delegation systems proposed so far (e.g., proxy signatures) include various drawbacks for any practical system. In this work we put forth the notion of a “Proxy Smart Card System”, a distributed system that allows a smart card owner to delegate part of its computations (e.g., signatures of messages) to remote users. We stress the problematic aspects concerning the use of known proxycryptography schemes in synergy with current standard technologies. This in turn motivates the need of proxy smart card systems. Then we formalize the security and functional requirements of a proxy smart card system, identifying the involved parties, the adversary model and the usability properties. Finally, we present the design and analysis of a proxy smart card system which outperforms the current state of the art.
1
Introduction
Proxy cryptography is a widely developed research area that consists in providing cryptographic primitives that allow a user to safely delegate part of its tasks (typically signatures of messages) to another user. Concrete applications of proxy cryptography are becoming more and more critical. For instance digital signatures are now regulated and accepted by law in almost all countries and many entities playing crucial roles in both enterprises (e.g., CEOs) and public institutions (e.g., mayors, rectors), have to sign a large amount of documents per day. Moreover, it is often the case that documents have to be signed urgently, even when the signer is out of his office and unreachable. The possibility of delegating signing privileges should therefore be extended also to digital signatures. Unfortunately we observe a huge gap between the results provided for proxy cryptography and their use in the real world. Indeed, it is well known that
This work has been supported in part by the joint project “SmartSEC”, with Bit4ID S.r.l., financed by Italian Ministry of Economic Development in the framework P.O.N. 2000-2006 - Misura 2.1.
P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 213–220, 2010. c IFIP International Federation for Information Processing 2010
214
G. Cattaneo et al.
results produced by cryptographers need several years to be assessed and then used by practitioners. Moreover cryptography in stand-alone is not usable, it needs to be integrated in a system with security and privacy mechanisms that can make robust all the involved components. Proxy cryptography is affected by such delays, and indeed, while the literature already gives several provablysecure schemes enjoying many features and reasonable efficiency, almost nothing of it is actually used in the real world. This is in large part a consequence of the long distance between the requirements of proxy cryptography (e.g., system parameters, cryptographic operations) and the currently used technologies (e.g., PKIX [1], Smart Cards). It is therefore urgent to provide mechanisms that allow delegation of signatures using current standard technologies only. Our contribution. In this work we study the problematic aspects of using proxy cryptography along with current standard technologies to implement delegation of signatures. Therefore, motivated by the world-wide spread of smart cards (SCs, for short), and their cryptographic operations (e.g., signatures) for implementing various cryptographic services, we put forth the notion of a Proxy Smart Card System (PSCS, for short). We investigate concrete real-world scenarios and according to them we formalize the security and functional requirements of a PSCS, identifying the involved parties, the adversary model and the critical usability properties. We finally present the design and analysis of a proxy smart card system based on the use of a network security appliance that outperforms the current state of the art. The development of our system required the combined use of several techniques and technologies in a novel way, which in some case could be also of independent interest. Our solution is a “ready-to-use” framework that can be easily plugged in real-life scenarios. It does not resort to currently unadopted features of proxy cryptography and instead uses the synergy of existing crypto tools and security technologies to obtain a robust, easy to configure, scalable and cheap system to delegate, under some access control policies, signature privileges.
2
Proxy Signatures
The concept of proxy signature was introduced respectively by Mambo et al. [2] and by Mambo and Okamoto [3]. In such schemes a player called owner O delegates to another player, called user U, the power to execute his own cryptographic tasks. In a proxy signature system, U can sign messages on O’s behalf. In general, in such systems, O generates some proxy secret keys which Us can use to sign documents verifiable through O’s public key. Originally, these building blocks were considered to be used in large enterprise scenarios, where a manager would like to delegate signature capabilities. Subsequently, the use of such schemes has been suggested in numerous other contexts. Security requirements. According to the relevant literature [2,4], and the requirements of real-world applications, a proxy signature schemes should enjoy the following (informal) properties.
Proxy Smart Card Systems
215
Proxy signature. Verifiability: a verifier always accepts a proxy signature computed by a delegated honest user U; Strong unforgeability: it must be computationally hard for a player that is not a delegated honest U to compute a new proxy signature that is accepted by a verifier; Strong identifiability: from a proxy signature computed by a delegated user U, it must be possible to determine efficiently the identity of U; Strong undeniability: it must be computationally hard for a player that computed a proxy signature, to subsequently repudiate it. The above properties have been formally defined along with several variations and extensions in the related literature. Here, for lack of space and the sake of focusing the paper on the core of our contribution, we will consider the above informal security requirements only. Functional requirements. We notice that currently no proxy-cryptography scheme seems to be concretely used in practice. Our investigations about the available schemes, the above security requirements and the available cryptographic tools, raised the following issues. 1) Proxy-cryptography schemes often use numbertheoretic constructions and procedures that heavily deviate from the currently available standard technology. Their introduction in real-life scenarios would require too much effort for users to move to new/different systems. 2) Several schemes do not combine gracefully security and flexibility, indeed most of the proposed systems enjoy some given properties and can not be easily adapted to relax some of them. 3) Several schemes suffer of practical limitations. The work done so far on proxy cryptography mainly focused on the design of powerful cryptographic primitives, but unfortunately it substantially ignored the concrete functional requirements of a practical and easy to use system. In order to be more concrete about such requirements, we studied different contexts where proxy signatures are needed and we collected the functional requirements (beyond the usual security requirements) that we believe any practical proxy signature system should enjoy. We summarize those requirements in the following categories. Compatibility: schemes should use standard technologies only in order to be compatible with current software applications; Flexibility: schemes should allow users to configure and select the appropriate features dynamically. Efficiency: schemes should be reliable and satisfy some critical performance requirements. Motivated by the above requirements, and the problematic use of proxy cryptography for satisfying them, we investigated the possibility of designing a system where all those security and functional requirements could be satisfied simultaneously. In the next section we show the design of our system that thus gives a positive answer to the challenging question of having a viable technology for digital signature delegation.
3
Design of a Proxy Smart Card System
Following the security and functional requirements identified in the previous section, we designed a PSCS, that is, a proxy smart cards system that can be used to safely delegate signing capabilities of a personal smart card. In our system Os can allow authorized Us to remotely access to their SCs in order to
216
G. Cattaneo et al.
sign messages using their private keys. Notice that smart cards are nowadays a standard technology deployed to all citizens by means of electronic ID cards. Moreover, the use of smart cards guarantees a high level of robustness of the system, thanks to the hardness of extracting private keys (i.e., the device is ideally considered tamper proof). Here we consider SCs as standard PKCS#11 [5] compliant smart cards, where the critical operations are protected by PIN (i.e., personal identification number). A central role in our PSCS is the Proxy Server P, a hardware/software network security appliance equipped with smart card readers. The purpose of P is to allow Us to use the signing capabilities of SC without compromising any critical information (e.g., private keys, PIN). O shares his SCs by plugging them into readers connected to P, while Us remotely interacts with P to use them according to the role-based access control (in short, RBAC [6]) configured by O. These interactions are implemented by PSCS through a Remote PKCS#11, that is, a library that exposes to Us standard PKCS#11 functionalities while the computations are carried out on SCs plugged in P. Using this approach, Us can continue to use their standard applications also on O’s SCs to compute proxy signatures. Making SCs remotely available introduces the problem of filtering remote access to the SCs. This requires the assumption that P is a tamper proof/evident network security appliance designed to provide the same services of a local smart card reader through the net. Remote smart card. The smart cards that P makes available to Us do not necessarily correspond to the smart cards plugged in card readers. Indeed, in our system Os have the possibility to configure SCs in different operating modes giving to Us a virtual view of the SCs available. In detail, Os can define the Remote Smart Card (RSC) as Single (SRSC) or Parallel (PRSC). In the former case, a RSC corresponds exactly to a real SC while in the latter case several SCs, offering the same objects, will appear to Us as a single RSC. A request on a PRSC can be executed indifferently by any SC linked to it. Notice that an O can have several certificates (and thus several public keys) associated to his identity, therefore PRSC is achievable by using a smart card for each certificate, so that each smart card stores a different private key. Indeed, a critical feature concerning the use of smart cards is that the private key should never leave the smart card (and thus cloning procedures should not be performed). Another important requirement is that the associated PIN should never be memorized in permanent storage, and we will deal with this later when we will discuss our PIN management system. From the above discussion, we have that SCs with different keys can still be used for signatures delegation. The above mechanism makes signature delegation more efficient, indeed, a PRSC allows one to parallelize the load of requests across its SCs. Set up of the system. All Us and Os must enroll the system by registering their public keys. O plugs his SCs into the smart card readers connected to P. Through a remote administration web interface O sets the configuration of his RSCs and defines the related access policies for the delegated Us. An authorized U for a
Proxy Smart Card Systems
217
given RSC, receives a special PIN that does not correspond to the real SC’s PIN, but instead is a virtual PIN that allows him to access that RSC. We discuss in the next section the problematic issues concerning PIN management, and the technical motivation of our non-trivial solution. Os can revoke the delegated capabilities to each U in any moment by simply updating the access control policies. Such updates have immediate effects, indeed a revoked U will not be able to invoke any further service on P. The past signatures will remain valid. The system allows Os to authorize the delegation only for a given time interval and/or on specific documents. Moreover, O can decide if the proxy signatures will be with or without warranty (in the former case, the signature will contain also a warning about performed delegation). Proxy signatures. First of all we remark that U can use his standard applications, that are PKCS#11 compatible, to sign documents through the O’s SCs. These applications must only set the client side of Remote PKCS#11 as PKCS#11 layer. This module has the task of interacting with P in order to accomplish remotely the operation invoked by the application. Obviously, this task is done transparently to the application. Its first step is to access to P by means of a strong authorization mechanism (i.e., TLS [7] client authentication through digital certificates). Once the secure channel has been established, according to U privileges, it enumerates to the application all the RSCs available as PKCS#11 slots. When an RSC has been selected by U to sign documents, the client component of Remote PKCS#11 will sign the request with U’s private key and will send it to the server component of the library. This signature is required in order to log on P the request, that thus can not be repudiated by U. If the PIN is correct and U has the required privileges, the operation is executed by the selected SC and the result is sent back to local component of Remote PKCS#11 that will forward it to the application. More specifically, the system will dispatch the requests on a PRSC to the first available SC linked to that PRSC through a Round Robin scheme that therefore will balance the load of requests. Since the sign functions are slow and long term operations, this mechanism radically improves system performance linearly scaling with the number of SCs configured for the PRSC. The system allows obviously Os access (even remotely) to all the logs, in order to let them monitor completely the activity of their delegates. Security model. Given the critical use of smart cards in real world scenarios, a security model is required in order to show that a proposal is resilient to attacks mounted by malicious players. First of all, we follow the standard approach that assumes that an adversary has complete control over the communication channel. This includes the capability of reading and updating all messages that cross the network, of delaying the delivering of messages, and so on. We assume that P is a trusted player, this means that when it is active it follows the prescribed procedures and his behavior can not be compromised. This assumption is both 1) necessary, and 2) achievable in practice. Indeed, in case P is under the control of an adversary, since SCs are plugged into its readers, and remotely accessed through its software, the adversary would obtain the PINs of the SCs and thus could also ask them non-authorized services (e.g.,
218
G. Cattaneo et al.
signatures). Notice that while it is known how to design protocols that are secure even in presence of such adversaries, the known solutions require that honest players (in this case SCs and honest Us) perform computations that go much beyond the simple PKCS#11 interface that is currently available for accessing to standard smart cards. The need of obtaining a proxy system on top of standard technologies, therefore requires that P behaves honestly. Honest behavior can moreover be enforced by using some run-time integrity check techniques, as proposed in [8,9], and by integrating the support of smart cards directly in the kernel of the operating system, as proposed in [10]. The above assumption about P is also achievable in practice since the hardware infrastructure of P can be placed into a restricted access area (basically implementing a tamper evident mechanism) and moreover his software could be placed in EEROM (i.e., Electrically Erasable Read-Only Memory). Therefore the software is rewritable only when a special password is known. There must be instead a read-write (RW, for short) memory that will contain for instance log files and the RBAC policy files. We do not assume special requirements about such an RW memory, indeed its content remain valid and used by P as long as there is a valid message authentication code (MAC, for short) associated to them. Indeed, this memory could be adversarially corrupted and we require that the adversary must not be able to produce new valid data. Moreover, erasing such data or trying to restore previous data will have no (substantial) effect since P is assumed to periodically send through S/MIME [11] encrypted and signed backups of such data to the addresses associated to Os. We assume that qualified Us are honest while other Us can be corrupted. The distinction between such two categories depends on the RBAC policies configured for each smart card. Us that can access to services provided by some SCs are assumed to be honest for those SCs and potentially dishonest for the remaining services of those SCs and for the other SCs. Notice that since RBAC policies are dynamic, the set of qualified users is dynamic as well, and thus a user can be considered honest only temporarily (therefore one can not simply assume that the owner of a SC gives the PIN to qualified Us). All honestly produced SCs are assumed to be incorruptible, instead an adversary can produce some non-legitimate SCs that can be plugged into the readers of P and Us. Pin management. A major requirement for the design of a proxy smart-card system is the transparent use of remote smart cards as they were local. Indeed, clients would like to recycle their applications that access to local smart in order to also access to the remote smart cards connected to the proxy smart-card system. Notice that access to a smart card is possible through a log on procedure where a personal identification number (PIN) has to be provided by the user and sent to the smart card. The need of recycling standard applications implies that one can not simply assume that qualified users are identified by the system through passwords. This restriction is enforced could be enforced by laws that mandatory require the use of PINs for accessing smart cards. Moreover, after a prescribed number of PIN log on failures a Personal Unblocking Key (PUK) is needed to restore access to the smart card.
Proxy Smart Card Systems
219
The above problem could in general be solved by the following trivial solution: the PIN of the smart card is communicated to all users that have sufficient privileges to access the smart card. This solution however does not satisfy the flexibility requirement of a proxy smart-card system since user privileges are in general dynamic and thus removing a user from the system would require the generation of new PINs that then should be distributed to all qualified users. This is clearly unacceptable in systems with many users and dynamic assignment of privileges. We have therefore developed a more sophisticated system. The failure of the trivial solution discussed above implies that the PIN on the client’s side must be different from the real PIN that allows one to succeed in the log on procedure with the smart card. It is therefore fundamental to establish a virtual PIN system where users know some virtual PINs that can be translated into real PINs by the proxy smart-card system. In this direction one can consider the following simple but conceptually wrong solution. The RBAC policy is encoded through a table where each U has associated a mapping between virtual PIN and real PIN. Therefore, upon receiving a remote log on request with a given virtual PIN, P simply accesses the table and translates the virtual PIN to a real PIN to be used for the log on procedure with the smart card. This procedure would match the flexibility requirement of the system. However, it still includes a security drawback that we want to exclude from our architecture. Indeed, the above table should be stored somewhere in the permanent memory of P and would include the real PIN. Storing a real PIN on a permanent memory is conceptually wrong and in contrast with the common philosophy about the correct use of smart cards. Taking into account these issues, our solution is more sophisticated and requires the use of the virtual PIN as a key for the symmetric encryption of the real PIN. Therefore, when a new virtual PIN is generated and associated to a real PIN, P will be updated by adding a new entry in an access control table and it will contain an encryption of the real PIN computed by means of the virtual PIN as key. When U accesses remotely to a SC, he has to send the virtual PIN that then will be used by P to decrypt the corresponding entry in the RBAC table and to perform the log on procedure on the SC. Notice that using this approach we can still have flexibility and at the same time no key or PIN is stored unencrypted in the permanent memory of P. Implementation details. In this section we illustrate the main implementation details of our PSCS. First of all we implemented our PSCS using a Client/Server schema, between the PKCS#11 local component (on client side) and the PKCS#11 engine (on server side). The first one exposes a standard PKCS#11 interface to U’s local application, but when the applications invoke its functions, the module remotely calls the corresponding engine function on P. Invocations are encapsulated in a proprietary format and sent using the HTTP protocol through a secure channel (HTTPS) with mutual authentication based on the exchange of X.509 certificates [1]. The server engine forwards the requests to the plugged SCs and returns to the client the results. In the standard PKCS#11 interface some functions must be coded by the library and some others must be executed natively by SC. Some computations (e.g., AES symmetric encryptions,
220
G. Cattaneo et al.
cryptographic hashing), are executed locally by the client module while others (e.g., signatures) by SC on P through the engine component. We stress that this mechanism is transparent to Us and requires only the availability of U’s authentication capabilities in the standard PKIX [1] setting.
4
Conclusion
We have conducted several performance measurements with different use cases. In all of them, our system resulted sufficiently practical, flexible, efficient and secure as no other currently available proposal in the literature. Our system is also easy to set up and we expect that our work will also give a chance for further extensions and improvements, thus generating follow up research on this topic. Further details about the implementation and the security of our system will be shown in the full version of this paper.
References 1. Housley, R., Ford, W., Polk, W., Solo, D.: Internet X.509 Public Key Infrastructure Certificate and CRL Profile (1999) 2. Mambo, M., Usuda, K., Okamoto, E.: Proxy signatures for delegating signing operation. In: ACM Conference on Computer and Communications Security, pp. 48–57 (1996) 3. Mambo, M., Okamoto, E.: Proxy cryptosystem: delegation of the power to decrypt ciphertexts. IEICE Trans. Fundamentals E80-A(1), 54–63 (1997) 4. Lee, B., Kim, H., Kim, K.: Strong proxy signature and its applications. In: SCIS, pp. 603–608 (2001) 5. RSA Laboratories: PKCS #11: Cryptographic Token Interface Standard, http://www.rsa.com/rsalabs/node.asp?id=2133 6. Ferraiolo, D.F., Kuhn, D.R.: Role based access control. In: 15th National Computer Security Conference, pp. 554–563 (1992) 7. Network Working Group: The Transport Layer Security (TLS) Protocol Version 1.2 (2008), http://tools.ietf.org/html/rfc5246 8. Catuogno, L., Visconti, I.: A Format-Independent Architecture for Run-Time Integrity Checking of Executable Code. In: Cimato, S., Galdi, C., Persiano, G. (eds.) SCN 2002. LNCS, vol. 2576, pp. 219–233. Springer, Heidelberg (2003) 9. Catuogno, L., Visconti, I.: An Architecture for Kernel-Level Verification of Executables at Run Time. Comput. J. 47(5), 511–526 (2004) 10. Catuogno, L., Gassir` a, R., Masullo, M., Visconti, I.: Securing Operating System Services Based on Smart Cards. In: Katsikas, S.K., L´ opez, J., Pernul, G. (eds.) TrustBus 2005. LNCS, vol. 3592, pp. 321–330. Springer, Heidelberg (2005) 11. Network Working Group: S/MIME Version 3 Message Specification (1999), http://tools.ietf.org/html/rfc2633
Can We Support Applications’ Evolution in Multi-application Smart Cards by Security-by-Contract? Nicola Dragoni1 , Olga Gadyatskaya2, and Fabio Massacci2 1
DTU Informatics, Technical University of Denmark, Denmark
[email protected] 2 DISI, University of Trento, Italy {gadyatskaya,massacci}@disi.unitn.it
Abstract. Java card technology have progressed at the point of running web servers and web clients on a smart card. Yet concrete deployment of multi-applications smart cards have remained extremely rare because the business model of the asynchronous download and update of applications by different parties requires the control of interactions among possible applications after the card has been fielded. Yet the current security models and techniques do not support this type of evolution. We propose in this paper to apply the notion of security-by-contract (S×C), that is a specification of the security behavior of an application that must be compliant with the security policy of the hosting platform. This compliance can be checked at load time and in this way avoid the need for costly run-time monitoring. We show how the S×C approach can be used to prevent illegal information exchange among several applications on a single smart card platform, and to deal with dynamic changes in both contracts and platform policy. Keywords: Security-by-Contract, multi-application smart card, illegal information exchange, security policy enforcement.
1
Introduction
Multi-application smart cards aim at making it possible to run several applications from different providers on the same smart card and to dynamically load and remove applications during the active life of the card. With the advent of new web enabled cards the industry potential is huge. However, despite of the large number of research papers on the topics there are few to none real-life deployments. One reason is the lack of solutions to an old problem [14]: the control of interactions among applications. While many techniques can be used to check information flow (e.g. [2,12,8]) if we know and install all applications at once before distributing the card to the public, the natural business model is the asynchronous loading and updating of applications by different parties. Hence we need a method to check interactions at load- or run-time. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 221–228, 2010. c IFIP International Federation for Information Processing 2010
222
N. Dragoni, O. Gadyatskaya, and F. Massacci
Applications run in dedicated security domains [10]. The name is evocative of a separate space (such as in a virtual machine) but in reality a domain just supports security services such as key handling, encryption, decryption, digital signature generation and verification for their providers’ (Card Issuer, Application Provider or Controlling Authority) applications, and a number of functions to download and make an application executable. The control of the communications between the applications and the applications and the platform rests on the Java Run-time Environment (JRE) [11]. The basic model of the GP security is the same behind the confinement of standard Java applets [7]: to deal with the untrusted code we can exploit the mechanism of permissions to control execution of potentially dangerous or costly functionality, such as starting various types of connections. However permissions do not solve the issue of interactions. On the card we can also have a firewall security mechanism that isolates each applet from the other applets within of its own space (a “context” in the Java Card jargon). The result is that the internal operations of an applet have no effect on other applets embedded on the card. Still, applications can interact in this environment by explicitly implementing sharing methods callable via an API, application service in Java Card 3.0 specification [11] or Global Services in the GP specs. In the GP registry every application has an entry, which includes its ID (AID) and Global Services recorded for this application (if any). But GP does not solve the problems of illegal information exchange even for the applications from different security domains and all inter-application interactions are pushed to lower level – JRE, or even hardware. If application A knows shareable interface of application B, then it may use it for its own purposes, and there is no means for B or B security domain owner to prevent it, unless special controls are hacked into the Java firewall. However this prevents completely the asynchronous download or update of different applications. Moreover, there is no uniform policy language to express security policies for GP and it is even difficult to show that the security policies of two versions of a smart card by the same vendor are inter-operable. There are business solutions for multi-application smart cards on top of GP and Java Card from Venyon Oy, Gemalto and companies alike developed for banking, transport and mobile operators. But typical solution from such companies is only responsible for handling loading of card customer applications, security domain key handling and management and removal of applications [1], thus such a solution is only an improvement of GP, but it is not dealing with certification of new applications on the card, checks of compliance of new applications with the initial card security policy and checks if the removal of some application is even possible and will not break the work of others remaining on the card. What remains out of reach is a secure way to deploy new applications on the multi-application smart card once it is in the field. A costly manual review is necessary. Owners of different trust domains would like to make sure their applications cannot be accessed by new applications added after theirs. Actually, currently smart card developers have to prove that all the changes that are possible to apply to the card are security-free, so that their formal proof of compliance
Can We Support Applications’ Evolution in Multi-application Smart Cards?
223
with Common Criteria is still valid after that changes and they do not need to obtain a new certificate. Otherwise no smart card customers (banks, governments, airline companies, etc) will accept to issue such cards for their needs. The natural consequence is that there are essentially no open multi-application smart cards, though both the GP and Java Card specifications support them. In the next section we present the S×C framework for open multi-application smart card security and show how it can solve the problem of Common Criteria compliance certification, introducing also the hierarchy of application models, and discuss the lowest level with its limitations (§3). Finally we summarize related works and conclude (§4).
2
Security-by-Contract for Smart Cards
In current setting, formal proof of card Common Criteria compliance includes a proof that all applications on the card satisfy the security policy of the card, provided together by all security domain owners and controlling authorities. So, if A1 , . . . , An are the applications on the smart card and the smart card n policy P olicy= SpecAi , where SpecAi is a policy provided by the owner of i=1
application Ai , then the compliance of applications to the policy can be written n as Ai satisfies P olicy. Accordingly, after new application B arrives on the i=1
platform the smart card vendor has to prove that n
Ai ∪ B satisfies P olicy ∪ SpecB .
i=1
For this Common Criteria compliance problem, we want to show that Securityby-Contract methodology (S×C) for smart cards we propose in this paper can help smart card vendors with this issue. In the S×C setting each application has a contract, which describes its security-relevant behavior. Thus application B will arrive on the platform with its contract ContractB . Then the S×C framework will prove (check) the compliance of the application B and its contract, and n then check that ContractAi ∪ ContractB satisfies P olicy ∪ SpecB . Since the i=1
contract is a formal model it is easier to show its compliance with another formal model of the same type (P olicy), rather then try to show the compliance of applications and the policy. This is why we claim that new smart cards need the notion of Security-by-Contract. In this paper we focus on contracts and policies describing the interactions among the different applications running on a single smart card platform. Intuitively, we say that an application A interacts with an application B if there is some information exchange between these applications. In this dynamic setting, we are primary interested in addressing two specific security challenges, namely preventing illegal information exchange among applications and dealing with dynamic evolution of smart card platform. In this paper due to limitations of space
224
N. Dragoni, O. Gadyatskaya, and F. Massacci
we will consider only arrival of new application on the platform as a dynamic change. This type of change is the most important, since it allows openness of the platform. The other types of evolution, namely update or removal of an existing application and update of platform security policy will be considered in the future works. Thus the problem we want to solve: – Problem P1 : new application should not interact with forbidden applications already on the smart card. Sekar et al. [16] have proposed the notion of Model Carrying Code (MCC), that requires the code producer to establish a model regarding the safety of mobile code which captures its security-relevant behavior. The code consumers check their policies against the model associated with untrusted code to determine if this code will violate their policy. The major limitation was that MCC had not fully developed the whole lifecycle and had limited itself to finite state automata which are too simple to describe realistic policies. Even a simple, basic policy such as “Only access url starting with http” could not be addressed. The Security-byContract (S×C) framework that we have developed for mobile code [4,3] builds upon the MCC to cope with more practical scenarios. At load time, the target platform checks that the evidence is correct. Such evidence can be a trusted signature as in standard mobile applications [18], but now the digital signature does not just certify the origin of the code, but also bind together the code with a contract with the main goal to provide a semantics for digital signatures. An alternative evidence can be a proof that the code satisfies the contract (and then one can use PCC techniques to check it [13] or the techniques used by Ghindici et al on smart-cards [5]). Once we have evidence that the contract is trustworthy, the platform checks that the contract is compliant with the policy that our platform wants to enforce. If it is, then the application can be run without further ado. At run-time the JRE firewall can simply check that only the declared API in the contract can be called. The matching steps guarantee that the resulting interactions would be correct. Security-by-Contract methodology proposed in [3,4] was created for mobile applications and did not take into account interactions among applications and illegal information flow problems. For the mobile platform there is no expectation that the platform owner will certify the absence of illegal information exchange between different applications. But multi-application smart card has different stakeholders, namely the owner of the platform, the owners of the applications and the user of the card. Now we enhance the S×C approach with information flow to deal with problems of sensitive data exchange of smart card applications. Another improvement of the S×C approach we suggest in this paper is enriching the contracts with “wishes”. Contract can contain not only exact behavior of the application, but also what behaviors application owner consider as possible. There might be a desire to interact with some application X not yet present on a platform or a wish to disallow some application Y to receive sensitive data through indirect interactions with some application Z. Another challenge we have to address is to find an appropriate language for specifying contracts (policies) describing possible (allowed) information exchange
Can We Support Applications’ Evolution in Multi-application Smart Cards?
225
among applications. To deal with computational limitations we propose a hierarchy of contracts/policies models for GP-based smart cards. The rationale is that each level of the hierarchy can be used to specify contracts and policies, but with different computational efforts and expressivity limitations. – L0: Application as Services. This level models applications as lists of required and available services. Essentially it is the current set-up of the GP. – L1: Allowed Control Flow. This level provides a call graph G1 (A) of the application, where vertices are the states of the application and edges represent invocations of different services. Then we can do a bit of historybased access control and more fine grained information exchange control. – L2: Allowed and Desired Control Flow. This level adds to the previous one the notions of correct and error states. It can be necessary if we want to test that removal of an application (or a change in the policy) does not break other applications. – L3: Full Information Flow. This level extends the previous one considering also the information flow among variables.
3
Contract and Policy as List of Services
At this level of abstraction we represent both contracts and policies by means of the services that application provides (to other applications) and of the services that application requires (from other applications). The list of available services can be comprised from the services with inherited Shareable Interface, the available services are called global services in the GP jargon. The list of required services can be made from the list of the OPEN getService calls [10]. Definition 1 (A rule). A security policy rule Rule is represented by the following four fields: Application Name and security domain (company or package) of the application, in the form name@domain. Shares(A) Set of applications with which the application A may interact. We use the notation A@D to denote a specific application A in the domain D, ∗@D to denote all the applications in the domain D, and ∗ to denote that A shares with any application of any domain. Provides(A) List of services provided by the application A. For the sake of simplicity this list contains only the names of the services, that is a service s.A@D is simply denoted with s. Requires(A) List of services required by the application A. Given an application A belonging to a security domain D (company or package) we denote a service s of A with s.A@D. Definition 2 (Contract). A contract of an application is a policy rule.
226
N. Dragoni, O. Gadyatskaya, and F. Massacci
Definition 3 (Security Policy). A security policy Policy of a smart card is a non-ordered set of different policy rules: = Rulej, i = j. Policy = {Rule1, . . . , Rulen }, where Rulei A contract of an application A matches a platform policy if there is no illegal information exchange between the application A and applications already on the card. We need therefore to define what is an illegal information exchange at this level of abstraction. We start introducing the notion of direct communication between applications. The idea is that A is able to directly communicate with B if B provides some services that A intends to use. Definition 4 (Direct Communication). Application A directly communicates with an application B, A → B, if Requires(A) ∩ Provides(B) = ∅. The notion of illegal information exchange is built on top of the notion of direct communication. The intuition is that there is a potential illegal information exchange if an application A directly communicates with another application B that may directly communicate to some other applications forbidden for A, i.e., with some applications that A is not allowed to directly communicate. We need therefore to capture the notions of allowed and forbidden information sharing between two communicating applications. Definition 5 (Allowed Information Sharing). Let A be an application directly communicating with B. We say that there is an allowed information sharing − → between A and B, denoted A ok B, if Shares(A) = Shares(B). Definition 6 (Forbidden Information Sharing). Let A be an application directly communicating with B. We say that there is a forbidden information → B, if Shares(A) = Shares(B). sharing between A and B, denoted A − no Definition 7 (Illegal Information Exchange). Given a contract ContractA of an application A and a platform policy Policy there is an illegal information exchange, denoted ContractA Policy, if there exist an application B described in Policy such that at least one of the following conditions is true: → B) – (A → B) ∧ (A − no − → – (B → A) ∧ (B no A) The notion of illegal information exchange is sufficient to address the problem P1 , the intuition is that when new application is loaded, its contract is checked against the platform policy in order to detect possible illegal information exchanges. We have an algorithm to perform this check, which is not presented in this paper due to lack of space.
4
Related Works and Conclusions
In [5] Ghindici et al. proposed a domain specific language for security policies describing the allowed information flow inside the card. Each application is
Can We Support Applications’ Evolution in Multi-application Smart Cards?
227
certified at loading time, having a information flow signature assigned to each method. Information flow in this framework is represented as relations between two method variables with annotations about the type of flow, for example, from secret to secret through a direct assignment. However these policies are too simple to capture the full scope of interesting policies. In [9,17] Huisman et al. presented a formal framework and a tool set for compositional verification of application interactions on a multi-application smart card. Their method is based on construction of maximal applets, w.r.t structural safety properties. To check that composition of two applets respects the behavioral safety property existing model checking techniques are used. In [6] Girard suggested to associate security levels to application attributes and methods using traditional Bell/La Padula model and the security policies in this model define authorized flows between levels. This approach was further investigated in [2] by Bieber et al. and the technique based on model checking for verification of actual information flows was presented there. The same approach was also used by Schellhorn et al. in [15] for their formal security model for operating systems of multi-application smart cards. In this paper we have proposed the security-by-contract (S×C) framework as a possible security model for multi-application smart cards. The S×C approach improves the current literature by addressing problems related to the dynamic evolution of both applications and policies. Moreover, it is based on a hierarchy of models that allow to have benefits in terms of computational complexity or language expressivity. In particular, the first level of the hierarchy requires algorithms not more complicated than the usual smart card applications, while the mentioned approaches are usually based on complicated logic and model checking, all needing off-card activities. We have shown how the S×C approach can be used to check the absence of illegal information flow during loading of new application at the first level of a proposed hierarchy. The key limitation of level L0 is that it does not capture the actual information exchange among the applications, but only the possible information exchange. In other words, we are not able to specify the concurrent behavior of an application, distinguishing for instance between the services that an application might need from the services that an application strongly requires. Another limitation of this level is the possibility of indirect communication between applications in current framework. Future work will be focused on two main issues: (1) developing all the levels of abstraction (starting from the limitations of Level 0) and (2) extending the security relevant actions of both contracts and policies in order to consider also rules restricting the use of resource APIs (connection to the Internet, EEPROM memory, ...). Further development of level L0 includes capturing indirect communications in the contracts and enhancing contracts with the notion of “wish”. Thus application providers will be able to declare in the contracts explicitly the exact behavior of the application extracted from the code and the desirable behavior of other applications on the platform concerning direct and indirect communications with their own application.
228
N. Dragoni, O. Gadyatskaya, and F. Massacci
References 1. Venyon banking services, http://www.venyon.com/banking 2. Bieber, P., Cazin, J., Wiels, V., Zanon, G., Girard, P., Lanet, J.-L.: Checking secure interactions of smart card applets: Extended version. J. of Comp. Sec. 10(4), 369– 398 (2002) 3. Desmet, L., Joosen, W., Massacci, F., Philippaerts, P., Piessens, F., Siahaan, I., Vanoverberghe, D.: Security-by-Contract on the .NET platform. Information Security Tech. Rep. 13(1), 25–32 (2008) 4. Dragoni, N., Massacci, F., Naliuka, K., Siahaan, I.: Security-by-Contract: towards a semantics for digital signatures on mobile code. In: L´ opez, J., Samarati, P., Ferrer, J.L. (eds.) EuroPKI 2007. LNCS, vol. 4582, pp. 297–312. Springer, Heidelberg (2007) 5. Ghindici, D., Simplot-Ryl, I.: On practical information flow policies for javaenabled multiapplication smart cards. In: Grimaud, G., Standaert, F.-X. (eds.) CARDIS 2008. LNCS, vol. 5189, pp. 32–47. Springer, Heidelberg (2008) 6. Girard, P.: Which security policy for multiplication smart cards? In: USENIX Workshop on Smartcard Technology. USENIX Association (1999) 7. Gong, L., Ellison, G., Dageforde, M.: Inside Java 2 platform security: architecture, API design, and implementation. Addison-Wesley, Reading (2003) 8. Hubbers, E., Oostdijk, M., Poll, E.: From finite state machines to provably correct java card applets. In: SEC 2003 (2003) 9. Huisman, M., Gurov, D., Sprenger, C., Chugunov, G.: Checking absence of illicit applet interactions: a case study. In: Wermelinger, M., Margaria-Steffen, T. (eds.) FASE 2004. LNCS, vol. 2984, pp. 84–98. Springer, Heidelberg (2004) 10. GlobalPlatform Inc. GlobalPlatform Card Specification, Version 2.2. Specification 2.2, GlobalPlatform Inc. (2006) 11. Sun Microsystems. Runtime Environment Specification. Java CardTM Platform, Version 3.0, Connected edition. Specification 3.0, Sun Microsystems (2008) 12. Mostowski, W., Poll, E.: Malicious code on java card smart cards: attacks and countermeasures. In: Grimaud, G., Standaert, F.-X. (eds.) CARDIS 2008. LNCS, vol. 5189, pp. 1–16. Springer, Heidelberg (2008) 13. Necula, G.C.: Proof-carrying code. In: Proc. of the 24th ACM SIGPLAN-SIGACT Symp. on Princ. of Prog. Lang, pp. 106–119. ACM Press, New York (1997) 14. Sabelfeld, A., Myers, A.C.: Language-based information flow security. IEEE Journal on Selected Areas in Communications 21(1), 5–19 (2003) 15. Schellhorn, G., Reif, W., Schairer, A., Karger, P., Austel, V., Toll, D.: Verification of a formal security model for multiapplicative smart cards. In: Cuppens, F., Deswarte, Y., Gollmann, D., Waidner, M. (eds.) ESORICS 2000. LNCS, vol. 1895, Springer, Heidelberg (2000) 16. Sekar, R., Venkatakrishnan, V.N., Basu, S., Bhatkar, S., DuVarney, D.C.: Modelcarrying code: a practical approach for safe execution of untrusted applications. In: Proc. of the 19th ACM Symp. on Operating Syst. Princ., pp. 15–28. ACM Press, New York (2003) 17. Sprenger, C., Gurov, D., Huisman, M.: Simulation logic, applets and compositional verification. Technical Report RR-4890, INRIA, 07 (2003) 18. Yee, B.S.: A sanctuary for mobile agents. In: Vitek, J., Jensen, C.D. (eds.) Secure Internet Programming. LNCS, vol. 1603, pp. 261–273. Springer, Heidelberg (1999)
Website Credential Storage and Two-Factor Web Authentication with a Java SIM Jonathan Hart, Konstantinos Markantonakis, and Keith Mayes Information Security Group, Smart Card Centre Royal Holloway University of London, Surrey, United Kingdom {jon.hart,k.markantonakis,k.mayes}@rhul.ac.uk
Abstract. In this paper two mobile website authentication schemes are proposed. The first enables authentication credentials (username and password) to be stored and retrieved securely from a mobile handset, and requires no changes to existing websites. The second scheme, which may optionally be used with the first, utilises a one-time password and is intended for applications requiring an enhanced level of authentication, e.g. financial services. Both authentication schemes use a Java SIM and ubiquitous mobile phone; with its familiar and convenient form factor and high user acceptance. Both schemes also provide protection against online phishing attacks. Keywords: Web authentication, credential storage, Java SIM, SIM toolkit, two-factor, passwords.
1
Introduction
In recent years there has been an exponential growth in the number of ecommerce services available, leading to a proliferation in the number of credentials that a user is expected to remember to access these services. Adams and Sasse [1] report that the average user can typically only use four or five unrelated passwords effectively, and this number falls if passwords are used infrequently. Sophos [2] in a recent survey found that a third of respondents admitted to reusing the same password on multiple websites. Users that reuse passwords on multiple sites may not realise that the security of a well protected account is only as good as that of the poorly-protected account. Blake Ives et. al [3] describe this as the domino effect. It is conceivable that a criminal could deliberately setup a malicious server specifically for the purpose of harvesting users’ credentials in an attempt to re-use those credentials on other websites. Financial institutions typically employ two-factor authentication to protect against key logging and phishing attacks, requiring a user to enter something they know (such as a username and password) and also something in their possession (such as a One-Time Password (OTP) from a hardware token or card reader). Hardware tokens and readers may however be inconvenient, especially if the user P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 229–236, 2010. c IFIP International Federation for Information Processing 2010
230
J. Hart, K. Markantonakis, and K. Mayes
has several accounts with different institutions; each requiring different hardware tokens or card readers. Two main issues with existing authentication systems have been identified: 1. the proliferation of passwords required for authentication to an ever increasing number of internet sites; and 2. the inconvenience of incompatible two-factor authentication tokens and card readers. In this paper we propose a convenient and secure solution to the above issues, using a mobile phone and Java SIM. The mobile phone is a familiar device which many people have within arms reach; this makes it attractive to use for authentication as the user is not burdened with additional hardware to carry around or learn to use. The loss or theft of a mobile phone is also likely to be reported more promptly than an authentication token. The SIM card is also a tamper resistant device which makes it an ideal candidate for the storage of authentication credentials and encryption keys. The SIM may also be transferred easily between handsets as required. Several existing authentication systems commonly in use today were reviewed, including password managers and two-factor OTP solutions. A number of issues with these systems were identified and the motivation set for developing the two authentication systems described in this paper. Due to page limits these are not discussed any further, however for an extensive discussion please see [4]. Related work includes the protocol described by Wu et. al [5]; in which no change is required to the web server; however credentials are stored on a potentially vulnerable third party proxy server. Gouda et. al [6] describe a method for using a single password with multiple websites, without each site having knowledge of the original password, and Mannan and Oorschot [7] propose a scheme for strengthening password authentication using a personal device. Both of these schemes however require significant changes to server infrastructure. Florncio et. al [8] propose a protocol that allows users OTP access to any web account without requiring any changes to the server. Here a user is required to trust a reverse-proxy server during the registration phase as the OTPs are based on their secret credentials. Management of multiple accounts may also be an issue with multiple sets of OTPs to manage.
2
The Proposed Authentication Schemes
The proposed authentication schemes assume that a user’s mobile number is associated with only one SIM card. The following design goals were considered: – Provide a scheme for storing web credentials on a SIM. – Provide a second more secure scheme for authenticating a user’s unique SIM. – Both schemes should be easy to operate and require either minimal or no changes to existing systems. – The design should be portable so that it can easily used from any PC, including for example in an Internet Caf´e, without requiring any special hardware.
Website Credential Storage and Two-Factor Web Authentication
2.1
231
The Entities Involved
Each of the entities in the system is now described, with reference to Fig. 1. OTP authentication messages (HTTPS)
MO-SMS MT-SMS
GSM 03.48 Secure SMS
tials den cre onse n p io t s tica nd re ) a hen S Aut quest HTTP ( re
Mobile Phone (MP) and SIM with SAT applet installed
SMS Gateway Server (SMSGS)
Auth requests (HTTPS)
Web traffic (HTTPS)
Web Server (WS) Authentication Server (AS) (Only required for OTP authentication)
Client Web Browser and Web Browser Extension (WBE) User
Service provider/network operator
Internet
Fig. 1. System Architecture
SIM Application Toolkit (SAT) Applet. We have developed a Java SIM SAT [9,10,11] applet which executes on the users SIM card. The applet provides the credential storage and authentication services for the two authentication schemes proposed. Mobile Phone (MP). The MP consists of a SIM toolkit capable handset with SMS capability and a SIM pre-loaded with the SAT applet. No software is installed on the mobile phone. Web Browser Extension (WBE). A WBE integrates into the web browser environment to extend the functionality of the browser [4]. The WBE is a required entity in the first authentication scheme. The main function of the WBE is to enable the credentials stored by the SAT applet to be retrieved from the SIM and entered into a web page logon form with minimal user interaction. SMS Gateway Server (SMSGS). The SMSGS role is to translate mobile network SMS messages to and from the SAT applet to HTTPS commands that are sent and received over a TCP/IP based network to the WBE and AS entities. SMS messages are sent using the GSM 03.48 secure SMS format [12,13]. Authentication Server (AS). In the two-factor OTP based authentication scheme third party institutions are required to operate an AS. The AS shares an institution generated subscriber specific secret key with each subscribers SAT applet. The institution AS and SAT applet are the only two entities that share this secret. Web Server (WS). The WS serves a user’s chosen content in response to a request from a user’s web browser, typically this will be over HTTPS for a
232
J. Hart, K. Markantonakis, and K. Mayes
secure website. In the case of the two-factor authentication scheme, the WS has a back-end connection to the AS which provides two-factor authentication for specific web pages or transactions. 2.2
Protocol Details
The proposed authentication schemes are now discussed with reference to the notation summarised in Table 1. Table 1. Notations, Keys and Algorithms used in protocol descriptions Notation Y Z X →Y :C X→Y →Z:C
Description Concatenation of the data items Y and Z in that order The entity X sends the entity Y a message with contents C The entity X sends the entity Z a message with contents C, via entity Y h(Z) Is the result of a collision resistant hash function such as SHA-2 applied to data string Z EK (Z) Is the result of encryption of the data string Z with a symmetric algorithm such as AES or 3DES using key K PK X (Z) Is the result of encryption of data string Z with a public key algorithm such as RSA and key X MAC X (Z) Is the result of a keyed MAC of the string Z, with key X X-RAND Is a random number generated by entity X X-PUB Represents entity’s X public encryption key X-PRIV Represents entity’s X private encryption key X-SYM Represents entity’s X symmetric encryption key X-SEED Represents a seed value for entity’s X one way hash function X-IDENTITY A string representing entity’s X identity AUTH Is the users authentication key CRED-UID The web authentication credential username CRED-PWD The web authentication credential password
Authentication Scheme 1 - Web Credential storage on SIM. In the first authentication scheme a user’s website credentials are stored on the user’s SIM card. The credentials are requested on-demand when the user visits a website requiring authentication. 1. The protocol starts with a one off-initialisation step that sets up authentication and encryption keys for the remainder of the protocol. The user installs the WBE on a host PC and chooses a username U and passphrase P, from which an authentication hash AUTH and symmetric key WBE-SYM are created in volatile memory: WBE-SYM = h(P U ) and AUTH = h(WBE-SYM) The above hashes are created using a collision resistant hash function such as SHA 256, in line with Ecrypt [14] recommend key lengths. WBE-SYM is
Website Credential Storage and Two-Factor Web Authentication
233
the symmetric key used by the SAT applet to send credentials to the WBE. AUTH is used to identify the user to the SMSGS. A message is then sent to the SMSGS to associated the username U with mobile number N in the SMSGS internal database: WBE → SMSGS: (U ||AU T H||N )
(1.1)
In response to the receipt of message (1.1) the SMSGS stores a permanent user identity record in its database and sends a message to the SAT applet identified by mobile number N requesting the applet sends the WBE its RSA public key: SMSGS → SAT: (PublicKeyRequest) (1.2) The SAT applet responds to message (1.2) with the applets RSA public key SAT-PUB and forwards this via the SMSGS to the WBE: SAT → SMSGS → WBE: (SAT-PUB )
(1.3)
The WBE responds with the WBE-SYM symmetric key, enciphered under the SAT applets RSA key, via the SMSGS gateway: WBE → SMSGS → SAT: PKSAT-PUB (WBE-SYM )
(1.4)
Message (1.4) completes the initialisation phase. To recap, at the end of this phase a user account has been created on the SMSGS and has been associated with the user’s mobile number. A symmetric key has also been exchanged between the WBE and SAT applet. The initialisation phase is only carried out when the WBE passphrase is initially set or changed. 2. Following initialisation the WBE may request a user’s credentials from the SAT applet, by supplying the username U, authentication hash AUTH (derived from passphrase P ; as before) and the website hostname S to the SMSGS: WBE → SMSGS: (UAUTHS ) (1.5) SMSGS → SAT: (GetCredentialS )
(1.6)
On receipt of message (1.6) the SAT applet checks the internal credential store and following confirmation by the user entering their PIN, responds with the user’s website credential username CRED UID and password CRED PWD. If no credentials are currently stored the user is given the opportunity to enter them. The credentials are then enciphered with the previously exchanged symmetric key WBE-SYM and sent to the WBE: SAT → SMSGS → WBE: EWBE-SYM (CRED UIDCRED PWD )
(1.7)
On receipt of message (1.7) the WBE deciphers the credentials received using the pre-shared symmetric key, and enters them into the web page logon form. This completes the protocol run.
234
J. Hart, K. Markantonakis, and K. Mayes
Authentication Scheme 2 - Two-factor OTP authentication. For the two-factor authentication scheme a OTP is generated by the SAT in response to a random challenge from the AS. 1. The protocol starts with a one off-initialisation step that sends the AS OTP seeding key to the SAT applet. The seeding key is enciphered under the SAT applets public RSA key, which is obtained using messages (1.1 - 1.3) above, substituting the AS for the WBE entity (not shown), the seeding key AS-SEED is then sent to the SAT applet along with the AS’s identity AS-IDENTITY : AS → SMSGS → SAT: PKSAT-PUB (AS-IDENTITYAS-SEED )
(2.1)
The SAT applet stores the AS’s identity AS-IDENTITY and seeding key AS-SEED, after confirming this action with the user. 2. Following the one off-initialisation above, the AS may then authenticate a user and SIM when requested by the WS (for example to login to a web page, or approve a transaction). The authentication request message from the AS to the SAT takes the following form: AS → SMSGS → SAT: PKSAT-PUB (AS-IDENTITYAS-RAND )
(2.2)
Where AS-RAND is a random number from a good and unpredictable source of randomness. 3. The SAT applet decrypts message (2.2) using its private RSA key and if a seed value has been previously stored for the AS with identity ASIDENTITY then asks the user to enter their PIN to confirm the authentication. If confirmed the SAT applet generates a response to the challenge AS-RAND, using a keyed MAC function: SAT → SMSGS → AS: MACAS-SEED (AS-RAND )
(2.3)
The AS receives message (2.3) and compares it with the locally generated expected response. If the SAT applet response matches the expected response the user and SIM are authenticated, otherwise authentication fails. This marks the end of the protocol run.
3
Practical Implementation
To test the proposed authentication schemes we carried out a proof of concept practical implementation. This involved developing a SAT applet, SMSGS and WBE. The SAT applet was loaded onto a test card and real-time tests performed against live websites for the SIM credential storage scheme. The two-factor OTP based authentication scheme was validated using the SAT development environment simulator [15] due to restrictions on the test card crypto functionality. The practical implementation is discussed in detail in [4].
Website Credential Storage and Two-Factor Web Authentication
4
235
Security Analysis
RSA public key cryptography is used for both the authentication schemes to exchange symmetric keys that are used later on in the protocol; the security of these keys is therefore reliant on a sufficiently strong RSA key length and secrecy of the RSA private key. The RSA private key is generated internally within the SIM and no external method is provided to retrieve the private key. Key lengths should be chosen to provide an adequate level of protection as recommended by Ecrypt [14]. Public Key Infrastructure (PKI) is not implemented to verify the authenticity of the public RSA keys from the SIM. As the key pair is generated by the SIM and tied to the host SIM mobile number we felt that this provided a reasonable level of assurance within this closed system. Web authentication credentials are encrypted before they leave the SIM applet with the symmetric key of the destination entity. This provides end-end encryption and protection of the credentials should the SMSGS be compromised. To guard against eavesdropping, man-in-the-middle and relay attacks, GSM 03.48 is used for secure SMS transport and the HTTPS between WBE, AS and SMSGS. HTTPS protects the integrity of the messages and also provides assurance that the SMSGS is genuine from the WBE side as the SMSGS SSL certificate is validated against a third party CA certificate during the initial HTTPS handshake. As the WBE does not operate in a secure environment it may be possible for another web browser extension or screen scraper to get access to sensitive information (such as the login credentials or WBE passphrase), however the same risks apply when entering the credentials by hand into the browser. In the OTP authentication design each AS shares a user specific individual secret key with the SIM only. As a result, even if an AS in the system were compromised only the keys owned by that AS would be vulnerable. Both authentication methods implement a PIN lockout function (after three incorrect PIN attempts) in the SAT applet to prevent an exhaustive PIN search should the handset be lost or stolen.
5
Conclusions and Future Work
In this paper two authentication schemes using a Java SIM have been demonstrated. The first scheme does not require modifications to existing websites and reduces the risk of password re-use as a user no longer needs to remember their credentials for individual websites and can choose a more secure or randomly generated password. In fact the SAT applet functionality could be extended to generate random passwords, removing the risk of a user choosing a poor password. The authentication scheme also provides a degree of protection from phishing attacks; as a user inadvertently visiting a phishing site will not have their credentials stored for that site on the SIM. It is acknowledged that as the scheme uses existing form based password authentication this may not provide the level of security required by certain institutions. The second authentication scheme provides an enhanced level of authentication as the user’s SIM is authenticated in real-time using a random challenge
236
J. Hart, K. Markantonakis, and K. Mayes
generated by the authenticating parties AS. A single SIM could therefore replace the multiple and often incompatible OTP tokens and card readers. A challenge to a wider scale implementation of the proposed schemes is the network operator’s ownership and control of the SIM. A possible solution to this would be to implement a hybrid solution, using a lightweight SAT applet to provide credential storage (provided and installed by the network operator) and a MIDP Java applet that executes on the mobile handset using JSR177 API extensions to interface to the lightweight SAT applet. Care would however need to be exercised to ensure that code and data stored on the mobile handset was not vulnerable to attack.
References 1. Adams, A., Sasse, M.A.: Users are not the enemy. Commun. ACM 42(12), 40–46 (1999) 2. Sophos: at risk as one third of surfers admit they use the same password for all websites, http://www.sophos.com/pressoffice/news/articles/2009/03/ password-security.html 3. Ives, B., Walsh, K.R., Schneider, H.: The domino effect of password reuse. Commun. ACM 47(4), 75–78 (2004) 4. Hart, J., Markantonakis, K., Mayes, K.: Website credential storage and two-factor web authentication with a Java SIM. Cryptology ePrint Archive, Report 2010 (2010) 5. Wu, M., Garfinkel, S., Miller, R.: Secure web authentication with mobile phones. In: DIMACS Workshop on Usable Privacy and Security Software (2004) 6. Gouda, M.G., Liu, A.X., Leung, L.M., Alam, M.A.: SPP: An anti-phishing single password protocol. Comput. Netw. 51(13), 3715–3726 (2007) 7. Mannan, M., van Oorschot, P.C.: Using a personal device to strengthen password authentication from an untrusted computer. In: Financial Cryptography, pp. 88– 103 (2007) 8. Florˆencio, D., Herley, C.: One-time password access to any server without changing the server. In: Wu, T.-C., Lei, C.-L., Rijmen, V., Lee, D.-T. (eds.) ISC 2008. LNCS, vol. 5222, pp. 401–420. Springer, Heidelberg (2008) 9. 3GPP: Specification of the SIM Application Toolkit (SAT) for the Subscriber Identity Module - Mobile Equipment (SIM-ME) interface. TS 11.14, 3rd Generation Partnership Project (3GPP) (2007) 10. 3GPP: Subscriber Identity Module Application Programming Interface (SIM API) for Java Card. TS 03.19, 3rd Generation Partnership Project (3GPP) (2002) 11. 3GPP (U)SIM Application Programming Interface (API); (U)SIM API for Java Card. TS 31.130, 3rd Generation Partnership Project (3GPP) (2009) 12. Guthery, S.B., Cronin, M.: Mobile Application Development with SMS and the SIM Toolkit. McGraw-Hill Professional, New York (2001) 13. 3GPP: Security mechanisms for SIM application toolkit; Stage 2. TS 03.48, 3rd Generation Partnership Project (3GPP) (2005) 14. Ecrypt II: (Report on key sizes), http://www.keylength.com/en/3/ 15. Gemalto NV: (Gemalto Developer Suite), http://www.gemalto.com
Attribute-Based Encryption with Break-Glass Achim D. Brucker1, Helmut Petritsch1 , and Stefan G. Weber2 1
2
Research, Vincenz-Priessnitz-Str. 1, 76131 Karlsruhe, Germany {achim.brucker,helmut.petritsch}@sap.com Telecooperation Group, Technische Universität Darmstadt, Hochschulstrasse 10, 64289 Darmstadt, Germany
[email protected] SAP
Abstract. Attribute-based Encryption (ABE) allows for implementing fine-grained decentralized access control based on properties or attributes a user has. Thus, there is no need for writing detailed, user-based policies in advance. This makes ABE in particular interesting for implementing security mechanisms in dynamic environments such as ubiquitous computing, disaster management, or health-care. For supporting the latter two application areas, common ABE approaches lack one important feature: break-glass, i. e., the controlled overriding of access control restrictions. In this paper we present an integration of break-glass into an approach for end-to-end secure information sharing using ABE techniques. Keywords: Access control, break-glass, attribute-based encryption, disaster management, trusted computing platform.
1
Introduction
The distribution and availability of digital information in every-day’s life and work brings along new opportunities for providing situation-dependent support to the individual. This ubiquity of information also creates new challenges in protecting both the provided information and the privacy of its users. Access control mechanism should allow the fine-grained specification of access control policies and protect the users privacy. Additionally, in several application domains, mechanisms for the controlled override of access restrictions need to be supported. Recently introduced, Attribute-based Encryption (ABE) techniques [2, 13, 14] have drawn attention for realizing decentralized access control in large and dynamic networks and ubiquitous computing environments [8, 15, 16]. By allowing to implement an efficient targeted broadcast encryption, ABE provides means for designing flexible and scalable access control systems, without the need of administrating large access control policies. Moreover, this approach allows for a decentralized enforcement of access control policies by cryptographically binding the policies to data objects. This makes ABE especially attractive in dynamic environments such as gridcomputing, disaster management, or the health-care area. Albeit, for the latter P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 237–244, 2010. c IFIP International Federation for Information Processing 2010
238
A.D. Brucker, H. Petritsch, and S.G. Weber
two areas, ABE creates particular challenges for providing one important feature: break-glass, i. e., the traceable, ad-hoc override of access control policies. Traditionally, break-glass access control systems are implemented in systems using user-based access control policies and (centralized) policy decisions points. In this paper, we present an integration of fine-grained break-glass concepts into a system for end-to-end secure information sharing based on ABE. In more detail, our contributions are an ABE security infrastructure for ubiquitous data sharing applications supporting: 1. an ABE scheme with multi-leveled breakglass access control and 2. secure logging that allows for analyzing the actions of users done during break-glass access rights in particular. The rest of the paper is structured as follows: after introducing the scenario and requirements in Sect. 2, we present preliminaries of our work in Sect. 3. In Sect. 4, we detail concepts building the foundation for the implementing architecture presented in Sect. 5. Sect. 6 and Sect. 7 conclude our work.
2
Scenario and Requirements
Our integration of break-glass into ABE is motivated by the rise of distributed disaster management information systems (DMISs), i. e., systems supporting crises management teams. For the operational headquarters, we assume that each of them is supported by a DMIS providing support for maintaining the current situation, planing, and simulation. Moreover, DMISs provide means for the efficient and secure communication within an operational headquarter and to the outside. The latter includes the communication between several operational headquarters (e. g., see [3]) and the communication with the forces in the field using mobile devices. For the field forces, we assume that they are equipped with mobile communication devices, i. e., smart-phones that provide a digital communication channel between the field forces and the operational headquarters. In the following, we focus on broadcast-based communication between the operational headquarters and the field forces. In particular, we do not assume a communication infrastructure providing confidential point-to-point channels. Instead, confidentiality of broadcasted messages is guaranteed by means of ABE, implementing an application level end-to-end encryption. Let us assume that in an emergency situation, a firefighter decides to override the access control that prevents him from reading the communication between the police officers and the police headquarter. Of course, such overrides need to be made on case by case basis. Thus, the firefighter needs to be able to decide if a certain message addressed to the police is valuable for him or not. Moreover, overrides needs to be logged for post-hoc audits. To allow the efficient and traceable break-glass access, we require that the mobile devices can store a sensible amount of messages (e. g., all messages sent in the last 30 minutes), messages are classified in a format readable even if the message is, due to access restrictions, not readable, and overrides of access control restrictions and all action taken on information obtained by overriding access control restrictions are logged immutably.
Attribute-Based Encryption with Break-Glass
3 3.1
239
Technical Background Attribute-Based Encryption
Attribute-based Encryption (ABE) [2, 14] is a public key cryptography primitive generalizing Identity-based Encryption (IBE) [7]: while in IBE, a single receiver of a confidential message is described by a single string associated with his identity, in Attribute-based Encryption (ABE) a group of receivers is described by a combination of several descriptive attributes, which is also called an attribute policy. Therefore, each user is associated with a set of person-related attributes such as job description and status, and receives related private keys analogues as well. Especially, in the cryptographic operations, attributes directly map to a users’ credential, i. e., the attributes present components of the private key. In current ABE implementations, the policy itself is cryptographically bound to the data object, but can still be read by any receiver [13]. Moreover, using ABE, a sender does not know the public keys of the recipients. Thus, messages can be encrypted before any receiver must own the required decryption keys. Albeit, a trusted third party, called attribute authority, must be able to produce any possible private key. In [15], we show that ABE allows for building a security architecture for secure data sharing, also suitable for emergency management applications, i. e., it can be used to implement an end-to-end encryption allowing operational headquarters to target dynamic groups of first responders. Albeit, the so far proposed concept lacks support for a controlled override of access restrictions in emergency cases. 3.2
Break-Glass
Introduced in [1], break-glass refers to quick means for extending a person’s access rights in exceptional cases. Of course, the usage of exceptional access rights needs to be documented for later audits and reviews. Usually, break-glass solutions are based on authenticating the user and, therefore, are not directly applicable to ABE-based access control system. Based on our break-glass approach presented in [4], we assume an access control policy p based on an access control model A. A policy maps access control relevant information, e. g., subjects, resources, and actions on resources to an access control decision. A policy p refines a policy p (written p p ) if and only if p is at least as restrictive as p . We write p for the policy that allows all actions and p⊥ for the policy that allows no action. The relation _ _ defines a partial order on a set of policies. Consequently, (PA , , p⊥ , p ) is a lattice, where PA be the set of all policies of the access control model A. During normal operations, the regular policy preg is put into place; we call the set = preg } of policies that are refined by the regular LA = {p | p ∈ PA ∧ preg p ∧ p policy, emergency policies of the policy preg and require (PA \ p⊥ , , preg , p ) to be a lattice. At runtime, policies can be active or inactive, whereas only active emergency policies, denoted as Lact A ⊆ LA , contribute to the access control decision. An access evaluating to “deny” regarding the regular policy, but granted by an active emergency policy p ∈ LA is called override access.
240
4
A.D. Brucker, H. Petritsch, and S.G. Weber
Integrating Break-Glass Access Control and ABE
For encoding a lattice of (emergency) policies in ABE, we use a hierarchy of emergency attributes (a ∈ A). While emergency attributes are technically similar to regular attributes, their usage implies further obligations: first, every use of an emergency attribute requires user confirmation and, second, all access based on the use of emergency attributes needs to be logged for later audit. To each emergency policy pj , we assign an emergency attribute ai representing the length of the shortest path (with respect to _ _) from the regular policy preg to pj . The length of the shortest override path provides a measurement of the severity of an override, i. e., an access requiring a “high” emergency attribute is more critical than one requiring a “low” emergency attributes. Of course, if several override attributes allow for accessing a specific resource, the lowest one (i. e., the one with the shortest path) should be chosen. We assume that the different emergency organization agreed on using a common subset (i. e., a sub-lattice) of emergency attributes. Still, this does not result in a sharing of emergency attributes, e. g., let AF (AP ) be the set of emergency attributes of the fire brigade (police) then AF ∩ AP = ∅ holds. We denote the emergency attribute ai representing polices that have a minimal distance of i to the regular policy with aiF ∈ AF (aiP ∈ AP ) for the fire brigade (police). Let us consider a situation in which firefighters should be able to access the status messages of the preg P police by overriding the regular access control. In more detail, status updates should be accessible to a1
p1F
p1P
1. police officers-in-charge (i. e., with regular access): preg P = (policeP ∧ officer-in-chargeP ) p2F 2. every police member under a low emergency at- a2 tribute: p1P = (policeP ), 3. every officer-in-charge of the fire brigade under p a∞ a low emergency attribute: p1F = (firebrigadeF ∧ officer-in-chargeF ), and 4. every member of the fire brigade under a high Fig. 1. A simple emergency attribute hierarchy emergency attribute: p2F = (firebrigadeF ). Fig. 1 illustrates the resulting hierarchy of emergency attributes. To support this scenario we derive the following ABE break-glass policy: → 1 − → 1 → 2 1 − 1 − 2 (preg P ) ∨ (aP ∧ pP ) ∨ (aF ∧ pF ) ∨ (aF ∧ pF ) police
fire brigade
Notably, the first part of the policy can only be decrypted by the police and the second part can only be decrypted by the fire brigade (to avoid a global key escrow, we require separate attribute authorities for each organization). Here, → − _ ∨ _ denotes a disjunction with lazy (also called short-circuit) evaluation semantics, i. e., if the left hand side already grants access, the right hand side is
Attribute-Based Encryption with Break-Glass
241
ignored. This semantics allows that the regular policy has a higher precedence than any other policy and that policies under a lower emergency attribute have a higher precedence that policies under a higher emergency attribute. The information exchange over organizational boundaries (i. e., between separate attribute authorities) requires an understanding of the semantics of the attributes between organization. Of course, only the set of attributes that should be used in shared policies needs to be exchanged. Within the DMIS foreign attributes can be grouped into virtual attributes (similar to e-mail aliases); this allows for maintaining an easy to use interface while, internally, mapping different organizational structures. For supporting the activation and deactivation of emergency attributes by a central authority, there are mainly two different approaches: 1. the status of all emergency attributes is broadcasted to and enforced by clients, i. e., messages are encrypted with all emergency attributes. 2. only emergency attributes active during encryption are used. The first approach requires a high trustworthiness of the clients, e. g., by manipulating status updates a device could be forced to continue to use a high attribute. The second approach cannot prohibit the usage of an inactive emergency attribute, if this emergency attribute has been active during encryption. Thus, we propose a combination of these two approaches: i. e., decryption is only possible if the required emergency attribute is active during both encryption and decryption. First, this gives the information provider maximal control over his data. Second, for access over organizational boundaries, the information receiving organization can restrict the use of foreign information. Messages sent to clients are self-contained, i. e., the user has to decide on a per message basis, if a message is relevant or not. For this decision the user requires some information about the information contained in the message. Such a classification may be sensitive itself (e. g., it may allow to infer secrets from the frequency of some type of message), so it has to be protected too. Thus, a message which allows override access consists of two parts: the inner part containing the message, encrypted with the regular policy and the emergency policies and the outer part containing some classification information about the message, whereas this classification can be protected by another policy. The outer policy must be less restrictive than the inner policy, i. e., users permitted to decrypt the inner part must be permitted to decrypt the outer part.
5
Security Infrastructure
Our approach for supporting ABE with break-glass on mobile devices requires a trusted software stack, which provides secure storage and logging functionalities. Such a trusted software stack can be provided by using a standard hardware component called Trusted Platform Module (TPM) (see Fig. 2). In particular, we rely on the root of trust for storage (RTS) and the root of trust for reporting (RTR), which both can be provided by a TPM.
242
A.D. Brucker, H. Petritsch, and S.G. Weber
Secure SW Stack Key Blob
TPM Module
Internal Storage
User Interface
In a registration phase, every Break-glass Regular member of the field forces receives Message Selection Message Handling a personal device containing the private keys representing the members attributes. After activation of Message Cache such a personal device, e. g., by entering a PIN, the device allows for decrypting messages under the Secure Channels (Input/Outoput) regular policy and the active emergency levels. Received messages are stored in their encrypted form, Secure Secure Emergency which allows to store them on a Key Logging Key Store Attributes Store non-secured area. The trusted base of the mobile device provides a secure stor- Fig. 2. Overview of the Security Infrastructure age compartment inside the TPM. However, the TPM can also protect larger amounts of stored data, i. e., the private keys for the attributes of the user, the status of current active emergency attributes, and the logs of break-glass accesses. Hereby, only the keys used for storage encryption remain in the TPM, while encrypted key blobs are stored outside the TPM. The TPM allows to provide a secure software stack, i. e., an isolated computing environment which runs on the mobile device. The module verifies that only certified applications access to certain, e. g., security critical, areas of the mobile device. As such, it guards the execution of critical steps, e. g., all steps relating to keys that shall only be available under additional obligations. The secure software stack allows to implement secure channels. In case of a break-glass access, the following functional steps are executed on the device: 1. Display of Policies: The classification of the message is displayed to the user. 2. Selection of Message: Based on the classification, the user selects a message. Hereby, he confirms the break-glass action on the chosen single message. 3. Granting Access: After evaluating the current emergency level, a copy of the required emergency attribute is released to the secure software stack. 4. Retrieval of regular Keys: Also, the regularly available attributes are transferred to the secure computing environment. 5. Decryption and Deletion: Regular attributes and emergency attributes are used for decrypting the selected message. Afterwards, the copies of the attributes are deleted. 6. Logging and Display of Content: The break-glass access is logged, i. e., an entry containing policy, time and emergency level is signed with the private key of the TPM and added to the log. Finally, the content of the decrypted message is displayed to the user. This mechanism guarantees that in case of a break-glass access, first, the user has to confirm the override, second, only active emergency levels are used for a single decryption and, third, the emergency access is logged to a secure memory storage. As mobile devices can be physically manipulated, log entries stored on the device are synchronized with the central storage during online phases or when the operation is finished and the device is returned to the operational center.
Attribute-Based Encryption with Break-Glass
6
243
Related Work
Our work extends previous work on ABE [2, 13, 14] (in particular CP-ABE [2]) and break-glass access control [1, 4, 5] (in particular [4]). In contrast to [6], our break-glass solution allows for the secure and traceable overruling of access control of mobile devices without the need of an online validation. Research on disaster management information systems spans from high-level organizational views up to questions of how field forces can be supported by “mobile response devices” [10], whereas questions from collaboration of organizations, visualization and decision-making are examined [12]. It is often scenariooriented, e. g., Johnson [9] draws conclusions from a flooding in uk in 2007 and points out, among others, a need for a better collaboration of organizations. Only a few works in the disaster management domain explicitly consider security issues; in [15], we propose an ABE-based security architecture for sharing sensitive data in emergency management applications. Tailored to a different application context, Huang and Verma [8] present an ABE-based framework for establishing secure communications and enforcing access control policies within vehicular ad hoc networks. Yu et al. [16] use ABE for enforcing fine-grained access control policies in wireless sensor networks. Although these works are similar to ours, they lack mechanisms for break-glass. Levin et al. [11] present an architecture for managing emergency information for first responders. Their assumptions about the environment are similar to ours, but their approach requires additional special hardware and does not support multiple emergency levels.
7
Conclusion
Securely providing the right information at the right time is a highly challenging, but important task. Based on practical experiences we introduced a realistic scenario in the emergency management domain. Here, an individual field force may need immediate access to certain information to save lives and property. Our experiences show that modern cryptographic techniques are important building blocks for realizing security and access control mechanisms in large scale decentralized systems and ubiquitous computing environments. However, to design a secure system, it is important to carefully integrate cryptographic mechanisms with further security concepts. In this paper, we have shown how ABE, which is among others appropriate for flexible, fast changing environments, can be combined with break-glass solutions which provide support for systems, where policies may be overridden in case of an emergency. Such systems are especially relevant for first response teams as fire brigades or for more static applications scenarios like health information on a chip-card, where sensitive information has to be protected but be accessible in emergency situations to save a patients life. Acknowledgments. This work has been supported by the German “Federal Ministry of Education and Research” in the context of the project “ SoKNOS” and by cased (www.cased.de).
244
A.D. Brucker, H. Petritsch, and S.G. Weber
References [1] Break-glass: An approach to granting emergency access to healthcare systems. White paper, Joint NEMA/COCIR/JIRA Security and Privacy Committee (2004) [2] Bethencourt, J., Sahai, A., Waters, B.: Ciphertext-policy attribute-based encryption. In: IEEE Symposium on Security and Privacy, pp. 321–334. IEEE Computer Society Press, Los Alamitos (2007) [3] Brucker, A.D., Hutter, D.: Information flow in disaster management systems. In: International Conference on Availability, Reliability and Security (ares), IEEE Computer Society Press, Los Alamitos (2010) [4] Brucker, A.D., Petritsch, H.: Extending access control models with break-glass. In: Carminati, B., Joshi, J. (eds.) ACM symposium on access control models and technologies (sacmat), pp. 197–206. ACM Press, New York (2009) [5] Ferreira, A., Cruz-Correia, R., Antunes, L., Farinha, P., Oliveira-Palhares, E., Chadwick, D., Costa-Pereira, A.: How to break access control in a controlled manner. In: IEEE International Symposium on Computer-Based Medical Systems (cbms), pp. 847–854 (2006) [6] Gardner, R.W., Garera, S., Pagano, M.W., Green, M., Rubin, A.D.: Securing medical records on smart phones. In: ACM workshop on Security and privacy in medical and home-care systems (spimacs), pp. 31–40. ACM Press, New York (2009) [7] Gentry, C.: IBE (Identity-Based Encryption). In: Handbook of Information Security, vol. 2, pp. 575–592. John Wiley & Sons, Chichester (2006) [8] Huang, D., Verma, M.: aspe: attribute-based secure policy enforcement in vehicular ad hoc networks. Ad Hoc Networks 7(8), 1526–1535 (2009) [9] Johnson, C.W.: Complexity, structured chaos and the importance of information management for mobile computing in the uk floods of 2007. In: [12], pp. 1–11 (2007) [10] Lachner, J., Hellwagner, H.: Information and communication systems for mobile emergency response. In: Kaschek, R., Kop, C., Steinberger, C., Fliedl, G. (eds.) Information Systems and e-Business Technologies (uniscon). LNBIP, vol. 5, pp. 213–224. Springer, Heidelberg (1974) [11] Levin, T.E., Dwoskin, J.S., Bhaskara, G., Nguyen, T.D., Clark, P.C., Lee, R.B., Irvine, C.E., Benzel, T.: Securing the dissemination of emergency response data with an integrated hardware-software architecture. In: Chen, L., Mitchell, C.J., Martin, A. (eds.) Trust 2009. LNCS, vol. 5471, pp. 133–152. Springer, Heidelberg (2009) [12] Löffler, J., Klann, M. (eds.): Mobile Information Technology for Emergency Response (MobileResponse). LNCS, vol. 5424. Springer, Heidelberg (2009) [13] Pirretti, M., Traynor, P., McDaniel, P., Waters, B.: Secure attribute-based systems. In: ACM conference on Computer and communications security (ccs), pp. 99–112. ACM Press, New York (2006) [14] Sahai, A., Waters, B.: Fuzzy identity-based encryption. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 457–473. Springer, Heidelberg (2005) [15] Weber, S.G.: Securing first response coordination with dynamic attribute-based encryption. In: World Congress on Privacy, Security, Trust and the Management of e-Business (congress), pp. 58–69. IEEE Computer Society Press, Los Alamitos (2009) [16] Yu, S., Ren, K., Lou, W.: FDAC: Toward fine-grained distributed data access control in wireless sensor networks. In: IEEE Conference on Computer Communications (infocom). IEEE Computer Society Press, Los Alamitos (2009)
On the Security of a Two-Factor Authentication Scheme Luigi Catuogno1 and Clemente Galdi2 1
Dipartimento di Informatica ed Applicazioni, Universit` a di Salerno Via Ponte Don Melillo, I-84084 Fisciano (SA), Italy
[email protected] 2 Dipartimento di Scienze Fisiche, Universit` a di Napoli “Federico II” Compl. Univ. Monte S.Angelo, Via Cinthia, I-80126 Napoli (NA), Italy
[email protected] Abstract. In this paper we evaluate the security of a two-factor Graphical Password scheme proposed in [1]. As in the original paper, we model the attack of a passive adversary as a boolean formula whose truth assignment corresponds to the user secret. We show that there exist a small number of secrets that a passive adversary cannot extract, independently from the amount information she manages to eavesdrop. We then experimentally evaluate the security of the scheme. Our tests show that the number of sessions the adversary needs to gather in order to be able to extract the users secret is relatively small. However, the amount of time needed to actually extract the user secret from the collected information grows exponentially in the system parameters, making the secret extraction unfeasible. Finally we observe that the graphical password scheme can be easily restated in as a device-device authentication mechanism.
1
Introduction
In a Graphical Password scheme, a remote system authenticates a user by means of a challenge/response scheme in which the system poses the challenge as “something” depicted on the terminal screen. This challenge can be answered correctly by the legitimate user who knows a certain secret. The user “computes” the response as the output of a cognitive function that takes as inputs the secret and what she sees on the terminal. Existing schemes vary according to (a) the way in which secrets and challenges are represented, (b) the cognitive function definition and (c) how the user sends back the response (e.g., by typing some numbers on a keypad, by clicking on some areas of an image etc.) The main threat to Graphical Password Schemes is known as shoulder surfing attack. In this attack an adversary observes “over the user’s shoulders” whatever appears on the screen and everything she does during the authentication session, and collects any information useful to extract the user secret. Since early
This work was partially supported by the European Union under IST FET Small/medium-scale focused research project FRONTS (Contract n. 215270).
P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 245–252, 2010. c IFIP International Federation for Information Processing 2010
246
L. Catuogno and C. Galdi
schemes’ main objective was ergonomy, most of the existing Graphical Password schemes do not implement any effective countermeasures against a malicious observer, who, in some case, could learn the user secret just observing a single or few authentication sessions. We refer the reader to [2] for a survey on the topic. Notice that “shoulder surfing” in human authentication protocols corresponds to the classical “passive eavesdropping” attack. The authors in [1] presented a Graphical Password scheme that, under some assumptions, can be used as a two factor authentication scheme. In the same paper the authors present an attack based on Formula Satisfiability (SAT, for short) as earlier proposed in [3]. This attack expresses the information the adversary can obtain, by observing the communication between the user and the system, as a boolean formula whose truth assignment corresponds to the user secret. As in the original paper, we assume the adversary to be a passive eavesdropper. We assume that a sequence of three unsuccessful authentications leads to the block of the user account. This assumption is extremely common in many application scenaria, e.g., ATM. Because of this limitation, we say that an attack is successful only if the adversary can extract the user secret. Our Contribution. In this paper we restate the protocol presented in [1] as a twofactor authentication scheme and we analyze the SAT-based attack described therein. We first show that there exists a small number of secrets, logarithmic in the size of the secrets’ space, that cannot be uniquely extracted even when the adversary is provided with an unbounded number of authentication transcripts. We then experimentally evaluate the security of the two-factor authentication scheme using the SAT-based attack. We show that the amount of time needed to extract the secret using such attack grows exponentially in the scheme parameters, making the authentication scheme extremely interesting. Indeed, even if the adversary is able to collect a sufficient number of transcripts, she may not be able to extract the user’s secret, simply because such operation is computationally infeasible. We stress that our experimental evaluation only considers sets of “small” parameters for which the authentication scheme is not secure. As it will be clear in Section 4, it was not feasible to obtain results for bigger values of the parameters, i.e., for the parameters that make the scheme secure. We finally show that such an authentication scheme can be easily deployed for the authentication of small devices, e.g. RFID tag-to-reader or reader-to-tag authentication. Due to space limitations, proofs and figures are omitted from this version of the paper.
2
The GRAPE Scheme
Let O be a set consisting of q = pa distinct objects, for some positive integers a and p. In GRAPE [1], a challenge is a random permutation α = (o1 , . . . , oq ) of all the objects in O. The challenge α in shown to the user as a matrix consisting of a rows and p = q/a columns.
On the Security of a Two-Factor Authentication Scheme
247
The answer to the challenge, the “password”, corresponds to the position of a sequence of secret objects σ = (σ1 , . . . , σm ) in the challenge matrix. It is clear that the password typed in by the user changes in each session as the challenge changes. To be more precise the secret is a sequence of m questions, called queries like: “On which row of the screen do you see the secret object σi ?”. Queries are chosen independently and, hence, the set of possible queries has size |O|m . The user response to the challenge is an array β = (β1 , . . . , βm ), where each βi is a number drawn from the set A = {0, 1, . . . a − 1} and corresponds to the answer to the i-th query. A session transcript is a pair τ = (α, β), where α is a challenge and β is the user response to α. The original scheme was analyzed under three different authentication strategies. We only focus on the “correct-wrong” one in which the user is required to correctly answer exactly k out of n queries while giving wrong answers to the remaining ones. A two-factor authentication protocol. The “correct-wrong” strategy just described enjoys particular features when the system arranges the objects on two rows, i.e., a = 2, and the user is required to answer correctly to exactly m/a = m/2 queries. Indeed, in case the user, for every challenge, has to answer correctly to a specific set of m/2 queries (unknown to the adversary), it is possible to show that the probability with which the adversary succeeds in authenticating giving random answers to the challenge drops to 1/2m , where m is the number of objects in the secret. Clearly, the required set of correct answers needs to change for each challenge, otherwise the adversary will be able to use a counting argument and identify the user secret. The authentication scheme we will analyze is the following: A challenge α is a random arrangement of the objects in O on two rows. The user is required to answer correctly to a specific set of m/2 out of m queries and to give wrong answers to the remaining ones. It is not reasonable to assume that a human being is able to compute or remember a list of different sets of answers (to be used in consecutive authentication sessions) to which she has to answer correctly. Here comes into play an authentication token whose only role is to generate the specific set of m/2 answers in place of the user. We notice that such tokens are already used for providing one-time PINs. However, if the token is used to provide the one-time PIN “in clear”, an adversary that steals the token can easily impersonate the legitimate user. In the presented authentication scheme, the mere possession of the device still does not allow the adversary to succeed in the authentication without the knowledge of the user secret. Thus the user secret still plays a central role in the multi-modal authentication scheme. We assume that the adversary is not allowed to read the token.
3
Analysis
In this section we describe the SAT based attack to the two-factor authentication scheme just described, presented in [1]. Roughly speaking, given a number
248
L. Catuogno and C. Galdi
of transcripts corresponding to successful authentication sessions, we model the information that an adversary may obtain by means of a boolean formula in a way that a truth assignment to the boolean formula corresponds to a possible user secret. Clearly, as the number of transcripts used to construct the formula grows, the number of possible truth assignment decreases. However, for the formula we construct, there always exists at least one truth assignment, i.e., the one corresponding to the user secret. We then show that, if the adversary is provided with a sufficient number of transcripts, such approach correctly extracts the user secret when its “plurality” is at least 3, i.e., if the user secret contains at least 3 different objects. At the same time, we show that if the secret plurality is at most 2, this approach cannot distinguish among strongly related secrets. However, since the latter case only occurs in a small number of cases, the proposed strategy can still be used to extract the user secret. Preliminaries. In the following we will denote by αk the challenge for the the k-th transcript. Since a = 2, αk is a matrix consisting of 2 rows and p = q/2 columns. Let (ik1 , . . . , ikp ) (resp., (ikp+1 , . . . , ikq )) be the indices of the objects on the first (resp. the second) row of αk . Since the challenge αk is a random permutation of the q distinct objects in the set O, it holds that {ik1 , . . . , ikp } ∩ {ikp+1 , . . . , ikq } = ∅ and {ik1 , . . . , ikp } ∪ {ikp+1 , . . . , ikq } = {1, . . . , q}. Let σ = (σ1 , . . . , σm ) ∈ Om denote the user secret, and let β k ∈ {0, 1}m be the response response of the user to challange αk w.r.t. σ. We say that an array c = (c1 , . . . , cm ) ∈ {0, 1}m is the correct answer, w.r.t. secret σ = (σ1 , . . . , σm ), to the challenge αk = ((ik1 , . . . , ikp ), (ikp+1 , . . . , ikq )) if the i-th component of the secret belongs to row ci of the challenge. More formally, for i = 1, . . . , m, ci = 0 iff σi ∈ {oik1 , . . . , oikp }, ci = 1 otherwise. Recall that, since the user correctly answers to exactly m/2 queries while gives wrong answers to the remaining m/2, for a given transcript (αk , β k ) if c is the correct answer to the challenge αk w.r.t. a secret σ, the arrays β k and c agree on exactly m/2 components. In other words, the adversary (1) is able to obtain the transcript (αk , β k ); (2) knows that exactly m/2 components of β k are correct and (3) she does not c. Let us define Am = {a = (a1 , . . . , am ) ∈ {0, 1}m | w(a) = m/2}, where w(·) denotes the Hamming weight of a. Finally, let ψ be a boolean formula defined on a set X of variables and let x be a truth assignment for the variables in X. If x satisfies ψ we will write x ψ, otherwise we will write x ψ. Constructing the Formula. Given the above definitions, we show how to construct a boolean formula given a set of transcripts. We assign m different boolean variable xi,1 , . . . , xi,m to each object oi , with i = 1, . . . , q. Intuitively, xi,j = 1 implies that the j-th component of the user secret is oi . Let σ = (σ1 , . . . , σm ) be a secret, where σi ∈ O for i = 1, . . . , m, . The Truth Assignment Tσ = (x1,1 , . . . , xq,m ) induced by σ is defined as: xi,j = 1 if σj = oi , or xi,j = 0 otherwise.
On the Security of a Two-Factor Authentication Scheme
249
Since each oj appears in αk exactly once, for every i, the i-th component of the user secret belongs either to row zero or row one of αk . For every j = 1, . . . , m, i.e., for every component of the user secret, we define φk0,j = xik1 ,j ∨ . . . ∨ xikp ,j and φk1,j = xikp+1 ,j ∨ . . . ∨ xikq ,j . It holds that, if j-th component of the user secret, σj , belong to row zero in challange αk , then Tσ φk0,j . At the same
time, σj does not belong to row one of αk and thus Tσ φk1,j . This means that Tσ φk0,j ∧ φk1,j . Similarly, if σj belongs to row one of αk then Tσ φk0,j ∧ φk1,j . Notice that the same holds for every j = 1, . . . , m. Given a transcript and an array a = (a1 , . . . , am ) ∈ Am we will use the following notation: ψ k (a) =
m j=1
φkβj ⊕aj ,j ∧ φk(1−βj )⊕aj ,j
and
ψk =
ψ k (a)
(1)
a∈Am
From the above discussion, Tσ ψ k (a) if the correct answer c for αk can be written as c = β k ⊕ a and, thus, Tσ ψ k . It is not hard to show that, for every truth assignment x, if x ψ k (a) then x ψ k (b), for every b ∈ Am \ a. Intuitively, the satisfiability of the above formulas follows from the observation that, for a generic transcript (α, β), there exists exactly one boolean array (a1 , . . . , am ) that identifies the correct and wrong answers in β. If the j-th answer in β is correct, i.e., aj = 0, then the j-th component in the user secret belongs to the row identified by βj (and, obviously, does not belong the the row identified by 1 − βj ). Similar arguments apply for aj = 1. If the adversary is provided with t transcripts, the above formula has to be t satisfied for each transcript, thus for ψ = k=1 ψ k it holds that Tσ ψ. Notice that the number of variables xi,j does not depend on the number of transcripts, i.e, for every k, the formulas ψ k are written using the same variables. The last constraint we need to consider is the fact that, each component of the secret consists of exactly m one q object. The above statement can be expressed by the following: m,q = j=1 i=1 (x1,j ∧ . . . ∧ xi−1,j ∧ xi,j ∧ xi+1,j ∧ . . . ∧ xq,j ). For every possible secret σ and for every possible sequence of successful transcripts ((α1 , β 1 ), . . . , (αt , β t )), if ψ and m,q are defined as above and if μψ = ψ ∧ m,q it holds that Tσ μψ . Notice that a truth assignment for μψ might not represent the actual user secret. As an example, consider the case in which the adversary only holds a single transcript. Clearly the formula μψ is satisfiable also in this case but there might exists multiple truth assignments. Impossibility result. A passive attack to such a scheme has an inherent impossibility result. We say that two secrets σ, χ ∈ Om are indistinguishable if, for every transcript (αk , β k ) it holds that Tσ ψ k ∧ m,q if and only if Tχ ψ k ∧ m,q . In other words, there exists no transcript that can be used to discriminate one secret from the other. Furthermore, we define the plurality of a secret σ, denoted by p(σ), as the number of different objects composing the secrets. For example, the plurality of σ = (1, 1, . . . , 1) is equal to 1, the plurality of σ = (1, . . . , 1, 3, . . . , 3) is equal to 2. Finally, if σ is a secret with plurality equal to two, then it is composed by two different objects, say σ1 , σ2 ∈ O. The complement σ of σ is
250
L. Catuogno and C. Galdi
obtained from σ substituting each occurrence of σ1 with σ2 and viceversa. We can prove the following: Theorem 1. Let σ ∈ Om be a secret. It holds that: – If p(σ) = 1, then σ is indistinguishable from any other secret with plurality 1 and it is distinguishable from all the secrets with plurality greater than 1; – If p(σ) = 2, then σ is indistinguishable from σ and it is distinguishable from all the other secrets; – if p(σ) > 2, then σ is distinguishable from all the other secrets; Theorem 1 states that, given a sufficient number of transcripts, the formula can be used to extract every secret with plurality greater than 2. At the same time, even if the adversary is given access to an infinite sequence of transcripts and independently from the specific attack, there exist a number of secrets, logarithmic in the size of the secrets’ space, that cannot be uniquely identified.
4
Experimental Evaluation
In this section we describe the experiments we have run in order to evaluate the performance of the system under analysis. The experiments have been run on a cluster composed by 3 nodes, each equipped with two quad-core Xeon processors with 8 Gb of RAM running Scientific Linux and the Mosix Cluster Management system. The results we report in this section have been obtained using the SAT solvers NoClause [4] and SatMate [5], with exactly the same behavior. The reason of using two different solvers was to self-validate the results by avoiding the possibility that one solver was performing particularly well/bad given the specific formula structure. Such solvers take as input boolean formulae in different formats. We have used the ISCAS1 format that, essentially, describes the circuit associated to the formula by means of INPUT, OUTPUT, AND, NOT, OR, XOR gates. One of the problems in automating consecutive runs of the experiments, is the fact that the formula μψ we need to evaluate is always satisfiable. On one hand, NoClause simply outputs a statement “Satisfiable”/“Unsatisfiable”, and thus, in our case, it always outputs “Satisfiable”. On the other hand, SatMate (if the formula is satisfiable) provides a truth assignment. Unfortunately, in case the number of transcripts is not sufficient to extract the user secret, the formula μψ has multiple truth assignments. Thus, the output of SatMate should have been checked against the actual user secret. In order to unify (and simplify) the testing using both solvers, we have preferred to work around the above differences as follows: we have added a new clause δ to the formula μψ that excludes the user secret. More precisely, if σ = (σ1 = oi1 , . . . , σm = oim ) is the user secret, we define δ = (xi1 ,1 ∧ . . . ∧ xim ,m ). Intuitively, (xi1 ,1 = 1, . . . , xim ,m = 1) is always a truth assignment for the formula μψ . Thus if μψ has at least two truth assignments, then μψ ∧ δ is still 1
See http://logic.pdmi.ras.ru/~ basolver/rtl.html for some details.
On the Security of a Two-Factor Authentication Scheme
251
satisfiable. On the other hand, if (xi1 ,1 = 1, . . . , xim ,m = 1) is the only truth assignment for μψ , then μψ ∧ δ is not satisfiable. Thus, from our point of view, if μψ ∧ δ is satisfiable, the number of transcripts used to construct μψ is not sufficient to extract the user secret. On the other hand if μψ ∧ δ is not satisfiable, then the number of transcripts used to construct μψ is sufficient for extracting the user secret. Every run of an experiment is identified by three parameters, the secret length m, the number of objects in the challenge q and the number of transcripts t used to construct the formula μψ . We have run several experiments with secret lengths of 4, 6 or 8. We stress a secret of length 8 is not secure in a real-life deployment since an adversary has probability 1/28 = 1/256 of guessing the user secret. On the other hand, as it will be clear soon, it was simply unfeasible to obtain results for values of m greater than 8. Our experiments can be useful, however, to determine the behavior of the system in case it is instantiated with secure real-life parameters. The first thing we have done is tried to evaluate the minimum number of transcript that are needed in order to extract the secret as a function of the secret length and the number of objects in the challenge. As it was expected, as the secret length increases, the percentage of successfully extracted secret slightly decreases. However, in all cases, 30 transcripts are sufficient to extract the secret with probability close to 1. We have then evaluated the time growth depending on three variables. If we fix the secret length and the number of objects in the challenge, the average solution time increases exponentially until the number of transcripts reaches 20 while, after this value, it stabilizes or even slightly decreases. This can be explained since with “few” transcripts, the number of truth assignments for the formula is high and, thus, the solver can easily find one truth assignment. On the other hand, when the number of transcripts increases, the number of truth assignments for μψ ∧δ decreases quickly to zero, and thus the solver needs more or less the same time for proving the formula to be unsatisfiable or to find a truth assignment. If we do consider the time growth as function of the secret length m or the number of objects q in the challenge, it can be seen that the average solution time increases exponentially in both variables. As for the secret length, the exponential growth was expected since the size of the input formula grows exponentially in this parameter. This unexpected growth in time made simply unfeasible running tests with a bigger values for the parameters.
5
Applications to RFID
Following the lead of [6], we have considered possible applications of our scheme to the authentication of small devices like RFIDs. In particular, we have focused our attention to the tag-to-reader authentication. The two factor authentication scheme can be easily deployed as a “one-factor” authentication scheme on low-cost devices in which the tag plays the role of the user while the reader impersonated the terminal. Since the scheme is independent from the specific et of objects, in a such context, the challenge can be any arrangement of all binary
252
L. Catuogno and C. Galdi
strings in the set {0, 1}. Clearly, there exists no “cognitive function”, but the tag is only required to search its secret among a set of binary strings. Finally, the tag itself could either store the sequence of sets of queries to which it has to give the “correct answer”. Alternatively, the device might generate such set using a pseudo-random generator, in which case the seed of the PRNG will be part of the secret shared between the tag and the terminal. Finally, periodical proactive secret updates could be provided more frequently with RFIDs w.r.t. the human scenario.
6
Conclusions
In this paper we have experimentally evaluated a two-factor authentication scheme initially proposed in [1]. We have first shown that there exists a small number of secrets that cannot be uniquely extracted even if the adversary is provided with an infinite record of transcripts. We have then experimentally evaluated the attack performance using two different SAT solvers. Our results show that, although the number of transcripts needed to extract the user secret is small, even with small values of the parameter it becomes sometime infeasible to extract such information from the given set of transcripts. An interesting result could be to prove the hardness of the secret extraction process. Moreover, we point out that our scheme does not use any cryptographic primitive and, for a basic implementation, it requires limited resources, making it suitable for applications to computationally constrained devices.
References 1. Catuogno, L., Galdi, C.: A graphical pin authentication mechanism for smart cards and low-cost devices. In: Onieva, J.A., Sauveron, D., Chaumette, S., Gollmann, D., Markantonakis, K. (eds.) WISTP 2008. LNCS, vol. 5019, pp. 16–35. Springer, Heidelberg (2008) 2. Suo, X., Zhu, Y., Owen, G.S.: Graphical passwords: a survey. In: Proceedings of 21st Annual Computer Security Application Conference (ACSAC 2005), Tucson AZ, US, December 5-9, pp. 463–472 (2005) 3. Golle, P., Wagner, D.: Cryptanalysis of a cognitive authentication scheme (extended abstract). In: IEEE Symposium on Security and Privacy, pp. 66–70. IEEE Computer Society, Los Alamitos (2007) 4. Thiffault, C., Bacchus, F., Walsh, T.: Solving non-clausal formulas with dpll search. In: Wallace, M. (ed.) CP 2004. LNCS, vol. 3258, pp. 663–678. Springer, Heidelberg (2004) 5. Jain, H., Bartzis, C., Clarke, E.M.: Satisfiability checking of non-clausal formulas using general matings. In: Biere, A., Gomes, C.P. (eds.) SAT 2006. LNCS, vol. 4121, pp. 75–89. Springer, Heidelberg (2006) 6. Juels, A., Weis, S.A.: Authenticating pervasive devices with human protocols. In: Shoup, V. (ed.) CRYPTO 2005. LNCS, vol. 3621, pp. 293–308. Springer, Heidelberg (2005)
The Design of Secure and Efficient P2PSIP Communication Systems Xianghan Zheng and Vladimir Oleshchuk Faculty of Engineering and Science, University of Agder, Norway {xianghan.zheng,vladimir.oleshchuk}@uia.no
Abstract. Recently, both academia and industry have initiated research projects directed on integration of P2PSIP paradigm into communication systems. In this paradigm, P2P network stores most of the network information among participating peers without help of the central servers. The concept of self-configuration, self-establishment greatly improves the robustness of the network system compared with the traditional Client/Server based systems. In this paper, we propose a system architecture for constructing efficient and secure P2PSIP communication systems. The proposed approach includes three-layer hierarchical overlay division, peer identifier assignment, cache based efficiency enhancement, proxy based security, and subjective logic based trust enhancement. A prototype with 512 P2PSIP peers is implemented. Keywords: Peer-to-Peer (P2P), Session Initiation Protocol (SIP), P2PSIP, Chord, Chord Secure Proxy (CSP), Chord Secure Proxy Gateway (CSPG), Subjective logic.
1
Introduction
P2P computing has begun to infiltrate into SIP communication systems. In this paradigm, P2P network stores most of the network information on each participating peer without help of the central servers. The concept of self-configuration, self-establishment greatly improves the robustness of the network system compared with the traditional Client/Server based systems. IETF P2PSIP working group defines the concept and motivation behind P2PSIP [1] in the following way: “The concept behind P2PSIP is to leverage the distributed nature of P2P to allow for distributed resource discovery in a SIP network, eliminating (at least reducing) the need for centralized servers. Both recent research projects (e.g. SIPPeer [2], P2PP [3], SIPDHT [4], and dSIP [5], etc.) and recent publications [6–10] have suggested many useful and interesting approaches for designing P2PSIP communication systems. However, two most critical problems existing currently are overlay efficiency and security. Firstly, Chord based approach has been suggested as a mandatory overlay technology to support P2PSIP communication [1, 6–9]. However, as a protocol originally designed for background downloading applications, it is not efficient for real-time services. For example, Chord lookup efficiency might degrade with the P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 253–260, 2010. c IFIP International Federation for Information Processing 2010
254
X. Zheng and V. Oleshchuk
increasing number of unstable peers (join/left the overlay frequently). Besides, Chord lacks of cache mechanism to preserve the useful information (e.g. public IP, port, peer ID, etc) for future session establishment. Secondly, the decentralized nature of P2P might cause a lot of security problems. For instance, a malicious intermediate peers are capable to misroute, discard, temper and replay received P2PSIP messages. Besides, it might be able to spy and record profile of the neighbouring peers (e.g. peer ID, public ID, port, etc) through parsing the incoming messages. In this paper, we propose a system architecture that provides efficient and secure session initiation services. The proposed approaches include: three layer hierarchical overlay division, peer identifier assignment, cache based efficiency enhancement, proxy based security, and subjective logic based trust enhancement. After that, we build a prototype with 512 P2PSIP peers, including 496 normal peers, 13 CSPs (Chord Secure Proxy), and 3 CSPGs (Chord Secure Proxy Gateways). We also describe a typical use scenario to show the protection against malicious or compromised intermediate peers.
2
System Architecture
In this section, we present the proposed system architecture. After that, we specify the corresponding approaches in details, including three-layer hierarchical division, peer identifier assignment, cache mechanism, CSP based security, and subjective logic based trust enhancement. 2.1
Architecture Overview
The proposed system architecture includes six main parts: P2PSIP peer, Chord Secure Proxy (CSP), Chord Secure Proxy Gateway (CSPG), Enrollment and Authentication (E&A) Server, Secure Opinion Server (SOS), and STUN1 , TURN2 and ICE3 server (shown in Figure 1). P2PSIP peer, which can be a mobile phone, laptop, PC, etc., is connected to the Internet. CSP is the secure proxy that helps source peer to locate the destination peer. E&A server is the secure server that handle the enrollment and authentication task when P2PSIP peer joins overlay. Secure Opinion Server (SOS) is the trust server that stores and dynamic computes opinion for each P2PSIP peer. STUN/TURN/ICE server is responsible to provide NAT traversal for peers behind NAT protection. In the system, the overlay is divided into three sub-layers. If the destination peer is in the same layer as the source peer, requests would be sent to CSP that is clockwisely nearest to the destination peer. Otherwise, the messages are directed to CSPG in source layer, then CSPG in destination layer, and finally, to the corresponding CSP that is clockwisely nearest to the destination peer. 1 2 3
STUN: Simple Traversal of UDP through NATs. TURN: Traversal Using Relay NAT. ICE: Interactive Connectivity Establishment.
The Design of Secure and Efficient P2PSIP Communication Systems
255
Fig. 1. System model
CSP is responsible for search and location of destination peer via “pingRequest multicast mechanism (described in Section 3.4). After that, the session between source and destination peers may be established. 2.2
Three Layer Hierarchical Division
We divide the overlay into 3 sub-overlays according to peer capabilities (e.g. connection type, stability in the overlay, CPU processing power, bandwidth, etc). The first sub-overlay is the stable peers that hold public IP addresses, have more powerful CPU, and own stable connection. Such typical devices can be a web server. The second sub-overlay is the peers with enough stability and processing power, e.g. normal PC with Internet connection. Peers in this layer do not own public IP address, and might relay on STUN/TURN/ICE for traversing NAT. The lowest sub-overlay is those with unstable connection (e.g. mobile phones, PDA, laptops with wireless connection). Note that each sub-overlay contains a few CSPs and at least one CSPG that are stable P2PSIP peers. It is reasonable to expect that many legacy P2PSIP peers in the future will be unstable peers (e.g. a large amount of mobile phones, PDA, laptops, etc) with wireless connections. Therefore, the division of three sub-overlay guarantees peer/resource lookup efficiency in the top two layers. 2.3
Peer Identifier Assignment
IETF P2PSIP WG is still discussing the assignment of peer identity in the overlay. Some researchers suggest use of conventional SHA-1 hash mechanism to produce 128/160 bits peer identifier. However, this solution might cause efficiency problems. For example, geographically close peers might be assigned with identifiers that are far away from each other in the overlay, and this causes long delay during connection establishment. We advocate the idea that geographically close peers should be assigned close peer identifiers in the overlay because the most frequently communicated peers are those who are spatially related to each other [11, 12]. We propose to incorporate this idea into our hierarchical system. In the beginning of enrollment,
256
X. Zheng and V. Oleshchuk
P2PSIP peer should contact an Enrollment and Authentication (E&A) server (which is a central server), submit information about peer capabilities (e.g. connection type, CPU processing power, bandwidth, storage, etc) and spatial information (e.g. public IP, etc), etc. Based on peer capabilities, E&A server allocates specific sub-overlay, based on spatial information, E&A server assigns specific peer identifier attached in specific sub-overlay. 2.4
Cache Mechanism
Cache mechanism improves lookup efficiency indirectly through retaining communication history (e.g. previous communicated peer ID, public IP, port, etc., as shown in Table 1) for the future usage. For searching the destination peer, source peer first check its cache entry record. If the destination peer (peer identifier, public IP address, port, etc) is already inside, the session might be established directly. Otherwise, the source peer will execute normal lookup algorithm described above. In stable overlay (e.g. first and second sub-layers) where peers do not join and left frequently, the cost might be only one hop. However, in unstable overlay (for instance, the third sub-layer) where peers are dynamically changed, this might cost even worse delay. Therefore, we do not suggest this approach to be implemented in the lowest layer sub-overlay. 2.5
Proxy-Based Security
In our previous publication, we proposed a proxy-based system architecture to protect security of P2PSIP system [13]. The proposed architecture contains three main parts: P2PSIP Peer, Resource, Chord Secure Proxy (CSP), as shown in Figure 2. For locating a peer/resource in the overlay, the source peer first sends the P2PSIP request to a specific CSP (Step 1). The CSP acts as a proxy server to probe the destination peer through multicasting a PingRequest message to its successors by Chord algorithm. When the destination peer receives a “PingRequest message, it contacts the CSP to catch the original P2PSIP request (Step 2). After that, the connection between source and destination peers can be established (Step 3). The connections in the system architecture are SSL/TLS secured. The use of “PingRequest message (in Step 2) makes sure that intermediate peers are incapable to receive original P2PSIP request. The proposed multicast mechanism (Step 2) guarantees on some level that “HelloRequest message could arrive to the destination peer. Therefore, this architecture provides secure P2PSIP session initiation. 2.6
Subjective Logic Based Trust
The subjective logic [14] defines the term “opinion, which is a triple ω = {t, d, u}, where t, d and u correspond to trust, distrust, and uncertainty respectively. Expressing trust by using three parameters instead of one simple trust level gives
The Design of Secure and Efficient P2PSIP Communication Systems
257
Fig. 2. System model
more adequate trust model of real world. Subjective logic also defines logical operators for combining opinions. For example, the recommendation operator ⊗ can be introduced to evaluate the trustworthiness of p which might be a statement like “the message traverse B to A is unchanged result of measurement, as following: A AB AB ⊗ ωpB = {tAB ωpAB = ωB p , dp , up } where B = tA tAB p B tp ,
B dAB = tA p B dp ,
A A B uAB = dA p B + u B + tB u p .
A is the opinion of A about trustworthiness of recommendation of B, and ωpB ωB is the opinion of B about trustworthiness of p. This approach is implemented in [15] in order to enhance security of P2PSIP. Suppose that a request goes from the source peer A, intermediate peers B1 , B2 , . . . , Bn?1 , and ends in the destination peer Bn . By applying the rules of subjective logic, the trustworthiness of this data flow is: B
B1 B1 A ⊗ ωB ⊗ ωB ⊗ . . . ⊗ ωBnn−1 ⊗ ωpBn ωpAB1 B2 ...,Bn = ωB 1 2 2
In this way, it is possible to evaluate the trust level for each message flow.
3
Evaluation
In this section, we evaluate the proposed system architecture. Firstly, we describe the prototype implementation. After that, we use a typical scenario to show the protection of system against malicious or compromised intermediate peers. 3.1
Prototype Implementation
We simulate the proposed system architecture with corresponding solutions by implementing the prototype in Java. The prototype of the system contains 512 peers (including 496 normal P2PSIP peers, 13 CSP peers, and 3 CSPG peers). Apache Derby is selected as the embedded database implementation for P2PSIP peers, CSPs, and CSPGs. Besides, we also build a Secure Opinion Server, which is a web server for storing and handling dynamic opinion calculation. The SOS
258
X. Zheng and V. Oleshchuk
uses Apache Derby as the opinion database, and Apache tomcat as the background HTTP container. The system is deployed on a platform with Windows XP professional system, 2×2.4G Intel Core CPU, 3G memory, and 100Mbps Ethernet connection. We define INVITE as the P2PSIP request and 180 ringing as the response (See Figure 3 and Figure 4). Note that all the messages sending and receiving are based on TCP. We use the Wireshirk [16] to monitor the message transmission. The testing shows that the system works well.
Fig. 3. P2PSIP INVITE
3.2
Fig. 4. P2PSIP 180 Ringing
Security
We use a typical malicious use scenario implementation (Figure 5) to show both of trust upgrading and the protection of the networks from compromised or malicious intermediate peers. We initiate a P2PSIP request from peer 80, searching for destination peer 1618. Then, we assume the intermediate peer 1617 is a malicious/compromised intermediate peer that might discard, misroute, modify or temper the data message. This makes impossible for the message flow to reach destination peer (based on the conventional Chord routing: Peer 80 → peer 1331→ peer 1593 → peer 1609 → peer 1617 → peer 1618) [17]. However, the situation is different in our system. The request would be directed to CSPG 1, CSPG 1030, and then CSP 1536. After that, “PingRequest is multicasted and therefore causes several routes. Although one of the routes will be interfered by malicious peer 1617, two others can still reach the destination peer. Finally, the destination peer asks Secure Opinion Server (SOS) via sending HTTP “asking, asking for the best route. We assume that in a certain period, the opinion of each related peer is: peer 1593 (0.8, 0.1, 0.1), peer 1600 (0.82, 0.08, 0.08), peer 1609 (0.92, 0.04, 0.04), peer 1618 (0.9, 0.05, 0.05). We simulate this by manually modifying the opinion database. According to the description of Section 3.6, the opinion of two routes is: ωp1 = {0.738, 0.042, 0.22} with v = 0.764 ωp2 = {0.662, 0.037, 0.301} with v = 0.738 After the opinion calculation, SOS returns the most trustful route to the destination peer 1618. Thus, the session can be established in the most trustful way.
The Design of Secure and Efficient P2PSIP Communication Systems
259
Fig. 5. A typical uses scenario
4
Conclusion
In this paper we propose a new efficient and secure model for P2PSIP communication systems. The system model resolves several issues including three suboverlay division, identifier assignment, cache mechanism, proxy based security, subjective logic based trust enhancement, NAT traversal, and message routing. These approaches improve the peer/resource lookup efficiency in P2PSIP session establishment and protect the system from security breaches, such as malicious or faulty intermediate peers. In the future, we plan to study the extension function of CSP for legacy devices (e.g. mobile phone, etc) that lacks the capability to access P2PSIP overlay due to limited protocol support or other limitation in device capabilities (e.g. available computing, bandwidth, etc). A possible system architecture proposed in [18] can be further studied in this context.
References 1. P2PSIP, http://www.p2p-sip.org 2. Kundan, S., Henning, S.: Peer-to-peer internet telephony using SIP. In: Proceedings of the international workshop on Network and operating systems support for digital audio and video. ACM, Stevenson (2005) 3. Peer-to-Peer, http://www1.cs.columbia.edu/~ salman/peer/ 4. SIPDHT2, http://sipdht.sourceforge.net/sipdht2/index.html 5. MjSip, http://www.mjsip.org 6. Bryan, D.A., Lowekamp, B.B., Zangrilli, M.: The Design of a versatile, secure P2PSIP communications architecture for the public internet. In: IEEE international Parallel and Distributed Processing Symposium, Lyon, France (April 2008) 7. Jennings, C., Lowekamp., B., Rescorla, E., Baset, S., Schulzrinne, H.: Resource Location And Discovery (RELOAD) (June 2008) draft-bryan-p2psip-reload-04
260
X. Zheng and V. Oleshchuk
8. Bryan, D., Matthews, P., Shim, E., Willis, D., Dawkins, S.: Concepts and Terminology for Peer to Peer SIP (July 2008) draft-ietf-p2psip-concepts-02 9. Matuszewski, M., Kokkonen, E.: Mobile P2PSIP - Peer-to-Peer SIP Communication in Mobile Communities. In: 5th IEEE Consumer Communications and Networking Conference. CCNC 2008, Las Vegas (January 2008) 10. Zheng, X., Oleshchuk, V.: Improving Chord lookup protocol for P2PSIP-based Communication Systems. In: International Conference on New Trends in Information and Service Science (3rd NISS) (June 2008) 11. Guangyu Shi, Y.L., Chen, J., Gong, H., Zhang, H.: T2MC: A Peer-to-Peer Mismatch Reduction Technique by Traceroute and 2-Means Classification Algorithm. In: 7th International IFIP-TC6 Networking Conference, Singapore, May 5-9 (2008) 12. Huang, L.: Location and Discovery of Subsets of Resources. Internet - Draft (working in process) (July 2008), http://tools.ietf.org/html/ draft-licanhuang-p2psip-subsetresourcelocation-00 13. Zheng, X., Oleshchuk, V.: A Secure Architecture for P2PSIP-based Communication Systems. In: 2nd International Conference on Security of Information and Networks (SIN 2009), North Cyprus (October 2009) 14. Jsang, A., et al.: Trust network analysis with subjective logic. In: ACISP 2006. LNCS, vol. 48. Springer, Heidelberg (2006) 15. Zheng, X., Oleshchuk, V.: Trust-based Framework for Security Enhancement of P2PSIP Communication Systems. In: The 4th International Conference for Internet Technology and Secured Transactions (ICITST 2009), London (November 2009) 16. Wireshark: Go deep, http://www.wireshark.org/ 17. Stoica, I., Morris, R., Liben-Nowell, D., Karger, D.R., Kaashoek, M.F., Dabek, F., Balakrishnan, H.: Chord: a scalable peer-to-peer lookup protocol for internet applications. IEEE/ACM Transactions on Networking 11(1), 17–32 (2003) 18. Zheng, X., Oleshchuk, V., Jiao, H.: A System Architecture for SIP/IMS-based Multimedia Services. In: International Joint Conferences on Computer, Information, and Systems Sciences, and Engineering (CISSE) (December 2007)
Novel FPGA-Based Signature Matching for Deep Packet Inspection Nitesh B. Guinde and Sotirios G. Ziavras Electrical & Computer Engineering Department, New Jersey Institute of Technology, Newark NJ 07102, USA
Abstract. Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Thus, only FPGA (Field-Programmable Gate Array) or ASIC (ApplicationSpecific Integrated Circuit) solutions could be efficient for this problem. Our FPGA-based solution performs high-speed matching while permitting pattern updates without resource reconfiguration. An off-line optimization method first finds sub-pattern similarities across all the patterns in the SNORT database of signatures [17]. A novel technique then compresses each pattern into a bit vector where each bit represents such a sub-pattern. Our approach reduces drastically the required on-chip storage as well as the complexity of matching, utilizing just 0.05 logic cells for processing and 17.74 bits for storage per character in the current SNORT database of 6456 patterns.
1
Introduction
Many computer network attacks in recent times were difficult to detect based only on header inspection. Deep packet inspection of the payload is needed to detect application-level attacks. The rules for matching may represent either new signatures or changes to existing ones. From October 2007 to August 2008, 1348 SNORT rules were added while 8170 rules were updated (on a daily or weekly basis) [17]. Thus, robust NID systems should handle rule updates (including additions) without taking them off-line. Signature/pattern matching is also relevant to virus detection based on the presence of specific command sequences in a program [21]; new signatures are added almost daily. The majority of deep packet inspection systems that try to identify malicious signatures employ pattern matching software running on general-purpose processors. Although their database of rules can be updated easily, the pattern matching process cannot keep up with fast network speeds. FPGA-based solutions, on the other hand, have the potential to match network speeds; often at the cost of complete system reconfiguration for pattern updates. Complete system synthesis can take several hours; also, the penalty for full FPGA reconfiguration can be many milliseconds or seconds [10]. Therefore, complete system reconfiguration is not prudent for 24/7 active networks. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 261–276, 2010. c IFIP International Federation for Information Processing 2010
262
N.B. Guinde and S.G. Ziavras
Common FPGA-based NID approaches aim to minimize the consumed area, increase the speed and rarely reduce the reconfiguration time for updates. The majority embed specialized state machines where states represent sequences of input characters; state transition information is stored in a location pointed to by the next incoming character (see [5] and [8]). A few papers (see [1], [2], [3] and [22]) discuss solutions that do not require FPGA reconfiguration when adding new patterns. Our pattern matching solution attempts to minimize the consumed chip area, while operating at a high speed and also supporting runtime pattern updates without FPGA reconfiguration. In related work (see [6] and [7]), graph-theoretic techniques partition the rule set into groups based on common character sequences; they reduce redundant searches across patterns and the consumed area. Similarly, our pattern preprocessing step first extracts fixedlength sub-patterns. To compress the stored information further, we create a bit vector for each sub-pattern to denote its location in the set of malicious patterns. Thus, a single bit now represents an entire sub-pattern. Also, our approach ultimately condenses pattern matching into position-based bit-vector matching, a very efficient process. Applying simple AND-SHIFT operations on these bit vectors, complete pattern detection is possible without the need for rigid state machines. The terms table and RAM are used interchangeably.
2
Related Work
The capabilities of FPGAs have recently improved tremendously. Sidhu et al. [5] proposed a straightforward algorithm to construct non-deterministic finite automata (NFA) representing given regular expressions. Hutchings et al. [8] implemented a module to extract patterns from the SNORT rule set [17] and then generated their regular expressions for NFA realization. Lin et al. applied minimization to regular expressions for resource sharing [16]. To reduce transfer widths, an 8-bit character decoder provides 256 unique outputs; various designs (see [6], [7], [8], [9] and [10]) were implemented. Since these designs hard-code the patterns into the FPGA, runtime updates are forbidden without complete FPGA reconfiguration. Content-addressable memories (CAMs) that support updates were proposed by Gokhale et al. [12]. Sourdis et al. [14] applied pre-decoding with CAM-based pattern matching to reduce the consumed area. Yu et al.[15] used ternary content-addressable memory (TCAM) for pattern matching. However, CAM approaches require large amounts of on-chip memory and have high power consumption and hence are unfavorable choices for large rule sets. The lookup mechanism in Dharmapurikar et al. [1] employs a hash table and several Bloom filters for a set of fixed-length strings to be searched in parallel. It may produce false positives and also accesses a slow off-chip memory after a Bloom filter match. CRC functions in Pnevmatikatos et al. (see [3] and [19]) reduce logic cells and memory space. Patterns are first decomposed into varyinglength fragments for storage. Input fragments are hashed and appropriate delay logic combines fragment matches into complete pattern matches. Thinh et al. applied Cuckoo hashing in pattern matching [22] with varying-length sub-patterns
Novel FPGA-Based Signature Matching for Deep Packet Inspection
263
while supporting runtime updates. It yields a good compression in terms of bits and logic cells per character. However, if a collision shows up while inserting a pattern, Cuckoo attempts to recalculate the hashing key. When recalculations are maxed out (i.e., a key cannot be generated for distinct placement), rehashing is needed for all the keys (including for already stored sub-patterns). This process may then suffer from unpredictable penalties. A pattern matching co-processor [2] facilitates updates. Modules that detect sub-patterns forward the respective sub-pattern indices to state machines registering state transitions for contained patterns. Our design employs fewer logic resources with smaller memory consumption per character than these designs. Another advantage of our design is that the pattern matching module does not need to increase in size with an increase in the number of malicious patterns.
3
Our Method
Assume a database of known malicious patterns and the need to design an FPGA-based pattern matching engine that can facilitate runtime updates without the need for hardware reconfiguration. This reliable engine should not produce false positives. Without loss of generality, we will test the implementation with the complete set of signatures in the SNORT database [17]. In summary, our method breaks up statically each pattern into fixed-length sub-patterns and then encodes the position of each sub-pattern in all of the encompassing patterns into a common bit vector. ‘1’ in this vector represents the presence of the subpattern in the respective position of a pattern while ‘0’ denotes otherwise. For each new sub-pattern match in the input, a ‘1’ bit is stored into a detection vector. Bit-wise AND -SHIFT operations on this vector move the ‘1’ with every new sub-pattern match. Another bit vector shows the position of each sub-pattern as a tail in one or more patterns. If a new sub-pattern match at the respective position can potentially represent the end of a pattern, then a hardware-based verification process is invoked to confirm the veracity of a complete pattern match. The entire process is described in the following sub-sections. 3.1
Pre-processing
Our static-time preprocessing divides each pattern into contiguous sequences of N-character sub-patterns; the only exception may be the sub-pattern in the tail of a pattern that may instead include from one to N-1 characters (if the number of characters in the pattern is not a multiple of N). We fix N before the separation process. Our analysis in Section 5 for the SNORT database shows that the best choice is N=3. Identifying the position of sub-patterns in patterns is crucial to our algorithm. Once all of the patterns have been separated into their sub-patterns, we store all distinct N-character sub-patterns into a table called GRP(N). Similarly, we create tables GRP(i), for i = 1, ..., N − 1, where GRP(i) stores all of the i-character sub-patterns that appear as tails in patterns. We denote all of the GRP(i)’s, for i = 1, ..., N, collectively as GRP. Let
264
N.B. Guinde and S.G. Ziavras
L be the maximum sub-pattern offset for a given pattern set. We create a bit vector (BV) and an end vector (EV) for every sub-pattern in GRP. BV is (L-1) bits long and shows the position of the sub-pattern in all the patterns, except the tail, that contain it. That is, if a particular sub-pattern appears only in the sub-pattern positions 2 and 4 of the same or two different patterns, then its BV will contain “010100...0”. The EVs are L bits long and store information about pattern tails. If a sub-pattern forms the tail of a pattern, then it will contain ‘1’ in the respective position of its EV vector. Members of GRP(i), for i= 1,, N-1, appear only as tails and hence require only an EV without the need for a BV. Every record is assigned a unique m-tuple of weights represented by vector W = {weight1 , weight2 ,..., weightm }; let bw be the bits per weight. Assume the set of six patterns in Fig. 1 and their sub-pattern separation for N = 3. Fig. 2 shows the GRP tables created for these patterns assuming N = 3, m = 3 and bw = 8. We can infer from Fig. 1 that L = 6. An m-tuple of weights is then calculated for each stored pattern by summing up weight-wise the m-tuples of its contained sub-patterns. The result is stored in a pattern table at the address denoted by the pattern address. These summation m-tuples of sub-patterns and patterns will eventually help the sub-pattern and pattern detection processes. The baseaddress field of a sub-pattern in GRP contains valid information only
Fig. 1. A set of six patterns separated into sub-patterns for N = 3
Fig. 2. GRP tables for the patterns in Fig. 2, assuming N=3, L=6, m=3 and bw = 8
Novel FPGA-Based Signature Matching for Deep Packet Inspection
265
if it appears as a tail. Its value is added to the sub-pattern offset to generate a pattern address pointing to a location in the pattern table that contains weight summation m-tuples. Fig. 3 shows the summation m-tuples (i.e., triplets since m = 3) for the patterns in Fig. 1; their components are represented by Sum1 , Sum2 and Sum3 . It also shows the address of the pattern summation tuples in the pattern RAM. Sub-pattern “ng” appears at offset 4 in the tail of pattern 5. Address 4 in the pattern table is already occupied by pattern 3 and the next available location has address 7. Hence, the baseaddress of “ng” is set to 3 (since 3 + 4 = 7).
Fig. 3. The pattern table for the patterns in Fig. 1
If two or more patterns have different tails at the same offset, then the baseaddress and offset fields of their tail sub-patterns receive such values that their summation points to distinct/available locations in the pattern table. To minimize the size of this table, a modulo Z operation is used when adding fields, where Z is the size of the pattern table (Z=16 in this example). However, if two or more patterns have the same tail sub-pattern at the same offset, then a collision will result. To remove collisions, a smaller collision RAM is used in addition to the pattern RAM. Patterns 4 and 6 have a common tail “rds” at the same offset, thus the collision RAM is used to place pattern 6 as shown in Fig. 3. The hash field in the GRP table is used to separate the placement of pattern summations. The collision RAM is addressed by hashing the summation tuples and hash field is used to select the appropriate summation tuples as inputs to the hashing function. Since no two patterns generate identical summation mtuples, this clause is used to select the appropriate order of tuples as inputs to the hashing function. In the worst case, we could use a pattern splitting method to resolve collisions (explained later in Section 3.4). 3.2
Runtime Detection of Malicious Patterns
A malicious pattern could start at any character offset in the input stream. Up to N characters at a time are investigated for known sub-patterns stored
266
N.B. Guinde and S.G. Ziavras
in the GRPs. A shift register (window) of N characters interfaces the input stream. Each cycle samples 1 to n consecutive characters in this window, where n is the total number of available characters (n=N for a full window); subpattern matches are attempted against the N GRP tables. On a sub-pattern match, the respective sub-pattern record is forwarded from the GRP table to a detection unit; otherwise, zero is transmitted. N detection units can deal with the N possible character strings in this window. A sub-pattern record is made up of BV, EV, m-tuple Weights, baseaddress and the hash field.
Fig. 4. Processing a P-character input with an N-character shifting window
Let C1 , C2 , ..., CP be an input stream of P characters, as in Fig. 4. The characters enter the window from the left. The window is divided each time into N sub-windows containing from 1 to N characters; they are denoted by Tn , where n=1, ..., N. For example, if a full window contains characters CN −1 to C2N −2 , then sub-window TN will contain characters CN −1 to C2N −2 , sub-window TN −1 will contain characters CN to C2N −2 , and so on. Every sub-window’s content is then looked up in the GRP tables for a match. If a sub-pattern match is found, then its GRP record is read out and forwarded to the appropriate detection unit; otherwise, zero is forwarded. Thus, in every cycle each detection unit receives either a GRP record or zero. The N sub-pattern detection units are denoted by dk , for k =1, ...,N. Every detection unit contains a detection vector DV, an end detection vector EDV and an m-tuple ACC of accumulated weights. The L-bit DV vector keeps track of individual sub-pattern matches; its MSB is originally set to ‘1’ whereas the remaining bits are initialized to ‘0’. The offsetd field shows the position of the only ‘1’ in DV. The L-bit EDV vector is initialized to zero and detects a tail match. ACC is initially set to all zeroes. Pattern detection involves simple SHIFT, AND, COMPARE and ACCUMULATE operations on the binary vectors and weight m-tuples arriving from GRP. Consider any detection unit d (d=d1 , d2 , ...,dN ). Let EVGRP , BVGRP , WGRP and baseaddressGRP represent arriving values from GRP for a sub-pattern sampled from window n. The detection unit then performs the following operations (“&” and “>>” denote concatenation and shift, respectively):
Novel FPGA-Based Signature Matching for Deep Packet Inspection
EDVd = DVd AN D EVGRP DVd = ‘1 & (DVd AN D BVGRP >> 1) = DVd ACCd = ACCd + WGRP
267
; ;if n=N, then the record ;will have BV ;otherwise ;if (DVd AND BVGRP )= 0
=0
;and n = N ;if (DVd AND BVGRP )= 0
= ACCd
;and n = N ;if n = N
T empd = ACCd + WGRP =0
;if EDVd = 0 ;otherwise
pattern address = baseaddress + of f setd + 1
;if EDVd = 0
If (DVd AND BVGRP ) is non-zero, then the m-tuple of the incoming sub-pattern record is added to the existing ACC m-tuple; otherwise, ACC is reset to zero. Also, the offsetd field is incremented if (DVd AND BVGRP ) is non-zero and the sub-pattern record source is GRP(N). If EDVd is non-zero, it signifies the presence of a pattern, and hence the incoming m-tuple is added to ACC and the resulting m-tuple is stored in the Tempd temporary m-tuple. Tempd must be compared with the pattern summation m-tuple in the pattern table for a match. The baseaddress of the tail sub-pattern that produced a non-zero EDV is then added to offsetd (‘1’ is also added to take care of the tail sub-pattern match offset), an address is generated and the summation m-tuples stored in that location are then compared against the values in Tempd . A match denotes the presence of a malicious pattern. Pattern matching takes place in the pattern verification unit that contains the pattern table. The input source to the overall detection unit varies with the window cycle e.g., if at one instance the detection unit receives an input from GRP(2), then at the next cycle it will receive input from GRP(3), and so on, until GRP (N) is reached after which the input source will be set again to GRP(1). Collision pattern RAM is also searched simultaneously for the summation tuple match by hashing the summation m-tuples using the hash field from the record. The hash field is used to select the inputs for hashing. 3.3
Appropriate Weight Distribution Prevents False Positives
Assume a tail sub-pattern that appears at the same offset off in a random input pattern and a GRP-stored malicious pattern. Also, each sub-pattern at offset i in this input, for i=1, 2, ..., off, appears at the same offset position in the set of stored patterns. A non-zero EDV value will be generated for this input. If the Tempd result is identical to the malicious pattern’s weight summation m-tuple (sum1 , sum2 , ...,summ ), then a false positive will be produced (the final decision
268
N.B. Guinde and S.G. Ziavras
is based on a comparison of m-tuples). Hence, it is imperative to assign unique sub-pattern weights that do not produce a malicious pattern’s summation mtuple when permuting stored sub-patterns while preserving their offsets in the respective malicious patterns. Our weight assignment process guarantees the prevention of false positives. To simplify the process, we select heuristically the values for bw and m in such a way that their product is much greater than the total number of bits required to assign unique m-tuples to all the sub-patterns and eventually unique accumulation m-tuples to all the patterns. We found out that the majority of SNORT patterns, around 67%, have lengths less than or equal to fifteen characters; in fact, around 40% have lengths less than or equal to nine. We first used the pattern length to order them in descending order. The sub-patterns appearing in patterns longer than fifteen characters were assigned weights on the higher side in order to produce very high summation m-tuples for these patterns. The sub-patterns appearing in patterns of up to nine characters were assigned weight values on the lower side in order to produce low pattern summation weight tuples. The remaining sub-patterns were assigned weight values in the mid range. There are many common sub-patterns in these three pattern groups. If a subpattern appears in a longer pattern as well as short patterns, then it is given a larger weight. The next step eliminates the possibility for runtime false positives. The process is based on each pattern’s summation m-tuple and the offset (say, off ) of its tail sub-pattern (say, sp). First, all possible “fictitious” patterns containing off sub-patterns are created, where: (1) their tail is sp, and (2) a sub-pattern at offset i (for i=1, 2, ...,off-1) also appears at the same offset i in a stored pattern (including the current pattern). The summation m-tuples of these “fictitious” patterns are then produced. If any summation m-tuple matches the original pattern’s summation m-tuple, then a false positive could show up at runtime; to eliminate this possibility, the sub-pattern weights are then modified or the pattern is split using the pattern splitting method (explained later). Our weight assignment procedure reduces the possibility that sub-patterns in shorter patterns can affect longer patterns, and vice versa. Since we choose sufficient bit widths for sub-pattern and summation tuples, the complexity of this process is reduced dramatically. Let us now show an example with tail “rds” from patterns 4 and 6 in Fig. 1 to illustrate how “fictitious” patterns are created and how summation m-tuples for these patterns are generated. All “fictitious” patterns for this tail are shown in Fig. 5, along with the produced summation m-tuples (i.e., triplets since m=3). The summation triplets stored in the pattern table for patterns 4 and 6 differ from these triplets (see Fig. 3), thus false positives cannot be generated by this tail. Such a calculation of summation tuples is carried out for every tail in the database to check out if a false positive is possible. This process is carried out offline at static time. 3.4
Pattern Splitting
Let us now look at the extremely rare case where a single pattern’s all subpatterns show up in the input at the wrong offsets while its tail is still present
Novel FPGA-Based Signature Matching for Deep Packet Inspection
269
Fig. 5. All possible “fictitious” patterns producing non-zero EDVs for tail “rds”
at the correct tail offset. Also, these sub-patterns appear in identical-with-thisinput offsets in other patterns. Our static-time process then deals with this case as shown in the following small example with three patterns: (1) “abc” “def” “123”; (2) “ssh” “abc” “465”; (3) “def” “tra” “678”; If the incoming flow contains “def abc 123”, a false positive will be triggered for a pattern 1 match. We eliminate this possibility by splitting pattern 1 into two smaller patterns “abc d” and “ef1 23”. Appropriate weights are then assigned to the modified set: (1) “abc” “d”; (2) “ssh” “abc” “465”; (3) “def” “tra” “678”; (4) “ef1” “23”; The final decision for detecting the original pattern 1, which is now a combination of the new patterns 1 and 4, is moved to higher layers i.e. in software on the host. SNORT does not contain such patterns. This method could also be applied while placing summation tuples in the pattern and collision RAMs for patterns that cannot be placed successfully using hash field.
4
Hardware Implementation
We assume N=3 (i.e., a window with up to three bytes or 24 bits). The block diagram of our implementation is shown in Fig. 6. Hashing: We found out from our analysis of the current SNORT that GRP(N) records are predominant and require a bigger RAM compared to the other GRP(i), for i=1, 2, ..., N-1. We use separate hash functions and RAMs for different GRP tables. There is no real need for hashing with GRP(1) due to the uniqueness of C3 that requires 28 (i.e., 256) distinct locations. Our hash functions apply simple XOR-ADD operations to the input to generate an address; they do not need separate key inputs. We use three RAMs per GRP table which are addressed in parallel using different functions which are a mix of one level and two level hashing. The details of hashing are out of scope here. If a pattern contains a sub-pattern which cannot be placed in any non-vacant position of the RAM, then we again resort to the pattern splitting method explained above.
270
N.B. Guinde and S.G. Ziavras
Fig. 6. Our architecture for N=3
Detection Unit: Detection is carried out using simple bitwise AND, SHIFT and ADD operations (i.e., accumulation operations) on bit vectors (DV, EDV) and weights (W). Our design reduces the problem complexity by applying compression to the data as it converts N consecutive characters (i.e., 8N bits) of a sub-pattern into a single bit in a vector representing a long pattern. In our current implementation, we represent any SNORT pattern with a 41-bit vector (the longest pattern in the current SNORT contains 122 characters whereas 3x41=123). Our design uses a simple pipelined structure where on every clock cycle bit vectors are used to potentially produce existing sub-pattern addresses and accumulated sums of weights. The bit vector of a sub-pattern coming from the sub-window switch block is bitwise ANDed with DV and then right shifted by one bit with a ‘1’ entering from the left-hand side. DV is also ANDed with the incoming EV of the sub-pattern record and is stored in the 41-bit end detection vector (EDV). If the result of the AND operation between DV and BV is non-zero, then the weights associated with this record are accumulated into ACC. Otherwise, the accumulation registers are reset to zero. If EDV is non-zero, then the accumulated weights along with the pattern address are forwarded to the controller block (discussed below) to confirm the validity of a match. There are also four sets of offsetd counters, ACC m-tuples and Temp m-tuples in the offset count block to keep track of the position of up to four ‘1’s in DV. One offsetd counter is initially enabled after being reset to the default value of 1. If the result of a (DV AND BV) operation is non-zero, the ‘1’ in the MSB position of the result is shifted to the right and another ‘1’ enters into the MSB from the left. This results in the first offsetd being incremented to 2 and the next offsetd being enabled after being reset to its default value of 1. Thus, the first offsetd counter keeps track of the ‘1’ which is now in position two while the second
Novel FPGA-Based Signature Matching for Deep Packet Inspection
271
offsetd counter keeps track of the ‘1’ currently in MSB. These counters are used to subvert special case attacks. Consider the four patterns: (1) “abc” “123” “xyz” “klm” “8”; (2) “123” “xyz” “klm” “65”;(3) “xyz” “klm” “ppp”; (4) “klm” “trs” “788” “23”; If we look closely, we can see that pattern 1 has commonalities with patterns 2, 3 and 4. However, they are not the same. For the input text “abc123xyzklmppp”, we know that pattern 3 will be triggered. But we could also infer that at an instant there will be four ‘1’ bits in DV at positions 1, 2, 3 and 4. These counters take care of such a scenario and the respective ACC and Temp m-tuples work correspondingly. It is highly unlikely to come across such a combination of patterns. We ran a script on SNORT and inferred that there could be at most two 1’s in DV in a clock cycle. Thus, we need only two offsetd counters to subvert such attacks. We kept four counters for future updates in the SNORT signatures. Also, since we use drastically reduced logic in our implementation, adding more counters to the logic will not make a big difference to resource usage. We can always resort to our pattern splitting approach. Patterns longer than 123 characters can be broken up into smaller patterns for storage as explained for the case of false positives. For example, a pattern of 126 characters can be broken up into two patterns of length 123 and 3 characters, respectively, and we can then detect this pattern by using the condition that the first and second patterns should be matched consecutively by the same detection unit within three window shifts. Address Generation unit: It employs a hash function and adders to generate the pattern address for the collision RAM by using the hash field and the summation tuples from the detection units. It also contains FIFOs to take care of non-zero EDVs from more than one detection units during the same clock cycle. Controller: It gets the accumulated weight m-tuples from the sub-pattern detection blocks. It reads the respective values from the pattern RAM and compares them with the incoming values. If a match is found, then it informs the next layer.
5 5.1
Results and Comparison with Earlier Work Pre-processing and Simulation Results
All the patterns in the available SNORT rule set (version v2.8, March 30th , 2009) were chosen for analysis to prove the viability of our proposed pattern matching design. This version of SNORT has 15,445 rules with 6456 distinct patterns; the longest pattern contains 122 characters and the median length is 12 characters. The pre-processing job on these patterns was carried out off-line using two C-program scripts. The first script identifies the unique character subpatterns, and creates their corresponding sub-pattern records, hash keys, record addresses, and pattern addresses along with their summation m-tuples. This information is stored into the on-chip RAM. These records are also kept in an
272
N.B. Guinde and S.G. Ziavras
off-line database to facilitate efficiency in future updates involving new patterns. To add new patterns, the second C-program script is run that differs from the first script only in that the available database information is compared with the sub-patterns extracted from the new patterns. For each newly extracted subpattern that already exists in the database, its newly generated bit vectors are bitwise ORed with those of its identical sub-pattern in the database; the results are stored in the on-chip RAM as well as modified in the database. If a newly extracted sub-pattern is not present in the database, then the new sub-pattern along with its bit vectors and other relevant information are stored in the GRP table and pattern RAM. These scripts could be run by the system administrator on the console. It is clear that a hardware implementation requires a fixed N. A trade-off is needed between the hardware complexity and the desired amount of on-chip data compression since L and the number of GRP records decrease with increases in N (hence, the memory consumption decreases). However, as we increase N the logic consumption increases since we need to include more detection units. We also need bigger switching fabric to forward the GRP vectors to the appropriate detection units in a cyclic manner. For a good choice of N, we studied the effects of N on the number of GRP records for SNORT. Since the longest pattern has 122 characters, we could easily obtain L by dividing 122 by N. The results are shown in Table 1. Table 1. GRP table size when varying N for the SNORT database N L GRP(5) 3 41 4 31 5 25 11181
GRP(4) GRP(3) 10135 11235 821 976 717
GRP(2) GRP(1) 705 175 588 126 524 143
Total GRP records 11015 12770 13541
Our hardware realization uses N=3 since it minimizes the number of GRP records and requires the least number of detection units. A choice of N l. In this context, (Ci1 , Rik ) can be regarded as the overall challenge-response pair determined by the structure, and the set C and tmax can be adjusted accordingly. Such feedback loops shift us into a region of absolute delay values (e.g. seconds) where we can maintain security even in the face of unwanted side effects, such as network and transmission delays. Different Adversarial Scenarios. The specification leaves to some extent open which specific resources Eve may employ during her attack. There are several meaningful scenarios, leading to different security notions. 1. C ONSUMER S ECURITY: Eve is assumed to be a private person, possibly very educated in cryptographic and security matters, but with a budget not exceeding one million dollars. 2. T ECHNOLOGICAL S ECURITY: We assume that Eve is allowed to use basically unlimited financial resources, and faces no restrictions other than those induced by current technology. When we say that a SIMPL system is secure in one of the above scenarios, we mean that it remains secure in the sense of Specification 1 if Eve is allowed the described resources. Which type of security we seek strongly depends on the intended application. A SIMPL system that is not technologically secure, but consumer secure might still find very fruitful applications in the consumer market. One should have this fact in mind, and not aim for technological security only when designing SIMPL systems.
3 Protocols and Applications We will now quote one exemplary protocol that can be realized by SIMPL systems in order to illustrate their working principle [1]. A few applications and the advantages of SIMPL systems are briefly discussed, too. 3.1 Identification by SIMPL Systems We assume that Alice, who holds an individual SIMPL system S, has put D(S), Sim, tmax and a description of C in a public register. Now, she can prove her identity to an arbitrary second party Bob as follows [1]: Protocol 2 (Identification of Entities by SIMPL Systems) 1. Bob obtains the information D(S), Sim, tmax , and C associated with Alice from the public register. 2. Bob sends a number of randomly chosen challenges C1 , . . . , Ck ∈ C to Alice. 3. Alice determines the corresponding responses R1 , . . . , Rk by experiment on her SIMPL system S, and returns them immediately to Bob. 4. Bob receives values V1 , . . . , Vk , and measures Alice’s response time (i.e. the time between the two events of sending C1 , . . . , Ck and receiving V1 , . . . , Vk ). If this time is above the threshold 2 · tmax , he aborts the protocol.
282
U. R¨uhrmair et al.
5. Bob checks through simulation by the algorithm Sim if for all i = 1, . . . , k, Vi = Ri . If this is the case, Bob believes Alice’s identity, otherwise not. Security. As usual, k is the security parameter of the protocol. In a nutshell, the protocol works because Eve is unable to determine the values Ri for randomly chosen Ci comparably quickly as Alice, provided that: (i) The lifetime of the system S (and the period since D(S) was made public) does not exceed tC , and (ii) Eve’s accumulated physical access times to S do not exceed tP h . In that case, Eve’s probability to succeed in the protocol without possessing S are less or equal to k . Practicality. Bob can improve his computational efficiency by verifying the correctness of the responses Ri merely for a randomly chosen, smaller subset of {1, . . . , k}. If necessary, possible network and transmission delays can be compensated for in advance by amplifying the absolute time gap between Eve and S through feedback loops (see discussion in section 2). Also the asymmetry between checking a solution and computing a solution may be exploited in future protocols (see section 6.3 of [1]). 3.2 Applications and Advantages of SIMPL Systems Straightforward applications of the above identification protocol include [1]: (i) Identification of hardware and computer systems. (ii) Secure labeling of valuable items, such as branded products, pharmaceuticals, passports, bank notes, credit cards, and the like. (iii) Unclonable (copy protected) representations of digital content and software, digital rights management. (iv) Tamper sensitive hardware environments. The upside of using SIMPL systems in these situations over standard mathematical cryptotechniques or alternative approaches such as Certificates of Authenticity [11] or PUFs has been discussed in detail in [1]. It includes: (i) SIMPL systems do neither contain nor constitute any sort of secret binary information. This makes them naturally immune against any side channel, invasive or malware attack. (ii) They allow protocols that are independent of the standard, unproven number theoretic assumptions (factoring, discrete log). (iii) They have strong practicality advantages over COAs and PUFs, due to their public key nature. (iv) They allow new DRM techniques, or unforgeable labels that can be read out digitally over long distances, and which can be verified offline at the same time [1]. These assets make them a worthwhile target for future investigations. In particular, it would be important to find electrical, integrated implementations — an issue which was left open in [1].
Towards Electrical, Integrated Implementations of SIMPL Systems
283
4 SIMPL Systems from Cellular Non-linear Networks 4.1 Introduction and General Idea A first electrical and on-chip candidate for SIMPL systems are Cellular Non-Linear Networks (CNNs) [22]. If successfully implemented, they would result in a technologically secure SIMPL system (see page 281). CNNs are analog computing arrays with a regular, periodic, cellular structure. The cells are characterized by a dynamical state variable, and their time evolution depends on their own internal state and on the inputs from their neighbouring cells. On an abstract level, their behavior is given and determined by so-called templates, which in the simpliest case are real-valued matrices. On a circuit level, it is given by the transistor architecture of a cell, which implements the behavior specified by the templates. More specifically, each cell is characterized by a dynamical state variable x, which obeys the following, ordinary differential equation (ODE): Ai,j,k,l ykl + Bi,j,k,l ukl + zij x˙ ij = −xij + k,l
k,l
i.e. the time derivative of the state variable (for the cell with i, j indices) depends on the y output of the neighboring cells (denoted by the k, l indices) via a the A cloning templates. Each cell has a bias (z) and inputs, which are coupled by the B template to the equation. As a mathematical model, CNNs are very general; for example, cellular automata [13] can be interpreted as a special CNN which operates on discrete variables in discrete time (and where rules replace the ODE-based description). CNNs are also known to be Turing-complete [14]. CNNs often have multiple layers, and these layers are also coupled to each other via B templates. Due to their analog and highly parallel architecture, CNNs have a remarkable computing power and efficiency. Already in 2004, a state-of-the-art programmable, commercially available CNN in a 0.35-μm standard CMOS technology exhibited peak computing figures of 330 GOPS [23] (or 3.6 GOPS/mm2 and 82.5 GOPS/W in terms of area and power consumption). These numbers are yet excelled by non-programmable CNNs, which we propose for use as SIMPL systems. In specialized tasks, it is known that CNNs can outperform digital computers by a factor of up to 1,000 [24] [25]. CNNs are the largest analog circuits, with the CNN referred to above [23] containing 3.75 million transistors. A further important property of CNNs is that their functionality is especially sensitive to the inevitable variations in the fabrication process, unless special countermeasures are taken. This can make the function FS computed by a CNN S truly unique. At the same time, since CNNs are integrated electrical systems, dedicated on-chip measurement circuitry can determine the fabrication mismatches, and deliver a sufficiently detailed description D(S) to simulate FS . Such types of self-measuring cells are already today in standard use for calibration purposes [26]. Furthermore, it is known that there is a stable regime where the fabrication mismatches determine the CNN behavior, and where they override circuit noise and temperature variations [27] [28]. Altogether, said properties make CNNs quite interesting candidates for SIMPL systems.
284
U. R¨uhrmair et al.
4.2 Implementation We propose two concrete candidates for CNN-based SIMPL systems. Firstly, CNNs employed for specialized tasks (see above), for example image processing tasks, where they are known to outperform classical architectures by factors of 10 – 1,000 [24] [25] [30]. Another attractive option, which we discuss in greater detail, is a template and circuitdesign that has been recently devised in our group [29]. It is inspired by the high internal complexity of optical PUFs [2], in whose time evolution many internal scattering components interact in parallel, leading to a high computational complexity and to laborious simulatability. Our template has the remarkable property that it effectively transfers optical behavior onto a CNN (i.e. onto an electrical integrated circuit), which then behaves quasi-optical, that is, similar to an optical system. In particular, the electrical current flowing through a certain reference point in each CNN-cell is equivalent to the local light intensity in an optical interference reference system. The upcoming figures provide the templates and cell architecture of this 3-layer CNN, as well as simulation results that confirm the quasi-optical behavior. Figure 1 shows the templates and the interaction structure of the proposed 3-layer CNN. Figure 2 illustrates the circuit-level design. Figure 3 provides simulation data which shows the quasi-optical interference patterns in the linear (left) and non-linear/mismatched case (right). Figure 4 illustrates that local changes in the structure propagate globally. This further illustrates the quasi-optical nature and the high computational complexity of the structure: Its evolution involves many interacting subunits in parallel. Template B
Template A 0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
Hx_layer
Ez_layer
Hy_layer
0
0
0
-1
2
-1
0
0
0
0
0
0
1
-2
1
0
0
0
0
1
0
0
-2
0
0
1
0
0
0
0
0
1
0
0
-1
0
0
0
0
0
2
0
0
-1
0
3 x 3 sphere of influence
Fig. 1. Templates and interaction structure of our 3-layer CNN-SIMPL system
The described CNN-design seems particularly suited as SIMPL system because its quasi-optical behavior fosters pairwise interaction between the cells throughout the
Towards Electrical, Integrated Implementations of SIMPL Systems
285
positive-weight feedbacks to the neighbors
OP3 V(output)
-V(output)
R5
OP2 +
R6
R3
negative-weight feedbacks to the neighbors
-
R2
R4
self-feedback (the centering weight)
V(state)
OP1 +
C
feedbacks from all the neighbors
R1
node1
Fig. 2. Circuit level design of our proposed CNN-SIMPL system
Frame 001 ½ 11 Mar 2009 ½ Zuse CNN
Frame 001 ½ 11 Mar 2009 ½ Zuse CNN
80
60
60
Y
Y
80
40
40
20
20
0
0
20
40
X
60
80
100
0
0
20
40
X
60
80
100
Fig. 3. Simulated behavior of the CNN-SIMPL system. The brightness levels illustrate the currents at a fixed reference point in each cell within a 100 × 100 cell structure. Left: Linear case, without fabrication mismatches, and with two excitation sources. Right: Non-linear case, resulting from fabrication mismatches, again two excitation sources. The left picture nicely shows the quasi-optical interference behavior. The non-linear case obviously provides a much more complex and richer regime, which is preferable for our purposes.
286
U. R¨uhrmair et al.
Fig. 4. A difference map that illustrates the global sensitivity of our CNN design to a local change in the structure. We changed only a single template at a particular position (denoted by B in the figure), which was even located far away from the input exciting the structure (marked as In). This altered the global behavior of the circuit detectably. The figure shows the difference of the values Ez1 and Ez2 obtained by two simulations, one for the original value of the templates, the other for one template value in position B altered.
structure. This leads to a particularly strong, inherent parallelism, which will be costly to simulate on digital architectures. Furthermore, as we could show in simulations, the behavior of the quasi-optical SIMPL automatically shifts into a non-linear, highly complex regime through the occurring manufacturing mismatches, which can be exploited even better for our purposes. In opposition to three-dimensional optical PUFs, its description D(S) can be determined by in-built on chip measurement circuitry. Another very important characteristics of our circuit that its behavior is sensitive, but not chaotic. Chaotic circuits are well known [15] and several CNN templates are known to realize chaos [16] [17] [18]. The time trajectories of a chaotic system are irreproducible in a real physical environment and are hence unsuited as a SIMPL system. Security Aspects. A 100 × 100 cell CNN with our architecture leads to the following specific numbers: It requires a description D(S) containing about 104 · 19 template values, which is about 100 kB of information. In order to simulate the real-time evolution which the CNN undergoes in a few microsecond time frame, 104 coupled differential equations need to be solved (i.e., one for each cell). We estimate that this gives us a speed advantage of 10 – 100 to comparable digital computing machines. Please note also that CNNs are very small and energy efficient, allowing their integration into small devices, while classical architectures with comparable computing power will often be distinguishable already by their size on mobile devices such as smart cards or security tokens.
Towards Electrical, Integrated Implementations of SIMPL Systems
287
5 SIMPL Systems from Special SRAM Memories 5.1 Introduction and General Idea One practical and stable, but only consumer secure SIMPL candidate will be presented in this section. It is based on a special design of SRAM memories, which we call “skew design”. Its basic idea is to design the SRAM-cells such that they exhibit varying behavior in different operational voltage regions. Some of the cells (cells of type 1) will function properly over the whole operational voltage range. Others, of type 2, will possess stable read operations, but exhibit (intended) write failures whenever the operational voltage V DD is below a certain threshold. This means that in these V DD regions, the content of the cell is not changed or affected by write procedures. Below the threshold, however, the write operation in cells of type 2 functions properly. Finally, there are cells of type 3, which contain a fixed bit value (0 or 1). It has been hardwired into them already in their fabrication, and their content cannot be changed by any write operation at all, regardless of the applied operational voltage. Now, imagine an SRAM-memory M where cells of the described three types are randomly distributed or mixed. We call such a memory a “skew memory”. Imagine further that on the basis of M , we build a larger hardware system S, which repeats the following feedback loop l times at maximal operational speed. Feedback loop, iteration i: 1. 2. 3. 4.
Write bitvalues bi1 , . . . , bik into the addresses W R1i , . . . , W Rki of M . i i from the addresses READ1i , . . . , READm . Read out the bit values B1i , . . . , Bm Switch to operational voltage V DD(i). i+1 Determine the parameters necessary for the next iteration, namely bi+1 1 , . . . , bk , i+1 i+1 i+1 i+1 W R1 , . . . , W Rk , READ1 , . . . , READm , V DD(i + 1), as a pseudoi random function of the values B1i , . . . , Bm obtained in step 2.
S is depicted schematically in Fig. 5. In order to associate a global input and a global output with S, we may say that the values b01 , . . . , b0k , W R10 , . . . , W Rk0 , READ10 , . . . , 0 READm , V DD(0) that are necessary to start the loop, constitute its global input. After l can serve as the global output of S. the last of the l iterations, the values B1l , . . . , Bm Alternatively, one may define the global output to be a function (e.g. a hash function) of l−q+1 l−q+2 l the values B1l−q+1 , . . . , Bm , B1l−q+2 , . . . , Bm , . . . , B1l , . . . , Bm that occured in the last q iterations of the loop. In this sense, we can interpret the behavior of S as a function FS mapping global inputs to outputs. Then, FS has the following properties: (i) FS can be individualized by changing the design of the memory M . To that aim, for example memory cells of type 3 (fixed bitvalues) can be distributed randomly over the memory in a final fabrication step. (ii) If the distribution of the cells of type 1, 2 and 3 is known, the function FS can be simulated digitally. (iii) The simulation of FS on a standard architecture will be slower than the real-time computation of FS by S. Also configurable hardware or ASICs that are not based
288
U. R¨uhrmair et al. SIMPL System S
Skew Memory GlobalIOutput
Global Input
Feedback Loop, repeated l times
Fig. 5. Schematic illustration of the input–output behavior of S and of the function FS
on a skew design will have a speed disadvantage. In both cases, the speed gap will only be a constant factor, however. (iv) If the special skew design of SRAM cells is legally protected, then an adversary needs his own chip foundry to produce a hardware system that implements FS comparably quickly, since ordering ASICs with a skew design will be legally prohibited. The above properties qualify S as a consumer secure SIMPL system. We will discuss the practical implementation over the next section. 5.2 Implementation A concrete skew design developed in our group [12] is illustrated in Fig. 1a), with width and length specified beside each transistor. The functionality of the design based on TSMC 0.18 μm technology has been succssfully verified with Spectre [31] simulations. The corresponding results are illustrated in Figure 7. In our case, V DDmin = 1.4 V, V DDmax = 1.7 V , and V DDf uncmin = 1.58 V . The memories, which will all share the same layout, can be individualized towards the end of manufacturing by fixing the content of some individually chosen cells to certain values. This means that the resulting structure will not be manufacturer resistant in
Fig. 6. (a) The SRAM cell layout. (b) The basic operation cycle of the SRAM-SIMPL system.
Towards Electrical, Integrated Implementations of SIMPL Systems
289
Fig. 7. Spectre Simulations confirm the desired behavior: Write failures occur at certain voltages, meaning that the content of the SRAM cell remains unchanged in the WRITE operation. At the same time, the READ operation functions properly at all voltages.
the sense of [4], but will at least require a fraudster to possess its own chip foundry. The common SRAM-cell arragement will be contained in the general simulation algorithm Sim, and the individual description D(S) consists of the cells that have been fixed to certain values. Please note that the described individualization can be carried out on the basis of a pseudorandom number sequence, which means that a short, few-hundred bit long random seed s suffices as D(S). The basic implementation of the feedback-loop is sketched in Fig. 1b). The implementation of the pseudo-random generator is carried out by an LSFR, since a LSFR works very quickly. Computationally more laborious PRNGs could perhaps be implemented more quickly by a fraudster in his hardware. He would thereby regain some of his speed disadvantage. Please note that we do not require a PRNG with cryptographic security in this application, but merely a PRNG with a long periodicity, such that as many memory cells as possible are at least once written to or read from in the feedback loop. The relative speed advantage of the real system can be further amplified by activating and writing into multiple word lines during one write cycle. Due to the skew design, the same value written in several lines will not necessarily result in the same cell content. Based on the simulation data we obtained, we estimate that the relative speed advantage of a SIMPL SRAM memory will be a factor on the order of 10, even compared to dedicated, configurable hardware such as FPGAs. At the same time, since all operations on the SRAM-memory are fully digital and well-defined, the content of the memory can be precisely simulated and predicted.
290
U. R¨uhrmair et al.
Compared to optical SIMPLs [1] and CNN-SIMPLs, the great advantage of the SRAM-variant is its practicality and stability. It can be implemented relatively cheaply, integrated in existing systems, and requires only very short descriptions D(S). This comes at the cost of losing their technological security, and exchanging it against consumer security (see page 281). Nevertheless, this seems acceptable in many applications. Security Aspects. Let us discuss a few security relevant aspects. A fraudster who wants to imitate the skew SIMPL systems without a skew architecture has a number of basic possibilities. First of all, he may try to implement the feedback loop in full logic, that is, without any memory cells at all. His hope may be that pure logic operations work faster than memory read and write steps, and that he can so outperform (or at least match) the speed of the original SIMPL. However, if the memory is sufficiently large, then the construction of such a pure logic will be prohibited by size and complexity constraints. This means that the faker needs to employ some sort of memory in his attempts. SRAM memories are, in general, the fastest currently available technology, meaning that the faker should use SRAM cells, too. If he cannot rely on skew cells, however, he cannot obtain the result of the WRITE operation in a skew cell (which is a function of the WRITE value, the actual operational voltage and the type of the cell) within one WRITE step. The faker rather needs to compute the resulting value “by hand” before he writes it into a classical cell. To that end, he needs to look up the type of the cell before writing the value. That costs him one extra read operation before he executes the write procedure. Furthermore, computing the resulting write value “by hand” also costs time. Overall, a faker without a skew memory requires one read operation, some computation and one write operation in order to emulate what happens within one write step of the skew memory. This provides a speed advantage of a factor around 2, as desired. As said earlier, our group currently investigates designs where the SIMPL memory allows to write the same bit block into more than one word line simultaneously. The values that arrive in the multiple lines eventually differ due to the individual skew design of the cells. This could rise the speed advantage to a constant factor on the order of 10.
6 Conclusions SIMPL Systems are a novel security concept, which can be regarded as a public key version of Physical Unclonable Functions [1]. Structurally, they function like a private/public key cryptosystem, with the notable difference that the equivalent to the private key is a physically hard-to-reproduce structure, which does not contain any secret information at all. This leads to critical security and practicality advances. In this paper, we reviewed the basic concepts presented in [1], but mainly focused on promising IC-based implementations of SIMPL systems. Our first idea was to employ large, analog computing arrays as SIMPL systems. They evolve in parallel and by exchanging analog signals between their subunits, creating a significant computational power and complexity. At the same time, the arrays can be
Towards Electrical, Integrated Implementations of SIMPL Systems
291
designed to strongly depend on fabrication mismatches, making the function which they implement individual and unique. We suggested to use cellular, non-linear networks with special templates, since they are the largest currently known analog circuits with up to millions of transistors. We proposed one concrete design on the template and circuit level, and evaluated its functionality in several simulations. One important asset of CNN-based SIMPL systems was that they can eventually lead to technologically secure SIMPL systems. Our second idea was to use special ASICs as SIMPL systems, whose circuit design implements one specific digital function more efficiently than a standard architecture. We suggested special SRAM designs, where the dimensions of the SRAM-cells are varied in such a fashion that their functionality depends on the applied operational voltage. This creates a small, constant computational overhead in the simulation of the cells, especially in the case where many subsequent read and write operations are applied at maximal speed and at quickly varied operational voltages in a feedback loop. The feedback loop also allows us to extend the relative, small computational overhead to larger absolute (but not relative!) time margins. Future work will focus on implementing these structures in silicon, and on the analysis of their concrete time margins over cryptographic adversaries.
Acknowledgements This work was conducted in the course of the Physical Cryptography Project at the TU M¨unchen. Support by the Institute for Advanced Study and the International Graduate School of Science and Engineering of the TU M¨unchen is gratefully acknowlegded. We thank Peter Vogl, Tamas Roska, and Wolfgang Porod for helpful discussions.
References 1. R¨uhrmair, U.: SIMPL Systems: On a Public-Key Variant of Physical Unclonable Functions. Available from IACR Preprint Archive. Report 2009/255, http://eprint.iacr.org 2. Pappu, R., Recht, B., Taylor, J., Gershenfeld, N.: Physical One-Way Functions. Science 297, 2026–2030 (2002) 3. Pappu, R.: Physical One-Way Functions, PhD Thesis, MIT 4. Gassend, B.: Physical Random Functions, MSc Thesis, MIT (2003) ˇ 5. Tuyls, P., Schrijen, G.-J., Skori´ c, B., van Geloven, J., Verhaegh, N., Wolters, R.: Read-Proof Hardware from Protective Coatings. In: Goubin, L., Matsui, M. (eds.) CHES 2006. LNCS, vol. 4249, pp. 369–383. Springer, Heidelberg (2006) 6. Edward Suh, G., Devadas, S.: Physical Unclonable Functions for Device Authentication and Secret Key Generation. In: DAC 2007, pp. 9–14 (2007) 7. Tuyls, P., Skoric, B.: Strong Authentication with PUFs. In: Petkovic, M., Jonker, W. (eds.) Security, Privacy and Trust in Modern Data Management. Springer, Heidelberg (2007) 8. Tuyls, P., Skoric, B., Kevenaar, T. (eds.): Security with Noisy Data. Springer, Heidelberg (2007) 9. R¨uhrmair, U., S¨olter, J., Sehnke, F.: On the Foundations of Physical Unclonable Functions (2009) (submitted), http://eprint.iacr.org/ 10. Feynman, R.P.: Simulating Physics with Computers. International Journal of Theoretical Physics 21(6&7), 467–488 (1982)
292
U. R¨uhrmair et al.
11. DeJean, G., Kirovski, D.: RF-DNA: Radio-Frequency Certificates of Authenticity. In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 346–363. Springer, Heidelberg (2007) 12. Srinivas, B.N.: SRAM for use in Physical Cryptography. MSc Thesis, Department for Electrical Engineering and Information Technology, TU M¨unchen (2009) 13. Wolfram, S.: Statistical mechanics of cellular automata. Rev. Mod. Phys. 55, 601–644 (1983) 14. Roska, T., Chua, L.O.: The CNN universal machine: An analogic array computer. Circuits and Systems II: IEEE Transactions on Analog and Digital Signal Processing 40(3), 163–173 (1993) 15. Kennedy, M.P.: Three steps to chaos. II: A Chua’s circuit primer. IEEE Transactions on Circuits and Systems I: Fundamental Theory and Applications 40(10), 657–674 (1993) 16. Zou, F., Nossek, J.A.: A chaotic attractor with cellular neural networks. IEEE Transaction on Circuits and Systems 38, 811–812 (1991) 17. Ogorzalek, M.J., Galias, Z., Dqbrowski, A.M., Dqbrowski, W.R.: Chaotic Waves and SpatioTemporal Patterns in Large Arrays of Doubly-Coupled Chua’ s Circuits. IEEE Transactions on Circuits and Systems-I: Fundamental Theory and Applications 42(10) (October 1995) 18. Gomez-Gesteira, M., de Castro, M., Perez-Villar, V., Chua, L.O.: Experimental Chua’s Circuit Arrays As an Autowave Simulator. IEEE Transactions on Circuits and Systems-I: Fundamental Theory and Applications 46(4) (April 1999) 19. Yao, A.C.-C.: Classical physics and the Church-Turing Thesis. Journal of the ACM 50(1), 100–105 (2003) 20. Scott Aaronson: NP-complete Problems and Physical Reality. Electronic Colloquium on Computational Complexity (ECCC), 026 (2005) 21. Shor, P.W.: Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer. SIAM J. Comput. 26(5), 1484–1509 (1997) 22. Chua, L.O., Roska, T.: Cellular Neural Networks and Visual Computing: Foundations and Applications. Cambridge University Press, Cambridge (2005) 23. Rodriguez-Vazquez, A., Linan-Cembrano, G., Carranza, L., Roca-Moreno, E., CarmonaGalan, R., Jimenez-Garrido, F., Dominguez-Castro, R., Meana, S.: ACE16k: The Third Generation of Mixed Signal SIMD-CNN ACE Chips Toward VSoCs. IEEE Trans. on Circuits and Systems – I 51(5), 851–863 (2004) 24. Chua, L.O., Roska, T., Kozek, T., Zarandy, A.: CNN Universal Chips crank up the computing power. IEEE Circuits and Devices Magazine 12(4), 18–28 (1996) 25. Cellular Wave Computers for Nano-Tera-Scale Technology – beyond spatial-temporal logic in million processor devices. Electronics Letters 43(8) (April 12, 2007) 26. Roska, T.: Private communication 27. Xavier de Souza, S., Yalcin, M., Suykens, J., Vandewalle, J.: Toward CNN Chip-Specific Robustness. IEEE Trans. on Circuits and Systems – I 51(5), 892–902 (2004) 28. Hillier, D., Xavier de Souza, S., Suykens, J., Vandewalle, J.: CNNOPT Learning CNN Dynamics and Chip-Specific Robustness. In: International Workshop on Cellular Neural Networks and Their Applications (2006) 29. Csaba, G., Ju, X., Chen, Q., Porod, W., Schmidhuber, J., Lugli, P., R¨uhrmair, U.: On-Chip Electric Waves: An Analog Circuit Approach to Physical Uncloneable Functions. Report No. 2009/246 (2009), http://eprint.iacr.org/ 30. Roska, T.: Cellular Wave Computers for Brain-Like Spatial-Temporal Sensory Computing. IEEE Circuits and Systems Magazine 5(2), 5–19 (2005) 31. Virtuoso Spectre Circuit Simulator, Cadence Design Systems, http://www.cadence.com
A Very Compact Hardware Implementation of the KASUMI Block Cipher Dai Yamamoto, Kouichi Itoh, and Jun Yajima FUJITSU LABORATORIES LTD. 4-1-1, Kamikodanaka, Nakahara-ku, Kawasaki, 211-8588, Japan {ydai,kito,jyajima}@labs.fujitsu.com
Abstract. For mobile devices, this paper proposes a compact hardware (H/W) implementation for the KASUMI block cipher, which is the 3GPP standard encryption algorithm. In [4], Yamamoto et al. proposed the method of reducing temporary registers for the MISTY1 FO function (YYI-08), and implemented a very compact MISTY1 H/W. This paper aims to design the smallest KASUMI H/W by the application of YYI-08 to KASUMI, which has a similarly structured MISTY1 FO function. We discussed the applicability and found the problems on register competition and logical equivalence in the simple application, so we propose the new YYI-08 improved for KASUMI and the compact H/W architecture. According to our logic synthesis on a 0.11-µm ASIC process, the gate size is 2.99 Kgates, which is the smallest as far as we know. Keywords: Block cipher, KASUMI, Hardware, ASIC, FPGA, Compact Implementation.
1
Introduction
Recently, mobile devices have included not only the basic functions such as telephone calls and cryptographic function for preventing a wiretapping, but also the additional functions such as digital camera and digital television. Future mobile devices have more additional functions as smart devices, so the CPU load will be increasing. Also, there is required high-throughput for the cryptographic function because of future broadband network. Hence the cryptographic function is more suitable to be implemented in dedicated hardware (H/W) than in software on CPU. The mobile devices have only a limited H/W resource, so circuit size of the H/W must be as small and low-power as possible. This paper focuses on the KASUMI 64-bit block cipher [1]. It is estimated that 80% of the global mobile market is based on second generation mobile communications systems (GSM) [2], and more and more GSM mobile phones use the KASUMI (A5/3). Also, the KASUMI will be widely used in third generation mobile communications systems as the 3rd Generation Partnership Project (3GPP) standard encryption algorithm. It is well known that the KASUMI is suitable for compact H/W implementations. We assume an implementation of a very compact KASUMI circuit is suitable for the future mobile devices with many additional functions. P. Samarati et al. (Eds.): WISTP 2010, LNCS 6033, pp. 293–307, 2010. c IFIP International Federation for Information Processing 2010
294
D. Yamamoto, K. Itoh, and J. Yajima
Hence we aim to implement KASUMI H/W with the throughput of over 100 Mbps, which is enough speed for mobile devices. Also, we aim to implement it with a few Kgates. The H/W is one of the smallest H/W implementation for block ciphers. A number of KASUMI ASIC and FPGA implementations have been studied [8]-[16]. In [8], [10]-[16], the implemented H/W is based on two types of H/W architectures; the pipeline architecture and the loop architecture. These papers aim to improve the processing speed and the H/W efficiency rather than to reduce the gate count. In [9], the implemented H/W is based on the loop architecture for designing the compact circuit. According to the logic synthesis on a 0.13-µm ASIC process, the gate size is 3.4 Kgates, which is the smallest at present. However, the paper did not optimize the size of temporary registers for storing intermediate data in the processing of KASUMI. In general, the 1-bit register has larger gate count than other 1-bit logic gates, such as AND, OR, XOR, and NAND. So, it is very significant for the compact KASUMI H/W to maximally reduce the total bit length of the registers. In this paper, we focus on four strategies for the compact design. First, we choose to implement the H/W by using the half of the FI function. Secondly, extended keys are generated on-the-fly by using shift registers. Thirdly, we use S-boxes implemented in the combinational logic. Fourthly, we optimize the total bit length of the registers, as the main topic of this paper. In [4], Yamamoto et al. proposed the method of reducing temporary registers for the MISTY1 FO function from 32 bits to 16 bits (YYI-08), and implemented a very compact H/W of MISTY1 [5]. KASUMI has a similarly structured MISTY1 FO function. In this paper, we discuss applying YYI-08 to KASUMI in order to reduce the bit length of the registers, and aim to design the smallest KASUMI H/W. In this process, we found some problems on the application, because of the following two differences between KASUMI and MISTY1. First, MISTY1 has the FL function outside of the F-function in Feistel network, while KASUMI has the FL function inside of the F-function. This difference causes the problem of the logic equivalence. Second, it takes 1 cycle for the common compact MISTY1 H/W to execute the FI function, while it takes 2 cycles for the common compact KASUMI H/W. This causes the problem that the additional temporary register is required to execute the FI function. We propose the new YYI-08 improved for KASUMI to solve these two problems. Also, we propose the implemented algorithm and the compact H/W architecture based on the YYI-08 improved for KASUMI. We synthesize our KASUMI H/W by a 0.11-µm CMOS standard cell library, then an extremely small size of 2.99 Kgates with 110.3 Mbps throughput is obtained. Also, we synthesize KASUMI H/W by using XCV300E-8BG432 FPGA device from Xilinx, then a very small size of 332 slices with 44.54 Mbps throughput is obtained. Through the synthesis on both ASIC and FPGA platforms, our KASUMI H/W is the smallest, as far as we know. The rest of the paper is organized as follows. Section 2 explains the algorithm of KASUMI. Section 3 explains the outline of YYI-08 for MISTY1. Our strategy
A Very Compact Hardware Implementation
295
for the smallest KASUMI H/W is discussed in Section 4. We analyze the problems with applying YYI-08 to KASUMI in Section 5. Section 6 proposes the new YYI-08 improved for KASUMI. Section 7 proposes the compact KASUMI H/W architecture base on our proposal. Section 8 evaluates the performance of our KASUMI H/W on both ASIC and FPGA platforms. Finally, we conclude with a summary and comment on future directions in Section 9.
2
KASUMI
Figure 1 shows the entire structure of KASUMI excluding the key scheduler [1]. KASUMI encrypts a 64-bit plaintext using a 128-bit secret key. KASUMI has the 8-round Feistel network with the F-function including FO functions and FL functions connected in series. The F Oi (1 ≤ i ≤ 8) function uses two 48bit extended key, KIi and KOi . The F Li (1 ≤ i ≤ 8) function is used in the encryption and decryption with a 32-bit extended key KLi . In Fig. 1, 16-bit KLi1 and KLi2 are the left and right data of 32-bit KLi , respectively. The F Oi function has three FI functions F Iij (1 ≤ j ≤ 3). Here, KOij (1 ≤ j ≤ 3) and KIij (1 ≤ j ≤ 3) are the j-th (from left) 16 bits of KOi and KIi , respectively. The FI function uses the 7-bit S-box S7 and the 9-bit S-box S9 . Here, the zeroextended operation is performed to 7-bit blocks by adding two ‘0’s. The truncate operation truncates the two most significant bits of a 9-bit string. KIij1 and KIij2 are the left 7 bits and the right 9 bits of KIij , respectively. The extended keys KOi , KIi , and KLi are easily generated by rotating the 128-bit secret key and XORing with constant values.
3
YYI-08
In this paper, the FO function of MISTY1 is implemented based on the assumption that the FI function is executed in 1 cycle, and the FO function is executed in 3 cycles by repeatedly using one FI function module for the compact design. The FO function of MISTY1 differs from that of KASUMI in that the extended key KOi4 is XORed. This XOR operator is non-influential factor for the implemented algorithm of the FO function, so the following discussion excludes this XOR operator. Figure 2 shows two methods of dividing an FO function into three cycles; the straightforward method and YYI-08. The data path in each cycle is illustrated by the thick line. In the straightforward method shown in Fig. 2(I), an FO function is separated horizontally for every cycle, so a 32-bit temporary register is required for left and right 16-bit data. REGL and REGR are two 32-bit data registers in which intermediate data is stored in the encryption process. The 32bit output data from the FO function is XORed with data registers in Cycle3. In the YYI-08 shown in Fig. 2(II), an FO function is separated vertically for every cycle. YYI-08 differs from the straightforward method in that the output data from the FI function in Cycle2 is directly XORed with data registers, which
296
D. Yamamoto, K. Itoh, and J. Yajima 32 16
P
KOi1 KIi1
64
32
32
KL1
KO2, KI2
KL3
KO4, KI4
KL5
KO6, KI6
FL1
FO1
FL2
FL3
FO3
FO4
FL4
FL5
FO5
FO6
FL6
+ +
KOi2
+
+
+ +
i2
+
KOi3 KIi3
+
+
i3
+
KL6
16
FL7
FO7
+
32
FO8
FL8
64
C
KL8
+
+
zero extended
truncated 7
KO7, KI7 16
KO8, KI8
KIij1 KIij2
S7
16 32
KL7
truncated
S9
FI
KO5, KI5
zero extended
S7
FI
KO3, KI3
7
S9
i1
KIi2
KL4
9
FI
KO1, KI1
KL2
FO2
16 16
KLi1 AND
