Security in Ad-hoc and Sensor Networks (Computer and Network Security)

Security Ad Hoc and Sensor Networks in SERIES IN COMPUTER AND NETWORK SECURITY Series Editors: Yi Pan (Georgia State...

Author: Raheem Beyah | Janise Mcnair | Cherita Corbett

104 downloads 1141 Views 5MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

Security

Ad Hoc and Sensor Networks in

SERIES IN COMPUTER AND NETWORK SECURITY Series Editors: Yi Pan (Georgia State Univ., USA) and Yang Xiao (Univ. of Alabama, USA)

Published: Vol. 1:

Security in Distributed and Networking Systems eds. Xiao Yang et al.

Vol. 2:

Trust and Security in Collaborative Computing by Xukai Zou, Yuan-Shun Dai and Yi Pan

Vol. 3:

Security in Ad Hoc and Sensor Networks by Raheem Beyah, Janise McNair and Cherita Corbett

Computer and Network Security Vol. 3

Security

Ad Hoc and Sensor Networks in

Raheem Beyah

Georgia State University, USA

Janise McNair

University of Florida, USA

Cherita Corbett

Sandia National Laboratories, USA

World Scientific NEW JERSEY

•

LONDON

•

SINGAPORE

•

BEIJING

•

SHANGHAI

•

HONG KONG

•

TA I P E I

•

CHENNAI

Published by World Scientific Publishing Co. Pte. Ltd. 5 Toh Tuck Link, Singapore 596224 USA office 27 Warren Street, Suite 401-402, Hackensack, NJ 07601 UK office 57 Shelton Street, Covent Garden, London WC2H 9HE

British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library.

SECURITY IN AD HOC AND SENSOR NETWORKS Computer and Network Security — Vol. 3 Copyright © 2010 by World Scientific Publishing Co. Pte. Ltd. All rights reserved. This book, or parts thereof, may not be reproduced in any form or by any means, electronic or mechanical, including photocopying, recording or any information storage and retrieval system now known or to be invented, without written permission from the Publisher.

For photocopying of material in this volume, please pay a copying fee through the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, USA. In this case permission to photocopy is not required from the publisher.

ISBN-13 978-981-4271-08-0 ISBN-10 981-4271-08-X

Printed in Singapore.

Preface Ad hoc and sensor networks continue to have a growing impact on communication. These cost-effective wireless networks provide location independent computing in environments ranging from military battlefields to in-home patient monitoring systems. However, having real-time connectivity to critical information over an open communication channel requires that the issue of security be addressed. The unconstrained nature of a wireless medium allows for interception, injection, and interference of communication. Moreover, in the absence of centralized infrastructure, nodes must rely on the cooperation of their neighbors to provide data for local processing and to route their processed data. Malfunctions or malicious behavior in ad hoc and sensor networks can cause erroneous results, false alarms, and unaccounted events, crippling the effectiveness of the network. Security solutions for ad hoc and sensor networks are necessary and must be particularly efficient to cope with the constrained resources of these wireless networks. Scope of Book Security in Ad hoc and Sensor Networks provides a comprehensive treatment of security concepts from conventional security services to frameworks for managing security. Security issues discussed include (but are not limited to) attacks, malicious node detection, access control, authentication, anomaly detection, privacy and anonymity, key management, location verification, security architectures and protocols, secrecy and integrity, and network resilience and survivability. This complete book provides an excellent reference for students, researchers, and industry practitioners related to these areas.

v

vi

Preface

Authentication and Confidentiality Part I of Security in Ad hoc and Sensor Networks begins with a discussion on two critical services, authentication and confidentiality. Authentication seeks to prove that a device is who it purports to be, while confidentiality aims to preserve the privacy of data from eavesdroppers. Chapter 1 highlights the requirements needed to provide these services explicitly for ad hoc networks. An analysis of the strengths, weaknesses, and overhead are detailed for numerous symmetric, asymmetric, and collaborative authentication solutions. Similarly, the authors also provide analysis for different types of confidentiality schemes that have been proposed in the literature. The confidentiality schemes described go a bit further than just efficiently encrypting payloads to protect privacy of data, but also seek to preserve the secrecy of the participants of the flow. Chapter 1 concludes with a vulnerability assessment of the wireless security protocols 802.1X and 802.11i, the de facto standards for authentication and confidentiality. The underpinning of many security services, especially authentication and confidentiality, is a secret key. Consequently, mechanisms for establishing, distributing, and revoking keys are critical to the operation of these services. This is particularly challenging for ad hoc and sensor networks because nodes enter/leave the network dynamically and there is no central authority for facilitating these mechanisms. Chapter 2 surveys several key distribution schemes while considering different factors that influence the strategy of a scheme. For instance, implementation of the key distribution scheme may depend on the layer of the protocol stack at which the scheme will operate and on whether the security service is intended for prevention or detection measures. The author of Chapter 2 also evaluates various key distribution schemes based on the storage requirements, network communication bandwidth utilization, and out-of-band communication overhead. Chapter 3 proposes a key predistribution framework that exploits the observation that nodes in the same group are usually close to each other after deployment, a characteristic that relaxes the need to discover the correct location of nodes post deployment.

Preface

vii

Privacy Part II, Privacy, focuses on the threat to the privacy of information and to the privacy of the participants routing the information. Chapter 4 presents a taxonomy of privacy types and discusses how to measure privacy. The authors then focus on location privacy, discussing issues unique to ad hoc, vehicular, and sensor networks while highlighting the state-of-the-art in each area. Chapter 4 concludes with an analytical methodology for the performance evaluation of location privacy solutions. The model accounts for network performance deterioration and other costs associated with location privacy. Chapter 5 proposes an anonymizing routing protocol that seeks to preserve topology and location privacy of ad hoc networks. Using bloom filters, the authors enable anonymity of the source and destination nodes and prevent forwarding nodes from inferring other nodes participating in the route. The authors compare the performance of their protocol to the Ad hoc On Demand Distance Vector (AODV) protocol. The use of wireless sensor networks is emerging in healthcare as a viable solution for continuously and automatically monitoring vital signs in patients. The application of sensor networks to Tele-medicine requires even more restrictive requirements, both legally and technically. Such systems must comply with safeguards (e.g., Health Insurance Portability and Accountability Act (HIPAA)) for protecting the confidentiality and privacy of health information. From a technical point of view, Telemedicine sensors must have lower complexity and energy consumption and are less tolerant of transmission errors than other sensor networks. Chapter 6 proposes a medical privacy-preserving scheme based on NTRU algorithms. The authors present a hardware implementation and a series of optimizations to achieve the required operation speed and low power dissipation. The authors evaluate the performance of their design for a cardiac sensor network. Reliability Part III, Reliability, is about the ability of ad hoc and sensor networks to continue operation in the presence of faults that manifest as malfunctions

viii

Preface

or malicious attacks. Chapter 7 examines the sources and patterns of faults in sensor networks and identifies metrics for fault tolerance. The authors also discuss current schemes for fault prevention and management. Finally, the authors introduce their own management scheme that focuses on fault detection and recovery for cluster-based sensor networks. Reliability in the data measurements resulting from phenomena observed in the environment is essential to the accurate functioning of ad hoc and sensor networks. Because the cost of communication is usually more expensive than computation, it is advantageous for a subset of the nodes to aggregate and process data from neighboring nodes locally and to communicate summary data rather than raw data. However, this type of in-network processing increases susceptibility to erroneous results from faulty nodes or malicious attacks. Chapter 8 explains the types of data anomalies that are unique to this context and surveys the state of the art in distributed anomaly detection schemes. Chapter 9 proposes two techniques for assuring the reliability of data specifically for vehicular ad hoc networks (VANETs). In VANETs, vehicles share traffic information to alert each other of events such as emergencies or traffic congestion. The authors take advantage of the high mobility of vehicles to exploit the low likelihood that vehicles traveling in opposite directions will collude in modifying or forging traffic data. Moreover, a two-directional collusion attack could only occur for the short period of time that the colluding nodes are close to each other. In such a case, subsequent messages would invalidate the malicious data. The authors propose two-directional and time-based schemes to verify the correctness of traffic data in VANETs. Network Management Most security research activity for wireless ad hoc and sensor networks has focused on enhancing specific techniques like authentication, encryption, access control and intrusion detection. Little has been done in developing frameworks for managing security services or upgrading the network post deployment. Part IV, Network Management, seeks to

Preface

ix

integrate powerful lightweight solutions to address these shortcomings, while still adhering to the resource constraints of ad hoc and sensor networks. Security operations such as encryption/decryption, frame error detection, challenge/response messages, and key exchange messages can be expensive. The ability to dynamically prescribe security operations on the basis of need can extend the life of ad hoc and sensor networks. Chapter 10 discusses the latest technologies for policy-based security management that enable this capability in an energy efficient manner. Radio frequency signals have a limited range, and therefore a wireless attacker can only attack nodes in its vicinity. For that reason, not all nodes are susceptible to the same level of attack at the same time. Propagation behavior is one of the concepts the authors explore in applying security at the right place, time and strength. The authors also conduct an analysis of the energy consumption due to computation and communication of security protocols to illustrate the value of their scheme in security management. Additionally, Chapter 10 presents a case study for a policy-based proactive/reactive security management framework. Chapter 11 presents a wireless sensor network authorization specification language (WASL) for expressing policies, which can be efficiently communicated throughout the network. WASL distinguishes between the ability to access data and the authorization to do so. For instance, a class of subjects can be authorized to perform a set of actions on a particular data object. This is particularly beneficial for ad hoc and sensor networks where nodes must rely on neighbors for forwarding data, but do not trust the neighbor to operate on the data. The authors demonstrate the implementation of WASL for three different security policy models. The ability to upgrade existing programs or install new programs post deployment is also essential to the management of ad hoc and sensor networks. A wireless sensor network may need an application patch or new security function added to keep the network operational. It would be impractical to complete this task manually, thus motivating a secure way to do “over-the-air” programming. Chapter 12 surveys recent advancements in dynamic program updates. The authors also propose

x

Preface

two ideas of their own based on the cryptographic hash function and the orthogonality principle. Many of the protocols used to disseminate program upgrades use version numbers to distinguish new configurations from old ones. Under certain faulty conditions the program updates may not stabilize. The implications of non-stabilizing upgrades could cause a wireless network to carry on forever expending valuable resources. Chapter 13 presents a solution to this problem.

Contents Preface.................................................................................................

v

Part 1: Authentication and Confidentiality

1

Chapter 1

Authentication and Confidentiality in Wireless Ad Hoc Networks........................................................... Anjum Naveed and Salil Kanhere

Chapter 2

Key Distribution............................................................. Mahalingam Ramkumar

Chapter 3

Key Pre-Distribution for Sensor Networks Using Group Deployment Knowledge ..................................... Donggang Liu, Peng Ning and Wenliang Du

Part 2: Privacy

3

29

67

103

Chapter 4

Location Privacy ............................................................ 105 Sergio Armenia, Laura Galluccio, Alessandro Leonardi, Giacomo Morabito and Sergio Palazzo

Chapter 5

On-Demand Anonymous Routing (ODAR)................... 137 Lichun Bao, Rex Chen and Denh Sy

Chapter 6

NTRU-Based Confidential Data Transmission in Telemedicine Sensor Networks...................................... 159 Fei Hu, Xiaojun Cao, Kyle Wilhelm, Marcin Łukowiak and Stanisław Radziszowski

xi

Contents

xii

Part 3: Reliability

193

Chapter 7

Fault-Tolerant Wireless Sensor Networks ..................... 195 Xiaoyuan Sherry Li and Janise McNair

Chapter 8

Detecting Data Anomalies in Wireless Sensor Networks ........................................................................ 231 Sutharshan Rajasegarar, Christopher Leckie and Marimuthu Palaniswami

Chapter 9

Reliable Traffic Information Propagation in Vehicular Ad Hoc Networks.......................................... 261 Soyoung Park, Cliff Zou and Damla Turgut

Part 4: Network Management and Configuration

293

Chapter 10 Energy Efficient Network Security Management .......... 295 Sherry Wang, Harold Zheng and Wenye Wang Chapter 11 Wireless Sensor Network Authorization Specification Language: The Formal Models ...................................... 333 David Marsh, Rusty Baldwin and Barry Mullins Chapter 12 Dynamic Program Update in Wireless Sensor Networks ........................................................................ 369 Manik Lal Das and Aakash Joshi Chapter 13 Stabilizing Reconfiguration in Wireless Sensor Networks ........................................................................ 385 Sandip Bapat and Anish Arora

Chapter 1 Authentication and Confidentiality in Wireless Ad Hoc Networks Anjum Naveed and Salil Kanhere School of Computer Science and Engineering University of New South Wales Sydney, Australia, 2052 (anaveed,salilk)@cse.unsw.edu.au The security services of authentication and confidentiality are of significant importance to ensure secure communication in any network. The decentralized nature and the broadcast medium of communication of wireless ad hoc networks results in unique challenges in realizing the services of authentication and data confidentiality. In this chapter, we first highlight the issues relating to authentication and confidentiality in wireless ad hoc networks and identify the characteristics of these services. Subsequently, we discuss the security mechanisms proposed for authentication and confidentiality in wireless ad hoc networks. The chapter also includes a detailed discussion about the standards IEEE 802.1X (Authentication) and IEEE 802.11i (Confidentiality).

1. Introduction A Wireless Ad Hoc Network is a group of low capacity computing devices (laptops, PDAs, etc.) connected through wireless links. These devices are generally mobile with frequent location changes. Communication between the devices can be established anywhere, in a decentralized manner without the support of an established infrastructure. The purpose of ad hoc networks is to enable the mobile device users to share resources, provide services to each other or simply establish a network for communication and information exchange. Ad hoc networks have a number of applications where infrastructure free communication is required. These applications include emergency relief, military operations, on-demand conferencing and home networking. Like any communication network, the true potential 3

4

A. Naveed and S. Kanhere

of wireless ad hoc networks cannot be exploited without considering and adequately addressing the security issues. ITU-T Recommendation X.8003 – Security Architecture for OSI – identifies the required security services for the communication networks. The security services have been broadly categorized into five groups namely authentication, access control or authorization, confidentiality, integrity and non-repudiation. Security management services that have been identified aim at ensuring availability, accountability and event management. Like all communication networks, wireless ad hoc networks require the same set of security services. However, the unique characteristics of ad hoc networks (decentralized communication, heterogeneous nature of devices, high mobility and frequently changing network topology) result in unique challenges to the security of ad hoc networks. The focus of this chapter is the security services of authentication and confidentiality with explicit consideration of the security challenges of wireless ad hoc networks. The security service of authentication provides the assurance that any particular entity (wireless device) is the one who it claims to be. With the perspective of wireless ad hoc networks, the service of authentication is further divided into two components: (i) Access Authentication and (ii) Origin Authentication. The objective of access authentication is to ensure that only legitimate devices can access the network services. This inturn protects the network from illegal access and malicious jeoperdization. On the other hand, the origin authentication ensures that within the authenticated network nodes, a node must be able to prove its identity for every communication session with any other node in the network. This ensures that an authenticated node cannot impersonate another legitimate node in the network. Consequently, the network is protected against misbehaving and compromised nodes. One of the methods used in the Internet for authentication is asymmetric key cryptography. In this cryptographic technique the identity of the user/device is bound with a private and a public key. The public key is known to everyone while the private key is known only to the device that owns the key. Suppose device A intends to communicate with device B, it encrypts the message using its private key and a publically known encryption algorithm. Upon receiving the message, device B verifies if A transmitted the message by decrypting the message using public key of device A. If the message is successfully decrypted (correctness of a message is verified through Cyclic Redundency Check, CRC), the message is considered to be originating from the authentic device A, otherwise, it is assumed that an unauthenticated device is impersonating the device A.

Authentication and Confidentiality in Wireless Ad Hoc Networks

5

Confidentiality ensures that the information transmitted across the network is accessable only by the intended recipients. In the example of the preceding paragraph, to ensure the confidentiality of the information, device A encrypts the message using public key of device B. Upon receiving the message, device B decrypts the message using its private key. In this case, a device can decrypt the message successfully only if it is in possession of valid private key of device B. Since the private key of device B is only known to the device itself, only the device B can decrypt the message successfully, ensuring the message confidentiality. Authentication and confidentiality are discussed together in this chapter because mostly the same method and keying material is used to provide both services. The rest of the chapter is organized as follows. In Section 2 we highlight the issues associated with authentication and confidentiality in ad hoc networks. Section 3 highlights the characteristics of these services for ad hoc networks. Section 4 and Section 5 detail numerous solutions proposed in literature for the services of authentication and confidentiality in ad hoc networks. We analyse the strenghts, weaknesses and overheads of each solution. Section 6 is dedicated to the standardization effort for securing the communication in ad hoc networks. Section 7 enlists the open issues and Section 8 concludes the chapter. 2. Security Issues Relating Authentication and Confidentiality In this section, we highlight the security issues relating authentication and confidentiality that arise from the unique characteristics of wireless ad hoc networks (limited resources, infrastructureless network and high mobility). We also discuss why the solutions proposed for wired networks and wireless local area networks (WLAN) are not feasible for wireless ad hoc networks. Limited resources: The devices participating in a wireless ad hoc network are generally limited in computational and communicational resources. Most of the devices are battery operated with limited battery life. In wired networks, the information confidentiality can be achieved through strong asymmetric cryptographic solutions. However, limited computational resources and battery power render these solutions infeasible for wireless ad hoc networks. There is a tradeoff between the achievable level of security and the resources required to achieve the desired level. Higher level of confidentiality can only be achieved at the cost of scarce computational and battery resources.

6


Decentralized and infrastructureless network: The commonly used method of authentication in the Internet is through digital certificates. The certificates are issued by a centralized certification authority to the nodes within the network. A centrally located authentication server is responsible for validiting the certificates presented by a node. The authentication server maintains a list of valid certificates. However, the decentralized nature of wireless ad hoc networks renders these methods impractical. Furthermore, computationally limited and highly mobile devices are incapable of acting as certification authority or the authentication server. High mobility: One of the methods proposed for ad hoc networks to provide the services of certification authority and authentication is by replicating these services at different network nodes. Such a replication can reduce the overhead involved. However, only a limited number of highy trusted and secure nodes can be assigned the role of certification authority. High mobility of nodes may render such solutions impractical since the service providing nodes can become frequently unreachable by the service requesting nodes. 3. Characteristics of Security Services Based on the issues highlighted in the previous section, the security solutions should posses the following characteristics in order to effectively provide the security services of authentication and confidentiality. • The security services of authentication and confidentiality should induce minimum computational and communicational overhead. • The level of security should be adjustable depending upon the level of resources (computational and battery power) available. • The services should be scalable, considering large sized networks with frequent arrival and departure of the network nodes. • The security services should not rely on any centralized entity, and no assumption should be made about the availability of any kind of infrastructure. • Availability of authentication and confidentiality should be ensured, keeping in view the high mobility of the nodes. • No assumption should be made about the node density while providing the security services. • The security services should be robust against multiple malicious, compromised and misbehaving nodes since such scenarios are


7

frequent in an ad hoc networking environment. Moreover, the services should be resilient against attacks like identity theft, session hijacking, eavesdropping and sybil attacks. 4. Authentication in Wireless Ad Hoc Networks The objective of authentication is to ensure that only legitimate devices can access the network services. The network nodes should be able to identify a malicious device, impersonating a legitimate participant node. Furthermore, if a participant device misbehaves after the trust relationship is established, the authentication mechanism should be able to evict the misbehaving node. Such a node should be denied of any further access to the network services or communication with any legitimate node in the network. A comprehensive analysis of the authentication protocols for wireless networks can be found in Ref. 16. The security techniques used to provide the authentication services can broadly be classified into three categories: (i) Symmetric cryptography, (ii) Asymmetric cryptography, and (iii) Collaborative mechanisms (i.e., Threshold cryptography). In this section, we explain the three categories in detail. We detail different solutions proposed for ad hoc networks based on these techniques with a discussion on the objectives of each solution, the employed approach, and strengths and weaknesses of the proposed solution. We also explain the important aspect of revocation, a mechanism used for evicting the misbehaving nodes or refreshing the authentication material for a compromised node. 4.1. Symmetric Cryptographic Techniques The symmetric cryptographic techniques employ the use of a shared secret key among the participating nodes (pair of nodes intending to communicate or the nodes requesting access to the network) to provide the service of authentication. In its simplest form, a common key is issued to all legitimate nodes in the network. This key can be distributed manually to the participant nodes. Any node in possession of the key can authenticate itself by presenting the key and can access the network or any service offered by the network. The computational and communicational overheads involved in this kind of authentication are negligible. However, symmetric key based techniques are only suitable for small scale networks. The probability of the shared secret key being compromised increases proportionally with the increasing network size. Furthermore, if a single node is compromised,

8


the entire network is compromised. Therefore, the secret key needs to be changed frequently in order to ensure the appropriate level of security. Wired Equivalent Privacy (WEP) protocol: the security mechanism initially employed by the IEEE 802.11i standard for WLAN security4 is predominantly based on the symmetric cryptographic technique. In addition to the issues identified above, a number of additional security issues have been identified. We do not go into details of these issues here. Interested readers are referred to the related publications.20–22 4.2. Asymmetric Cryptographic Techniques Asymmetric cryptographic solutions involve the use of a pair of keys (a public key and a private key) for each participating node. The private key is known only to the node to whom it was issued, while the public key of the node is known to all the participating nodes. These keys are pre-distributed (often before joining the network) to the nodes by a Certification Authority in form of a digital certificate. A digital certificate binds the node identity with the two keys and associates an expiration time with the certificate. The certificate is then signed by the private key of the certification authority to make it tamper proof. To authenticate itself and to access the network services (join the network or start a communication with a member node) a node presents its digital certificate. The existing member nodes can extract the information stored in the certificate by decrypting the certificate using the public key of the certification authority, which is distributed among all participant nodes. The validity of the certificate can then be verified to ensure that the certificate was issued to the node which is presenting the cerificate and that the certificate has not expired yet. If the certificate is valid, the node is allowed to access the services it requested, otherwise, the node is considered a malicious attacker and is denied network access. Note that the certificate of the misbehaving nodes can be revoked. This is achieved through a certificate revocation list that can be maintained at a centralized location where all the revoked certificates can be listed. Several issues specific to ad hoc networks are involved with the above mentioned authentication technique: (i) the decentralized and infrastructure free nature of ad hoc networks make it impractical to have a centralized certification authority; (ii) computational and communicational overhead can be significantly high in case of asymmertic cryptography; and (iii) in the case of misbehaving nodes, certificate revocation can be a callenging task as a centralized certificate revocation list maintainance is impractical.


9

Nevertheless, the strengths of asymmetric cryptographic techniques have encouraged the researchers to employ the technique for authentication and security of wireless ad hoc networks. Several solutions to the above mentioned problems have been proposed in the literature. In Section 4.3, we discuss the techniques that focus on the distribution of the certification authority and authentication server within the network nodes. Section 4.4 details the key revocation mechanisms employed in wireless ad hoc networks. 4.3. Collaborative Mechanisms In this section, we present authentication mechanisms that aim at distributing the role of the certification authority among the participating nodes. The idea of utilizing threshold cryptography for collaborative authentication in ad hoc networks was first proposed by Zhou et al.11 Since then, a number of distributed neighbor collaboration authentication protocols have been proposed by researchers following a similar approach.12–14,17 For example, Deng et al.17 have proposed threshold cryptography based solution for the distribution of the master key . A node in the network is authenticated through its private key. In the proposed scheme, all nodes possess the public key while every node has a share of the private key. The (k,n) threshold secret sharing scheme is employed to generate the private key for a node which states that k out of n shares of private key are required to construct the complete private key and less than k shares of the secret key cannot construct the complete private key. Based on this mechanism, whenever a node needs to refresh its private key, it needs k neighbors to send their secret share to the node to reconstruct the private key, and no node can construct the private key based on its own information. The process of private key generation is shown in the Figure 1 where the requesting node broadcasts the REQU EST message along with its own share for verification. The neighboring nodes reply to the REQU EST message by sending their own share of the secret key to the requesting node. The requesting node is then able to generate the private key on receiving k shares of the key. In this way, an intruding node cannot generate the private key unless its own share of private key is verified by k neighboring nodes. Similarly, the private key of a misbehaving node is not refreshed by the neighbors. Therefore, the threshold secret sharing serves as the strong authentication and key management solution.

10

A. Naveed and S. Kanhere A is dependent on K neighbors for complete private key generation

Reply from k neighbors with their private key share

Fig. 1.

A

Broadcast own private key share

Neighbor collaboration for private key generation in Wireless Mesh Networks.

Note that threshold cryptography is based on the asymmetric crytopgraphy where the private key is distributed among nodes as partial components. Consequently, the computational overheads involved in the schemes detailed above can be significantly higher. The process of combining the partial shares to generate the private key can incur additional delay. Furthermore, if a particular node does not have enough number of neighbors to collect k shares of the private key, its key will be revoked even if the node is legitimate and a well behaving member. Capkun et al.29 have proposed a self-organized public-key management scheme for mobile ad hoc networks. The authors propose that each node issues its own public/private key pair, which binds the node identity with the issued keys. The neighboring nodes of a particular node can verify if a particular public key is associated with the identity of the node that claims the key. Based on this verification a certificate can be issued (signed using private key of the issuing node) and distributed to the nodes within the network. The certificates are issued for a specific time interval and renewed after that interval of time, provided that the identity of the node and the key binding is still trusted. This mechanism works as a distributed certification authority. With random mobility of the nodes and the exchange of certificate repositories, the local certificate repositories of the nodes can quickly grow, establishing the trust relationship with other nodes. The certificates are revoked explicitly if misbehavior or invalid identity-key binding is detected based on inconsistency between the neighboring node repositories. The key authentication of a node v by a node u is performed through chain of certificates as follows: (i) The first certificate of the chain should be directly verifiable by u. i.e., signed by the public key of u. (ii) Each remaining certificate can be verified using public key contained in the previous certificate of the chain. (iii) The last certificate contains the public key


11

of v. The proposed mechanism works without requiring a centralized certification authority or authentication server. However, the proposed system can be throttled by multiple colluding adversaries. Keoh et al.13 have proposed similar credential verification scheme that establishes a web of trust between the nodes. However, the authors suggest the association of different trust levels for each credential verification by the nodes. Furthmore, partial attributes of the XML based Credential Assertion Statements can also be verified by the nodes. Interested readers are referred to the related publication for further details.13 4.4. Certificate Revocation for Wireless Ad Hoc Networks Wireless ad hoc networks are prone to security attacks – where one or few participating nodes are compromised by external adversary to gain network access – due to the broadcast nature of their communication. Furthermore, the cooperative nature of these networks leads to several attacks launched by internal selfish nodes. These misbehaving nodes (compromised or selfish) need to be identified and evicted from the network to ensure secure and smooth operation. The authentication credentials of such nodes should be invalidated and all participating nodes should be informed about this invalidation, ensuring the isolation of the misbehaving nodes from the network. In wired networks, Certificate Revocation Lists (CRL) are maintained at some centralized, publically accessable location.23 This list comprises of the information about the revoked certificates. Network nodes can access the list from a centralized location. Alternatively, the list can be broadcasted at regular intervals to the participating nodes. In wireless ad hoc networks, the assumption of a centralized location is impractical and a single computationally limited node cannot be responsible for maintaining and broadcasting CRL. Furthermore, keeping in view the dynamic nature of wireless ad hoc networks, identification of misbehaving nodes can be a challenging task. This is due to the lack of uniform traffic patterns where anomalies can be detected. Several techniques have been proposed in the literature for identification of misbehaving nodes.2,24 However, misbehavior detection is not the focus of this chapter. We assume that one of these techniques2,24 can be employed to detect the misbehaving nodes. The techniques discussed in the following paragraphs aim at isolating the misbehaving nodes from the network by invalidating their authentication credentials. Claude et al.25 have proposed a certificate revocation scheme for wireless ad hoc networks. The authors propose that each node maintains a CRL

12


and the certificates are revoked by individual nodes. Each node maintains a profile table and a status table. When a node detects the misbehavior of a neighboring node, it launches an accusation against the misbehaving node by broadcasting the certificate identity of the misbehaving node. When a node receives the accusation message, it records the accusation in the profile table with the certificate identity of the accuser, the accused, the status of the certificate as broadcasted by the accuser and date and time of accusation. The message with duplicate accuser and accused certificate ID are ignored. The Status table is constructed from the profile table. It contains the following information: number of accusations against node i, number of accusations by node i, behavior index of node i, weight of i’s accusation, revocation quotient and certificate status of node i. The behavior index of node i is inversely proportional to the number of accusations against it. The weight of its accusation is inversely proportional to its behavior index and the number of accusations it makes against other nodes. The revocation threshold is used to decide if the certificate of the node should be revoked. When a node revokes the certificate of another node in the network, it no longer considers this node as authentic. Its accusations about other nodes are ignored and no communication from this node is trusted. However, the decision of the accusing node does not impact the decision of the neighboring nodes. The proposed method, while simplistic and efficient, involves excessive communication and storage overhead on the nodes. Yang et al.2 have proposed a distributed certificate renewal and revocation technique based on the threshold secret-shared cryptographic technique. The authors have utilized the routing behavior of the nodes to identify the misbehaving nodes. A novel token-based crediting scheme has been proposed. Each participant node is issued a token with a fixed token life when it joins the network. The token serves the purpose of a credential for node authentication. The token of the node expires after a fixed time duration. Just before token expiration, the node requests its neighboring nodes for token renewal. Note that the nodes maintain a credit index of each neighboring node within the network. k out of n neighbors collaborate using threshold secret-shared cryptography (discussed in previous section) to issue a new token to the requesting node. The token expiry time of this newly issued token depends upon the credit of the node. The credit of well behaving nodes gets accumulated over the period of time. Therefore, the token expiry time of these nodes is longer and is linearly incremented every time the node refreshes its token. On the other hand, the token of misbehaving nodes is revoked because enough number of neighbors (k) are


13

not willing to renew the token due to the node’s bad credit. Furthermore, a node with an expired token is unable to participate in the network. 5. Confidentiality in Wireless Ad Hoc Networks We will now analyze different privacy mechanisms proposed for ad hoc networks. For each solution we will address the approach, security issues addressed by the solution, strength of solution, overheads caused and the weaknesses. Wu et al.26 have proposed that the traffic from a source to destination can be split into multiple flows, each following a different routing path. Furthermore, if the traffic is split in a random way, the traffic pattern can be completely concealed from any intermediate adversary. Consequently, traffic confidentiality can be ensured in a multi-hop wireless network. The proposed technique, however, is dependent upon the use of a multi-path routing protocol that can find multiple diverse paths from every source to destination. Moreover, considerable overhead is involved at the destination where packet reassembly from different flows is required. Another drawback of the proposed scheme is that certain component flows will have to use suboptimal and low quality paths, resulting in increased end-to-end delay. Bouam et al.27 have proposed a similar solution that ensures the data confidentiality. The authors have proposed spliting each message (instead of flows) into n − 1 components (n ≥ 3), each component being routed on a separate path. A random number x is generated between 1 and n. Each message is associated with a unique identifier to help the receiver reassemble the message in order. The xth component of the message is encrypted using symmetric encryption and transmitted to the receiver. The remaining n − 1 components are transmitted in pairs using XOR operation with reference to x. The operation is shown in Figure 2 for x = 3 and n = 6. The values of x and n are transmitted on a pre-decided control channel. The transmitted messages are also encrypted using symmetric encryption, resulting in a second level of security. The receiver first receives the xth component and using this component, regenerates the remaining message components by repeatedly applying the XOR operation. The components are then placed in order to regenerate the original message. The proposed technique is flexible because Diversity Coding (which splits a single communicational channel into multiple component channels) can be used instead of multi-path routing. Furthermore, asymmetric cryptography can be used to encrypt each component message to provide stronger level of confidentiality


14

and origin authentication. However, the message spliting and reassembling can introduce considerable computational overhead and additional delay. C1 + C3 C2 + C4 S

C3 C4 + C1

D

C5 + C2 (x,n)=(3,6) Fig. 2.

Message spliting for data confidentiality.

Another technique proposed by Michell et al.28 is a state based key hop protocol based on stream ciphers. The authors have proposed the use of the RC4 algorithm, however, unlike WEP where the state of RC4 is reinitialized for every packet, the authors propose that same seed should be used to generate the streams for a specific duration of time. The issue of a weak key is avoided by using a stream offset. The offset indicates the starting point down the stream from which the packet encryption should start. The two communicating nodes are synchronized such that the nodes know the initial seed for the stream (Base key), duration for which the key remains valid, RC4 states, and the offset. The RC4 states define the offset for the subsequent packets after the first packet is transmitted using initial offset. After the fixed duration, the base key expires and new base keys should be achieved (hence the name key hop) and the states should be re-synchronized by the two nodes. Note that no method is detailed for distribution of the synchronization parameters among the two nodes. The proposed algorithm offers a strong and light weight encryption algorithm and reduced computational overhead. However, the issue of distributing the parameters required for synchronization is not addressed. Knowledge of these parameters can enable an adversary to easily decrypt the entire communication between any pair of nodes. Therefore, a secure method for distribution of these parameters is of utmost importance for the secure operation of the protocol. Soliman and Omari5 have proposed a security framework based on stream cipher for encryption to provide the services of data confidentiality,


15

data integrity, and authentication. This framework ensures per packet mutual authentication between the two communicating nodes within the network. The objective of using stream cipher is to allow online processing of the data. Consequently, minimum delay is introduced because of the security provisioning. Two secret security keys, Secret Authentication Key (SAK) and Secret Session Key (SSK), are used for authentication of the supplicant and authenticator. SAK is exchanged between the supplicant and the authenticator after initial mutual authentication from the authentication server, whereas the SSK is used for a given communication session between the two nodes. The SAK and SSK pair is used by the communicating nodes to generate the permutation vector (PV) which is used for the encryption and decryption of data. In the strongest mode of security, the data is also involved in the PV generation, resulting in the randomness which makes the decryption of the data difficult even if the encryption key of one packet is compromised. The synchronization of the generated permutation vector between the sender and the receiver of the data results in origin authentication of every MPDU. To minimize the security overhead, plain text MPDU is XORed with the PV generated for that MPDU. The authors have proved that the encryption of data using PV provides strong security services of data confidentiality, data integrity, and origin authentication. Junaid et al.15 have proposed a piggyback challenge-response protocol, which relies on Advanced Encryption Standard (AES) in Counter Mode30 for providing data confidentiality. AES in counter mode requires a counter block and an encryption key to encrypt the message. The message is divided into blocks of 128 bits and each block is encrypted using the encryption key and a unique counter block (see Ref. 30 for details). The authors propose the extension to IEEE 802.11i4 key generation mechanism as shown in Figure 3. The temporal key (TK) generated through IEEE 802.11i using four-way handshake is used as seed for the pseudo-random function (PRF128) to generate the initial counter. This initial counter is used as the AES initial counter block, which is linearly incremented to generate subsequent counter blocks. The initial counter is also used as the first nonce N0 , which is transmitted with the first message. Data confidentiality and origin authentication is provided as follows: Suppose node A and node B share a PMK and wish to communicate. Assume that node A initiates the communication by sending an initial message to node B. Node A will use TK as the encryption key for this message. It

16


P airwiseM asterKey(P M K) ? P airwiseT ransientKey(P T K) ? T emporalKey(T K) ? P RF − 128 ? InitialCounterblock/N onceN0

IEEE802.11i

P roposed Extension

? ? CounterM odeAES Fig. 3.

Key generation mechanism.

will encrypt the first message along with the nonce N0 (generated using Fig. 3) and the Meta Data using Eq. (1). ET K (N0 ||Data||M etaData)

(1)

The field Meta Data is used for message integrity and is beyond the scope of this chapter. The intended recipient (node B), upon receiving the message will also generate the initial counter (also the nonce N0 ) using the procedure shown in Fig. 3. It will decrypt the message using Eq. (2), TK being the decryption key. After decryption, node B will compare its own generated nonce value with the received nonce. Since both nodes A and node B share the PMK, the N0 generated should be the same as the N0 which was transmitted as a part of the message by node A. The nonce will act as challenge text to authenticate the source of the message. DT K (ET K (N0 ||Data||M etaData)) = N0 ||Data||M etadata

(2)

Node B will then use N0 as the encryption key for the reply, rather than the TK. PRF-128 will be used to generate a new nonce N1 , which will be concatenated with the data and Meta Data, encrypted using N0 and transmitted back to Node A. Thus, a new nonce is generated iteratively for each subsequent message, which enhances the robustness of the security


N odeA

17

N odeB

ET K (N0 ||Data − 1||M D) EN0 (N1 ||Data − 2||M D) EN1 (N2 ||Data − 3||M D) EN2 (N3 ||Data − 4||M D)

ENi−2 (Ni−1 ||Data − i||M D)-

Fig. 4.

Per frame authentication mechanism.

solution. Node A will employ the aforementioned decryption process to retrieve the message and authenticate (using the response nonce) the sender. The communication between nodes A and B is shown in Fig. 4. In general, the i-th message exchanged between nodes A and node B is encrypted using Eq. (3) and the corresponding decryption process uses Eq. (4). The exchange of the nonce results in a continuous challenge-response protocol, which provides data confidentiality as well as per packet authentication. The per packet authentication protects against MAC spoofing attacks as well as replay attacks. ENi−2 (Ni−1 ||Data||M etaData)

(3)

DNi−2 (ENi−2 (Ni−1 ||Data||M etaData)) = Ni−1 ||Data||M etadata

(4)

6. Standardization Efforts IEEE 802.11i4 is the defined standard for the MAC layer security of the wireless networks. We dedicate this section to discuss the IEEE 802.11i standard. The section begins with the explaination of the security methods used for the services of authentication and confidentiality in the IEEE 802.11i standard. Subsequently, we expose the vulnerabilities in IEEE

18


802.11i that render the standard prone to security attacks. These weaknesses lead to attacks including: pre-computation and partial matching attacks; session hijacking attacks; man-in-the-middle attacks exploiting vulnerabilities in IEEE 802.1X; and DoS attack exploiting vulnerabilities in four-way handshake. We also briefly discuss the proposed prevention mechanisms for these attacks. IEEE 802.11i standard consists of three components: Key Distribution component, Mutual Authentication component, Data Confidentiality, Integrity, and Origin Authentication component. In the following sections, we briefly discuss these components under broad categories of authentication and confidentiality. 6.1. Mutual Authentication Using IEEE 802.1X Standard IEEE 802.11i standard uses IEEE 802.1X6 for key distribution and authentication. IEEE 803.1X relies on Extensible Authentication Protocol (EAP)7 and an authentication, authorization, and accounting server (AAA Server) like RADIUS or DIAMETER8,9 for the purpose. IEEE 802.1X is a port-based access control protocol, which operates in a client-server architecture. When an authenticator (A member node of the network) detects a new supplicant (a node requesting to join the network), the port on the authenticator is enabled and set to the “unauthorized” state for that supplicant. Only 802.1X traffic (EAP messages) is allowed in this state. Any other traffic originating from the supplicant is blocked until after authentication. The authenticator sends out the EAP-Request message to the supplicant, which is replied by an EAP-Response message, containing the preloaded credentials of the supplicant. The authenticator forwards this message to the AAA server. The server may be distributed or replicated on several nodes in the case of wireless ad hoc networks. If the server authenticates the supplicant and accepts the request, it generates Pairwise Master Key (PMK), which is distributed to authenticator and supplicant using EAP messages. After authentication from server, the authenticator sets the port for the supplicant to the “authorized” state and normal traffic is allowed. After successful distribution of the encryption key (PMK) and authentication of supplicant using 802.1X, the supplicant (mobile device) and the authenticator (peer mobile device) mutually authenticate each other. This process is based on the four-way handshake. The four-way handshake is initiated when the two nodes intend to exchange data. Although an encyption


19

key PMK is available to both the supplicant and the authenticator, this key is meant to last the entire session and should be exposed as little as possible. The purpose of four-way handshake is to use the PMK and establish two more keys called the Pairwise Transient Key (PTK) and Group Temporal Key (GTK). The first message of the four-way handshake is transmitted by the authenticator to the supplicant which consists of ANonce. The supplicant uses this ANonce and readily available fields: Supplicant nonce (SNonce); Authenticator MAC address; and Supplicant MAC address, to generate the PTK using cryptographic hash function. The second message of the handshake is transmitted by the supplicant to the authenticator consisting of SNonce and Message Integrity Code (MIC), which is encrypted using PTK. The authenticator is then able to generate the PTK and GTK. The attached MIC is decrypted using the generated PTK. If the MIC is successfully decrypted, then the authenticator and the supplicant have successfully authenticated each other (Mutual Authentication). This is because the authenticator’s generated PTK will only match the PTK transmitted by the supplicant if the two share the same PMK. Third message is transmitted by the authenticator consisting of GTK and MIC. The Last message of fourway handshake is the acknowledgement transmitted by the supplicant. The two nodes can exchange the data after successful four-way handshake. PTK is used to generate Temporal Key (TK), which is used to encrypt unicast messages, while the GTK is used to encrypt broadcast and multicast messages. The four-way handshake (shown in Figure 5) involves generation and distribution of these keys between supplicant and authenticator and also leads to the mutual authentication of the two.

Authenticator

Supplicant ANonce Construct PTK SNonce, MIC

Construct GTK GTK, MIC ACK

Fig. 5.

Four-way handshake.


20

6.2. Confidentiality and Origin Authentication IEEE 802.11i provides two methods for the security services of data confidentiality and origin authentication. First method, Temporal Key Integrity Protocol (TKIP) is the enhanced version of Wired Equivalent Privacy (WEP) and has been provided for backward compatibility with the hardware that was designed to use WEP. RC4 encryption is used in TKIP. We do not discuss TKIP here, interested readers are referred to the Section 8.3.2 of the standard4 for further details. MAC Header Construct AAD Plain text Mpdu

A2, Priority Construct Nonce Data

CCM Encryption

Encrypted data, MIC

||

TK PN KeyID Fig. 6.

Increment PN Construct CCMP Header CCMP encryption process and encrypted frame generation.

The second method is the Counter mode (CTR) with CBC-MAC Protocol (CCMP). CCMP is based on the Counter mode With CBC-MAC (CCM)10 of the AES encryption algorithm. CCM combines Counter (CTR) for confidentiality and the Cipher Block Chaining (CBC) Message Authentication Code (MAC) for origin authentication. CCM encryption takes four inputs, as shown in Figure 6: the Encryption key, Additional Authentication Data (AAD), a unique Nonce for every frame and the Plain text. CCM requires a fresh temporal key (TK) for encryption in every session. AAD is constructed from the MAC header and consists of the following fields: Frame Control field FC (Certain bits masked), Address A1, Address A2, Address A3, Sequence Control field SC (Certain bits masked), Address A4 (If present in the MAC header) and Quality of service Control field QC (if present). CCMP uses the A2 and the priority fields of MAC header along with a 48-bit Packet Number (PN) to generate the unique nonce value for each frame protected by a given TK. PN is incremented for each MAC Protocol Data Unit (MPDU) resulting in a fresh value of nonce for each


21

MPDU. The output of the encryption is the cipher text and the Message Integrity Code (MIC). The frame to be transmitted is constructed by concatenating the MPDU header, CCMP header, cipher text and MIC. CCM encryption is explained in RFC 3610. 6.3. Vulnerabilities in IEEE 802.11i and Security Attacks A number of security vulnerabilities have been identified in the IEEE 802.11i standard. This section details these vulnerabilities, the attacks launched by exploiting the vulnerabilities and the available prevention mechanisms. 6.3.1. IEEE 802.1X Vulnerabilities IEEE 802.1X6 is used for key distribution and authentication in IEEE 802.11i. The process of authentication involves three entities: Authenticator, Authentication Server and the Supplicant. The protocol assumes that the authenticator is always trusted. Therefore, the supplicant does not verify the messages received from the authenticator and unconditionally responds to these messages. This assumption is the security vulnerability that can be exploited by the adversary. The adversary can act as authenticator and launch the session hijacking attack and the man-in-the-middle attack as exposed in Ref. 19. Figure 7 shows how an adversary can launch session hijacking attack by exploiting the explained vulnerability. The adversary waits until the authenticator and the supplicant complete the authentication process and the authenticator sends the EAP success message to the supplicant. Following this, the adversary sends 802.11 disassociate message to the supplicant with the spoofed IP of the authenticator. The supplicant assumes its session has been terminated by the authenticator as the message is not verified for integrity. There onwards, the adversary gains the access to the network by spoofing the MAC address of supplicant and proceeds with mutual authentication procedure using four-way handshake. Figure 8 shows man-in-the-middle attack launched by the adversary exploiting the same vulnerability. After the initial exchange of EAP request and response messages between the supplicant and the authenticator, the adversary sends EAP success message to the supplicant using its own MAC address. Since the IEEE 802.1X protocol suggests unconditional transition upon receiving the EAP success message by the supplicant, the supplicant assumes it is authenticated by the authenticator and changes the state. When the authenticator sends the EAP success message, the supplicant


22

Authenticator

Supplicant EAP Request EAP Response EAP Success

Adversary

Supplicant Authenticated Authenticator’s 802.11 MAC disassociate MAC address spoofed Gains Network Connectivity

Network Traffic

Fig. 7.

Session hijacking attack on 802.1X authentication mechanism.

Authenticator

Adversary

Supplicant EAP Request

EAP Response EAP Success EAP Success

Supplicant Authenticated

Supplicant State Moves Ahead No Action

Network Traffic

Fig. 8.

Man-in-the-middle attack on 802.1X authentication mechanism.

has already passed the stage where it was waiting for the success message and hence no action is taken for this message. The supplicant assumes the adversary as the legitimate authenticator while the adversary can easily spoof the MAC address of the supplicant to communicate with the actual authenticator. Therefore, the adversary will become the intermediatory between the supplicant and the authenticator. The proposed solutions to prevent these attacks19 recommend the authentication and integrity check for the EAP messages between the authenticator and the supplicant. The solution also proposes that the peer-to-peer based authentication model be adopted where the authenticator and the supplicant should be treated as peers and the supplicant should verify the messages from the authenticator during the process of trust establishment. The peer-to-peer model is suitable for wireless ad hoc networks where both the authenticator and the supplicant are wireless peer devices.


23

6.3.2. Four-way Handshake Vulnerabilities Four-way handshake is the mechanism used for the mutual authentication of the supplicant and the authenticator in IEEE 802.11i. Vulnerabilities in the four-way handshake have been identified and the DoS attack exploiting these vulnerabilities proposed in Ref. 18. The handshake starts after PMK is distributed to the supplicant and the authenticator. The supplicant waits for a specific interval of time for message 1 of the handshake from the authenticator. If the message is not received, the supplicant disassociates itself from the authenticator. Note that this is the only timer used by the supplicant. If message 1 is received by the supplicant, it is then bound to respond to every message from the authenticator and wait for the response until it is received. On the other hand, the authenticator will timeout for every message, if it does not receive the expected response within a specific time interval. Further, the supplicant is de-authenticated if the response is not received after several retries. Also note that both the authenticator and the supplicant drop the message silently, if the MIC of the message cannot be verified. Authenticator Msg1: ANonce

Attacker

Supplicant

Msg2: SNonce, MIC

Construct PTK

PTK

Msg1: ANonce’ Construct GTK Msg3: GTK, MIC

Construct PTK’ [PTK overwritten]

PTK

PTK and PTK’ Differ MIC not Verified Protocol Blocked (Attacker sends messages with spoofed MAC address of Authenticator)

Fig. 9.

Denial-of-Service attack on four-way handshake.

This mechanism of four-way handshake is vulnerable to the DoS attack by the adversary. Consider Figure 9 where the authenticator sends the message 1 to the supplicant. Note that message 1 is not encrypted. Supplicant generates a new SNonce and then generates PTK using the ANonce, SNonce and other relevant fields and responds with the message 2, which is encrypted using PTK. At this point, the adversary sends the malicious

24


message 1 with the spoofed MAC address of the authenticator. The supplicant is bound to respond to the message. It assumes that the message 2 that it sent to the authenticator is lost so the authenticator has retransmitted the message 1. Therefore, it calculates PTK (different from PTK and over writing PTK) based on the ANonce sent by adversary and sends message 2 again which is encrypted using PTK . Meanwhile, the authenticator responds to the first message 2 of the supplicant by sending the message 3 that is encrypted using PTK. The integrity check performed by the supplicant on message 3 fails, because the supplicant is now using PTK while the authenticator encrypted the message using PTK. Consequently the fourway handshake process is blocked until the authenticator de-authenticates the supplicant after several retries, denying the supplicant of the service. Three solutions have been proposed in Ref. 18 to prevent the above attack. We only discuss the most effective solution here. Note that every time the supplicant receives message 1, it generates a new SNonce which is concatenated with ANonce (transmitted by authenticator in message 1) and other relevant information to generate new PTK. The proposed solution suggests that the supplicant should store the SNonce created in response to the first message 1 that it receives from authenticator. The same SNonce should be used for all subsequent message 1s until the supplicant receives message 3 from the authenticator. Upon receiving the message 3, supplicant should use the newly transmitted ANonce in message 3 and the stored SNonce to generate PTK again, which should be used to decrypt message 3. Use of same SNonce and ANonce will generate same PTK if other information remains unchanged. Therefore, supplicant will be able to respond to the legitimate message 3 even if it receives multiple message 1s from adversary. Note that the adversary cannot send a malicious message 3 because message 3 is encrypted using PTK, which is dependent on PMK (only known to the supplicant and the authenticator). 6.3.3. CCMP Encryption Vulnerabilities Although CCMP (employed by IEEE 802.11i) uses the CCM encryption, the strength of which is time tested, the protocol is vulnerable to the partial matching and pre-computation attacks. The vulnerabilities of the protocol implementation and the resulting attacks have been exposed in Ref. 15. The research shows that the address field A2 and the priority field of the MAC header and the PN field in the CCMP header are transmitted as plain text in the headers as well as in the encrypted form as part of the MIC. This


25

leads to the partial matching attack and the researchers have shown that the key strength of the 128-bit encryption key used in CCMP decreases. The decrease in the key strength exposes the protocol to pre-computation attack, resulting in the compromise of data confidentiality and data integrity. Further, The CCM encryption is a two phase process. During first phase the MIC is calculated and in the second phase the encryption of the frame takes place. Similarly, the decryption is done in two phases, where first the message integrity is verified from MIC and then the decryption takes place. The two phase processing of the frame at each wireless link may lead to considerable delay in the case of multi-hop wireless networks like wireless ad hoc networks where the data traverses a number of intermediate wireless hops before reaching the wired Internet. The delay introduced by the security services leads to the impracticability of the CCMP protocol for large wireless mesh networks consisting of several intermediate hops. 7. Open Issues The strong security offered by asymmetric cryptography makes it an attractive solution for wireless ad hoc networks. However, the limited computational and communication capabilities of the devices and the unavailability of centralized certification and authentication servers pose challenges for adopting the asymmetric cryptographic solutions for wireless ad hoc networks. A number of light weight security solutions have been proposed as an alternative to asymmetric cryptography, reducing the complexity of security provisioning. However, majority of these protocols do not specify any mechanism for initial credential distribution and verification. Shared secret threshold cryptographic solutions can effectively address the problem of unavailability of centralized certification and authentication server. However, the additional overheads involved in key renewal and partial key accumulation to generate the private key make these solutions less attractive. Consequently, the wireless ad hoc networks have yet to meet a complete security solution for authentication and data confidentiality that is lightweight, distributed and covers all aspects of the two security services including initial credential distribution and verification. 8. Conclusion In this chapter, we considered the two security services of authentication and data confidentiality in wireless ad hoc networks. The security issues

26


relating to authentication and confidentiality, specific to ad hoc networks, have been identified and the characteristics of these services have been outlined. The proposed security solutions for the two services of authentication and confidentiality have been categorized into three categories, depending upon the underlying security techniques. The proposed solutions within each category are discussed in detail. Finally, IEEE 802.11i, standard for wireless security is detailed, its vulnerabilities are highlighted and the solutions proposed for the vulnerabilities are discussed. The chapter ends with a note on the open issues relating the two security issues of authentication and confidentiality in wireless ad hoc networks. References 1. Arunesh Mishra, William A. Arbaugh, An Initial Security Analysis of the IEEE 802.1X Standard, Technical report, university of Marryland. February 2002. 2. Hao Yang, Shu. J, Xiaoqiao Meng, Songwu Lu. SCAN: self-organized network-layer security in mobile ad hoc networks, Appears in: IEEE Journal on Selected Areas in Communications, Volume: 24, Issue: 2, pages 261-273, Februry 2006. 3. Security Architecture for Open Systems Interconnection for CCITT Applications, ITU-T Recommendation X.800, March 1991. 4. IEEE Std. 802.11i-2004, Wireless Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Medium Access Control (MAC) Security Enhancements. http://standards.ieee.org/getieee802/download/802.11i2004.pdf. 5. Hamdy S. Soliman, Mohammed Omari. Application of synchronous dynamic encryption system in mobile wireless domains. In Proceedings of the 1st ACM international workshop on Quality of service and security in wireless and mobile networks (Q2SWinet ’05), Pages 24-30, October 2005. 6. IEEE Std. 802.1X-2004, IEEE Standard for Local and metropolitan area networks - Port-Based Network Access Control June, 2001. http://standards.ieee.org/getieee802/download/802.1X-2004.pdf 7. B. Aboba, L. Blunk, J. Vollbrecht, J. Carlson, H. Levkowetz, Ed., Extensible Authentication Protocol (EAP), RFC 3748, June 2004. 8. C. Rigney, S. Willens, A. Rubens, W. Simpson, Remote Authentication Dial In User Service (RADIUS), RFC 2865, June 2000. 9. P. Calhoun, J. Loughney, E. Guttman, G. Zorn, J. Arkko, Diameter Base Protocol, RFC 3588, September 2003. 10. D. Whiting, R. Housley, N. Ferguson, Counter with CBC-MAC (CCM), RFC 3610, September 2003. 11. L. Zhou and Z. J. Haas. Securing Ad hoc networks, IEEE Network Magazine, 13(6), November/December 1999.


27

12. H. Luo and S. Lu. Ubiquitous and robust authentication services for ad hoc wireless networks, Proceedings of 7th IEEE Symposium on Computers and Communications, July 2002. 13. Keoh, S. L. and Lupu, E. 2002. Towards flexible credential verification in mobile ad-hoc networks. In Proceedings of the Second ACM international Workshop on Principles of Mobile Computing Toulouse, France, October 2002. POMC ’02. 14. J. Kong, P. Zerfos, H. Luo, S. Lu, and L. Zhang, “Providing robust and ubiquitous security support for MANET,” in Proc. IEEE ICNP, 2001, pp. 251-260. 15. M. Junaid, Muid Mufti, M. Umar Ilyas, Vulnerabilities of IEEE 802.11i Wireless LAN CCMP Protocol, Transactions on Engineering, Computing and Technology V11, February 2006. 16. Aboudagga, N., Refaei, M. T., Eltoweissy, M., DaSilva, L. A., and J. Quisquater. Authentication protocols for ad hoc networks: taxonomy and research issues. In Proceedings of the 1st ACM international Workshop on Quality of Service and Security in Wireless and Mobile Networks (Q2SWinet ’05). Montreal, Quebec, Canada, October 2005. 17. Hongmei Deng; Mukherjee, A.; Agrawal, D.P., Threshold and identity-based key management and authentication for wireless ad hoc networks, In proceedings of International Conference on Information Technology: Coding and Computing (ITCC 2004). pages 107-111 Vol. 1, April 2004. 18. Changhua He, John C Mitchell, Analysis of the 802.11i 4-Way Handshake, WiSE’04, Philadelphia, Pennsylvania, USA, October 2004. 19. Arunesh Mishra, William A. Arbaugh, An Initial Security Analysis of the IEEE 802.1X Standard, Technical Report CS-TR-4328, Department of Computer Science, University of Marryland. February 2002. https://drum.umd.edu/dspace/handle/1903/1179?mode=full 20. W. A. Arbaugh. An inductive chosen plaintext attack against WEP/WEP2. IEEE Document 803.11-01/230, May 2001. 21. W. A. Arbaugh, N. Shankar and Y. J. Wan. Your 802.11 wireless network has no clothes. In Proceedings of IEEE International Conference on Wireless LANs and Home Networks, December 2001. 22. N. Borisov, I. Goldberg and D. Wagner. Intercepting mobile communications: the insecurity of 802.11. In proceedings of ACM International Conference on Mobile Computing and Networking, July 2001. 23. R. Housley, W. Polk, W. Ford and D. Solo. Internet X.509 public key infrastructure certificate and certificate revocation list (CRL) profile. Internet Request for Comments (RFC 3280), April 2002. 24. Yi-an Huang, Wei Fan, Wenke Lee, Philip S. Yu. Cross-feature analysis for detecting ad-hoc routing anomalies. Proceedings. 23rd International Conference on Distributed Computing Systems, Pages: 478 487, May 2003. 25. Claude Crepeau and Carlton R. Davis. A certificate revocation scheme for wireless ad hoc networks. Proceedings of first ACM Workshop Security of Wireless Ad hoc and Sensor Networks, 2003.

28


26. T. Wu, Yuan Xue and Y. Cui. Preserving Traffic Privacy in Wireless Mesh Networks. Proceedings of WoWMoM’06, 2006. 27. Souheila Bouam and Jalel Ben Othman. Data security in ad hoc networks using multipath routing, Proccedings of 14th IEEE International Symposium on Personal. Indoor and Mobile Radio Communication, 2003. 28. S. Michell and K. Srinivasan. State based key hop protocol: A lightweight security protocol for wireless networks. Proceedings of PE-WASUN’04, October 2004. 29. Srdjan Capkun, Levente Buttyan and Jean-Pierre Hubaux. Self-organized public-key management for mobile Ad Hoc networks. IEEE transactions on mobile computing, vol 2, no 1, 2003. 30. R. Housley, Using Advanced Encryption Standard (AES) Counter Mode With IPsec Encapsulating Security Payload (ESP), RFC 3686, January 2004.

Chapter 2 Key Distribution

Mahalingam Ramkumar∗ Department of Computer Science and Engineering Mississippi State University, MS 39762 [email protected]† Securing any network calls for mechanisms to facilitate cryptographic security associations between participants. The choice of key distribution schemes that facilitate such security associations mandates consideration of several factors, like the scope and types of security associations required, and the overhead that can be tolerated. The choice of schemes for securing mobile ad hoc networks (MANETs) is especially challenging due to many of its unique constraints. This chapter provides an in-depth look at various factors that influence the choice of KDSs for MANETs. Several schemes are explored with regard to their suitability for MANETs.

1. Introduction Devices forming mobile ad hoc networks (MANETs) cooperate with each other for routing packets. Through mutual cooperation, MANETs eliminate the need for a dedicated infrastructure for routing packets. Due to their reduced dependence on infrastructure, MANETs can be quickly deployed in rural areas where no infrastructure exists. MANETs are also appealing in dense urban areas due to the high cost of acquiring real estate for erecting communication infrastructure.

∗ Mahalingam

Ramkumar has been an Assistant Professor since August 2003. His primary area of research is security solutions for large-scale networks constituted by resource limited devices. † MSU (established in 1862) is a land-grant university, designated as a Doctoral/Extensive institution by the Carnegie Foundation for the Advancement of Teaching. The Dept. of CSE is a part of the Bagley College of Engineering at MSU. 29

30

M. Ramkumar

Securing MANETs calls for proactive strategies to ensure that all participants (mobile devices and gateways) act in a fair manner. One of the important facilitators for such proactive strategies is cryptographic authentication, which depends on key distribution schemes (KDS). From a broad perspective, a KDS for a network is a mechanism for distributing secrets to all subscribers (or entities, or MANET devices, or nodes) that are inducted into the network. The secrets assigned to a node are used for establishing cryptographic security associations (SA) with other nodes. Packets originating from nodes without a valid authentication will simply be disregarded by other nodes. Thus, the secrets assigned to a subscriber confers the eligibility for the subscriber to take part in the network. 1.1. Requirements and Constraints In general, the choice of key distribution schemes for any application has to consider several factors like 1) the scope of cryptographic SAs; 2) different types of SAs that are required; and 3) overhead necessary for this purpose. 1.1.1. Scope of Cryptographic Security Associations Any security solution can be broadly classified into preventive and corrective measures. For MANETs, where every node is expected to adhere to some rules (the rules prescribed by the ad hoc routing protocol) preventive measures may involve use of trustworthy computing modules to ensure adherence to rules. Corrective measures cater to the failure of preventive measures. Corrective measures can include strategies to 1) detect inconsistencies in the routing information supplied by some node; 2) identify misbehaving nodes; and 3) reduce the role of misbehaving nodes in the network - for example, dropping packets from such nodes, or giving preference to routes that do not include misbehaving nodes, or even ejecting such nodes from the network by revoking their privileges. Cryptographic SAs are an important basis for all preventive and corrective measures. Even if all nodes are trustworthy, a node receiving a packet will need to verify that the packet does originates from a trustworthya node, and not from an “external” node, which does not belong to the network. Similarly, in a scenario where a node B receives a packet from a node “claiming to be” A, unless B can verify that the packet does indeed originate from A (by verifying the authentication), none of the corrective measures are feasible. a Secrets assigned to trustworthy devices have to be protected by the device to ensure that no entity can impersonate the trustworthy device.

Key Distribution

31

1.1.2. Types of Security Associations Cryptographic SAs can be broadly classified into two types: one-to-one and one-to-many SAs. One-to-one SAs take the form of a shared secret between two entities. KDSs for this purpose facilitate any two entities to compute a shared secret, either directly, or after some exchanges. A shared secret KAB between A and B can be used by A and B to establish a private channel between them, and for authentication of messages. When privacy is desired, a message M sent from A to B (or vice-versa) is encrypted using the secret KAB . For authentication of the message M sent from A to B (or vice-versa) the sender can append a hashed message authentication code (HMAC) h(M, KAB ), which can be verified by the receiver to establish that the sender has access to the secret KAB , and that the message has not been modified in transit. One-to-many SAs are used for source authentication. Such an authentication appended by the message source A can be verified by any entity. However, one-to-many SAs cannot be used for establishing a private channel. Cryptographic SAs in MANETs can also be classified based on the network layer in which they are used. For example, “application layer” SAs are used for authenticating the contents of application data exchanged between end-points. “Network layer” SAs are used for authenticating routing data. “Link layer” SAs may be used for authenticating packets exchanged between neighboring nodes. 1.1.3. Overhead The overhead for facilitating cryptographic SAs can themselves be classified into several categories like 1) one-time (or infrequent) out-of-network bandwidth overhead for distributing secrets to (or signing public keys of) mobile devices; 2) overhead for storing secrets/certificates; 3) in-network bandwidth overhead for the appended cryptographic authentication, and exchanging certificates (if necessary); and 4) computational overhead for evaluating SAs. In general, different types of overhead have different associated costs. Furthermore, the overhead for establishing SAs may also differ for different network layers. 1.2. Organization In the rest of this chapter several key distribution schemes are reviewed. Their suitability for different types of SAs for different layers of MANETs are explored. In Section 2 we provide an overview of the application

32

M. Ramkumar

model and a brief description of more common key distribution strategies based on asymmetric cryptographic primitives. In Section 3 schemes that employ only symmetric cryptographic primitives are explored in greater detail. In Section 4 different types of overhead mandated for employing cryptographic SAs and associated costs are investigated, considering different constraints unique to MANET devices. Good choice of key distribution schemes for MANETs, the mechanics of how they can be used for efficiently securing MANETs, and different MANET routing protocols, are discussed in Section 5. Conclusions are offered in Section 6. 2. Key Distribution Schemes Any discussion on key distribution strategies is perhaps incomplete without an understanding of the application model that mandates the very need for the key distribution scheme. As a generic example that should cover any MANET based network, we shall consider a scenario involving a fictitious wide-area voice-and-data service provider, Tingular, using MANETs to provide services to mobile users. Due to the low investment required in communication infrastructure, Tingular aims to provide such services at a low cost. For example, Tingular may employ wireless access points deployed at homes as gateways for Internet access. In exchange, subscribers who offer use of their access point to mobile Tingular users, may be provided Tingular services for free (or at a lower cost). Subscribers to the Tingular network can use any handheld computer that 1) can house Tingular’s SIM card (subscriber identification module), and 2) has WiFi capabilities to exchange packets with other mobile computers and gateways. Inducting a subscriber into the Tingular network consists of 1) providing the SIM card, with some secrets, to the subscriber; and 2) providing the software that runs on the mobile computers of subscribers. Once inducted, Tingular computers can find other Tingular computers within range, and form MANETs to reach either gateways to the Internet, or communicate with other Tingular computers. The key distribution schemes described in this chapter thus assume the existence of an infrastructure in the form of an off-line key distribution center (KDC) managed by Tingular. The mobile nodes (with Tingular SIM cards) interact with the KDC only during the initialb induction into the network. b And

perhaps infrequently (once a year) to renew their subscription or for renewing keys and/or certificates.

Key Distribution

33

2.1. KDS Requirements One of the primary considerations for any key distribution scheme is the network size N . From the perspective of the KDC, the network size is the total number of mobile devices that are conferred with secrets, and thereby inducted into the network. For MANETs it is very important to distinguish between the network size N and the size of the ad hoc subnet N . While the total number N of eligible participants (Tingular subscribers) may be several millions, only a small subset of such participants (say tens or hundreds or at most thousands) may find themselves in a specific geographical region, and come together to form an ad hoc subnet. For example, N Tingular devices may find themselves in an airport or a mall, and for a small duration, form an ad hoc subnet either to route packets amongst themselves or to reach gateways. In general, a node will have no prior knowledge of the specific N devices with which it might need to communicate with whilst participating in an ad hoc subnet. Thus every node should have the ability to establish security associations with all N inducted nodes. The use of a trusted mediator (like the Tingular KDC) for this purpose will also be impractical in some scenarios (where access to a gateway to the wide-area network does not exist - for example in a scenario where a set of Tingular subscribers form a subnet in some remote rain forest to communicate amongst themselves). Furthermore, induction of nodes will be a continuous process. For example, a subscriber A may be inducted into the Tingular network at some time t1 , and the subscriber B may be inducted at a later time t2 . However, irrespective of the time at which the nodes where inducted, A and B should be able to establish SAs. Thus key distribution schemes for MANETs should R1 cater to large network sizes (N ); R2 facilitate ad hoc establishment of security associations (without a mediator); and R3 support asynchronous induction of devices into the network. 2.2. Schemes Based on Asymmetric Cryptography Scalable key distribution schemes based on asymmetric cryptographic primitives, which meet all three requirements (R1 to R3), can be broadly classified into certificate based (CB) and identity based (IB) schemes.

34

M. Ramkumar

2.2.1. Certificate Based Schemes In the more conventional certificate based (CB) schemes, every node is associated with a unique ID, a public key, and a private key. Depending on the nature of the MANET, the unique ID could take various forms like MAC address (of the WiFi card), IP address, a telephone number, or SIM card ID. A node with ID A chooses a random private key RA and then computes the public key UA . The private key RA is a secret privy only to the node A. While the public key UA is made public, and can be computed from the private key, it should not be possible for any one to compute the private key RA from the public key UA . However, as the public key provides no information about the identity of the node, a certificate authority (CA) or the key distribution center (KDC) provides a binding between the public key UA and the ID A by issuing a public key certificate. More common CB schemes employ asymmetric cryptographic schemes like RSA, El Gamal or elliptic curve cryptographic (ECC) schemes in conjunction with a CA. Using its key pair, a node A can sign a message by appending a digital signature, which can be verified by any node which has access to the certified public key of A. For authenticated establishment of a shared secret KAB between A and B, both of them exchange their public key certificates. After verifying the public key of B, A can send a secret KA , encrypted using the public key of B. Similarly, B can send a secret KB encrypted using the public key of A. The common secret KAB can be then be computed as KAB = KA ⊕ KB .

2.2.2. Identity (ID) Based Schemes In identity based (IB) schemes the public key of A is simply the ID A. Thus no certificates are necessary to bind the public keys of A to its ID. In IB schemes the KDC chooses some master secrets. Using the master secrets the KDC can compute private keys corresponding to any public key (ID). Thus the private key(s) RA of an entity A are assigned by the KDC to A. With IB schemes two nodes A and B can independently compute a shared secret KAB without exchanging certificates for this purpose. IB public key schemes for encryption and signatures,1 most of which take advantage of pairings in special elliptic curve groups, have attracted substantial attention recently.

Key Distribution

35

3. Schemes Based on Symmetric Cryptography The CB and IB schemes based on asymmetric primitives provide both oneto-one (establishment of pairwise secrets) and one-to-many SAs (in the form of digital signatures). On the other hand, schemes based only on symmetric primitives are less versatile. Some schemes can be used only for establishment of pairwise secrets. Some schemes can be used only for source authentication (and thus cannot be used to establish a private channel). More specifically, ID based key predistribution schemes (KPS) permit two nodes A and B to independently compute a common secret KAB without any exchanges, and without the need for a mediator (after keys have been predistributed to entities by a KDC). In a scenario where A intends to authenticate its message to multiple verifiers, say B, C, and D, node A can append independent HMACs based on individually shared secrets KAB , KAC and KAD respectively. However, in scenarios where the number of verifiers are large, such an approach is inefficient. Furthermore, in scenarios where the A does not have a priori knowledge of the identities of potential verifiers, it is simply not possible for A to append individual HMACs. Several certificate based source authentication schemes employing only symmetric primitives (all of which utilize one-way hash functions) exist for one-to-many SAs, where the authentication appended by a message source can be verified by any verifier. 3.1. CB Schemes for One-to-many SAs Source authentication schemes employing only symmetric primitives include several CB schemes like one-time signature (OTS) schemes, s-time signature schemes, chained OTS schemes, TESLA, and per-use (PU) hash chains. In this chapter we limit ourselves to OTS, TESLA and PU hash chains. 3.1.1. TESLA In the TESLA2 broadcast authentication scheme, a node A chooses a ran0 0 1 L and creates a one-way hash chain {KA , KA , . . . , KA }, where dom secret KA i−1 i KA = h(KA ). The hash chain is associated with two parameters: i) T1 L−1 - an absolute value of time; and ii) a time interval ∆. The value KA is L−2 associated with time T1 , KA with time T2 = T1 + ∆, and more generally, L−i , with time Ti = T1 + (i − 1)∆. The nature of the association is that KA

36

M. Ramkumar

L−i KA should remain A’s secret at least till time Ti . The value KLA is the commitment to the hash chain (analogous to a public key). The KDC or L , ∆, T1 indicating identity of the CA issues certificates of the form A, KA node, and the parameters of its hash chain. To authenticate a message M sent before time Tj = T1 + (j − 1)∆, A L−j from its TESLA chain to compute (and append) employs the value KA L−j L−j ). The value KA is made public by A after the HMAC MA = h(M, KA time Tj . Any node with access to the certified commitment of the sender, receiving the message M with the appended TESLA HMAC before time Tj L−j (when KA was a secret), can verify the message after it gains access to L−j the value KA (after time Tj when the source makes the value public). TESLA based authentication is 1) delay sensitive as verifiers should receive authenticated packets before some time Tj ; and 2) does not facilitate instantaneous verification as verifiers have to wait until the secret is made public.

3.1.2. One-Time Signatures (OTS) In one-time signature (OTS) schemes3 the secret key is used as the starting point for many hash function evaluations. A sequence of intermediate results are determined by the message M to be signed. The intermediate results are presented along with the message as the signature. Any verifier can compute the commitment (public key) using the intermediate results (signature) and the message, and thus verify the signature. In the OTS scheme by Bleichenbacher and Maurer4 to sign a message M, or equivalently, a b-bit hash M of the message M (or M = h(M)), l “primary” hash chains of length k and ls secondary hash chains of length ks are used, where l log2 k = b, and kl < ksls .

(1)

As an example, for b = 80 (M is a 80-bit value) we can choose l = 10 primary chains of length k = 28 = 256 and ls = 2 secondary chains of length ks = 51. Note that kl = 2560 < ksls = 512 = 2601. To generate an OTS key pair, a node A chooses a private key ro . The head values of the l+ls hash chains are derived from a private key ro as Pi0 = h(ro , i, 1), 1 ≤ i ≤ l and Si0 = h(ro , i, 2) for 1 ≤ i ≤ ls respectively. The tail values of the primary chains are Pik , 1 ≤ i ≤ l (obtained by repeatedly hashing each Pi0 k times). Similarly Siks for 1 ≤ i ≤ ls (obtained by repeatedly hashing each Si0 ks times) are the tail values of the secondary

Key Distribution

37

chains. The public key uo is a one-way function of all l + ls tail values (i.e., all tail values are hashed together to yield the public key uo ). The KDC or CA issues a certificate binding the ID A and the public commitment uo . To sign a message M, the originator A computes the b-bit hash M = h(M). The b-bit value M to be signed is interpreted as l log2 k-bit numbers M = [B1 · · · Bl ], 0 ≤ Bi ≤ k − 1. Let l i=1

Bi = X =

l s −1

(ks − ui )ksi

(2)

i=0

where 1 ≤ ui ≤ ks . The signature for the hash M takes the form of l hash values PiBi from the primary chain and ls hash values Siui from the secondary chain. Verification of the signature involves repeated hashing each of the l+ls hashes to derive the tail values of each chain, and combining the tail values together to compute the public key uo . As a more concrete numerical example, let M be a 80-bit value represented as a concatenation of 10 8-bit numbers B1 · · · B10 with numerical values 123 5 8 245 234 200 4 45 221 120. Now l=10

Bi = X = 1205 = 34 × 510 + 23 × 511

i=1

= (51 − 17) × 510 + (51 − 28) × 511

(3)

The signature for M are twelve hashes: 10 hashes from the primary chain 120 ) and two hashes from the secondary chain (S117 (P1123 , P25 , . . . , P9221 , P10 28 and S2 ). The verifier can hash forward the 10 primary chain values 133, 251, . . . , , 35, 136 times (respectively) to arrive at the 10 tail values Pik=256 , 1 ≤ i ≤ 10. The values S117 and S228 are hashed forward 34 and 23 times to yield the tail values S151 and S251 respectively. All twelve values are hashed together to verify that the result is indeed the public commitment u0 . Note that with access to the signature for a message M (or equivalently its hash M ), anybody can compute the primary hash chain values ˆl ] = M where B ˆ i ≥ Bi ∀i. However for ˆ = [B ˆ1 · · · B for “signing” a hash M l ˆ ˆ = î < ui for at least one such messages X i=1 Bi > X. In other words u ˆ cannot value of i. Thus the secondary hash chain values for the message M be computed without access to the private key ro . Similarly, for messages for which the secondary chain values can be computed, computing at least one of l primary chain values will require access to the private key. Thus

38

M. Ramkumar

as long as a key pair is used to sign only one message, only an entity with access to the private key can sign the message. In chained OTS 6 schemes commitments for several OTSs are chained together to form a special hash chain.5 While such schemes are for instantaneous verification, they are delay sensitive. Some s-times signature schemes have also been proposed. Such a scheme with parameters t, k where t m > 2 can be used for signing m-bit messages with O(k) signature size k and O(t) public key size.7 TESLA vs OTS: Consider a scenario where a node C receives a TESLA authenticated message originating from A at some time t and that the key (from A’s TESLA chain) used for authenticating the message is expected to be A’s secret till time t1 ≥ t. At some time t2 ≥ t1 when A reveals the secret, C can now verify that the message did indeed originate from A. However it is not possible for C to prove to another node D (which did not receive A’s message before time t1 ) that the message did indeed originate from A. Thus one practical ramification of the delay sensitivity of TESLA is that TESLA cannot be used for non-repudiation. On the other hand, digital signatures (based on public key schemes) and OTS schemes are i) delay insensitive; and ii) facilitate instantaneous verification. Anyone can verify that the message was sent by A, at any time. Thus such schemes can be used for non-repudiation. However, while a public-private key pair of conventional public key schemes can be used for signing unlimited number of messages, an OTS key pair can be used for signing only one message. Multiple commitments can be efficiently disseminated using Merkle hash trees. 3.1.3. Merkle Tree Both TESLA and OTS require that certified commitments of nodes are “made available” to all potential verifiers. In general, each node may be associated with multiple commitments as i) one commitment is needed for every signed message in OTS schemes; and ii) a TESLA hash chain (corresponding to a commitment) can be used only between a specific interval of time. A Merkle hash tree8 is a useful construct for certifying a large number of commitments using a single commitment (which is provided to all potential verifiers). To commit 2L values using a Merkle tree, a binary tree of depth L is constructed. Figure 1 depicts a Merkle tree for L = 3. The 2L leaves of the tree say, C0L · · · C2LL −1 are first blinded by hashing it once, leaving

Key Distribution

39

2L blinded leaf values V0L · · · V2LL −1 where ViL = h(CiL ). The 2L values V0L · · · V2LL −1 are paired, and each pair are hashed together to create a new value as a commitment for both values (for example, in the figure V12 = h(V23 , V33 )). Thus at depth L − 1 are 2L−1 values V0L−1 · · · V2L−1 L−1 −1 . The 2L−1 values at depth L − 1 of the tree are likewise paired and hashed together to get 2L−2 commitments at depth L−2. The binary tree proceeds this way until a single hash V0O is reached at the root of the tree. The root serves as the commitment for all 2L values. The root value V0O is distributed to all potential verifiers. The 2L leaves are certificates, binding commitments to identities. As each node may be associated with several commitments, several leaves of the tree may be reserved for each node. Corresponding to a node A with (say) nA such certificates (leaves) the CA (or KDC) provides L hashes from the Merkle hash tree to A - one from each level of the tree. Thus A will receive and store i) nA keys; ii) nA certificates; and iii) nA L values from the tree. For a network with 8 million nodes (223 ), where each node is assigned n = 29 = 512 OTS commitments, the KDC will need to create a Merkle tree with 4 billion leaves (or depth L = 32). V00 V01 V02

V11 V12

V22

V32

V03 V13 V23 V33 V43 V53 V63 V73 C0

C1

C2 Fig. 1.

C3

C4

C5

C6

C7

Merkle hash tree.

To authenticate any commitment, the sender appends the leaf value and L hashes. To authenticate certificate C3 (say, a certificate A, uo , indicating that uo is an OTS commitment of A), the source A includes (along with its OTS) the certificate C3 , and values V23 , V02 and V11 . Any verifier can compute V33 = h(C3 ), V12 = h(V23 , V33 ), V01 = h(V01 , V11 ), and V00 = h(V01 , V11 ), and thus be satisfied that the certificate C3 = A, uo is authentic. In the figure, circles with darker shades indicate values appended by A along with its authentication. The circles with lighter shades (and

40

M. Ramkumar

lighter outlines) represent values that are computed by any verifier using the values sent by the signer. Note that the overhead required to verify certificates - bandwidth overhead for appending L hashes and computation of L hash functions - grows logarithmically with the number of committed certificates. If the CA requires to authenticate a trillion (240 ) certificates, L = 40. 3.1.4. Per-use (PU) Hash Chains The one-to-many schemes discussed thus far enable any verifier to verify 1) the source of the message; and that 2) the message has not been modified en route. The per-use (PU) hash-chain schemes however only permit any verifier to verify that “the sender has sent at least i messages,” and provides no assurances regarding the contents of messages (the message could have been modified en route). PU schemes, which require low overhead, have some useful applications in securing routing protocols. Most routing protocols employ a (ID, sequence number)-tuple to identify packets containing (different types of) routing information. When some node C receives a packet indicating a tuple (A, q), it generally updates its routing tables only if the sequence number q is higher than a previously seen routing information packet from A. In a scenario where A has released a packet with sequence number q it is desirable to have measures in place to ensure that no other node but A can create a packet with the tuple (A, q ) with q > q. The PU hash chain schemesc do precisely that. A node with ID A LA −1 0 0 1 , and constructs a hash chain {KA , KA , . . . KA } with chooses a secret KA LA the commitment KA . Note that unlike the TESLA chain, the elements of the PU hash chain are not associated with any absolute value of time or time-interval. Along with the first indexed message (sequence number 1) LA −1 . With message indexed 2, A reveals sent by A, A reveals the secret KA LA −2 , and so on. As the secret is made public along with the the secret KA message, the contents of the message cannot be authenticated using the LA −i accompanies some message secret. However, the fact that a value KA indicating a tuple (A, i), provides an assurance to the verifier that node A has indeed released a routing message with sequence number i.

c Such an approach is used in Ariadne9 for thwarting Route-Request floods, as discussed later in this chapter.

Key Distribution

41

3.2. ID Based Key Predistribution Schemes In ID-based key predistribution schemes (KPS) the KDC chooses a set of P master secrets S. Every mobile device is provided with k secrets. The set of k secrets SA assigned to a device with ID A is based on the ID A and the set of P KDC secrets S. Now A and B (with secrets SA and SB , respectively) can independently compute a pairwise secret KAB . Any one with access to secrets of v entities, say {O1 · · · Ov }, can obviously compute any shared secret of the form KOi X for all 1 ≤ i ≤ v, for any X. However, by pooling together the secrets of entities {O1 · · · Ov }, one may also be able to , illegitimately compute shared secrets of the form KAB when neither A nor B belongs to the set {O1 · · · Ov }. In other words, scalable KPSs are susceptible to collusions. 3.2.1. Deterministic and Probabilistic KPSs Collusion susceptible scalable KPSs can be broadly classified into 1) nsecure deterministic KPSs; and 2) (n, p)-secure probabilistic KPSs. An nsecure deterministic KPS can tolerate an attacker who has pooled together secrets from n nodes. In other words, for an n-secure deterministic KPS, the attacker (who has access to all secrets of n or less nodes) cannot determine any illegitimate shared secret. However, with access to secrets of more than n nodes, the attacker can discover all pairwise secrets. For an (n, p)-secure probabilistic KPS, an attacker who has access to all secrets of n randomly chosen nodes can compute only a fraction p of all illegitimate pairwise secrets. Alternately, an attacker with access to secrets of n nodes can discover any illegitimate pairwise secret with probability p. Note that as long as p is low (say 2−64 ), it is computationally infeasible for the attacker to even determine which illegitimate pairwise secret can be exposed using the secrets pooled from n nodes. For such probabilistic KPS 0 ≤ p(n) ≤ 1 is a monotonic (and increasing) function of n. Deterministic n-secure KPSs can actually be considered as special cases of (n, p)-secure KPSs where p takes only binary values (0 or 1). Mathematically ⎧ =0 x≤n ⎪ ⎪ Deterministic KPSs ⎪ ⎪ x>n ⎨ =1 ⎫ x=0 ⎬ (4) p(x) ≥ 0 ⎪ ⎪ ≥ p(x ) x < x ⎪ Probabilistic KPSs ⎪ ⎩ ⎭ →1 x→∞

42

M. Ramkumar

Thus, while deterministic KPSs fail in a catastrophic manner, probabilistic KPSs fail gracefully. In this chapter we restrict ourselves to one representative scheme from each class - Blom’s deterministic KPS10 and the (n, p)-secure key subset and symmetric certificates (KSSC)12 scheme. 3.2.2. Blom’s Deterministic Scheme The symmetric key generation scheme (SKGS) proposed by Blom10 is based on maximum distance separation (MDS) codes over a finite-field - for example, the finite-field formed by the set of integers Zq = {0, 1, . . . , q − 1} (where q is a prime). The KDC chooses (1) a public primitive element α ∈ Zq ; independent values (2) (n + 1) × (n + 1) symmetric matrix D with n+1 2 (secrets) chosen randomly from Zq . Corresponding to a node with ID A ∈ Zq the KDC computes gA = [gA (0), gA (1), . . . , gA (n)]T , gA (i) = αi×A . A A T SA = DgA = dA = [sA 0 , s1 , . . . sn ]

(5)

The k = n + 1 secrets SA are then provided to A over a secure channel. A T B B B T Nodes A and B (with secrets dA = [sA 0 · · · sn ] and d = [s0 · · · sn ] A T B T respectively) can compute KAB = (d ) gB = (d ) gA (as D is a symmetric matrix). In other words, A and B compute KAB as

n A iB si α mod q by A KAB = i=0 (6) n B iA mod q by B i=0 si α An n-secure SKGS is unconditionally secure as long as n or less nodes pool their secrets together. However, an attacker who has access to secrets secrets chosen assigned to more than n nodes can solve for all P = n+1 2 by the KDC, and thus compute any pairwise secret. 3.2.3. Key Subset and Symmetric Certificates (KSSC) Scheme The concept of symmetric key certificates (SC) was first employed by Davis and Swick11 in the context of Kerberos. An SC is derived by binding some arbitrary descriptor D ∈ {0, 1}∗ (a bit-string of arbitrary length) with a secret key K through a one-way function. For example, KD = ht (K, D)

(7)

Key Distribution

43

is an SC derived from K. Note that an SC is derived in the same manner as a hashed message authentication code (HMAC). Furthermore, like HMACs, SCs can be truncated (say only 64 LSBs of the 160-bit hash is retained). However, unlike HMACs, SCs are treated as secrets. The SC is only privy to the issuer (the entity with secret K) and the entity receiving the SC KD . In the KSSC scheme12 the KDC chooses (1) m master secrets; (2) a hash function h() (for example, SHA-1); and M (3) a pseudo-random function (PRF) fm (), which when seeded by a value yields m uniformly distributed integers between 0 and M − 1. The KDC generates a set of k = mM secrets S = {K(i, j)}0 ≤ i ≤ m − 1, 0 ≤ j ≤ M − 1. For an entity with ID A the KDC computes the PRF M (A) = [a0 · · · am−1 ]. The node A is then assigned a set of m secrets SA fm and a set of mM SCs CA where SA = {K(0, a0 ), K(1, a1 ), . . . , K(m − 1, am−1 )} CA = {KA (i, j) = ht (K(i, j), A)}, 0 ≤ i ≤ m − 1, 0 ≤ j ≤ M − 1. Thus every node receives m secrets and mM SCs. Two nodes A and B can compute 2m common secrets i

B SA = KA (i, bi ), 0 ≤ i ≤ m − 1 and

(8)

i

A SB

(9)

= KB (i, ai ), 0 ≤ i ≤ m − 1

More specifically M (1) A computes {bi } = fm (B) to determine the indices of m of its mM i B SCs SA ∈ CA (where 0 ≤ i ≤ m − 1); B ∈ CA ; (2) B uses its m secrets SB to compute m SCs i SA i A (3) A uses its m secrets SA to compute m SCs SB ∈ CB ; and t (A) to determine the indices of m of its mM (4) B computes {ai } = fm i A SCs SB ∈ CB .

All 2m values are used to derive the pairwise secret KAB , simply by XORing them together: B B KAB = {0 SA ⊕ · · · ⊕ m−1 SA } A A ⊕ · · · ⊕ m−1 SB } ⊕ { 0 SB

(10)

Note that the SCs assigned to any node do not reveal any information about secrets or SCs assigned to other nodes. However, if the pool of secrets accumulated by the attacker includes all m secrets assigned to both A and

M. Ramkumar

44

B, the attacker can compute all 2m SCs used for computing KAB . The probability that the attackers pool of secrets exposed from n entities can be used to compute KAB (or all 2m SCs can be computed by the attacker) is p(n) = (1 − )2m ≈ (1 − e−n/M )2m .

(11)

In general, to realize an (n∗ , p∗ )-secure KSSC (or p(n∗ ) = p∗ ) with minimum k = k ∗ = m∗ M ∗ , we can choose ∗ ) 1 m∗ = log(1/p ∗ ∗ 2 log 2 ⇒ k∗ = (12) ∗ n 2 n log(1/p ) M ∗ = log 2 log 2 2 For example, for m = 32 and M = 216 , (and k = 221 ) we have (1) p(45000) ≈ 2−64 - or an attacker with access to secrets of 45,000 entities can compute only one in 264 illegitimate pairwise secrets; and (2) p(85000) = 2−30 - an attacker with access to secrets assigned to 85,000 entities can compute one in a billion pairwise secrets. 3.2.4. Blom’s Scheme vs KSSC Note that improving the collusion resistance n of Blom’s scheme mandates a linear increase in computational and storage overhead. For achieving nsecurity every mobile device needs to store n + 1 secrets. Computing any shared secret calls for 2(n+1) finite-field multiplications and one finite-field exponentiation. Even for n of the order of a few hundreds, the computational overhead for Blom’s scheme will be comparable to that of public key schemes. On the other hand, for KSSC the computational overhead - comput∗ ) SCs - is independent of n. Only the storage overhead ing m = log(1/p 2 log 2 k = m(M + 1) (for m secrets and mM SCs) increases linearly with n. For example, the scheme with m = 32 and M = 216 is (n = 45000, p = 2−64 )secure. To realize a scheme which is (n = 90000, p = 2−64 )-secure, all we need to do is to double M . The value m (which determines the computational overhead) remains the same (m = 32). Only the storage overhead mM is increased from k = 221 to k = 222 . 3.3. A “Nonscalable” Key Predistribution Scheme Scalable KPSs like Blom’s KPS and KSSC achieve unlimited scalability by tolerating susceptibility to collusions. On the other hand nonscalable

Key Distribution

45

key predistribution schemes, which are not susceptible to collusions, have limitations on the total network size N (the number of entities that can be inducted by the KDC). The most well known of nonscalable KPSs is the “basic” KPS. To support a network of N entities, the KDC chooses N2 pairwise secrets and provides every node with N − 1 secrets. The reason that the scheme does not scale well is due to the O(N ) storage requirement for each node. For many practical networks the total number of subscribers may be limited. For example, for networks within the scope of a large organization, the total number of subscribers may rarely exceed a few million. Almost any conceivable network-enabled mobile device can afford several GBs of pluggable flash storage. Given that storage for a million 64-bit secrets is a mere 8 MB, for many networks the need for O(N ) storage may not be the limiting factor. Unfortunately, even in scenarios where O(N ) storage requirement is not a limiting factor, scalable key distribution schemes are preferable, as the term “scalability” refers to much more than simply the “number of subscribers” that a network can support. Scalable key distribution schemes typically permit seamless induction of new subscribers into the network. For example, with the basic KPS, if a new node is added to the network, the KDC has to provide all existing nodes with a secret to authenticate the new node. While providing the new node with secrets to authenticate all existing nodes is not an issue, it is certainly not convenient to provide all existing nodes with a secret corresponding to the new node. Furthermore, scalable schemes include mechanisms for binding a unique subscriber identifier with the credentials of the user. For certificates based schemes this is achieved by signing certificates that bind the public key with different credentials. For ID based schemes this is achieved by choosing the ID as a one-way function of credentials, or simply by using some special bits in the ID to succinctly represent some credentials associated with the device/user. Note that for scalable ID based KPSs where the secrets assigned to any entity is tied to the ID, an entity with ID A can compute KAB irrespective of when the entity B was inducted to the network. For basic KPS we cannot tie secrets to IDs as the credentials of entities who may be inducted in the future (and thus their IDs) is not known when existing entities are provided with secrets. The modified Leighton-Micali scheme (MLS) proposed recently13 overcomes many of the deficiencies of the basic KPS. Like basic KPS 1) the MLS scheme is not susceptible to collusions; and 2) the total achievable

M. Ramkumar

46

network size N is limited by storage overhead that can be borne by the devices. However MLS permits seamless induction of new subscribers and ID based allocation of secrets. 3.3.1. Modified Leighton-Micali Scheme In the MLS scheme the KDC chooses a master secret K. A node A is inducted into the network by providing the entity with a secret KA = h(K, A)

(13)

In order to establish a secret with B (which is issued a secret KB = h(K, B)) the node inducted later into the network is provided with a public value PAB = h(KA , B) ⊕ h(KB , A)

(14)

For example, if B was inducted after A, only B has access to the public value PAB . The shared secret KAB is computed as

KAB =

by A h(KA , B) h(KB , A) ⊕ PAB by B

(15)

Thus, both A and B can compute a common secret KAB = h(KA , B) without involvement of the KDC. For this purpose, every node is provided as many public vales as the number of nodes inducted into the network earlier. The first node receives only one secret and no public values. The second node receives one secret and one public value. The millionth inducted node receives one secret and 999, 999 public values. On an average, every node will need to store N/2 public values. The network can scale to the extent permitted by storage. It is also intuitively appealing that newly inducted entities will need more storage than older entities. With the current rate of advances in storage capabilities of mobile devices entities inducted in the year 2010 will obviously be able to tolerate more storage than an entity inducted in 2009. The MLS scheme is a modification of an alternative to Kerberos proposed by Leighton and Micali,14 where an online KDC computes public values on demand. Furthermore, unlike the original scheme where the pairwise secret between A and B is different depending on who (A or B) initiates the exchange, in the MLS scheme13 a fixed rule determines how KAB is computed, irrespective of who initiated the exchange.

Key Distribution

47

4. The Cost of Security Associations The price paid for employing cryptographic security associations is the overhead mandated for this purpose. 4.1. Overhead The overhead for using cryptographic SAs can be broadly classified into computational overhead (for computing and verifying cryptographic SAs), bandwidth overhead (both in-network and out-of network overhead), and storage overhead. 4.1.1. Computational Overhead One-to-one SAs: For certificate based public key schemes the computations required for a node A to compute a shared secret KAB are 1) verification of public key certificate of B by verifying the signature of the CA; 2) one public key encryption to convey a secret to B; and 3) one public key decryption to decrypt a secret conveyed by B. For an n-secure Blom’s KPS, computation of KAB will require A to perform 2n finite-field operations. For KSSC, irrespective of the value n the computational overhead for A (to compute KAB ) involves evaluation of tens of hashes. For the MLS scheme, the computational overhead amounts to computing a single hash. Thus for scenarios where low computational overhead is an important requirement, MLS and KSSC are best suited. One-to-many SAs: For certificates based asymmetric schemes, to verify a signature appended by some node C, A will have to verify the public key certificate of C and then verify the signature of C. For one time signatures, the computational overhead amounts to about 1000-2000 hash function evaluations. Signing is typically twice as expensive as verification in terms of the number of hash function evaluations. 4.1.2. In-network Bandwidth Overhead One-to-one SAs: For CB public key schemes, the in-network bandwidth overhead for establishing a shared secret KAB is for exchanging public key certificates (certificates may be a few thousand bits long) and two encrypted challenges (each 1000 bits long). For ID based schemes (scalable KPSs like Blom’s scheme, KSSC, and “nonscalable” MLS) no bandwidth overhead is required for computing a shared secret. Thus for scenarios where low

48

M. Ramkumar

bandwidth overhead is an important requirement, MLS and KSSC are best suited. One-to-many SAs: When public key CB schemes are used for signatures, the bandwidth overhead is for the appended signature and the public key certificate. When one-time signature scheme is used for this purpose, the signature takes the form of a few tens of hashes. In addition, several hashes from a Merkle tree will need to be revealed to authenticate the OTS commitment. For public key CB schemes the overhead for disseminating and verifying certificates can be amortized for several subsequent signatures. However, in OTS schemes where a commitment can be used for only one signature, every signature should be accompanied by several additional hashes for authenticating the commitment. Furthermore, the bandwidth overhead for CB schemes may also be different for different network layers. The in-network bandwidth overhead for appended authentication and exchanging certificates is less of a concern for link layer SAs, as certificates need to be broadcast only once for the benefit of all neighbors. The overhead for this purpose may also be tolerable for application layer SAs as the certificates need to be relayed only over the path between the end-points. However for network layer SAs, where the certificate of some device has to be sent to possibly all mobiles in the subnet, the overhead can be substantial. 4.1.3. Storage and Out-of-Network Bandwidth Overhead Out-of-network bandwidth overhead is for purposes of one-time distribution of secrets/public values to the mobile devices by the KDC. Typically, as such values are also stored by the mobile devices, it is also the storage overhead for devices. For schemes based on asymmetric primitives, the storage overhead is negligible (each device will need to store its private key and certificate). The storage overhead for OTS schemes is higher than public key schemes. Corresponding to every commitment (which can be used only for one signature) each device will need to store a few tens of hashes from a Merkle hash tree (to authenticate the commitment), and the private key. For key predistribution schemes, the out-of-network overhead and storage can be substantial. For scalable KPSs like Blom’s scheme and KSSC, the storage overhead is O(n), irrespective of the network size N . For MLS (which is not susceptible to collusions) the storage overhead is O(N ).

Key Distribution

49

4.2. The Cost of Resources Obviously, different resources have different associated costs. For mobile devices it is advantageous to reduce computational and in-network bandwidth overhead in the interest of prolonging battery life. Out-of-network bandwidth overhead is however, not a severe limitation. For example, during induction, mobile devices could be provided with one secret over a secure channel. One secret could be included in the SIM card provided by Tingular to its subscribers. All other values could be encrypted using the secret, and delivered even over the postal network, by mailing optical disks or flash memory cards, or downloaded from Tingular’s FTP site. Furthermore, while storage overhead for mobile devices was a concern a few years ago, it is obviously not a severe concern now with the dramatically increasing storage capabilities of current mobile devices. Any mobile device can easily afford several GBs of pluggable flash storage. Using a few tens (or even hundreds) of MBs of that storage for keys/certificates is indeed reasonable. Even while the computational abilities of mobile devices has increased to such extents that most devices will be able to support asymmetric computations, it is indeed desirable to limit the use of expensive asymmetric primitives to the extent possible. Apart from placing substantially higher demands on computation and bandwidth, indiscriminate use of asymmetric cryptographic primitives can also lead to simple denial of service (DoS) attacks. For example, attackers can simply send packets with random “signatures.” It is only after expensive computations necessary for verification, can the unfortunate receivers realize that the signature is invalid. In general, MANET devices will need to employ several key distribution schemes for different types of security associations, for different network layers. In other words, every mobile device may be assigned many sets of secrets, used for different purposes. However, as we shall see in Section 4.3, it is desirable to ensure that some secrets assigned to a mobile device are protected even from the user of the device. We shall also see that in such scenarios, it is very much desirable to keep the computational overhead for operations performed with such protected secrets to very low levels. 4.3. Protection of Secrets The computers taking part in any network can be broadly classified into 1) network hosts; and 2) routers. In conventional networks like the Internet, computers have very well defined tasks. Network hosts are clients or servers

50

M. Ramkumar

that exchange application data. The broad purpose of a host is to satisfy the needs of the user employing the host. On the other hand, routers are computers that are entrusted with the task of routing packets between network hosts. Routers thus perform the “selfless” task of serving other hosts. Internet routers are typically managed by organizations with substantial infrastructural backing, and are thus implicitly trusted by all hosts. In contrast, in ad hoc networks, most computers will simultaneously perform the roles of network hosts and routers. It is thus instructive to see every mobile device that takes part in ad hoc networks as consisting of two agents 15 - a user agent, and a network agent. The “selfish” user agent works only on behalf of the owner of the mobile device to send application data to other mobile computers, and thus carries out tasks performed by a host (a client or a server) in conventional networks. The “selfless” network agent works for the entire network to route packets between user agents, and thus performs the task performed by routers in conventional networks. For this purpose network agents are expected to strictly comply with co-operative routing protocols. Ideally, users with selfish interests should not be able to 1) impersonate the network agent to send misleading routing information; or 2) modify the tasks entrusted to the network agent. Thus the network agent tasks should (ideally) be carried out inside the confines of a tamper-responsived trusted boundary. Physical separation between the network and user agents is indeed existing practice in mobile telephone networks, where the network agent of a mobile A is the SIM card provided by the network operator. The user agent can choose any mobile phone operated, manufactured by any vendor. The SIM card, provided by the network operator, is what carries the secrets necessary for the user to take part in the network. Obviously different sets of secrets will be needed for the user and network agents of the same mobile device. More specifically, the secrets assigned to the user agent should be used only for securing application layer data exchanged between end-points. The user agent secrets can be privy to the owner of the mobile. Thus no hardware protection of such secrets are required. It is also desirable that the network operators do not have access to the user’s application layer secrets. After all, end-users rely on the network only for delivering the packets. The network agent secrets should be used for authenticating routing data. It is obviously desirable to ensure that the end-user does not have d Tamper-responsive

computers respond to intrusions by zeroizing their secrets.

Key Distribution

51

access to the network agent secrets. Thus, computations using the network agent secrets should be performed only inside the SIM card. The network agent secrets can, however, be stored encrypted outside the SIM card (encrypted using a secret stored inside the SIM card). In such scenarios, it is desirable to reduce the computational overhead inside the tamper-responsive boundary. Obviously, limiting the network agent to only symmetric primitives has some compelling advantages. In such scenarios the SIM card can consist of an elementary processor with a hardware block-cipher or hash function, which could be re-used for all computations. Low computational overhead translates to low heat dissipation, which in turn implies that strategies for shielding the SIM card from intrusions (aimed at exposing the network agent secrets) will be less constrained. Furthermore, lowering the complexity of the computing engine in the SIM card will also permit easier verification of the integrity of the SIM card. This will permit realization of trustworthy SIM cards, at a low cost. 4.4. User Agent and Network Agent KDSs KSSC and MLS are ideally suited for the network agent as 1) storage for encrypted secrets for KSSC, or public values for MLS, is not an issue; and 2) KSSC and MLS impose very low computational burden inside the SIM card - a few tens of hashes for KSSC, and one hash for MLS. Thus, efficient schemes exist facilitating pairwise secrets between network agents. This fact is, however, not widely appreciated (yet) in the literature. In fact, most secure routing protocols in the literature are based on the premise that one-to-one SAs are expensive. More specifically, protocols which require pairwise secrets have implicitly assumed that asymmetric primitives will be used to establish such secrets. It is for this reason that a popular secure routing protocol, i.e., Ariadne,9 prefers TESLA instead of pairwise secrets, even though using pairwise secrets instead of TESLA has several compelling advantages.16 However, the fact that storage is an inexpensive resource renders schemes for pairwise secrets (like MLS and KSSC) inexpensive. Compared to KSSC and MLS, one-to-many schemes like TESLA and OTS are substantially more expensive. One-to-many SAs can be provided by OTS schemes, digital signatures, or in some scenarios, using TESLA. Even while OTS schemes demand more bandwidth overhead than digital signatures, and demand substantially higher computational overhead compared to KSSC and MLS (order of a thousand hash function evaluations) they may still be preferable for

52

M. Ramkumar

the network agent (compared to digital signatures) as they eliminate the complex circuitry needed for performing public key computations. However, while OTSs can be used by the network agent, it is desirable to limit their use due to their computational and bandwidth overhead. In scenarios where delay sensitivity is not an issue, TESLA, which demands substantially lower bandwidth overhead compared to OTS schemes, can be used for one-to-many authentication. For user agents KSSC (even while it can realize very high levels of collusion resistance) may not be well suited due to lack of proactive measures to protect the user agent secrets. MLS (which is not susceptible to collusions) is obviously preferable over asymmetric schemes for establishment of pairwise secrets (as long as the network size is not prohibitively high, for example, not more than a hundred million). However, in scenarios where one-to-many SAs are required, digital signatures may be preferable to OTS schemes (due to the higher bandwidth requirements for OTS). Nevertheless it is still judicious to limit the use of asymmetric primitives to the extent possible. Furthermore, additional measures will need to be enforced to reduce susceptibility to DoS attacks. 5. Choice of Key Distribution Schemes The secrets assigned to network agents and user agents will be used by the agents for computing/verifying application layer, network-layer and linklayer SAs. More specifically, we would desire to employ 1) the secrets protected by the SIM cards to authenticate all routing data; and 2) the secrets assigned to the user agent for authenticating/protecting the privacy of application layer data exchanged between end-points. The specific choice of KDSs will need to consider trade-offs between cost and requirements. From the perspective of cost we would ideally like to limit network agents to KSSC or MLS, and user agents to MLS, as (arguably) storage is the cheapest of all resources. We would also like to avoid one-to-many associations (like digital signatures, one-time signatures and TESLA) to the extent possible. However, there are many scenarios where the use of one-to-many SAs are necessary. More specifically, one-to-many schemes are compelling in scenarios where the number of potential verifiers are large. Furthermore, they are unavoidable in scenarios where the sender does not know the identities of the potential verifiers. In this section we shall investigate such specific scenarios where the use of one-to-many SAs is either compelling or

Key Distribution

53

mandatory. In such scenarios it is obviously desirable to limit the network agent to employ OTS, TESLA, or PU hash chains. However, the specifics of how they can be used to authenticate routing data will depend on the specific nature of the routing protocol. 5.1. Brief Overview of MANET Routing Protocols Similar to routing protocols for wired networks, MANET routing protocols can also be broadly classified into distance-vector (DV) and link-state (LS) based approaches. In LS based protocols the link-state of every node indicating the sender, a sequence number, lifetime of the packet, and a list of neighbors, is sent to all nodes in the subnet. This will enable every node to determine the entire topology of the subnet, and thereby compute the shortest path to any destination. Such LS packets (with increasing sequence numbers) are created and sent periodically to keep up with dynamic changes in topology. In the table-based DV approach every node periodically sends a table to all its neighbors indicating the distance to every node in the subnet. In each period, the table sent by a node is accompanied by a fresh sequence number. Nodes which have no knowledge of other nodes (for example, a node which has just entered a subnet) will also send a “table” with one row indicating the “distance to itself (0),” and a sequence number. Eventually, every node in the subnet will be able to determine the shortest path to forward a message to all other nodes in the subnet. However (unlike LS based approaches), nodes do not get to know the complete topology of the subnet or even the complete path to the destination. Every node can only determine the best next-hop neighbor for sending a packet to any destination. A third approach to routing is flooding, where the sender simply floods a message (with a sequence number) to all its neighbors. The neighbors in turn flood the message to all their neighbors, and so on. The sequence number is used to keep the flooding in check - every node will rebroadcast a packet indicating the same (source, sequence number)-tuple only once. Ad hoc routing protocols, which typically employ variants of the three basic routing principles, and most often, a combination of the three basic strategies, can be broadly classified into on-demand and proactive protocols. Proactive protocols use LS18 or DV17 based strategies to maintain a consistent view of the dynamic topology at all times. Reactive or ondemand protocols maintain either no information or partial information

54

M. Ramkumar

about the subnet topology. More specific information is determined as and when required, usually by flooding requests to obtain missing topology information. For example, in the ad hoc on-demand DV (AODV) protocol,19 every node proactively maintains only the one-hop topology information. Whenever a node S desires to send some message to D, S floods a Route-Request (RREQ) packet indicating a sequence number, the destination D, the maximum number of hops to which the RREQ can be flooded, and a hop-count field (initialized to zero). Every node that rebroadcasts the packet increments the hop-count field by one. The destination D, or some node with the knowledge of a route to D, can instantiate a Route-Response (RREP) packet. Following the receipt of RREP by the source S, even while no node in the path is aware of the complete path between S and D, every node in the path learns the distance (hop-count) to D, and the next hop in the path to D. In the on-demand dynamic source routing (DSR) protocol,20 nodes do not proactively maintain any topology information. A source S seeking to send a message to a destination D invokes a RREQ packet indicating the source, sequence number, the destination D, and the maximum number of hops. Every node rebroadcasting the RREQ inserts its ID / address in the RREQ. When the RREQ reaches the destination, or some node with the knowledge of a path to the destination, an RREP is invoked. As the RREP includes the complete path between S and D, every node in the path learns the complete path from S to D. 5.2. Authentication of Routing Data Consider a scenario where a node S sends some routing information. As the routing data will be authenticated by the network agent, the authentication strategies should ideally be restricted to symmetric cryptographic primitives. If the information is meant for a single node (say R), the information can be efficiently authenticated using a HMAC based on the shared secret KSR (facilitated by MLS or KSSC). If this information is meant for all neighbors of S (Q, R and T ) this can still be authenticated by appending independent HMACs - one for each neighbor. Alternately the node S can convey a one-hop group secret to all its neighbors, and use the secret for encrypting/authenticating all routing data sent by S.

Key Distribution

55

In many scenarios it may be required for a node S to authenticate the routing data to all nodes that are two-hops away. A common requirement for popular neighborhood discovery protocols (like IMEP21 and the more recent NHDP22 ) used in conjunction with MANET routing protocols is for every node to advertise its neighbor list to all its neighbors. Thus every node will come to be aware of all nodes two hops away (neighbor’s neighbors). In such cases it is still possible for nodes to individually convey a two-hop group secrete to all such nodes by encrypting it using individually shared secrets facilitated by KSSC or MLS. If some scenarios however, the routing information may be meant for consumption by all nodes in the subnet. It is in such scenarios it becomes necessary to employ one-to-many authentication schemes. Unfortunately one-to-many schemes demand substantially more overhead compared to KSSC and MLS. In particular, OTS schemes, for which one key pair can be used only for one signature, is both bandwidth and computation intensive, and its use should be restricted to the extent possible. Thus, to the extent possible, we should attempt to employ less demanding schemes like TESLA and PU hash chain. For certifying the commitments for such chains, nodes could employ OTS schemes. For example, every node could be associated with a limited number of OTS key pairs (a few hundred). Nodes can then periodically construct several TESLA and PU chains and use one of its OTS key pairs to authenticate such commitments. When using TESLA and PU schemes it is however necessary to keep the limitations of such schemes in mind - the time-sensitivity of TESLA, and that PU schemes do not provide any assurance regarding the integrity of the message. 5.2.1. Redundancies in Routing Protocols Mandating authentication reduces the degrees of freedom for attackers. For example, if authentication is not mandated, any node can send any packet claiming any fictitious identity. With authentication, S cannot send routing data impersonating some node X. Cryptographic authentication appended by S provides an assurance that the information does indeed originate from the claimed sender S (or more specifically, some entity with access to the secrets of S), and that it has not e Du

et al. have23 propose such a strategy where the secret is conveyed to two-hop nodes using pairwise secrets established using public key schemes. Using MLS or KSSC for this purpose renders the overhead for this purpose substantially lower.

56

M. Ramkumar

been modified en route. However, the fact that the routing data from S has been authenticated does not imply that the information itself is accurate. In a scenario where the information sent by S is that “node D is five hops from S” there is nothing to convince the receiver that this information is indeed true. A malicious S can send some routing data indicating “D is 10 hops away” or some non-existent node “Y is 3 hops away”. However, if the verifier (the receiver of the routing data from S) can independently verify from sources other than S, that D, is indeed 5 hops away from S, then the verifier has more confidence in the routing information sent by S. Without such redundancies, there is nothing that prevents a node from sending deliberately misleading routing information. One common approach to include this desirable redundancy (with reasonable overhead) is by carrying over authentication. In such a scenario, the information sent by S may be of the form “node D is five hops from S, and the next node in the path to S is Q.” To support its claim, node S also provides a message sent by Q claiming that “D is four hops from Q, and S is a neighbor of Q,” duly authenticated by Q. Thus the authentication appended by Q is carried over such that two-hop neighbors of Q can verify the appended authentication. 5.2.2. Distance Vector Protocols For DV based approaches the routing data disseminated by a node to its neighbors consists of several rows, each row indicating the distance to some node in the subnet. Unlike LS approaches where the routing data (LS packet) originating from a node is carried without any modifications to all nodes in the network, the routing table advertised by a node (in DV) is only sent to its neighbors. As every node will be aware of its neighbors, and the number of neighbors are typically small, authenticating the routing table to all neighbors can be easily accomplished by appending individual HMACs for each neighbor. In other words, one-to-many SAs are not necessary for this purpose. To reduce the freedom of attackers to send misleading information, it is desirable to carry over authentication. For each row of the table, one HMAC may be appended using the two-hop group secret. More specifically, when S receives a routing table update from Q, it includes a row corresponding to a node D (four hops away from Q and five hops from D), and a HMAC appended by Q for verification by other neighbors of S (or two-hop neighbors of Q). Similarly when D sends a table that includes

Key Distribution

57

the row D it encloses the HMAC appended by Q, which will be verified by neighbors of S, and a HMAC appended by S, which will be verified by two-hop neighbors of S. It is important to note that carrying over authentication, while necessary to ensure that nodes cannot misrepresent routing information without colluding with other nodes, goes against the very spirit of DV protocols. DV is in general more efficient than LS approaches as nodes do not need to know the entire topology of the network. For the basic DV protocol, nodes need to know only the next hop to reach any destination. When authentication is carried over to two hops, every node will learn the identities of the next two nodes in the path to every destination. Obviously, while carrying over authentication to more hops may be more desirable from a security standpoint, such an approach may reduce the very appeal of DV based approaches. Perhaps, carrying over authentication to two-hops (and not-three) is a reasonable trade-off. 5.2.3. On-Demand Protocols In on-demand protocols, where a source S sends a RREQ to find a path (in DSR) or route (in AODV) to a destination D, one important requirement is to address RREQ flooding attacks.9 From the point of view of attackers, the ability to send an unlimited number of supercilious RREQ packets is an efficient way of perpetrating denial of service (DoS) attacks, as a single packet sent by the attacker will require every node to flood the packet. Obviously, authentication of RREQ is an important requirement. More specifically, a minimum requirement is for every node to establish the source of the RREQ packet. If authentication of RREQ packets is not mandated, an attacker (say C) can send RREQs impersonating different sources (say X, Y , Z) at will. However, if source authentication is mandated, the attacker C cannot impersonate other nodes. If too many RREQs are sent from node C, other nodes can simply stop honoring such RREQs (by ignoring them) and thus avert DoS attacks. Ideally, if overhead is not an issue, RREQ packets should be authenticated using digital signatures or OTS so that all nodes in the subnet can verify the source and other fields of the RREQ packet specified by the source (like sequence number, destination, hop-limit). Note that TESLA is not suited for this purpose as TESLA authentication cannot be verified instantaneously. Fortunately, PU schemes are better suited for this purpose. Along with every RREQ, one value is released from the PU chain. Note

58

M. Ramkumar

that while attackers can still modify other fields of such subsequent RREQ packets (like destination, hop count) and render the RREQ useless, they cannot modify the source or increment the sequence number, thus preventing RREQ floods. As mentioned earlier, OTSs can be used (infrequently) to authenticate commitments for PU chains. Obviously, such a strategy for restricting RREQ floods have to used with other strategies to ensure that malicious nodes cannot make illegal modifications to the RREQ. For DSR, where intermediate nodes are expected to insert their ID / address, measures should be used to ensure that attackers cannot insert non-existent nodes in the path or remove nodes from the path.24 For AODV, where every node is expected to increment the hop-count by one, measures are required to ensure that attackers cannot decrease the hop-count field, or send it unmodified, or increase it by more than one. However, such strategies do not require25 the use of oneto-many schemes.26 In DSR, as the destination will know the identities of every node in the path, and as every node in the path knows the ID of the destination (indicated in the RREQ), every intermediate node can also append an authentication (based on the pairwise secret shared with the destination) verifiable by the destination.16 5.2.4. Link-State Protocols In link-state based proactive protocols the link-state packets (periodically) flooded by a node S should be authenticated such that every node in the subnet will be able to verify the source S, and integrity of the link-state packet. Thus one-to-many SAs are indeed mandatory for this purpose. Redundancy is automatically built into link-state protocols. Note that in a scenario where A sends a link-state packet indicating that B, C and D are its neighbors, the receiver will also receive link-state packets from B, C and D, each of them indicating that A is one of their neighbors. One approach to authenticate LS packets is using TESLA. LS packets are authenticated using a TESLA HMAC employing a secret from the hash chain, which will be released in a few seconds or milliseconds (follows the LS packet with a small delay). The TESLA commitments could themselves be authenticated using OTS. Alternately, if the delay in verification is unacceptable, the source and sequence number of LS packets could be authenticated using IS hash chain. The integrity of other contents of the LS packet (like the list of neighbors and age of the packet) could be preserved by using one-hop and two-hop authentication.

Key Distribution

59

It is important to see why the OTS-TESLA combination cannot be used for authenticating rows of the DV table. TESLA is acceptable for authenticating LS packets as a packet sent by a node S will be immediately flooded over the entire subnet and will thus reach all nodes before the TESLA time-interval. Now consider a scenario with DV, (D · · · Q → S → R) - where Q and S are neighbors, and R is a neighbor of S and a twohop neighbor of Q. A row corresponding to a destination D, authenticated by Q, and sent to S may be sent by S onwards to R after a considerable delay (up to one update period), thus rendering TESLA unsuitable for this purpose. 5.3. Protocol Independent Authentication Apart from protocol specific strategies seen thus far, cryptographic authentication is also required for some purposes that do not depend on the specific routing protocol used. Recall that secrets assigned to nodes confer eligibility to take part in the network. More specifically, the secrets provide to nodes confer the eligibility for some finite duration. However, there will always be scenarios where after some node is conferred the privilege till time T , the network operator may desire to revoke the privilege (before time T ). Revocation is achieved by broadcasting revocation lists authenticated by the KDC or the certificate authority. Once the latest revocation list has been provided to all nodes, packets from revoked nodes will simply be disregarded by other nodes. Obviously it is impractical for the KDC to individually authenticate the revocation list to every node. Thus, oneto-many schemes are essential for this purpose. However as revocation messages will be created infrequently, one-time signatures are ideally suited for this purpose. 5.3.1. Logical Neighborhoods From a security standpoint, a primary difference between wired and wireless networks is the fact that in wired networks a router is well aware of all routers to which it is physically connected. In wireless networks, there is no way for a node A to determine the list of all entities that can hear a packet sent by A. Irrespective of the nature of the routing protocol, it is thus indeed desirable for nodes forming ad hoc networks to be able to have some control over which nodes have access to its packets.

60

M. Ramkumar

The existence of light weight schemes like MLS and KSSC for establishing pairwise secrets provides a low overhead strategy for every node to enforce a logical neighborhood. For example, a node A with neighbors B, C, D, E in its physical neighborhood (and perhaps other passive nodes lurking around), can induct a subset of the nodes into its logical neighborhood. The node A can choose a secret KA and provide the secret (by individually encrypting KA with pairwise secrets) to only the nodes it desires to have in its logical neighborhood. For example, A can give the secret to B, D, and E and withhold the secret from C, and other nodes (the very existence of which is unknown to A). Subsequently, all packets sent from A will be encrypted using the secret KA . Thus nodes that have not been explicitly welcomed by A into its logical neighborhood cannot gain access to the packet. There are many valid reasons as to why a node A may choose to cutoff a specific node C (which is physically in the neighborhood of A) from its logical neighborhood. For instance 1) A may have observed consistent misbehavior of node C, or 2) suspect a one-way link27 between A and C or 3) suspect the presence of a semi-active28 attacker between them.29 Furthermore, in a scenario where two nodes A and C are in close proximity and have identical views of the network, the nodes gain nothing by adding each other to their respective logical neighborhoods (unless A and C are end points in an interaction). Most existing approaches for mitigating participation by malicious nodes involve propagating accusatory messages regarding misbehavior of nodes. Unfortunately, in most scenarios it may be infeasible for a node observing misbehavior to provide incontrovertible proof of misbehavior, verifiable by all nodes. Thus, such strategies are themselves susceptible to simple DoS attacks where a node can send false accusations to create unnecessary traffic. The ability to cut-off neighbors in the physical neighborhood from the logical neighborhood facilitates DoS-free countermeasures to reduce the ill-effects of malicious nodes. Nodes cut off by all neighbors are effectively cut off from the subnet. Maintaining a logical neighborhood is advantageous for dense neighborhoods. In a region where a node A has 100 nodes within range, A may decide to include only 10 of them in its logical neighborhood as 10 neighbors may be sufficient to provide A with connectivity to all other mobiles or the gateway. Such an approach is also useful in scenarios involving highly dynamic nodes. Consider a scenario where a mobile device in a fast moving vehicle sends a RREQ packet. If every neighbor simply floods the RREQ

Key Distribution

61

onwards it may result in substantial wastage of bandwidth as the RREQ source is very likely to have moved away from the location the RREQ originated by the time the response (RREP) comes back. If nodes enforce a logical neighborhood (and induct nodes in their logical neighborhood only after a few exchanges) only nodes moving at roughly the same speed (or relatively stationary to each other) will form an exclusive network. Thus a set of northbound vehicles in Interstate I-95 may form an ad hoc subnet that excludes all southbound vehicles (and vice-versa). Mandating a logical neighborhood can also deter selfish behavior. For example, a selfish node C may remain silent and not participate in the routing process unless it hears a RREQ addressed to C, or if C needs to send a message. When a logical neighborhood is enforced C will have to be inducted into neighborhoods of other nodes before C can monitor traffic. Once inducted, a node C is pressured to participate to the fullest extent due to the fact that it is under constant observation by its neighbors, who may cut C off if they sense non-participation of C. 5.3.2. User-Agent One-Hop Signatures While there are compelling reasons for network agents to avoid asymmetric primitives for authenticating routing packets, user agents can use asymmetric primitives. Consider a scenario where a node A detects an inconsistency in a packet received from some node C. More specifically, assume that A recognizes that the authentication appended by B (where B is a two-hop neighbor of A and a one-hop neighbor of C) is inconsistent with the routing information supplied by C. In such a scenario, the best that A can do is to suspect that either B or C may be malicious, and drop the inconsistent packet. The compelling advantage of using digital signatures stems from their capability for non-repudiation. To provide this capability, the user agent of every node will need to append a digital signature to every packet that originates from the node. By doing so, the user agent (or the user) “accepts responsibility” for the packet leaving his/her mobile computer. The signed packet is then encrypted using the one-hop group secret used for enforcing a logical neighborhood. The signatures are verified by the user agents of neighbors, and stripped off before the packets are forwarded onwards. However, every node caches the packets sent by the neighbors (along with the signature) for a small duration (say a few seconds). Whenever an inconsistency is detected, the signed packet could (at a later time) be submitted to the network operators (KDC). For example, a

62

M. Ramkumar

neighbor common to C and B will be able to submit signed packets from B and C. The network operators (KDC), with access to network agent secrets of all mobiles, can readily determine which of the two nodes acted in a malicious manner. Such nodes may then face the threat of being revoked from the network by the KDC. Note that without non-repudiable signatures, the nodes face very little risk. Some nodes may intentionally introduce malicious modifications to packets relayed so that they can reduce their routing burden. For example, if a malicious node C illegally modifies the RREQ it relays, it can be assured that it will not be a part of the path that is established between the source and the destination. If non-repudiable signatures are mandated, the risk of being revoked from the network is perhaps sufficient motivation for nodes to behave well. While OTS can be used for non-repudiable signatures, digital signatures based on asymmetric primitives are clearly preferable in this case as nodes will have to sign every packet. Furthermore, recall that the main disadvantages of CB based asymmetric schemes are: 1) high computational overhead, which in turn could lead to simple DoS attacks; 2) bandwidth overhead for disseminating certificates. However their main disadvantages are less of an issue in this case as digital signatures appended by nodes need not be carried over, and distribution of certificates to one hop neighbors is not as expensive. Secondly, enforcing private logical neighborhoods eliminates DoS attacks. As all packet will be encrypted/authenticated using the one-hop group secret, the signature from a node claiming to be A will be verified only after it is ensured that the sender has access to the group secret KA . 6. Conclusions Efficient choice of key distribution schemes for facilitating cryptographic SAs between devices forming MANETs have to take several factors into account. Irrespective of the specific routing protocol used, both one-to-one SAs (pairwise secrets) and one-to-many SAs are required. Furthermore every mobile device should be considered as two distinct agents: i) a lightweight, tamper-responsive network agent (in practice, a SIM card plugged into a mobile computer); and ii) a more capable user agent (a general purpose mobile computer). The SIM card protects and performs computations with secrets used for authenticating routing information. The network agent secrets should be protected from the owner (the user) of the device.

Key Distribution

63

The secrets assigned to the user agent can be used for securing application layer data and for non-repudiation to make the user agent “take responsibility” for packets aired from his/her mobile device. The need for lowering the complexity of the network agent (in order to render the SIM card inexpensive and trustworthy) calls for restricting the network agent to symmetric cryptographic computations. Because storage is an inexpensive resource for mobile devices, light weight key predistribution schemes like MLS and KSSC are well suited for establishing pairwise secrets between network agents. Such secrets can be used for establishing one-hop and two-hop secrets to protect the integrity of routing data for all routing protocols. In general, one-to-many authentication schemes are more expensive compared to one-to-one schemes like KSSC and MLS. Network agents can afford to use OTS schemes as long as they are used infrequently due to the bandwidth overhead required for the signature and authenticating public commitments (tens of hashes). However, it is possible to efficiently employ OTS to disseminate commitments for other one-to-many schemes like the delay sensitive TESLA broadcast authentication scheme and delay insensitive per-use hash chain schemes. As user agents are less resource constrained, user agents can employ conventional digital signatures for non-repudiation. Under such a scenario, the threat of being ejected from the network can serve as an effective deterrent for users desiring to break the rules imposed by routing protocols for selfish gains. References 1. D. Boneh, M. Franklin, “Identity-based encryption from the Weil pairing,” Advances in Cryptology – Crypto’2001, Lecture Notes on Computer Science 2139, Springer-Verlag (2001), pp. 213-229. 2. A. Perrig, R. Canetti, D. Song, D. Tygar, “Efficient and Secure Source Authentication for Multicast,” Network and Distributed System Security Symposium, NDSS ’01, Feb. 2001. 3. R.C. Merkle, “A Digital Signature Based on a Conventional Encryption Function,” Advances in Cryptology, Crypto 87. 4. D. Bleichenbacher, U. Maurer, “On the Efficiency of One-Time Digital Signatures,” ASIACRYPT: Advances in Cryptology : International Conference on the Theory and Application of Cryptology, 1996. 5. Y-C Hu, D.B. Johnson, “Securing Quality-of-Service Route Discovery in On-Demand Routing for Ad Hoc Networks,” SASN-2004, Washington, DC, October 2004.

64

M. Ramkumar

6. Y-C Hu, A. Perrig, D.B. Johnson, “Efficient Security Mechanisms for Routing Protocols,” Symposium on Networks and Distributed Systems Security (NDSS), 2003. 7. A. Perrig, “The BiBa One-Time Signature and Broadcast Authentication Protocol,” ACM Conference on Computer and Communications Security, pp. 28-37, 2001. 8. R.C. Merkle, “Protocols for Public Key Cryptosystems,” Proceedings of the IEEE Symposium on Security and Privacy, 1980. 9. Y-C Hu, A. Perrig, D.B. Johnson, “Ariadne: A Secure On-Demand Routing Protocol for Ad Hoc Networks,” Journal of Wireless Networks, 11 pp. 11-28, 2005. 10. R. Blom, “An Optimal Class of Symmetric Key Generation Systems,” Advances in Cryptology: Proc. of Eurocrypt 84, Lecture Notes in Computer Science, 209, Springer-Verlag, Berlin, pp. 335-338, 1984. 11. D. Davis, R. Swick, “Network Security via Private-Key Certificates,” Proceedings of the 3rd USENIX Security Symposium, Baltimore, Sep. 1992. 12. M. Ramkumar, “An Efficient Key Distribution Scheme for Large Scale Mobile Computing Applications,” submitted to the IEEE Transactions on Mobile Computing. 13. M. Ramkumar, “On the Scalability of a “Nonscalable” Key Distribution Scheme,” Proceedings of IEEE SPAWN 2008, Newport Beach, CA, June 2008. 14. T. Leighton, S. Micali, “Secret-key Agreement without Public-Key Cryptography,” Advances in Cryptology - CRYPTO 1993, pp. 456-479, 1994. 15. B. Gaines, M. Ramkumar, “A Framework for Dual Agent MANET Routing Protocols,” to be presented at IEEE Globecom 2008, New Orleans, LA, November 2008. 16. K.A. Sivakumar, M. Ramkumar, “Improving the Resilience of Ariadne,” Proceedings of IEEE SPAWN 2008, Newport Beach, CA, June 2008. 17. C. Perkins, P. Bhagvat, “Highly Dynamic Destination-Sequenced DistanceVector Routing (DSDV) for Mobile Computers,” ACM SIGCOMM Symposium on Communication, Architectures and Applications, 1994. 18. P. Jacquet, P. M¨ uhlethaler, T. Clausen, A. Laouiti, A. Qayyum, L. Viennot, “Optimized link state routing protocol for ad hoc networks,” Proceedings of the 5th IEEE Multi Topic Conference (INMIC 2001), 2001. 19. C. Perkins, E. Royer, S. Das, “Ad hoc On-demand Distance Vector (AODV) Routing,” Internet Draft, draft-ietf-manet-aodv-11.txt, Aug 2002. 20. P. Johanson, D. Maltz, “Dynamic source routing in ad hoc wireless networks,” Mobile Computing, Kluwer Publishing Company, 1996, ch. 5, pp. 153-181. 21. S. Papademetriou, P. Papadopoulos, V. Park, A. Qayyum, “An Internet MANET Encapsulation Protocol (IMEP) Specification,” Internet Draft, August 1999. 22. T. Clausen, C. Dearlove, J. Dean, “MANET Neighborhood Discovery Protocol (NHDP),” IETF draft, Mar 10, 2008.

Key Distribution

65

23. X. Du, Y. Wang, J. Ge, Y. Wang, “A Method for Security Enhancements in AODV Protocol,” Proceedings of the 17th International Conference on Advanced Information Networking and Applications, AINA’03, Xian, China. 24. K.A. Sivakumar, M. Ramkumar, “An Efficient Secure Route Discovery Protocol for DSR,” IEEE Globecom 2007, Washington, DC, Nov 2007. 25. K.A. Sivakumar, M. Ramkumar, “Safeguarding Mutable Fields in the AODV Route Discovery Process,” Proceedings of the Sixteenth IEEE ICCCN-07, Honolulu, HI, Aug 2007. 26. M.G. Zapata, N. Asokan, “Securing Ad Hoc Routing Protocols,” Proceedings of the ACM workshop on Wireless security, Atlanta, Georgia, September 2002. 27. K.A. Sivakumar, M. Ramkumar, “On the Effect of Oneway Links on Route Discovery in DSR,” Proceedings of the IEEE International Conference on Computing, Communication and Networks (ICCCN-2006), Arlington, VA, October 2006. 28. Y-C Hu, A. Perrig, D.B. Johnson, “Rushing Attacks in Wireless Ad Hoc Network Routing Protocols,” Proceedings of WiSe 2003, San Diego, CA, September 2003. 29. J. Marshall, V. Thakur, A. Yasinsac, “Identifying flaws in the secure routing protocol,” Proceedings of the 2003 IEEE International Performance, Computing, and Communications Conference, 2003.

Chapter 3 Key Pre-Distribution for Sensor Networks Using Group Deployment Knowledge Donggang Liu∗ , Peng Ning† and Wenliang Du‡ ∗

Department of Computer Science and Engineering The University of Texas at Arlington † Department of Computer Science, North Carolina State University ‡ Department of Electrical Engineering and Computer Science Syracuse University Many key pre-distribution techniques have been developed recently to establish pairwise keys between sensor nodes in wireless sensor networks. To further improve these schemes, researchers have also proposed to take advantage of the sensors’ expected locations and discovered locations to help the pre-distribution of the keying materials. However, in many cases, it is very difficult to deploy sensor nodes at their expected locations or guarantee the correct location discovery at sensor nodes in hostile environments. In this chapter, a group-based deployment model is developed to improve key pre-distribution. In this model, sensor nodes are only required to be deployed in groups. The critical observation in the chapter is that the sensor nodes in the same group are usually close to each other after deployment. This deployment model is practical; it greatly simplifies the deployment of sensor nodes, while still providing an opportunity to improve key pre-distribution. Specifically, the chapter presents a novel framework for improving key pre-distribution using the group-based deployment knowledge. This framework does not require the knowledge of the sensors’ expected or discovered locations and is thus suitable for applications where it is difficult to deploy the sensor nodes at their expected locations or correctly estimate the sensors’ locations after deployment. To seek practical key pre-distribution schemes, the chapter presents two efficient instantiations of this framework, a hash key-based scheme and a polynomial-based scheme. The evaluation shows that these two schemes are efficient and effective for pairwise key establishment in sensor networks; they can achieve much better performance than the previous key pre-distribution schemes when the sensor nodes are deployed in groups.

67

68

D. Liu, P. Ning and W. Du

1. Introduction Recent technological advances have made it possible to deploy wireless sensor networks consisting of a large number of low-cost, low-power, and multifunctional sensor nodes that communicate in short distances through wireless links.1 Such sensor networks are ideal candidates for a wide range of applications in military and civilian operations such as health monitoring, data acquisition in hazardous environments, and target tracking. The desirable features of wireless sensor networks have attracted many researchers to develop protocols and algorithms to support these various applications (e.g., Refs. 1–5). Sensor networks (especially in military operations) are often deployed in hostile environments where enemies may be present. It is therefore critical to ensure the correct network operations as well as the integrity, availability, and at times confidentiality of the data collected by sensor nodes in hostile environments. However, providing security services for sensor networks is particularly challenging. In the first place, sensor nodes are usually resource-constrained, which makes it not practical to implement those wellstudied but expensive algorithms on sensor nodes. Second, sensor nodes are usually deployed in an unattended manner. It is very difficult to physically protect the sensor nodes individually. A few sensor node could be captured by adversaries after deployment. Once a sensor node is captured, it can give way its secrets very quickly.6 As a result, any security algorithm has to be resilient against the compromised sensor nodes. Key management is the cornerstone of many security services such as authentication and encryption. A critical task of key management is to establish a pairwise key between two sensor nodes in the network. Research seeking low-cost pairwise key establishment techniques that can survive node compromises in sensor networks was quite active in the past three, four years, yielding several novel key pre-distribution schemes. To name a few, Eschenauer and Gligor proposed to distribute a random subset of keys from a key pool to every sensor node before deployment such that every pair of sensor nodes will have a certain probability of sharing at least one key after deployment.7 Chan et al. extended this scheme by having two sensor nodes share at least q pre-distributed keys to establish a pairwise key.8 Chan et al. also developed a random pairwise keys scheme.8 This scheme pre-distributes random pairwise keys between a sensor node and a random subset of other sensor nodes, and has the property that the compromise of sensor nodes does not lead to the compromise of any key

Key Pre-Distribution for Sensor Networks Using Group Deployment Knowledge

69

shared directly between two non-compromised sensor nodes. To further enhance the security of key pre-distribution, Liu and Ning and Du et al. independently developed two similar threshold-based schemes.9,10 Chan and Perrig also developed a protocol named PIKE for key establishment by using peer sensor nodes as trusted intermediaries.11 However, due to the resource constraints (especially the limited battery power) on sensor nodes and the threat of compromised nodes, none of the above key management schemes can guarantee the security of the keying materials used for the communication between sensor nodes. It is always desirable to improve the security and performance of key management. In many applications, long distance peer-to-peer secure communication between sensor nodes is rare. Even if it is needed, we can establish a key using a number of intermediate nodes if the hop-by-hop encryption and authentication is available, and use this key to secure the long distance peerto-peer communication. Thus, one primary goal of secure communication is to provide authentication and/or encryption between neighbor sensor nodes. Therefore, the most important information that can benefit key pre-distribution is the knowledge about which nodes are most likely to be the neighbors of each sensor node. Once this information is available, we can pre-distribute pairwise keys for the pairs of sensor nodes that are likely to be neighbors. As a result, a sensor node will have a high probability of establishing a pairwise key with its neighbor. Several techniques have been proposed recently to take advantage of the sensors’ location information to improve key pre-distribution.12–16 Some of them assume that the locations of sensor nodes can be pre-determined to a certain extent, while some assume that the locations of sensor nodes can be discovered after deployment. However, in practice, it could be difficult, and sometimes impossible, to guarantee that the sensor nodes are deployed precisely at expected locations. Besides, the sensor’s discovered location is usually not trustworthy in hostile environments.17–22 In this chapter, we develop a group-based deployment model to improve the security and performance of key pre-distribution. In this model, the sensor nodes are required to be deployed in groups. A critical observation is that the sensor nodes in the same group are usually close to each other after deployment. We believe that this group-based deployment model is more practical than the aforementioned models since it requires less efforts in the deployment of sensor nodes, while still providing an opportunity to improve key pre-distribution.

70


Specifically, we propose a novel group-based key pre-distribution framework based on this deployment model. Compared to the previous techniques for improving key pre-distribution, this framework has the following two advantages. First, the expected or discovered locations of sensor nodes are no longer required for key pre-distribution. This simplifies the deployment of sensor networks when it is hard to deploy sensor nodes close to their expected locations, and improves the security of key pre-distribution when it is hard to guarantee the correct location discovery. Second, this framework can be applied to improve any of the existing key pre-distribution schemes, while the previous techniques for improving key pre-distribution can only be used to improve certain types of key pre-distribution techniques. To seek practical key pre-distribution techniques, we also develop two efficient instantiations in this framework, a hash key-based scheme and a polynomial-based scheme. These two schemes have a number of advantages over the previous key pre-distribution schemes. First, in these two schemes, the neighbor sensor nodes have a high probability of establishing direct keys with low storage overhead, and there is no additional communication overhead required for direct key establishment. Second, they are resilient to node compromise attacks even if there are a large number of compromised sensor nodes. Finally, they provide efficient alternatives to achieve better security and performance when it is difficult to deploy the sensor nodes close to their expected locations or correctly estimate the sensors’ locations after deployment. The remainder of this chapter is organized as follows. The next section introduces our group-based deployment model. Section 3 presents our framework. Section 4 describes our two efficient instantiations of the proposed framework. Section 5 provides the detailed analysis for the proposed approaches. Section 6 reviews related work on sensor network security. Section 7 concludes this chapter and points out possible future research directions. 2. Group-Based Deployment Model When the sensor nodes are deployed in the target field, there are many factors that will affect where a sensor node will be finally deployed. For example, when a sensor node is dropped from an airplane, the final location of this sensor node will be at least affected by the location and the velocity of the airplane when the sensor node is dropped, and the wind speed. However, since the sensor nodes in the same group will be deployed together, it is


71

very likely that they are affected in a similar way by the same set of factors. Therefore, the final locations of the nodes in the same group will be close to each other with a high probability after deployment. Based on the above discussion, we present a practical deployment model in this subsection. In this model, the sensor nodes are only required to be deployed in groups. The deployment knowledge used to improve key predistribution is the observation that the sensor nodes in the same group are usually close to each other after deployment. This model in fact is more practical and requires less efforts in the deployment of sensor nodes than the models where the sensor nodes need to be placed close to their expected locations. For example, a group of sensor nodes may only need to be dropped from the airplane at the same time. For the sake of presentation, we call a group of sensor nodes that need to be deployed together as a deployment group. We assume that the sensor nodes are static once they are deployed. We define the resident point of a sensor node as the point location where this sensor node finally resides. The sensors’ resident points are generally different from each other even for the sensor nodes in the same group. However, in our later evaluation, we assume the resident points of the sensor nodes in the same group follow the same probability distribution function for simplicity, though the proposed method will still work under different distribution functions. The detailed description of the proposed deployment model is given below. The sensor nodes to be deployed are divided into n deployment groups {Gi }i=1,...,n . We assume that these groups are evenly and independently deployed in a target field. The sensor nodes in the same deployment group Gi are deployed from the same place at the same time with the deployment index i. During the deployment of any group Gi , the resident point of any sensor node in this group follows a probability distribution function (pdf) fi (x, y), which we call the deployment distribution of group Gi . An example of the pdf fi (x, y) is a two-dimensional Gaussian distribution. Figure 1 illustrates a two-dimensional Gaussian distribution with center (150, 150). The actual deployment distribution is affected by many factors. For simplicity, we model the deployment distribution as a Gaussian distribution (also called Normal distribution) since it is widely studied and proved to be useful in practice. Although we only employ the Gaussian distribution in our evaluation, our methodology can be applied to other distributions as well.


72

x 10

5

7 6 5 4 3 2 1 0 300 250

300

200

250 150

200 150

100

100

50

50 0

Fig. 1.

0

Deployment distribution.

Specifically, we assume that the deployment distribution for any node in the deployment group Gi follows a two-dimensional Gaussian distribution centered at a deployment point (xi , yi ). Different from the previous deployment models where the deployment points are pre-determined,12,15 we do not assume any prior knowledge of such deployment points. In fact, we only assume the existence of such deployment points. The mean of the Gaussian distribution µ equals (xi , yi ), and the pdf for any sensor node in group Gi is the following: fi (x, y) =

1 −[(x−xi )2 +(y−yi )2 ]/2σ2 e = f (x − xi , y − yi ), 2πσ 2

where σ is the standard deviation, and f (x, y) =

(1)

1 −(x2 +y 2 )/2σ2 . 2πσ2 e

3. A Framework for Group-Based Key Pre-Distribution According to the deployment model discussed in the previous section, the sensor nodes in the same deployment group have high probability of being neighbors. To take advantage of this observation, the pairwise key predistribution techniques should at least benefit the sensor nodes in the same deployment group. Hence, we first employ an in-group key pre-distribution method, which enables the sensor nodes in the same deployment group to establish pairwise keys between each other with a high probability. To


73

handle the pairwise key establishment between the sensor nodes in different deployment groups, we then employ a cross-group key pre-distribution method, which enables the selected sensor nodes in different deployment groups to establish pairwise keys and thus bridges different deployment groups together. A key pre-distribution technique can usually be divided into three different phases, the pre-distribution, which specifies how to pre-distribute keying materials to each sensor node, the direct key establishment, which specifies how to establish a pairwise key shared between two sensor nodes directly, and the path key establishment, which specifies how to discover a sequence of sensor nodes to help two given sensor nodes to establish a temporary session key. A key established in the direct key establishment phase is called a direct key, while a key established in the path key establishment phase is called an indirect key. For simplicity, we assume there are n equal-sized deployment groups with m sensor nodes in each of these groups. The description of our framework is given below. For simplicity, we omit the detail of the message format. 3.1. Pre-Distribution For each deployment group Gi , we need a key pre-distribution instance Di to take care of the pairwise key establishment in Gi . For the sake of presentation, these key pre-distribution instances are called the in-group (key pre-distribution) instances. The in-group instance Di can be the instance of any existing key pre-distribution technique. To handle the pairwise key establishment between sensor nodes in different deployment groups, we construct m cross groups {Gi }i=1,...,m . The requirements on these cross groups are: (1) each cross group includes exactly one sensor node from each deployment group, and (2) there are no common sensor nodes between any two different cross groups. In other words, for any i and j with i = j, we have Gi ∩ Gj = φ and |Gi ∩ Gj | = 1. We also generate a key pre-distribution instance Di for the pairwise key establishment in every Gi . These instances are called the cross-group (key pre-distribution) instances. By doing this, each cross group provides a potential link for any two deployment groups. Similarly, the cross-group instance Di can be the instance of any key pre-distribution technique. In this chapter, we propose a simple way to construct the deployment groups and cross groups for pairwise key establishment. Basically, each


74

deployment group Gi contains the sensor nodes with the IDs {(i − 1)m + j}j=1,...,m , while each cross group Gi contains the sensor nodes with the IDs {i + (j − 1)m}j=1,...,n . By doing this, a sensor node can easily figure out which deployment group or cross group another sensor node belongs to based on the ID of the other node. Figure 2 shows an example of this group construction when n = 4 and m = 3. In this figure, G1 includes node 1, 4, 7 and 10, G2 includes node 2, 5, 8 and 11, and G3 includes node 3, 6, 9 and 12. G1

G2

G3

G4

1

4

7

10

G'1

2

5

8

11

G'2

3

6

9

12

G'3

Fig. 2.

Example of group construction.

3.2. Direct Key Establishment After the pre-distribution step, each sensor node has the keying materials for two key pre-distribution instances, an in-group instance and a crossgroup instance. Hence, the direct key establishment between two neighbor sensor nodes is simple and direct. If they are in the same deployment group, for example, Gi , they can follow the direct key establishment of the in-group instance Di . If they are not in the same deployment group but belong to the same cross group Gj , they can follow the direct key establishment of the cross-group instance Dj . To determine if two sensor nodes u and v are in the same deployment group or the same cross group, they only need to know the ID (either u or v) of the other party due to u v equals m , they are our group construction method. Specifically, if m in the same deployment group; if u mod m equals v mod m, they are in the same cross group. Clearly, there is not additional communication cost introduced by applying our framework.


75

3.3. Path Key Establishment If two sensor nodes cannot establish a direct key, they have to go through the path key establishment to find a sequence of other sensor nodes to help them establish an indirect key. It is required that any pair of adjacent sensor nodes in this sequence can establish a direct key between them to make sure the security of key establishment. It is also assumed that every message between two sensor nodes is encrypted and authenticated by the direct key established between them. Similar to the direct key establishment, if two sensor nodes are in the same deployment group Gi , they can follow the path key establishment in Di . The indirect keys between the sensor nodes in the same group are called the in-group indirect keys. When two sensor nodes belong to two different groups Gi and Gj , we use a different method to establish an indirect key. Basically, we need to find a “bridge” between these two deployment groups in order to establish a cross-group indirect key. A bridge between group Gi and Gj is defined as a pair of sensor nodes a, b (a ∈ Gi and b ∈ Gj ) that belong to the same cross group Gk (a, b ∈ Gk ). A bridge is valid when the two sensor nodes involved in this bridge can establish a direct key. According to the pre-distribution step, there are m potential bridges (one from each cross group) between every two deployment groups that can be used to establish an indirect key between sensor nodes in these two deployment groups. In addition, due to our group construction method, a sensor node can easily compute all possible bridges between any two deployment groups. Specifically, the possible bridges between group Gi and Gj are {(i − 1)m + k, (j − 1)m + k}k=1,...,m . For example, as shown in Figure 2, there are 3 bridges between group G1 and G4 : 1, 10, 2, 11, and 3, 12. The path key establishment for the sensor nodes in different deployment groups thus works as follows. (1) The source node u first tries the bridge involving itself to establish an indirect key with the destination node v. Assume this bridge is u, v . Node u first sends a request to v if it can establish a direct key with v . If node v can also establish a (direct or indirect) key with the destination node v, node v forwards this request to the destination node v to establish an indirect key. (2) If the first step fails, node u will try the bridge involving the destination node v. Assume the bridge is u , v. In this case, node u sends a request to node u if it can establish a (direct or indirect) key with u . If node

76


u can establish a direct key with node v, it forwards the request to the destination node v to establish an indirect key. Note that if nodes u and v are in the same cross group, this step can be skipped, since step 1 and step 2 compute the same bridge. (3) When both of the above steps fail, node u has to try other bridges. Basically, it randomly chooses a bridge u , v other than the above two, assuming u is in the same deployment group with u, and v is in the same deployment group with v. Node u then sends a request to u if it can establish a (direct or indirect) key with u . Once u receives this request, it forwards the request to v in the bridge if they share a direct key. If v can establish a (direct or indirect) key with the destination node v, it forwards the request to node v to establish an indirect key. We use the same example as in Figure 2 to illustrate the above algorithm. When node 1 wants to establish an indirect pairwise key with node 12, it first tries the bridge 1, 10. If this fails, it tries the bridge 3, 12. If both bridges fail, it needs to try the bridge 2, 11. If none of these bridges works, the path key establishment fails. In our later analysis, we will see that it is usually unlikely that none of those bridges works. When one of the bridges works, the two sensor nodes involved in this bridge will be used as the intermediate nodes by node 1 and node 12 to establish the indirect key. In the above approach, the path key establishment in a cross-group instance has never been used. The reason is that the sensor nodes in a cross group usually spread over the entire deployment field, which makes it expensive to perform path key establishment in a cross group. 4. Seeking Efficient Instantiations In the proposed framework, as long as a key pre-distribution technique can provide pairwise key establishment between sensor nodes for a group of sensor nodes, it can be used as the basic building block to construct a group-based scheme. This implies that our framework can be applied to any existing key pre-distribution technique. Since we have additional deployment knowledge in our framework, we are able to more precisely predict the possible neighbors for any sensor node than the original schemes. It is thus expected that the framework can improve the existing key pre-distribution schemes even if the expected or


77

discovered locations are not available. In this chapter, we are interested in seeking practical instantiations under the proposed framework. 4.1. Overview The previous section has described the details of our framework. There are two remaining issues that need to be addressed properly to develop an efficient instantiation. The first issue is the technical detail of the ingroup and cross-group key pre-distribution instances. We note that in our framework, the size of deployment groups and the size of cross groups are usually much smaller than the network size. For small size groups, it is practical to apply simple key pre-distribution schemes such as the basic polynomial-based scheme in Ref. 23. The reason is that a single sensor node can usually provide enough storage space for us to use very secure and efficient key pre-distribution schemes for a small number of sensor nodes. For example, for a group of 100 sensor nodes, we can assign a unique key between every pair of sensor nodes. This only occupies the storage space that is equivalent to 99 keys. The second issue is the communication with the two given sensor nodes involved in the bridge identified in the path key establishment. In the proposed framework, we provide an efficient way for a sensor node to compute all the possible bridges by only looking at the IDs of the sensor nodes. However, it is still non-trivial to actually communicate with the two sensor nodes related to a given bridge. Theoretically, we are able to check every possible bridges as long as the routing protocol can support the communication between any pair of sensor nodes. However, in practice, it is not desirable to introduce too much communication overhead during the path key establishment. Besides, the routing protocol may not support the endto-end communication between any pair of sensor nodes. We are thus more interested in the ideas that can discover a valid bridge by only contacting a few sensor nodes in the network. With these in mind, we introduce two efficient instantiations in this subsection. For the first issue, we will look for key pre-distribution schemes that do not require additional communication overhead during the establishment of direct keys. This is particularly suitable for resource-constrained sensor networks since the wireless communication is one of the most expensive operations for wireless sensor networks.2 On the other hand, this will greatly simplify our path key establishment protocol as well as the implementation of our final group-based key pre-distribution technique. Indeed, it will not

78


only save the communication overhead but also reduce the code size for the implementation. Therefore, from the whole-system’s point of view, we are able to allocate more storage space for keying materials, leading to a more secure and efficient group-based key pre-distribution technique. Additionally, the above idea is practical since every deployment group or cross group only has a small number of sensor nodes. For the second issue, we propose a simple way to identify the working bridge between two sensor nodes. Specifically, every sensor node only needs to discover the list of the nearby sensor nodes that belong to the same deployment group as itself. Once the lists are available, two neighbor sensor nodes u and v only need to exchange their lists to identify a working bridge u , v where u and v are actually close to the two sensor nodes u and v. For example, in Figure 2, suppose node 1 and node 12 want to establish an indirect key. Node 1 discovers that node 2 is in its neighborhood, and node 12 discovers that node 11 is in its neighborhood. In this case, after node 1 and node 12 exchanged their lists of the nearby sensor nodes, they can easily conclude that the bridge 2, 11 works perfect for them. Additionally, we note that any two sensor nodes in the same deployment or cross group can always establish a direct key according to our early discussion for the requirement of the solutions for the first issue. This makes our solution for the second issue more efficient. Note that in the above algorithm, two sensor nodes need to exchange the lists of neighbor nodes in the same group to identify the working bridge. The size of such list could be large, making it expensive for communication between sensor nodes. However, the size of such list is always no more than m. In addition, the IDs of the sensor nodes in a particular deployment group can be easily computed due to our group construction method. We can simply use a bit string to represent the list of neighbor nodes that belong to the same group. Hence, we only need m 8 bytes for such list. For example, when m = 100, we only need 13 bytes to represent the list. Clearly, the communication overhead introduced by such list will not be a problem for our method. Based on the above discussion, we can see that our solution for the second issue is quite clear as long as the direct key between the sensor nodes in the same group can be established. Such a solution actually works for both of our later instantiations. Hence, the only remaining issue at this point is the in-group and cross-group key pre-distribution instances. Therefore, in our instantiations, we only explain the technical detail of these in-group and cross-group key pre-distribution instances.


79

4.2. Hash Key-Based Instantiation For small groups, the simplest key pre-distribution method is to generate and assign a unique random key to every pair of sensor nodes. This scheme also provides perfect security guarantee in the presence of compromised sensor nodes, which means that the compromise of sensor nodes does not leak any information about the shared keys between non-compromised sensor nodes. However, in this chapter, we propose to take advantage of the oneway hash function to reduce almost half of the storage overhead and evenly split it among sensor nodes. The detail of the basic building block for our group-based instantiation is presented below. Before deployment, every sensor node i is pre-distributed with a master key Ki , which is only known by the trusted central server (e.g., base station) and the node i. Let G be either a deployment group or a cross group. Assume that the node IDs in G have already been sorted in an ascendent order. For any sensor node i ∈ G, let Pos(i) be the position of this node in the ordered group G. For any two nodes i and j (Pos(i) < Pos(j)) in this group, we check the value (Pos(i) + Pos(j)). If it is an odd value ((Pos(i) + Pos(j)) mod 2 = 1), we will pre-distribute H(Ki ||j) to the node j; otherwise, we will pre-distribute H(Kj ||i) to the node i, where H is a one-way hash function. For example, as shown in Figure 2, node 1 and node 2 are in the same deployment group. In this case, we will simply pre-distribute the key H(K1 ||2) to node 2. Because of our group construction method, we can easily calculate the positions of a sensor node in its deployment group and cross group, respectively. Specifically, given a sensor node ID i, we can easily determine that this node is in the deployment group with index mi and the cross group with index ((i − 1) mod m) + 1. Therefore, in case of the deployment group, we have Pos(i) = ((i − 1) mod m) + 1; in the case of cross group, we have Pos(i) = mi . Therefore, if a sensor node i wants to establish a key with node j after deployment, it can easily determine whether they are in the same group (either deployment group or cross group). If they are not in the same group, they will follow the path key establishment protocol that is discussed at the beginning of this section to establish an indirect key; otherwise, both of node i and node j can easily figure out the direct key shared between them using the following algorithm. • If Pos(i) < Pos(j) and (Pos(i)+Pos(j)) mod 2 = 1, node i can compute the shared key H(Ki ||j), while node j has already been pre-distributed with this key.

80


• If Pos(i) < Pos(j) and (Pos(i) + Pos(j)) mod 2 = 0, node i has the pre-distributed key H(Kj ||i), while node j can compute this key easily. • If Pos(i) > Pos(j) and (Pos(i) + Pos(j)) mod 2 = 1, node i has the pre-distributed key H(Kj ||i), while node j can compute this key easily. • If Pos(i) > Pos(j) and (Pos(i)+Pos(j)) mod 2 = 0, node i can compute the shared key H(Ki ||j), while node j has already been pre-distributed with this key. From the above discussion, we can clearly see that a sensor node can immediately determine the direct key shared with another sensor node in the same group. There is no additional communication overhead. Since any two sensor nodes in the same group shared a unique key, there is no need to implement the path key establishment inside a group. In addition, we can also see that every shared key between two sensor nodes is only known by these two related sensor nodes. Hence, the compromise of sensor nodes does not lead to the compromise of any direct key between two non-compromised sensor nodes. As a result, the above scheme guarantees the perfect security property in the presence of node compromise attacks. Now let us estimate the storage space for the keying materials at sensor nodes. Consider any sensor node i in a deployment group G. There are Pos(i) − 1 sensor nodes with smaller IDs and n − Pos(i) sensor nodes with larger IDs. When Pos(i) is an odd number, we can easily see that node i keys for the sensor nodes with smaller IDs, will get pre-distributed Pos(i)−1 2 n−P os(i) and keys for the sensor nodes with larger IDs. Therefore, the 2 overall number of pre-distributed pairwise keys to node i for the deployment group G is n − Pos(i) n Pos(i) − 1 + ≈ . 2 2 2

(2)

Similarly, if Pos(i) is even, the number of pre-distributed pairwise keys to node i is approximately n2 . When node i belongs to a cross group G , we can also estimate the number of pre-distributed pairwise keys as m 2 in a similar way. Thus, the total number of pairwise keys that are predistributed to a sensor node for both of its deployment group and cross group is approximately m+n 2 .


81

4.3. Polynomial-Based Instantiation The idea presented in the previous subsection allows a sensor node to establish a shared key with any other sensor node in the same group easily. In addition, it also provides the perfect security guarantee. However, the hash key-based instantiation has the following two problems. First, the storage overhead for the pre-distributed pairwise keys increases linearly with number of groups (n + m). Although we can always allocate enough space for these keying materials, it is always desirable to allow the trade-off between security and storage overhead given resource constraints. Second, for the hash key-based scheme, once the groups are constructed, it is non-trivial to further extend the network and deploy new groups of sensor nodes. As a result, it is also desirable to seek other instantiations where the network can be easily extended. This subsection provides an instantiation that meets these requirements. In this instantiation, we use the basic polynomial-based pairwise key establishment in Ref. 23 as the basic building block of our group-based key pre-distribution. The resulting scheme is similar to the grid-based scheme.10 However, it also differs from the grid-based scheme in that this instantiation exploits the node grouping idea to make sure that the sensor nodes sharing the same polynomial will be close to each other. This immediately provides some nice properties, as we will see later. Compared to the hash key-based scheme, this instantiation allows us to make trade-offs between security and storage, while still provides an efficient way to establish a pairwise key between any two sensor nodes. Specifically, for any group G (either a deployment group or a cross group), we generate a unique symmetric t-degree bivariate polynomial fg (x, y) with the property of fg (x, y) = fg (y, x). Every sensor node i ∈ G gets pre-distributed a polynomial share fg (i, x) by evaluating the bivariate polynomial fg (x, y) at x = i. It is assumed that the polynomial fg (x, y) is only known by a trusted server. To establish a pairwise key with node j, node i only needs to compute fg (i, j), which equals fg (j, i), the value that can be computed by node j as well. There is no additional communication involved. For example, as shown in Figure 2, the deployment group G1 includes nodes 1, 2 and 3. We generate a random 2-degree bivariate polynomial fG1 (x, y) with the property of fG1 (x, y) = fG1 (y, x) and then pre-distribute fG1 (1, x), fG1 (2, x), and fG1 (3, x) to node 1, node 2 and node 3, respectively.


82

Table 1. n m c pd pi pcd pci

Notations.

number of deployment groups number of the sensor nodes in the same deployment group number of compromised sensor nodes probability of having a direct key between two neighbors probability of having an indirect key between two neighbors probability of a direct key being compromised probability of an indirect key being compromised

According to Ref. 23, this simple method can tolerate up to t compromised nodes in a group. In other words, the collusion of no more than t compromised nodes cannot break the shared key between any two noncompromised sensor nodes in the group. On the other hand, we also see that the overall storage overhead for key materials in the polynomial-based instantiation is 2t, which is independent of the number of groups n + m in the network. Clearly, this allows further trade-offs between the storage space and the security performance. Note that the polynomial-based instantiation is similar to the grid-based scheme10 or PIKE,11 especially when every row (or column) of the sensor nodes in the grid structure are deployed in the same group. However, the main contribution of this chapter is that we exploit the possibility of using the deployment knowledge other than the expected or discovered locations to further improve key pre-distribution. As we will see, our polynomial-based scheme can achieve much better performance than the grid-based scheme when the group-based deployment knowledge is available. On the other hand, our group construction generates small groups and thus allows us to build an efficient key pre-distribution for a large scale network from a simple and efficient key pre-distribution scheme that may only work well for a small network if used directly.

5. Evaluation During the evaluation, we assume the same number of deployment groups and cross groups in the network (m = n) for simplicity. The analysis will be focused on the probability of establishing keys between sensor nodes and the security of the direct and indirect keys in the presence of compromised sensor nodes. For convenience, we list those frequently used notations in our later analysis in Table 1.


83

5.1. Overhead This chapter provides a framework and two efficient instantiations to establish pairwise keys between sensor nodes. The overhead of using such keys in security protocols (e.g., encryption or authentication) depends on the real applications. Thus, in this chapter, we only focus on the overhead involved in establishing these keys. In particular, we focus on the overhead of the two instantiations. As we discussed earlier, the storage overhead for the hash key-based instantiation is approximately n (since m = n), while the storage overhead for the polynomial-based instantiation is 2t. In both instantiations, any two sensor nodes in the same deployment group or the same cross group can establish a direct key between each other, and there is no communication overhead involved in the establishment of the direct keys between sensor nodes. When two sensor nodes are in different deployment groups and different cross groups, they need to establish an indirect key to protect the communication between them. According to the protocol description, the path key establishment may involve one intermediate node, which is either in the same deployment group as the source node or in the same deployment group as the destination node, or two intermediate nodes, where one is in the same deployment group as the source node and the other is in the same deployment group as the destination node. Hence, in practice, the communication overhead for path key establishment is limited in two deployment groups. In addition, every sensor node only needs to discover the list of the nearby sensor nodes in its local area for the path key establishment. This only incurs a small amount of communication overhead. 5.2. Establishing Direct Keys Consider a particular sensor node u in the deployment group Gi at position (x , y ). Let A denote its communication area in which any other sensor node can directly communicate with node u. In this chapter, we assume A is a circle centered at (x , y ) with radius R, where R is the signal range of a sensor node. Thus, the average number of the sensor nodes in any deployment group Gj , including Gi , that finally reside in A can be estimated as f (x − xj , y − yj )dxdy. (3) ni,j (x , y ) = n A


84

For any deployment group Gj other than Gi , we know that there is only one sensor node u in Gj that shares the same cross group Gk with node u. Thus, the probability of this node u being deployed in A can be estimated ni,j (x ,y ) . This indicates that among all those sensor nodes deployed as n in A, the average number of sensor nodes that belong to the deployment groups other than Gi but share the same cross group Gk with node u can be estimated as n j=1,j=i ni,j (x , y ) . (4) ni (x , y ) = n When sensor nodes are evenly distributed in the deployment field, it is possible to further simplify the above equation. Suppose the average number of sensor nodes in the communication range of a sensor node is nA . We have nj=1,j=i ni,j (x , y ) = nA − ni,i (x , y ). Thus, ni (x , y ) =

nA − ni,i (x , y ) . n

(5)

In the proposed two instantiations, two sensor nodes in the same group can always establish a direct key. Thus, the average number of the sensor nodes in A that can establish direct keys with node u can be estimated as (ni,i (x , y ) + ni (x , y )). This means that the probability of u having direct keys with its neighbor nodes can be estimated as pi (x , y ) =

(ni,i (x , y ) + ni (x , y )) . nA

(6)

Hence, for any node in group Gi , the probability of having direct keys with its neighbor nodes can be estimated as f (x − xi , y − xi )pi (x, y)dxdy,

pd =

(7)

S

where S denotes the entire deployment field. pd can also be used to estimate the probability of any node in any deployment group having a direct key with its neighbor node when S is an infinite field. For a given deployment field S, we simply configure the deployment point of Gi as its geometric centroid, and use the probability of a node in Gi having a direct key with its neighbor node to represent the probability of having a direct key between any two neighbor nodes.


85

According to the above analysis, we can clearly see that both of our instantiations result in the same probability of establishing a direct key between two neighbor nodes in the network since the probability of having a direct key between two sensor nodes in the same group (either deployment group or cross group) for both instantiations is always 1. During the evaluation, we use the following configuration throughout this chapter. we assume there are totally 10,000 sensor nodes deployed in a 1000 × 1000 square meters area. These sensor nodes are divided into 100 deployment groups with 100 sensor nodes in each group (n = m = 100). We assume sensor nodes are evenly distributed in the deployment field so that the probability of finding a node in each equal size region can be made approximately equal. In other words, the density of the sensor nodes is approximately one sensor node per 100 square meter. We always assume 2 the signal range is R = 40m. Thus, there are π40 100 ≈ 50.27 neighbors on average for any given sensor node. Figure 3 illustrates the probability of establishing a direct key between two neighbor sensor nodes for different standard deviation σ of the deployment of sensor nodes. We can clearly see the high probability of establishing a direct key between two neighbor sensor nodes for a small value of σ. This indicates that our framework greatly improves the key pre-distribution as long as the sensor nodes in the same group are indeed close to each other after deployment. However, the result also shows that the probability of establishing direct keys for our schemes decreases when the sensor deployment deviation σ increases. In particular, the benefits introduced by our group-based approaches as compared with existing solutions will diminish when the sensor nodes in the same group are not close to each other. This is also confirmed by our later study on the probability of establishing indirect keys and the security in hostile environments. This problem, however, is not surprising since our study is motivated by the location-based grouping of sensor nodes. When the group-based deployment model turns out to be ineffective, our approaches cannot do much to improve the performance. Nevertheless, our study indicates an interesting research direction where the performance of key management is improved by investing more efforts on the sensor deployment. To better show the effectiveness of our framework, we also compare them with the existing key pre-distribution techniques such as the random pairwise keys scheme,8 the random subset assignment scheme,10 and the grid-based scheme.10 In addition, we will also compare our schemes with


86

Probability of having direct keys between neighbors

1.2 RS RK Grid Our schemes CPKS

1

0.8 0.6 0.4 0.2 0 0

50

100 150 Standard deployment deviation

200

Fig. 3. Probability of having direct keys between neighbor nodes. “RS” represents the random subset assignment scheme. “RK” represents the random pairwise keys scheme. “Grid” represents the grid-based scheme. “CPKS” represents the closest pairwise keys scheme.

the closest pairwise keys scheme (the extended version),13 which exploits the knowledge of the expected locations of sensor nodes to facilitate key pre-distribution. For the random subset assignment scheme and the grid-based scheme, we assume the same number of bivariate polynomials in the system and the same number of polynomial shares stored on each sensor node as the polynomial-based instantiation. Thus, there are m + n = 200 bivariate polynomials in the polynomial pools for the random subset assignment scheme and the grid-based scheme. The random subset assignment scheme assigns the polynomial shares of 2 randomly selected polynomials from the pool to each sensor node. The grid-based scheme arranges 200 polynomials on a 100 × 100 grid, and each sensor node also gets two polynomial shares. For the closest pairwise keys scheme, we assume the same storage overhead as our hash key-based instantiation. Hence, every sensor node can store 100 keys, which means that it shares keys with 200 sensor nodes that are closest to itself in terms of the expected locations. In addition, we also assume the sensor nodes are deployed in the same way as our group-based model. The deployment field is equally partitioned into 10 × 10 cells with one group for each cell. The expected location of every deployment group is the center of the corresponding cell, which is known by every sensor node.


87

Figure 3 shows the results of comparison. We can see that our schemes have a significantly higher probability of establishing a direct key between two neighbor sensor nodes than the random subset assignment scheme and the pairwise keys scheme. This indicates that our schemes can support larger sensor networks under the same network settings. Therefore, we believe that our framework can substantially improve the performance of existing key pre-distribution techniques. Figure 3 also shows that the closest pairwise keys scheme can achieve better performance than the proposed schemes. The reason is that this scheme assume the knowledge of sensors’ expected locations, which is not required by our schemes. As discussed before, the expected locations could be difficult to obtain in real-world scenarios. We therefore strongly believe that the group-based model is a more realistic deployment model. On the other hand, the performance of our schemes are actually not significantly worse than the closest pairwise keys scheme. 5.3. Establishing Indirect Keys In the following, we estimate the probability of having an indirect key between two neighbor sensor nodes when they cannot establish a direct key. Note that the key pre-distribution instances in both instantiations guarantee that any two nodes in the same group can establish a direct key. Thus, the need for establishing indirect keys only happens when two sensor nodes are in different deployment group and different cross group. In this case, they have to find a valid bridge between these two deployment groups to establish an indirect key. Since there are m cross groups and the nodes in the same group can always establish a direct key in our proposed instantiations, there are totally m valid bridges. Any one of these bridges can help the source node to setup an indirect key with the destination node. On the other hand, the two sensor nodes involved in each of these bridges can be easily computed based on the IDs of the source and the destination node. Therefore, as long as the source or the destination node can communicate with both of the two nodes involved in any of these bridges, they can setup an indirect key. For example, as shown in Figure 2, assume node 1 wants to setup an indirect key with node 12. Suppose node 1 can communicate with node 2, and node 12 can communicate with node 11. In this case, the bridge 2, 11 will be used to setup an indirect key between them since they can communicate with both nodes 2 and 11.

88


Therefore, an interesting question is to estimate the probability of establishing an indirect key if a sensor node only communicates with the sensor nodes that are not far away. For simplicity, we assume that a sensor node will only contact the sensor nodes that are no more than d hops away from itself for path key establishment, where d is a system parameter. For the ease of analysis, we simply consider the sensor nodes that are within d × R meters of a given sensor node u as the sensor nodes that are within d hops of node u, where R is the signal range of sensor nodes. Consider a particular sensor node u in the deployment group Gi . Let us first estimate the average number of sensor nodes in Gi that are no more than d × R meters away from u. Let (x , y ) be the final resident point of node u. Let B denote the area that are no more than d × R meters away from (x , y ). Thus, the average number of sensor nodes in group Gi that finally reside in B can be estimated as f (x − xi , y − yi )dxdy. (8) nd (x , y ) = n B

Therefore, on average, the number of sensor nodes in Gi that are no more than d × R meters away from node u can be estimated as f (x − xi , y − xi )nd (x, y)dxdy, (9) nd = S

where S denotes the entire deployment field. Consider two neighbor nodes u and v in different deployment group Gi and Gj , respectively. The average number of other sensor nodes in group Gi that can be reached by either u or v is at least nd , and the average number of other sensor nodes in group Gj that can be reached by either u or v is at least nd . As long as these nd nodes in Gi and nd nodes in Gj form at least one bridge, the indirect key can be established. Since node u and v are in different cross group, there are m − 2 bridges that involve two nodes and 2 bridges that only involve one node. Therefore, the probability of successfully finding one bridge can be estimated by pi = 1 − (1 −

nd 2 (n − 2 − nd )!(n − 2 − nd )! ) ( ). n (n − 2)!(n − 2 − 2nd )!

(10)

Figure 4 illustrates the probability of having an indirect key between two neighbor sensor nodes when they cannot setup a direct key. We can clearly see that a sensor node can easily setup an indirect key with its neighbors by only communicating with the sensor nodes in its local area. In addition, when the sensor nodes in the same deployment group are close


89

to each other (leading to a small value of σ), a sensor node only needs to communicate with its neighbors to setup an indirect key with any other neighbor node with a very high probability.

Probability of having indirect keys between neighbors

1.2 1 0.8 0.6 0.4

d=1 d=2

0.2

d=4 0 0

50


200

Fig. 4. Probability of having indirect keys between sensor nodes in different deployment groups.

Similar to the analysis in the previous subsection, we also compare the performance of our schemes (the two instantiations) with the random pairwise keys scheme,8 the random subset assignment scheme10 and the gridbased scheme.10 We configure these schemes in the same way as we did before. Specifically, every sensor node in these schemes store the keying materials that is equivalent to 100 cryptographic keys. There are m + n = 200 bivariate polynomials in the polynomial pools for the random subset assignment scheme and the grid-based scheme. The random subset assignment scheme assigns the polynomial shares of 2 randomly selected polynomials from the pool to each sensor node. The grid-based scheme arranges 200 polynomials on a 100 × 100 grid, and each sensor node will also get two polynomial shares. For all these schemes, we assume that a sensor node will only contact other sensor nodes that are no more than 2R meters away from itself for path key establishment. For the random subset assignment scheme,10 the random pairwise keys scheme,8 and the closest pairwise keys scheme, two sensor nodes always try to find an intermediate sensor node that can establish direct keys with both the source and the destination node. Hence, the probability of having an indirect key can be estimated by 1 − (1 − p2 )n ,


90

where p is the probability of having a direct key between neighbor nodes and n is the total number of sensor nodes contacted in path key establishment. For these three schemes, we always assume that only the source node is responsible for contacting other sensor nodes during the discovery of intermediate nodes. For the grid-based scheme,10 since two sensor nodes can always immediately compute the paths for the path key establishment, we assume that they always try to find a path that only involves up to two nodes. There are n + m − 2 potential paths that can help establish an indirect key between two sensor nodes. Two of them involve only one intermediate node, and n + m − 4 of them involve two intermediate nodes. The probability that none of them works can be estimated by (1 −

n (n − 1) n )2 (1 − ( ))n+m−4 . nm − 2 (nm − 2)(nm − 3)

(11)

Hence, the probability of having an indirect key can be estimated by 1 − (1 −

n n (n − 1) )2 (1 − ( ))n+m−4 . nm − 2 (nm − 2)(nm − 3)

(12)

Figure 5 compares the probability of establishing indirect keys between neighbor sensor nodes for different schemes. We can clearly see that our proposed instantiations outperform all the previous location-unaware schemes significantly for a reasonable value of σ. In other words, as long as the sensor nodes are deployed in groups, our framework can be used to obtain high performance key pre-distribution schemes for sensor networks. Similarly, we also note that the closest pairwise keys scheme can achieve better performance than our schemes. The reason has been explained before. Figure 5 also shows that it is not guaranteed that every two neighbor nodes can find a valid bridge for use, especially for a large deployment deviation σ. However, we do not suggest the development of any additional protocol for such problem due to the following reasons. First, compared with developing a new complicated protocol, investing more efforts on sensor deployment and allocating more storage space for keys seem far more reasonable and practical to improve the probability of establishing keys between sensor nodes. Second, it is usually not necessary to guarantee that every two neighbor nodes can establish a pairwise key since node redundancy is often used for fault tolerance in sensor networks. In most cases,


91

the network will function properly as long as there are sufficient number of “working” sensor nodes.

Probability of having indirect keys between neighbors

12 1 0.8 0.6 RS RK Grid Our schemes CPKS

0.4 02 0 0

Fig. 5.

50


200

Probability of having indirect keys between sensor nodes for different schemes.

5.4. Security Analysis The main threat we consider in the security analysis is the compromise of sensor nodes since it is quite clear that an attacker has no way to infer the shared key established between any two sensor nodes without compromising sensor nodes. We assume the attacker compromises a random set of c sensor nodes in the network. We assume that the secrets in a sensor node will be disclosed to the attacker once this sensor node is compromised. This subsection focuses on the impact of compromised sensor nodes on direct key establishment and path key establishment. Similar to the analysis in the previous subsection, we investigate the security of the proposed two instantiations and compare them with the random subset assignment scheme,10 the random pairwise keys scheme,8 the grid-based scheme,10 and the closest pairwise keys scheme.13 During the evaluation, we always assume that the memory usage at each sensor node is equivalent to store 100 cryptographic keys. According to the previous configuration, there are 10, 000 sensor nodes in the network, and n = m = 100. For our polynomial-based instantiation, the random subset assignment10 and the grid-based scheme,10 the bivariate polynomials have the degree of t = 49.

92


5.4.1. Impact on Direct Key Establishment For the hash key-based instantiation, every pre-distributed pairwise key is only known by the related two sensor nodes. Certainly, once a few sensor nodes are compromised, the attacker will know the master keys of these compromised nodes and also get a number of hash images of the master keys at some other non-compromised sensor node. However, due to the one-way hash function, no matter how many hash images of a master key is disclosed, it is still computationally infeasible to recover this master key. This indicates that no matter how many sensor nodes are compromised, the direct key shared between non-compromised sensor nodes are still secure. In other words, the hash key-based instantiation provides the perfect security guarantee against node compromise. When compared with the random pairwise keys scheme,8 we note that the random pairwise keys scheme can also provide the perfect security guarantee against node compromise. However, as shown in the previous analysis, the probability of having a direct key between two neighbor nodes in the random pairwise keys scheme is much lower than that in the hash keybased instantiation. The reason is that the proposed group-based deployment model allows us to predict a sensor’s neighbor nodes more accurately. For example, when a sensor node can only store 100 keys, the probability of having a direct key between neighbors is only 0.01 for the random pairwise keys scheme. In contrast, for the hash key-based instantiation, we can achieve a much higher probability of having a direct key between neighbors, especially when the sensor nodes in the same group are close to each other after deployment, as shown in Figure 3. As a result, given the same storage overhead and security performance, our hash key-based instantiation can achieve a much better performance in terms of the probability of establishing a direct key between neighbor sensor nodes. When compared with the closest pairwise keys scheme,13 we note that this scheme can also achieve perfect security guarantee against node compromise. Additionally, as we discussed before, this scheme can also achieve a higher probability of establishing keys for sensor networks. However, we still believe that our hash key-based scheme is more practical in most applications due to the following two reasons. First, the closest pairwise keys scheme uses the expected locations of sensor nodes, which may not be available. Second, the performance of our scheme is not significantly worse than the closest pairwise keys scheme.


93

As mentioned, the grid-based scheme10 can be considered as our polynomial-based instantiation if a row or a column of sensor nodes in the grid are deployed in the same group. This means that the grid-based scheme and our polynomial-based instantiation have the same security performance against the node compromise attacks given the same settings (e.g., storage overhead, network size). On the other hand, Figure 3 tells us that our polynomial-based instantiation can achieve much higher probability of establishing direct keys between neighbor nodes than the grid-based scheme. This implies that our polynomial-based instantiation is more desirable than the grid-based scheme when the group-based deployment model is made possible. Thus, in our later security analysis, we will simply skip the security comparison between the grid-based scheme10 and the polynomialbased instantiation. Next, we will study the security of the direct keys established in the polynomial-based instantiation and compare it with the random subset assignment scheme.10 Since every sensor node can store 100 keys, the degree t of polynomials in our instantiation is set to 49. For the random subset assignment scheme, we also set the degree of the bivariate polynomial to 49 and assign every sensor node two shares on two randomly selected polynomials from a polynomial pool. The size of the polynomial pool in the random subset assignment scheme is configured in such a way that the probability of having a direct key between two neighbor sensor nodes is the same as that in our proposed polynomial-based instantiation. In this way, we actually compare the security of two schemes under the same storage overhead and the same probability of establishing direct keys between neighbor sensor nodes. In the following, we first look at the impact of the compromised sensor nodes on the polynomial-based instantiation. Consider a direct key between any two non-compromised sensor nodes in the same group Gi (either a deployment group or a cross group). Since there are totally c compromised sensor nodes, the probability of j sensor nodes in group Gi being (n−1)c−j c! compromised can be estimated as (c−j)!j! for j ≤ m − 1. Based on nc the result in Ref. 23, as long as there is no more than t compromised nodes, the direct key between two non-compromised nodes in Gi is still secure. Hence, the probability of any direct key between two non-compromised sensor nodes in Gi being compromised can be estimated as pcd = 1 −

t j=0

c! (n − 1)c−j (c − j)!j! nc

(13)


94

Figure 6 compares the probability of a direct key between two noncompromised sensor nodes being compromised for the polynomial-based instantiation and the random subset assignment scheme.10 In this figure, we consider the case when σ is set to 50 and the case when σ is set to 100. When σ = 50, the probability of having direct keys between neighbor sensor nodes in our polynomial-based instantiation is 0.3. Thus, the size of the polynomial pool in the random subset assignment scheme is set to 13 to achieve the same probability of having direct keys between neighbor sensor nodes. Similarly, when σ = 100, we will configure the polynomial size in the random subset assignment scheme as 45. From the figure, we can clearly see that the our polynomial-based instantiation can achieve much better security performance given the same settings, especially when the sensor nodes in the same deployment group are close to each other after deployment.

Probability of a direct key being compromised

1.2 1 0.8 0.6 0.4

RS-50 RS-100 Poly

0.2 0 0

1000

2000

3000

4000

5000

6000

7000

8000

Number of compromised nodes

Fig. 6. Probability of a direct key between two non-compromised nodes being compromised. “RS-50” represents the random subset assignment scheme when σ = 50. “RS100” represents the random subset assignment scheme when σ = 100. “Poly” represents our polynomial-based instantiation.

5.4.2. Impact on Path Key Establishment In the following, we study the impact of compromised sensor nodes on the indirect keys established between neighbor sensor nodes. Note that when the compromised sensor nodes can be detected, two non-compromised nodes can always re-establish an indirect key through the path key establishment and avoid those compromised sensor nodes or compromised


95

key pre-distribution instances. However, it is usually very difficult to detect compromised sensor nodes. When the compromised nodes cannot be detected, the indirect key between two non-compromised nodes may be disclosed to the attacker without being noticed. Thus, in the following analysis, we focus on the probability of a given indirect key between two non-compromised sensor nodes being compromised when we cannot detect the compromised sensor nodes. The establishment of an indirect key between sensor nodes involves up to two intermediate nodes. Without loss of generality, we assume the source node u in group Gi wants to setup an indirect key with the destination node v in group Gj . We also assume the indirect key is established through a bridge u , v , where u ∈ Gi and v ∈ Gj . Since the key established between node u and node v is an indirect key, we have either u = u or v = v . Note that u and v are also in different cross groups. We need to consider the following two cases: (1) u = u or v = v : The probability that this case happens can be 2 . Clearly, the path key establishment only involves one estimated as m intermediate node. The indirect key will be still secure if this node is not compromised and the two related direct keys are not compromised. Hence, the probability of the indirect key being compromised can be c ) estimated by p1 = 1 − (1 − pcd )2 (1 − nm−2 (2) u = u and v = v: The probability that this case happens can be estimated as m−2 m . Clearly, the path key establishment only involves two intermediate nodes. Similarly, the probability of the indirect key c )2 being compromised can be estimated by p2 = 1 − (1 − pcd)3 (1 − nm−2 Overall, the probability of an indirect key between non-compromised sensor nodes being compromised can be estimated as pci (c) =

2 × p1 + (m − 2) × p2 . m

(14)

For the purpose of comparison, in the random subset assignment scheme10 and the random pairwise keys scheme,8 two sensor nodes always try to find an intermediate sensor node that can establish direct keys with both the source and the destination node. Clearly, an indirect key will be still secure if (1) the intermediate node has not been compromised and (2) the two related direct keys used for the path key establishment have not been compromised. Thus, the probability of an indirect key between two

96


c non-compromised sensor nodes being compromised is 1−(1−p)2(1− nm−2 ), where p is the probability of a direct key between two non-compromised sensor nodes being compromised for the random subset assignment scheme10 or the random pairwise keys scheme.8 For the random subset assignment scheme, the size of the polynomial pool in the random subset assignment scheme is configured in such a way that the probability of having a direct key between two neighbor sensor nodes is the same as that in our proposed polynomial-based instantiation. For simplicity, we assume the standard deviation of the sensor deployment is 50 meters, leading to a probability of 0.3 for establishing direct keys between neighbor sensor nodes. In this case, we set the polynomial pool size to 13 such that the probability of having a direct key between neighbor sensor nodes is also 0.3. For the grid-based scheme,10 since two sensor nodes can always immediately compute the paths for the path key establishment, we assume that they always try to find a path that only involves up to two nodes. The prob2 . In this case, this ability of only involving one intermediate node is n+m−2 c ), indirect key will be compromised at a probability of 1 − (1 − p)2(1 − nm−2 where p is the probability of a direct key between two non-compromised sensor nodes being compromised. The probability of involving two intermediate nodes in the path key establishment is n+m−4 n+m−2 . In this case, the probability of the indirect key being compromised can be estimated by c )2 . Hence, overall, the probability of an indirect key 1 − (1 − p)3 (1 − nm−2 in the grid-based scheme being compromised can be estimated by

2(1 − (1 − p)2 (1 −

c nm−2 ))

+ (n + m − 4)(1 − (1 − p)3 (1 − n+m−2

c 2 nm−2 ) )

(15)

Figure 7 shows the probability of an indirect key between two noncompromised sensor nodes being compromised for these different schemes. We can see that our two instantiations has better security performance than the random subset assignment scheme given a reasonable σ in terms of the fraction of compromised indirect keys given a certain number of compromised sensor nodes. The random pairwise keys scheme and the closest pairwise keys scheme can have slightly better security than our schemes. However, as we mentioned before, our instantiations can achieve a high probability of having a direct key between neighbor sensor nodes and do not assume the knowledge of the expected locations, while the random pairwise keys scheme can hardly establish a direct key between two neighbor


97

sensor nodes and the closest pairwise keys scheme assumes the knowledge of the expected locations. The grid-based scheme has a similar security performance when compared with the proposed two instantiations. However, our proposed schemes achieve much better performance in terms of the probability of establishing direct keys between neighbors when the sensor nodes are deployed in groups as shown in Figure 3. Therefore, we strongly believe that the proposed two instantiations are usually more practical than the existing key pre-distribution schemes when the group-based deployment model is made possible. In Figure 7, we also note that the probability of an indirect key between two non-compromised nodes being compromised increases at a nonnegligible rate when there are more and more compromised sensor nodes. To further enhance the security of our techniques under compromised sensor nodes, we can certainly apply the multi-path reinforcement idea in Ref. 8. Basically, we have every two sensor nodes establish multiple indirect keys from a number of independent paths and then XOR these keys to generate the actual indirect key used for secure communication. The multi-path reinforcement requires a number of independent paths to setup an actual indirect key. This is actually non-trivial for many existing key pre-distribution techniques. However, in our proposed instantiations, every sensor node can easily compute m paths to any other sensor node that cannot establish a direct key with itself. Due to the group-based deployment model, it is very likely that this sensor node will find most of these paths in its local area. As a result, the multi-path reinforcement can be efficiently implemented in our framework to further improve key predistribution. Once this idea is applied in our framework, the attacker has to break all paths to compromise the actual indirect keys. The security of our schemes can thus be enhanced. 5.5. Discussion In this chapter, we present a novel group-based framework for improving key pre-distribution and two efficient instantiations under this new framework. The analysis in this section demonstrates the significant improvements achieved by applying our framework when the sensor nodes are deployed in groups. We strongly believe that the proposed two instantiations are practical for the current generation of sensor networks. First, these two schemes allow efficient implementation since a sensor node can either directly setup a


98

Probability of indirect keys being compromised

12 1 RS RK Grid Hash Poly CPKS

08 06 04 02 0 0

500

1000

1500

2000

Number of compromised nodes

Fig. 7. The probability of an indirect key being compromised for different schemes. “Hash” represents the hash key-based instantiation.

key with its neighbor or immediately identify the nodes in its local area to setup an indirect key as long as it has the list of the nearby sensor nodes. Second, the proposed instantiations can achieve much better security and performance than the existing key pre-distribution schemes when the sensors’ expected or discovered locations are not available. Therefore, the two instantiations are more practical than the previous schemes in practice, especially when the sensor nodes can be deployed in groups. When the proposed two instantiations are compared with each other, we note that both of them have advantages and disadvantages. First, the hash key-based scheme can provide perfect security guarantee, and the key can be derived by performing one efficient hash function. For the polynomial-based scheme, the sensor node has to evaluate a t-degree polynomial to compute the pairwise key. Although the polynomial-based scheme can also provide perfect security guarantee when we configure t = m − 1, it introduces more (almost double) storage overhead than the hash key-based scheme. Second, the polynomial-based scheme can provide unconditional security when the number of compromised sensor nodes in one group is less than t, the degree of the bivariate polynomial, while the hash key-based scheme only provides computational security guarantee. Third, the storage overhead of the hash key-based scheme increases linearly with the number of groups (n + m) in the network, while the storage overhead in the polynomial-based scheme only depends on the security parameter t. In other words, the polynomialbased scheme allows further trade-offs between the storage overhead and the security of key pre-distribution. Finally, the polynomial-based scheme


99

can be extended whenever we want to deploy new groups. In contrast, for the hash key-based scheme, we have to reserve additional space for the future deployment. Based on the above discussion, we can conclude that the hash keybased solution is more appropriate when the storage space allows since it provides perfect security with small overhead in computing the shared keys. However, when we have severe storage constraints, we should use the polynomial-based solution since it can trade-off the security with the storage space and provides an efficient way to extend the network size. 6. Related Work A number of techniques have been proposed to establish pairwise keys in resource constrained sensor networks. A basic probabilistic key predistribution scheme was introduced in Ref. 7 and improved in Ref. 8. The limitation of these approaches is that a small number compromised sensor nodes may affect the secure communication between a large number of non-compromised sensor nodes. A random pairwise keys scheme was proposed in Ref. 8. Although this technique provides perfect security against node capture attacks, it cannot scale to large sensor networks. To improve the resilience of sensor networks against node compromises, two thresholdbased key pre-distribution techniques were developed in Refs. 9, 10. A cooperative protocol was developed to enhance the security of pairwise key establishments.24 The giant component theory was used in Ref. 25 to further improve the performance and provide trade-off between connectivity, memory size and security. In this chapter, we demonstrate that the performance of these key pre-distribution techniques can be further improved significantly by using our framework. The grid-based idea was first proposed in Ref. 10 to arrange the secrets in sensor networks based on a logical grid. A similar idea was later used in PIKE.11 However, the grids considered in these two studies are logical grids, while this chapter investigates the possibility of using the locality of group deployment to improve the performance of the existing key pre-distribution techniques. The prior deployment knowledge of sensor nodes has been used to improve the performance of many key pre-distribution protocols.12,13,15,16 The post deployment knowledge of sensor nodes has also been used to improve key pre-distribution.14 The technique in this chapter differs from these approaches in that it does not require the expected or discovered location

100


information of sensor nodes, and is therefore desirable for the scenarios where it is difficult to deploy the sensor nodes at their expected locations or correctly estimate the sensors’ locations after deployment. There are many other studies on sensor network security, including key management schemes,26–28 tamper-resistant hardware,29 efficient broadcast authentication,2 secure data aggregation and in-networking processing,30–32 and vulnerabilities, attacks, and countermeasures.33,34 We consider them complementary to our techniques in this chapter. 7. Conclusion and Future Work In this chapter, we developed a general framework that can be used to improve the performance of existing key pre-distribution schemes. This framework does not require the knowledge of sensors’ expected locations or actual deployment locations. We also presented two efficient instantiations in this framework. The analysis demonstrated that this framework can significantly improve the security as well as the performance of existing key pre-distribution protocols. Several research directions are worth further studying, including detailed performance evaluation through simulation, the implementation of these techniques on real sensor platforms, and the evaluation through field experiments. References 1. I. Akyildiz, W. Su, Y. Sankarasubramaniam, and E. Cayirci. Wireless sensor networks: A survey, Computer Networks. 38(4), 393–422, (2002). 2. A. Perrig, R. Szewczyk, V. Wen, D. Culler, and D. Tygar. SPINS: Security protocols for sensor networks. In Proceedings of Seventh Annual International Conference on Mobile Computing and Networks (MobiCom) (July, 2001). 3. J. Hill, R. Szewczyk, A. Woo, S. Hollar, D. Culler, and K. S. J. Pister. System architecture directions for networked sensors. In Architectural Support for Programming Languages and Operating Systems, pp. 93–104, (2000). 4. D. Gay, P. Levis, R. von Behren, M. Welsh, E. Brewer, and D. Culler. The nesC language: A holistic approach to networked embedded systems. In Proceedings of Programming Language Design and Implementation (PLDI 2003) (June, 2003). 5. D. Niculescu and B. Nath. Ad hoc positioning system (APS). In Proceedings of IEEE GLOBECOM ’01, (2001). 6. C. Hartung, J. Balasalle, and R. Han. Node compromise in sensor networks: The need for secure systems. Technical Report CU-CS-990-05, U. Colorado at Boulder (Jan., 2005).

Key Pre-Distribution for Sensor Networks Using Group Deployment Knowledge 101

7. L. Eschenauer and V. D. Gligor. A key-management scheme for distributed sensor networks. In Proceedings of the 9th ACM Conference on Computer and Communications Security (CCS), pp. 41–47 (November, 2002). 8. H. Chan, A. Perrig, and D. Song. Random key predistribution schemes for sensor networks. In IEEE Symposium on Security and Privacy (S&P), pp. 197–213 (May, 2003). 9. W. Du, J. Deng, Y. S. Han, and P. Varshney. A pairwise key pre-distribution scheme for wireless sensor networks. In Proceedings of 10th ACM Conference on Computer and Communications Security (CCS), pp. 42–51 (October, 2003). 10. D. Liu and P. Ning. Establishing pairwise keys in distributed sensor networks. In Proceedings of 10th ACM Conference on Computer and Communications Security (CCS), pp. 52–61 (October, 2003). 11. H. Chan and A. Perrig. PIKE: Peer intermediaries for key establishment in sensor networks. In Proceedings of IEEE Infocom (Mar., 2005). 12. W. Du, J. Deng, Y. S. Han, S. Chen, and P. Varshney. A key management scheme for wireless sensor networks using deployment knowledge. In Proceedings of IEEE INFOCOM (March, 2004). 13. D. Liu and P. Ning. Location-based pairwise key establishments for static sensor networks. In 2003 ACM Workshop on Security in Ad Hoc and Sensor Networks (SASN), pp. 72–82 (October, 2003). 14. D. Liu and P. Ning, Improving key pre-distribution with deployment knowledge in static sensor networks, ACM Transaction on Sensor Networks (TOSN). 1(2), (2005). 15. D. Huang, M. Mehta, D. Medhi, and L. Harn. Location-aware key management scheme for wireless sensor networks. In Proceedings of the 2nd ACM workshop on Security of ad hoc and sensor networks (SASN), pp. 29–42 (October, 2004). 16. Z. Yu and Y. Guan. A key pre-distribution scheme using deployment knowledge for wireless sensor networks. In Proceedings of ACM/IEEE International Conference on Information Processing in Sensor Networks (IPSN) (Apr., 2005). 17. D. Liu, P. Ning, and W. Du. Attack-resistant location estimation in wireless sensor networks. In Proceedings of the Fourth International Conference on Information Processing in Sensor Networks (IPSN) (April, 2005). 18. L. Lazos and R. Poovendran. Serloc: Secure range-independent localization for wireless sensor networks. In ACM workshop on Wireless security (ACM WiSe 2004), Philadelphia, PA (October 1, 2004). 19. S. Ray, R. Ungrangsi, F. D. Pellegrini, A. Trachtenberg, and D. Starobinski. Robust location detection in emergency sensor networks. In Proceedings of IEEE INFOCOM 2003 (April, 2003). 20. Z. Li, W. Trappe, Y. Zhang, and B. Nath. Robust statistical methods for securing wireless localization in sensor networks. In Proceedings of the Fourth International Conference on Information Processing in Sensor Networks (IPSN) (April, 2005). 21. S. Capkun and J. Hubaux. Secure positioning of wireless devices with application to sensor networks. In Proceedings of IEEE InfoCom, (2005).

102


22. L. Lazos, S. Capkun, and R. Poovendran. Rope: Robust position estimation in wireless sensor networks. In Proceedings of the Fourth International Conference on Information Processing in Sensor Networks (IPSN) (April, 2005). 23. C. Blundo, A. De Santis, A. Herzberg, S. Kutten, U. Vaccaro, and M. Yung. Perfectly-secure key distribution for dynamic conferences. In Advances in Cryptology – CRYPTO ’92, LNCS 740, pp. 471–486, (1993). 24. R. D. Pietro, L. V. Mancini, and A. Mei. Random key assignment for secure wireless sensor networks. In 2003 ACM Workshop on Security in Ad Hoc and Sensor Networks (SASN) (October, 2003). 25. J. Hwang and Y. Kim. Revisiting random key pre-distribution schemes for wireless sensor networks. In Proceedings of the 2nd ACM workshop on Security of ad hoc and sensor networks (SASN), pp. 43–52 (October, 2004). 26. D. Carman, P. Kruus, and B.J. Matt. Constrains and approaches for distributed sensor network security. Technical report, NAI Labs, (2000). 27. S. Zhu, S. Setia, and S. Jajodia. LEAP: Efficient security mechanisms for large-scale distributed sensor networks. In Proceedings of 10th ACM Conference on Computer and Communications Security (CCS), pp. 62–72 (October, 2003). 28. R. Anderson, H. Chan, and A. Perrig. Key infection: Smart trust for smart dust. In Proceedings of IEEE International Conference on Network Protocols (ICNP 2004) (Oct., 2004). 29. S. Basagni, K. Herrin, D. Bruschi, and E. Rosti. Secure pebblenets. In Proceedings of ACM International Symposium on Mobile ad hoc networking and computing, pp. 156–163, (2001). 30. J. Deng, R. Han, and S. Mishra. Security support for in-network processing in wireless sensor networks. In 2003 ACM Workshop on Security in Ad Hoc and Sensor Networks (SASN) (October, 2003). 31. L. Hu and D. Evans. Secure aggregation for wireless networks. In Workshop on Security and Assurance in Ad Hoc Networks (January, 2003). 32. B. Przydatek, D. Song, and A. Perrig. SIA: Secure information aggregation in sensor networks. In Proceedings of the 1st ACM Conference on Embedded Networked Sensor Systems (SenSys) (Nov, 2003). 33. A. D. Wood and J. A. Stankovic, Denial of service in sensor networks, IEEE Computer. 35(10), 54–62, (2002). 34. C. Karlof and D. Wagner. Secure routing in wireless sensor networks: Attacks and countermeasures. In Proceedings of 1st IEEE International Workshop on Sensor Network Protocols and Applications (May, 2003).

Chapter 4 Location Privacy

Sergio Armenia, Laura Galluccio, Alessandro Leonardi, Giacomo Morabito and Sergio Palazzo∗ CNIT, Catania Research Unit V.le A. Doria 6 - 95125 Catania (Italy) {first name.last name}@diit.unict.it Location privacy is concerned with the protection of information about the position of an individual over a period of time. Location privacy problems arise in any mobile networking scenario since nodes need to disclose information about their position to enable correct data delivery. Such problems become more critical in the case of ad hoc networks where the wireless multihop nature of the communication paradigm is the cause of more opportunities of eavesdropping for an attacker. Furthermore, as nodes move in time they must exchange location information with each other for the purpose of topology control and routing updates, which results in a disclosure of location information. Specific location privacy problems are encountered in the case of wireless sensor networks where sensors can detect the presence and movements of individuals even if they do not bring any communication device, which causes several possibilities of location privacy violations. In this chapter, first a discussion about what is privacy, how it is possible to classify it, and how to measure it is provided. Next, the most relevant research results in the area of location privacy in wireless ad hoc, vehicular, and sensor networks scenarios are surveyed. Finally, an analytical methodology for the performance assessment of location privacy enhancing solutions is described.

∗ This

work was supported by the European Commission in the framework of the FP6 STREP DISCREET (FP6-2004-IST-4 contract no. 27679). 105

S. Armenia et al.

106

1. Background 1.1. Privacy and Society The idea of privacy is deeply rooted in our culture. It has been debated for almost 2500 years since when Aristotele set a distinction between public and private life. Although this debate has always been extremely active, a universally recognized definition of privacy does not exist to date. Indeed, several definitions have been proposed, the most popular of which are given belowa : • Privacy is the condition of not having undocumented personal information known or possessed by others,2 where personal information is considered documented if it belongs to the public record, that is, newspapers, court records, or other public documents. • Privacy denotes a degree of inaccessibility to persons, their mental states, and information about them from the senses and surveillance of others.3 • Privacy is the ability of an individual or group to seclude themselves or information about themselves and thereby reveal themselves selectively.4 Regardless of its exact definition, today privacy is almost universally valued as indispensable to the development and free expression of personality. As such it has found attention in legislation since 1361 when the Justice of the Peace Act was emanated in England, according to which eavesdroppers and stalkers were punished with arrest; and today privacy is recognized as one of the fundamental human rights as stated by Article 12 of the Universal Declaration of Human Rights,5 and is regulated by almost all legislations of civilized countries. The continuous advances in information and communication technologies have increased attention towards privacy. Indeed, it has always been obvious that such advances involved increased privacy problems, as evident in the work by Warren and Brandeis who conclude their analysis of the impact of communication and media technologies on privacy with a call for new appropriate legislation.6 The technologies menacing privacy were related to the diffusion of newspapers and photographs. It was 1890 and a A thorough discussion of the debate about privacy can be found in the Stanford Encyclopedia of Philosophy.1

Location Privacy

107

more than one hundred years had to pass before Mark Weiser’s visionary paper on ubiquitous computing was published.7 Nowadays, ubiquitous computing is becoming a reality and the involved pervasiveness of computing and communication technologies represents a serious menace to information privacy. Indeed, such technologies can collect a large quantity of information about individuals which, once generated, cannot be easily controlled by their proprietors. The resulting picture is quite complex and is further complicated by law enforcement requirements that impose the disclosure of all possible information about an individual if this is needed for security reasons. As a consequence, a large research effort has been devoted to the relationships between ubiquitous computing and privacy. Good surveys of the most relevant concepts and results can be found in the background paper by G. A. Gow8 presented at the ITU Workshop on Ubiquitous Network Societies, and the State of the Art deliverable of the DISCREET project.9 From existing literature it is evident that privacy must be considered as a quality of service (QoS) parameter, exactly like loss probability and delay. However, in the definitions provided above, privacy remains a vague concept which can become more concrete through a classification that highlights different types of privacy needs. Furthermore, since privacy should be considered as a parameter, methodologies are required for its quantification. Accordingly, in Section 1.2 we provide a taxonomy for privacy, whereas in Section 1.3 we outline the most interesting methodologies for the quantification of privacy proposed so far. 1.2. Taxonomy Many types of privacy can be distinguished. More specifically, in Figure 1, we represent the classification of the different types of privacy from the perspective of an individual, which we call user level privacy types. Traditionally, two types of privacy are consideredb : Physical and Information privacy. Physical Privacy concerns the defense from intrusions into one’s physical space and/or solitude. It involves protection from intrusions into private properties such as house or vehicles (in this case we talk about privacy from intrusions), from being stalked (in this case we talk about privacy b Also

organizational privacy has been considered, which is about the interest of corporations, government agencies and other organizations to keep their activities and knowledge base secret.

S. Armenia et al.

108

Fig. 1.

Classification of the user level privacy types.

from stalking), and from being unconsciously observed and/or heard (in this case we talk about privacy from spying). Information Privacy, instead, concerns the protection of information about the individual (or group of individuals). More specifically, it concerns the information that typically people do not want to be public. This includes political preferences, lifestyle (e.g., family habits, sexual preferences and behaviors, etc.), health related information, and financial information. Initially, communication and information technologies were considered a threat to Information Privacy only. Now that such technologies are integrated in the ubiquitous computing framework to create smart environments they also menace Physical Privacy. As an example, a multimedia sensor network integrating cameras10 allows people to be spied on and even stalked unawares. However, all the above types of privacy are defined at a very high level. Since we are interested in the telecommunication system, the above types of privacy must be mapped into others defined at the telecommunication system level, as is done for QoS management in any telecommunication scenario. At the telecommunication system level we can distinguish Content Privacy and Context Privacy as shown in Figure 2. Content Privacy concerns the protection of messages being transmitted to or received from the communication devices.

Location Privacy

Fig. 2.

109

Classification of the types of privacy at the telecommunications system level.

Context Privacy, instead, concerns other sensible information about the user that can be inferred even if the message content is protected. Within Context Privacy we can further distinguish: • Application privacy, which concerns the protection of the telematic application being run. Observe that such information can be inferred from the socket port being utilized as well as the data trace, i.e., statistics of the packet size and the time interval between transmissions.11 A violation of Application privacy may result in a loss of Lifestyle and/or Financial privacy. • Correspondent privacy, which concerns the protection of the identity of the other peer of a communication. This can be easily inferred by the IP address of the packets being exchanged.12 A violation of Correspondent Privacy may result at individual level in the loss of all types of Information Privacy. • Location privacy, which concerns the protection of the user location information. In this case, such information is naturally exposed as knowledge of the user position is needed for the message delivery. Furthermore, in wireless sensor network scenarios, sensors may be deployed which can detect the position of a user. A loss of location privacy may result in the violation of all types of Information Privacy as well as loss of Privacy from Stalking. In the context of location privacy, we can also introduce the itinerary privacy, which identifies the ability to protect nodes’ movements so preventing adversaries from inferring the itineraries of the node.13

S. Armenia et al.

110

1.3. Measure of Privacy The importance of introducing a metric for privacy estimation has been recognized lately and several definitions have been proposed in different application scenarios. A first attempt in this sense has been made in a paper by Reiter and Rubin14 where the problem of privacy is dealt with in the scenario of World Wide Web transactions. More specifically, the aspect of privacy which is the focus of this work is the anonymity of a message exchange, i.e., anonymity of a message exchange is granted if it is impossible to identify the sender of the message and the receiver. In this context, the authors propose a scheme called Crowds and introduce the concept of degree of anonymity to assess the proposed scheme.

Fig. 3.

Degree of anonymity.

As shown in Figure 3, the degree of anonymity can be seen as an informal continuum. At the one end there is absolute privacy, which means that an attacker can in no way identify the sender or the receiver of a message. At the opposite end, we have provably exposed, in which case the identity of the sender and/or receiver is provably determined. Between the two extremes, four intermediate points of interest can be definedc : • Beyond suspicion: In this case, even if the attacker sees the evidence of a sent message, the sender appears no more likely to be the originator of the message than any other potential sender in the system. • Probable innocence: In this case, from the attackers point of view, the sender of the message appears no more likely to be the originator than not to be the originator. Observe that this is weaker c Here we define the four intermediate points in case of senders anonymity; however, extensions of such definitions to the case of receivers anonymity is straightforward.

Location Privacy

111

than Beyond suspicion in that the attacker may suspect that the sender is more likely the originator of the message than any other potential sender. • Possible innocence: In this case, from the attackers point of view there is a non trivial probability that the sender of the message is someone else than the person suspected. • Exposed: In this case, the attacker knows the originator of the message but cannot prove it. Although the degree of anonymity is sufficient for the purposes of assessing Crowds, it manifests several problems which prevent it from being a viable approach to the definition of a measure of privacy: • Even if the same definition can be quite easily applied to other privacy issues apart from anonymity, e.g., location, behavior, etc., it is not possible to extend it to cases where multiple aspects of privacy must be considered at the same time. • It does not provide a methodology to assign a specific value to privacy; instead, it only provides a qualitative way to measure privacy. Actually, assigning a value to privacy is a complex task which can be simplified considering the privacy loss due to the use of a certain service. In this direction, a definition of the measure of privacy loss has been proposed by Maheswaran et al. in the case of applications using personal agents.15 Personal agents have sensitive information about the individual and, in order to run applications, need to interact with other agents. In these interactions part of the information may be released and, therefore, there is a loss of privacy. In the above work a mathematical framework is introduced to measure the loss of privacyd . Suppose that sensitive information can be represented through a random variable S which can assume a value in a set of M possible values {s1 , s2 , ..., sM }. Let pS (sM ), with m ≤ M , represent the probability that S = sM , as perceived by the attacker before the agent interacts with other agents to run the application. Let us define the function V (pS ) as follows: V (pS ) =

M

I(pS (sm ))

(1)

m=1 d Here

we present a simplification of the mathematical framework to illustrate the basic idea, more details can be found in the paper.

S. Armenia et al.

112

where pS is the vector defined as follows: pS = [pS (s1 ), pS (s2 ), ..., pS (sM )] and I(x) is an indicator function that can be defined as15 0 if x = 0. I(x) = 1 if x = 0.

(2)

(3)

Accordingly, the function V (pS ) represents the number of values that can be assumed by S in the attacker view. Following the interactions between the agents, the probability distribution of S may change. Let pS represent the array of the probabilities of S after the application is run. Obviously, pS and pS are different from each other. Maheswaran et al. propose to measure the loss of privacy as: V (pS ) − V (pS )

(4)

As an example, following the interactions between the agents, the attacker may exclude that S assumes certain values. Accordingly, the loss of privacy is the number of values that the attacker learns cannot be assumed by S. This definition of the measure of privacy loss has a major drawback: it depends on the definition of the indicator function I(x). The expression utilized in the example given in Eq. (3) cannot be applied in the general case. As an example, it might be that following the interactions between agents the attacker learns that most of the values can be assumed by S with very low probability, but none of these values can be excluded. In this case, according to the definition provided in Eq. (3) the loss of privacy is equal to zero, whereas a lot of privacy is lost. Another interesting approach has been introduced to assess data mining algorithms that preserve privacy16 and, then, further extended to the general case.17–19 In these works, the loss of privacy is related to the amount of information gained by the attacker after the attack. Such information is given by the difference between the uncertainty on S before and after the attack. In the context of the information theory the measure of uncertainty of a random variable can be evaluated as the entropy of such a variable: H(S) =

M m=1

pS (sm ) · log2 (1/pS (sm ))

(5)

Location Privacy

113

Now suppose that following the attack, the attacker can observe a variable X which is related to S and can assume one of the following N values: {x1 , x2 , ..., xN }. The uncertainty about S after the attack will be given by the conditional entropy:20 N M

H(S|X) =

pSX (sm , xn ) · log2 1/pS|X (sm |xn )

(6)

m=1 n=1

where pSX (sm , xn ) represents the joint probability that S assumes the value sm and X assumes the value xn , whereas pS|X (sm |xn ) represents the probability that S is equal to sm given that X is equal to xn . The loss of privacy following the attack is defined as ρ = 1 − 2−I(S,X)

(7)

where I(S, X) is the mutual information between S and X and can be calculated as follows: I(S, X) = H(S) − H(S|X)

(8)

A major advantage of this definition as a measure of privacy loss is that it is based on the theoretical definition of information.20 Furthermore, it can be easily extended to the case in which S and X are continuous random variables. In fact, if this is the case, I(S|X) = h(S) − h(S|X)

(9)

where, if we denote as ΩS and ΩX the sets of values where S and X are defined, fS (s) · log2 (fS (s)) · ds (10) h(S) = − ΩS

h(S|X) = − ΩS

fSX (s, x) · log2 fS|X (s|x) · ds · dx

(11)

ΩX

In Eqs. (10) and (11), fS (s) is the probability density function of S, fSX (s, x) is the probability density function of the pair of random variables (S, X), and fS|X (s|x) is the probability density function of S provided that X is equal to x.

114

S. Armenia et al.

2. Location Privacy in Wireless Ad Hoc and Sensor Networks In this chapter we focus on location privacy which, as we said in Section 1.2, concerns the protection of location information, i.e., the set of data describing an individual’s location over a period of time. Location privacy is important since it can cause privacy losses of several types at the user level. In fact, location information can be used to attack: • Privacy from stalking - For example, location information can be used to stalk a person without actually following her/him. • Lifestyle privacy - For example, location information can be used to identify how many hours per day an individual spends in the office, where she/he usually shop, who her/his friends are, etc. • Medical privacy - For example, location information can be used to identify what kind of healthcare specialists is an individual consulting, where she/he takes therapies, etc. • Political privacy - For example, location privacy can be used to learn if an individual takes part in political assemblies or whether she/he is meeting certain politicians. Wireless networks, which are at the very basis of the ubiquitous computing paradigm, represent a challenging environment for location privacy due to the broadcast nature of the wireless communication medium. Indeed, mobile devices must inform the network about their position so that information delivery can be accomplished. The consequent message exchanges can be eavesdropped by attackers. Encrypting such message exchange partially solves this problem, at least in mobile infrastructured networks, e.g., cellular networks, WiFi networks, etc. On the contrary, simple message encryption cannot solve the problem in the case of infrastructureless wireless networks such as ad hoc, vehicular and sensor networks, which are expected to play a crucial role in ubiquitous computing as well. In fact, since all nodes act as packet relays, location information must be disclosed throughout the network. Another problem due to the wireless multihop nature of the communication paradigm is that an attacker can easily backtrace packets from the destination up to the source. Location privacy problems are further amplified in the case of wireless sensor networks since individuals generate reactions from the sensor network and consequently results in the generation of packets independently from their

Location Privacy

115

will and can therefore be tracked even if they do not use any communication device. We will address the problem of location privacy in ad hoc and vehicular networks in Section 2.1; then, in Section 2.2, we will focus on the wireless sensor network scenario. 2.1. Location Privacy in Ad Hoc Networks In ad hoc networks there is no pre-existing infrastructure, user devices also behave as relay nodes, and therefore position of nodes changes over time more unpredictably than in other network scenarios. This makes packet routing an extremely complex task. Accordingly, a large research effort has been devoted to the design of appropriate routing/forwarding algorithms.21 Most of the proposed algorithms rely on the exchange of messages between nodes for the purpose of topology control and routing updates. In this way nodes have to disclose information about themselves, such as the identity of their utilizer and their location. Obviously, this results in a loss of location privacy.22 Several solutions have been proposed in the past to solve this problem. One possibility is to use algorithms which do not require nodes to disclose information about their position for routing purposes, such as flooding or geographical forwarding. In fact, if flooding is applied the packets transmitted by the source will reach all the nodes of the network and, eventually, the destination too, with no need of any message exchange for routing purposes. As a result, flooding solves the problems related to location privacy. However, it is well known that flooding is highly inefficient in terms of bandwidth and energy utilization, and therefore better solutions are required. In geographical forwarding packets are routed towards a known position, i.e., the position of the destination without the need of exchanging information related to network topology.23 This apparently solves the problem highlighted above. Nevertheless, the destination position, DP , should appear in clear in an appropriate field of the packet header, which can thus be read by all nodes in the radio coverage of forwarding nodes. It follows that an attacker can gain information about the positions of the sourcedestination pairs, which involves a violation of the correspondent privacy and, in turn, of the location privacye. e Members of the Network Research Lab at UCLA note that a case supporting this statement has occured in 1996.24 Chechnya rebel leader General Dzhokhar Dudayev was located and killed by Russian armed forces via a traceable wireless call. Before this success Russian army had tried many other search methodologies in vain.

116

S. Armenia et al.

On the contrary, the route un-traceability should be guaranteed. This can be achieved, for example, by means of onion routing-like protocols.25 To understand how, consider a network with a certain number of special nodes, called onion nodes, that have public keys known by all nodes in the network. As an example, in Figure 4 there are six onion nodes, i.e., O1 , ..., O6 . The source randomly chooses a sequence of a certain number, N , of them which we denote Oi1 , Oi2 , ..., OiN . In Figure 4 the information source S chooses a sequence of two onion nodes, N = 2, and more specifically chooses O4 and O2 . Then it prepares the packet and sets the DP field in the packet header equal to Pos(D), where Pos(x) represents the current position of node x. This packet is encrypted using the public key of the onion node OiN . The resulting string is put in the data field of a new packet in which the DP field in the header is set equal to Pos(OiN ). The output packet is encrypted again using the public key of OiN −1 and inserted in the data field of a new packet which is destined to Pos(OiN −1 ). The same procedure is repeated for OiN −2 , OiN −3 , ..., Oi1 . Finally, the packet is transmitted and forwarded through the network using a mechanism similar to the one utilized in IP packet encapsulation. Accordingly, the positions of the source S and destination D cannot be linked by nodes in the end-to-end path. For example, in Figure 4 the traffic source S prepares the packet and sets the DP field in the packet header equal to Pos(D). Then it encrypts the packet using the public key of O2 and inserts the resulting string in the data field of a new packet. In the same packet the DP field of the header is set equal to the position of O2 , Pos(O2 ). The output of this operation is encrypted using the public key of O4 and inserted in the data field of a new packet destined to Pos(O4 ). At this point the packet is transmitted. Since the DP field in the header in clear is equal to Pos(O4 ), the packet arrives to node O4 traversing the area that we have called A1 . Note that eavesdroppers in the same area can infer that node S has generated a packet but they cannot access information about the destination D, given that this is encrypted. Node O4 receives the packet and decrypts it. The resulting packet has the DP field in the header set equal to Pos(O2 ) and therefore will arrive to node O2 traversing the area denoted as A2 ; observe that none of the nodes in this area knows that the final destination of the packet will be D and that the source was S. As node O2 receives the packet, it decrypts it and forwards it to the final destination D. Note that onion nodes might distribute information about their current position through flooding. Onion nodes can also be used to maintain updated information about the current location of nodes. More specifically,

Location Privacy

Fig. 4.

117

Onion routing for route un-traceability.

we may assume that each node has one or more onion nodes that are responsible for maintaining updated information about its location. This set of responsible onion nodes could be evaluated as a function of the node identity. When a node S wants to start a connection with a certain destination D node S will send a query about the position of D to the responsible nodes of D. The responsible onion nodes will reply with the current value of Pos(D)f . This information is encrypted using the public key of S. Obviously, both the query and the reply are routed using the onion routing-like solution described above. Note that onion routing-like solutions guarantee a high degree of route un-traceability but introduce higher delays as well as inefficiencies in terms of bandwidth and energy utilization. Another solution that does not require exchange of topological information and, at the same time, guarantees route un-traceability is ANODR.26 In this case, a source S that wants to establish a connection with a destination D triggers a route discovery phase in which a route request (RREQ) message is flooded in the network. Observe that, in order to guarantee onion nodes might request node D a permission containing the credential of node S before sending the reply.

f Responsible

118

S. Armenia et al.

route un-traceability, at each hop a trapdoor functiong is applied to the RREQ before it is broadcast. The trapdoor information utilized by the node is only known to the node itself (trapdoor functions are used instead of cryptographic functions because they are computationally lighter). Upon receiving the RREQ, the destination D sends back a route reply (RREP) message that traverses the shortest path between the source S and the destination D. Note that none of the nodes is aware of the path between the source S and destination D, not even S and D. Finally, route un-traceability can also be achieved utilizing multi-path solutions like the one proposed by Shields et al. for the Internet27 and applied to ad hoc networks by Choi et al.28 The basic idea behind multipath solutions is quite straightforward. As depicted in Figure 5, the source S sends the same packet throughout several, say M , paths to M nodes n1 , n2 , ..., nM . The actual destination should be one of the nodes in the set {n1 , n2 , ..., nM }. In Figure 5 the value of M is equal to 4 and the destination D is the end node n2 . In this way an attacker cannot identify exactly the actual destination. An appropriate routing algorithm is responsible for the calculation of the paths so that they are the shortest between the source and each end-node. As usual, the number and depth of paths selected are the result of a tradeoff between privacy and bandwidth/energy requirements. Note that, differently from onion routing-like solutions, the delay is the minimum possible for the current setting of the ad hoc network. Other solutions have been proposed in the past which allow exchange of topology information while guaranteeing un-linkability between nodes and user identity by means of pseudonyms. At any time, each node uses one or several pseudonyms to identify itself. Linking between pseudonym and real identity should be possible only for police or other entities responsible for public security and crime control. However, if the same pseudonym is used for a long time, then the linking with the real identity can be done quite easily. Accordingly, solutions have been proposed that enable nodes to use several pseudonyms. As an example, according to the random node identification (RNI) protocol,28 each node uses two random pseudonyms at any time. One is used as an identifier at the MAC layer, the other is used as a node identifier. More specifically, every node in the network generates a random node gA

trapdoor function is a function that is easy to compute in one direction, believed to be difficult to compute in the opposite direction (finding its inverse) without some information, called the trapdoor.

Location Privacy

Fig. 5.

119

Multi path routing for route un-traceability.

pseudonym and advertises it via a message such as a HELLO message in AODV. Accordingly, neighbor nodes know each others through their random pseudonyms. The pseudonym is used for routing and communicating with neighbor nodes. Intermediate nodes use pseudonyms of neighbor nodes to maintain next-hop information. Each node changes its pseudonym after a random time interval. After changing the pseudonym the node starts advertising itself. Accordingly, nodes cannot distinguish an updated pseudonyms from a new neighbor. The same procedure applies to the pseudonym of the MAC identifier. Note that by using RNI it is impossible to keep track of the pseudonyms utilized by each node. This guarantees privacy, but makes it impossible to have information disclosure after a request by some legal/security authority. To solve this problem solutions have been proposed, such as MASK,29 in which each node is provided with a set of pseudonyms generated by a trusted authority (TA). In this way, nodes have several pseudonyms among which to choose, which improves un-linkability; however, it is possible to identify the node from the pseudonym utilized if the TA discloses such relationship in case of a request by some legal/security authority.

120

S. Armenia et al.

Freudiger et al.30 exploit the specific characteristics of nodes mobility in vehicular networksh to achieve un-linkability. More specifically, the mix zone concept18,34 is tailored to the vehicular communication scenarios. Mix zones are areas where nodes change their pseudonym. Obviously, this change is effective when several nodes are inside the same mix zone contemporarily. Accordingly, in case of vehicular networks mix zones must be chosen where there are cross roads. In fact, it is there that two or more cars are likely to be close to each other. The pseudonym change is encrypted and coordinated by the road side infrastructure which also plays the role of trusted authority. This enables information disclosure upon request by some legal/security authority. In the context of vehicular networks, a different approach is considered in CARAVAN.35 The starting assumption of CARAVAN is that, given the specific characteristics of viability systems and of the resulting traffic, vehicles are likely to spontaneously move in groups most of the time. In other words, it is possible that a group of vehicles move maintaining a short distance from each other for a long time. This characteristic of node mobility is called group mobility. Topology control and route update solutions can be used that exploit group mobility. In fact, nodes moving together, i.e., belonging to the same group, can select one of them to act as group representative, the so-called group leader. It is responsible for the location updates of the entire group. Accordingly, attackers can eavesdrop only location information of the group leader. Other nodes do not need to disclose their location information as long as they do not change groups. CARAVAN defines a set of procedures required for the management of the group. Group mobility can be further exploited considering that secure driving and cooperative driving applications generate redundant data related to traffic and road conditions. In CARAVAN, group members avoid transmitting redundant information and thus, the opportunities of overhearing decrease and privacy increases. Note that the solution proposed in the work by Freudiger et al.30 can be extended to exploit group mobility also. Furthermore, applicability of the CARAVAN approach is not limited to the vehicular networking case. On the contrary it can be used in other ad hoc networking scenarios featuring group mobility.36 h Readers

interested in the general privacy problems and security aspects encountered in vehicular networking can refer to the work by Parno et al.31 which covers the security aspects, the paper by Dotzer32 which addresses the general problem of privacy, and the work by Hubaux et al.33 where both aspects are considered.

Location Privacy

121

From the analysis of the procedures proposed for vehicular networks, it is evident that there is not specific interest in preventing route untraceability. This is because in vehicular networks most of the end-to-end communication flow through the wired infrastructure and therefore, route backtracing is significantly more difficult than in other ad hoc networking scenarios. Also, little effort is put into maximization of energy and computation efficiency. This is because in case of vehicular networks, differently from most of the other ad hoc networking scenarios, nodes are likely to have high capacity in terms of both computation and energy capabilities. Thus, the related requirements are relaxed, whereas requirements on delay are usually quite strict given the real-time nature of most vehicular networking applications, such as driving safety and cooperative driving. 2.2. Location Privacy in Sensor Networks In wireless sensor networks the problems of location privacy become more critical since sensors can detect the presence of individuals and generate messages which will arrive to the sink even if the individual does not bring any communication device with her/him. To better understand the consequent of location privacy problems we refer to the panda-hunter game reference scenario since it was the first one defined rigorously.37,38 Suppose that a set of sensor nodes have been deployed by the Save The Panda Organisation, in a random way within a large area in order to study and monitor panda habit. Sensor nodes are able to detect panda’s presence. At any time, while the panda freely moves, there is always a sensor node, called source node, that detects panda’s position. Such an observation must be periodically reported to a sink node, via multihop routing techniques. In this way the current position of the panda approximately is the position of the current source node. Thus, whenever the sink node receives a new message from the source node, it knows the up-to-date panda position. We suppose that transmissions are encrypted, so the source node ID field cannot be read by attackers. Moreover, we assume that the relationship between node ID and node location is known by the sink node only. In the area there is a hunter as well, with the role of an adversary. He aims to catch the panda, thus he is an enemy from the Save The Panda Organisation standpoint. The hunter is not able to decrypt messages, therefore he cannot learn, at least not directly, the location of the source node. In the worst case scenario we can consider37 the hunter is

S. Armenia et al.

122

• non malicious, i.e., he does not interfere with the proper functioning of the network; • device rich, i.e., he is equipped in such a way he can measure signal strength and angle of arrival of any message; • resource rich, i.e., he has unlimited amount of power; • informed, i.e., he knows the sink location and the network structure and protocols. By exploiting his devices and resources, the hunter can analyze messages at RF level, so he can try to capture panda by back-tracing the routing path used by messages until the source. As an example, consider the sensor network represented in Figure 6. There are N = 11 sensor nodes s0 , s1 , ..., s10 , with s0 representing the sink.

Fig. 6.

Example of hunting activity.

In Figure 6 we show the shortest path routing tree connecting each sensor node si to the sink s0 , i.e., node s0 is the root of the tree. If the hunter is located near node s6 and detects radio activity, then a node in the set {s7 , s8 , s9 , s10 } is the source node. Instead, if no activity is detected, then the panda is near one of the remaining nodes, i.e., a node in the set {s1 , s2 , s3 , s4 , s5 } is the source node. Observe that in any case the hunter splits the network and obtains information about the panda location.

Location Privacy

123

This leads to a strict connection between location privacy and routing protocol in a WSN. Routing protocols must be privacy-aware in order to save, or at least prolong, panda’s life. A simple way to improve privacy is to introduce some randomness in the routing behavior.39 According to this simple intuition, one may think that applying flooding is a good way to protect location privacy, even if this is obtained at the cost of very high energy and bandwidth consumption. In fact, every node in the network participates in the forwarding and we may think that the attacker is likely be led to the wrong source. However, Ozturk et al. observe that flooding offers the least possible location privacy protection.37 To understand why consider the scenario depicted in Figure 7.

Fig. 7.

Flooding example.

There are 13 sensor nodes s1 , s2 , ..., s13 and a sink s0 . Node s10 generates a packets and floods it into the network. More specifically, at the first step node s10 transmits the packet. This is received by nodes s6 , s8 , s11 and s12 , which will forward the same packet at the second step so that it reaches nodes s4 , s5 , s7 and s9 . The flooding continues similarly and the sink s0 receives the packet at the fourth step by node s2 and at the fifth step by node s1 .

124

S. Armenia et al.

An attacker near the sink listens the packet arriving from node s2 first, and thus infers that s2 is on the shortest path between the source and the receiver. Accordingly, the attacker goes near node s2 and waits for the next packet transmission. Applying the same reasoning the attacker can identify the next node in the shortest path between the traffic source and node s2 . In this way, the attacker can backtrace packets and identify the traffic source. This problem can be easily solved by introducing a random delay between the reception of a packet and its subsequent forwarding. Nevertheless, this introduces further delays and still does not solve the energy and bandwidth inefficiency problems which are typical of flooding.

Fig. 8.

Phantom routing.

Therefore, Ozturk et al. propose an alternative solution which they call phantom routing.37 The basic idea is quite simple, though very interesting, and is sketched in Figure 8. Every time a node generates a new packet, it chooses another node in the network, called the phantom source, and sends the packet to this node according to any routing protocol. Then, the phantom source initiates the flooding of the packet. In order to improve performance, flooding can be limited to a specific area called flooding area.

Location Privacy

125

For example, in Figure 8 the flooding area contains nodes s0 , s1 , s2 , s4 , and s13 , and the phantom source is node s5 . Note, however, that the phantom source changes at each packet transmission and, therefore, it is very difficult for the attacker to backtrace the packet flow and identify the source location. However, even if the flooding area is limited, phantom routing does not completely solve the inefficiency problems involved with flooding. Accordingly, Y. Xi et al. propose an algorithm called Greedy Random Walk (GROW).40 GROW is a variation of random routing that makes the attack more difficult. This is achieved by making a sensor node preferrably choose as next-hop a neighbor node that has not participated in a random walk before. In this way paths will always go to cover new areas in the network.

Fig. 9.

Example of hunting with random routing.

As an example, if the next-hop is chosen randomly among all the neighbors of the current relay, like it is shown in Figure 9, for the attacker it is difficult to infer the source of packets through a simple eavesdropping of radio activity in the wireless channel. In fact, in Figure 9 where we show the path obtained applying random routing in the same WSN shown in Figure 6, the fact that node s3 is forwarding a packet does not necessarily mean that the source node is in the set {s3 , s4 }. Performance results show that GROW achieves higher privacy protection and energy efficiency than phantom routing at the expenses of higher delay. Observe that all the above solutions cause lower efficiency in terms of bandwidth and energy consumption. As a consequence, an appropriate

S. Armenia et al.

126

tradeoff is needed. In the following section we show how an analytical framework based on Markov chains can be effectively used to derive such a tradeoff. 3. Performance of Location Privacy Enhancement Solutions In this section we provide a methodology for the analysis of performance of location privacy enhancement solutions proposed for sensor networks as provided in the work by Armenia, Morabito, and Palazzo.19 The described methodology can be easily extended to other cases. In more detail, in Section 3.1 we describe the system model. This is used for the privacy loss analysis provided in Section 3.2. As we already said, privacy enhancement solutions involve a cost in term of network performance deterioration. A framework for the analysis of such cost terms will be provided in Section 3.3. Finally, in Section 3.4 we give some numerical examples to show the tradeoffs between privacy protection and cost. 3.1. System Model Let us consider a WSN composed of M nodes denoted as s0 , s1 , ..., sM−1 . For any node si , with i < M , we define Φ(si ) the set of neighborsi of si and φ(si ) the number of its neighbors, i.e., φ(si ) = |Φ(si )|. Now suppose that s0 is the sink and let us call d(si ) the distance between node si and the sink s0 . Obviously, d(s0 ) = 0 and d(si ) = mins∈Φ(si ) {d(n) + 1}. Observe that routing of packets towards the sink in a sensor network can be modeled by means of a matrix Q ∈ (M−1)×(M−1) , the generic element of which, [Q]i,j , represents the probability that the next relay of a packet transmitted by si is sj , with i and j ∈ [1, (M − 1)]. We define Q as the routing matrix. In order to model random routing we define the best next relay Ψ(si ) as the neighbor of si which is closest to the sink, i.e., it is a node that satisfies the following relationship d (ψ(si )) ≤ d(m), ∀m ∈ Φ(si )

(12)

Let us stress that even if several nodes may satisfy the relationship in Eq. (12), for each si only one node ψ(si ) is selected. Accordingly, if the shortest path routing is utilized [Q][i,j] is equal to 1 if sj is the best next relay, i.e., if sj = ψ(si ), and is equal to 0, otherwise. As an example, for i We

say that two nodes are neighbors if they are in the radio coverage of each other.

Location Privacy

127

the shortest path routing in the scenario depicted in Figure 6, the routing matrix is given by: ⎞ ⎛ 01000100000 ⎜1 0 1 1 0 0 0 0 0 0 0⎟ ⎟ ⎜ ⎜0 1 0 0 0 0 0 0 0 0 0⎟ ⎟ ⎜ ⎜0 1 0 1 1 0 0 0 0 0 0⎟ ⎟ ⎜ ⎜0 0 0 0 0 0 0 0 0 0 0⎟ ⎟ ⎜ ⎟ ⎜ Q = ⎜1 0 0 0 0 0 1 0 0 0 0⎟ ⎟ ⎜ ⎜0 0 0 0 0 1 0 1 0 0 0⎟ ⎟ ⎜ ⎜0 0 0 0 0 0 1 0 1 0 0⎟ ⎟ ⎜ ⎜0 0 0 0 0 0 0 1 0 1 0⎟ ⎟ ⎜ ⎝0 0 0 0 0 0 0 0 1 0 1⎠ 00000000010 We define as p-random routing a routing algorithm which chooses the best next relay with probability p and any other neighbor node with equal probability. Accordingly, the routing matrix of a p-random routing protocol is ⎧ p if sj = ψ(si ) and φ(si ) > 1 ⎪ ⎪ ⎪ ⎨ (1−p) if sj = ψ(si ) and φ(si ) > 1 [Q]i,j = φ(si )−1 (13) ⎪ 1 if sj = ψ(si ) and φ(si ) = 1 ⎪ ⎪ ⎩ 0 otherwise Note that if p is equal to 1, random routing becomes a shortest path routing. 3.2. Privacy Loss Analysis We measure privacy loss as given in Eq. (7). In order to calculate it we need pSX (sm , xn ) and pS|X (sm , xn ) as evident by combining Eqs. (5), (6) and (8). Obviously, the probability pS|X (sm |xn ) can be calculated as pS|X (sm |xn ) =

pSX (sm , xn ) pSX (sm , xn ) = M−1 pX (xn ) i=0 pSX (si , xn )

(14)

Suppose that all locations are equiprobable, i.e., pS (sm ) = 1/M for any sm . Accordingly, the uncertainty on S given in Eq. (5) can be calculated as H(S) = log2 M . Also, suppose that the hunter attacks the WSN at node s∗ . Following the attack, the hunter detects radio activity if the path between the source

S. Armenia et al.

128

node and the sink passes through the node s∗ and viceversa. Accordingly, X can assume only two values: 0 if there is no radio activity at node s∗ (15) X= 1 if there is radio activity at node s∗ As a consequence, we can rewrite Eq. (6) as H(S|X) =

M−1 1

pSX (sm , x) log2

m=0 x=0

1 pS (sm |x)

(16)

In Eq. (16) we need to calculate the probability pSX (sm , x) which can also be used in Eq. (14) to calculate pS|X (sm |xn ). The probability pSX (sm |xn ) is given by pSX (sm , x) = pX (x|sm ) · pS (sm ) = pX (x|sm )/M

(17)

Observe that pX (x|sm ) represents the probability that a packet generated by node sm does not pass through s∗ , if x = 0, and that such packet passes at least once through s∗ , if x = 1. Now we will calculate pX (1|sm ); once this is known, pX (0|sm ) can be easily evaluated as pX (0|sm ) = 1 − pX (1|sm )

(18)

Recall that pX (1|sm ) is the probability that a packet generated by node sm passes through node s∗ at least once before reaching the sink s0 . Let V be the random variable representing the hop at which the packet visits for the first time node s∗ . Applying the theorem of the total probability, the probability pX (1|sm ) can be calculated as the sum of probabilities that a packet generated by node sm visits at the V -th hop node s∗ , for any value of V , i.e., pX (1|sm ) =

∞

pXV (1, v|sm )

(19)

v=0

The probability in the sum in the right handside of Eq. (19) is the probability that the packet generated by sm does not visit node s∗ and does not reach the sink until hop (v − 1), and, finally, at the v-th hop visits node s∗ . This can be calculated as: ∗

pXV (1, v|sm ) = w(m) · Gv · [w(s ) ]T where:

(20)

Location Privacy

129

• w(j) is an array of M − 1 elements, w(j) ∈ M−1 , all set equal to zero, with the exception of the j-th element which is equal to 1, i.e., 0 if i = j and 1 ≤ i ≤ M − 1 [w(j) ]i = (21) 1 if i = j and 1 ≤ i ≤ M − 1 • G is an [M −1]×[M −1] matrix, G ∈ [M−1]×[M−1] , and its generic element [G][i,j] represents the probability that a packet received by node si will be relayed to node sj , with sj = s∗ , and is not relayed by node s∗ . This can be obtained as follows: if j = s∗ [Q][i,j] (22) [G][i,j] = 0 if j = s∗ • [w]T represents the transponse of the array w. Substituting Eq. (20) in Eq. (19) we can easily obtain: ∞ ∗ (m) v · G · [w(s ) ]T pX (1|sm ) = w

(23)

v=0

By applying the spectral decomposition to matrix G = D · B · D−1 , where B is a diagonal matrix containing the eigenvalues βi of G and D is the matrix whose columns are the corresponding eigenvectors, we can rewrite Eq. (23) as follows: ∞ ∗ (m) v ·D· B · D−1 · [w(s ) ]T (24) pX (1|sm ) = w v=0

We call K the sum in the right hand side of Eq. (24). We can easily obtain that K is a diagonal matrix whose generic element is if i = j 1/(1 − βi ) (25) [K][i,j] = 0 otherwise. Accordingly, Eq. (24) can be rewritten as ∗

pX (1|sm ) = w(m) · D · K · D−1 · [w(s ) ]T

(26)

where K has been calculated in Eq. (25). Once pX (1|sm ) has been calculated we have all the parameters required for the calculation of the uncertainty on S given X, i.e., H(S|X). Note that the value of privacy loss ρ depends on s∗ . Since the hunter knows the structure and protocols of the network, the node s∗ which maximizes the privacy loss will be selected. As a consequence, the WSN gives a privacy loss γ given by γ = maxs∗ {ρ}.

S. Armenia et al.

130

3.3. Cost Analysis Privacy protection involves inefficiencies from an economical point of view41 as well as the technical point of view. Accordingly, it introduces a cost that must be estimated in order to evaluate the actual acceptability of a given solution.42 In this section, we focus on the cost of privacy protection solutions in terms of energy efficiency, as well as delay and traffic load increase. All the above parameters depend on the number of hops traversed by a packet from the source to the sink. This is a random variable which we call Z. At this point, we can say that the average value of all the above parameters are proportional to the average value of Z, E{Z} that can be calculated as ∞ z · pZ (z) (27) E{Z} = z=1

where pZ (z) represents the probability that the number of hops between the source and the destination is equal to z. The probability pZ (z) is the probability that a packet does not reach the sink in (z − 1) hops and finally arrives at the sink at the z-th hop. Therefore, it is easy to show that pZ (z) can be rewritten as

pZ (z) = π (S ) · P z−1 · ω T

(28)

where

• π (S ) is an array of (M − 1) elements, π (S ) ∈ M−1 . Its generic element is given by: = pS (sm ) = 1/M with 1 ≤ m < M . (29) π (S ) m

• P is an [M −1]×[M −1] matrix, i.e., P ∈ [M−1]×[M−1] . Its generic element [P ][i,j] represents the probability that a packet received by node si is transmitted to node sj , with sj = s0 . Accordingly, the generic element of P is given by: [P ][i,j] = [Q][i,j]

if i and j ∈ {1, 2, ..., M − 1}

(30)

• ω is an array of M −1 elements, i.e., ω ∈ M−1 . Its generic element [ω]m , with 1 ≤ m < M represents the probability that a packet is relayed by node sm to the destination. Accordingly, [ω]m = [Q][m,0]

(31)

Location Privacy

131

Applying the spectral decomposition to P and following a procedure analogous to that presented in Section 3.2, we can calculate the average energy spent to deliver a packet to the sink as

= c · π (S ) · T · H · T −1 · ω T

(32)

where c is the energy spent for the transmission and reception of a packet. In Eq. (32) the matrix H is a diagonal matrix and its generic element is if i = j 1/[(1 − λi )]2 [H][i,j] = (33) 0 otherwise where λi is the i-th eigenvalue of P and T is the matrix of the eigenvectors of P . 3.4. Numerical Examples In this section we apply the analytical framework described in the previous sections to evaluate the tradeoffs between location privacy and energy efficiency in WSN. We consider a network of M sensor nodes uniformly distributed on a squared area of size 1 km × 1 km. We assume that all sensor nodes have coverage radius equal to R = 200 m. Once position of sensor nodes is set and the value of the parameter p, characterizing the random routing, is known, it is possibile to construct the routing matrix Q as given in Eq. (13). Starting from the routing matrix Q it is possible to evaluate the privacy loss γ and the average energy consumption as reported in Section 3.3. All values in the following figures have been evaluated as the average of the results obtained in 20 cases. For each case, a new distribution of sensor nodes has been generated. Moreover, for each case individual routes are chosen considering the same sink node and a source node chosen in a random fashion based on uniform distribution. The results obtained confirm the intuitive insight, i.e., improvement of privacy is at the expense of the energy consumption. Specifically, as the degree of randomness of the routing algorithm increases, the privacy loss decreases but energy consumption increases. In Figure 10 we show the privacy loss, calculated as described in Section 3.2, versus the value of the probability p for two different values of the number of nodes, i.e., M = 50 and M = 100.

132

S. Armenia et al.

Fig. 10. Privacy loss, γ, versus the probability p for different values of the number of sensor nodes.

In Figure 10 the privacy loss increases as the probability p becomes higher. This is an expected result. Indeed, using low values of p makes the routing behavior unpredictable and therefore, the attacker cannot easily obtain significant information eavesdropping the network. Note that the node density accentuates the effects of randomness. When p is low, the higher the node density the more the attacker gets confused, and the lower the privacy loss. Viceversa, when p approaches 1, the higher the node density the more the attacker is confident in identifying the node nearby as the target, and the higher the privacy loss. In Figure 11 we show the average energy consumption to deliver a packet to the sink, , versus the probability p for M = 50 and M = 100. More specifically, in Figure 11 we show the values of the ratio /c. We present normalized energy consumption values because c depends on the specific communication technology utilized, and not on the routing algorithm. As expected, the energy consumption decreases as the value of the probability p increases; furthermore, the higher the number of sensor nodes M , the lower the energy consumption. This is because, if there are more nodes, it is likely to find better next relays than in the case where there are few nodes. To highlight the tradeoff between privacy loss and energy efficiency, in Figure 12 we show two plots. In the upper plot we represent the normalized energy consumption, /c, versus the corresponding value of the location privacy loss, γ. As expected, the privacy loss increases as the

Location Privacy

133

Fig. 11. Normalized energy consumption /c versus the probability p for different values of the number of nodes.

Fig. 12. (Upper plot:) Average energy consumption versus privacy loss γ and (Bottom plot:) The value of the probability p versus the corresponding privacy loss γ for M=100.

energy consumption decreases. This figure has been obtained considering M = 100 nodes and can be utilized by the designer to select an appropriate tradeoff between energy efficiency and privacy. Once a point in the curve is chosen, the designer can use the bottom plot to obtain the corresponding value of p that gives the selected performance.

134

S. Armenia et al.

4. Conclusions In this chapter we have presented the basic concepts of location privacy which concerns the protection of information about the position of an individual or an asset over a period of time. First, we have discussed about the meaning of privacy, how it is possible to classify it and how to measure it. Then, we have addressed the most relevant research results in the areas of location privacy in wireless ad hoc, vehicular, and sensor networks. Finally, a methodology for the performance analysis of location privacy enhancing solutions for sensor networks has been described. Our survey of the current literature on the subject shows that, even if recently there has been a large research effort devoted to such issues, several research issues are still open and require further investigations. References 1. J. DeCew. Privacy. In ed. E. N. Zalta, The Stanford Encyclopedia of Philosophy. (2005). http://plato.stanford.edu/archives/fall2006/entries/ privacy/. 2. W. Parent, Privacy, morality and the law, Philosophy and Public Affairs. 12, 269–288, (1983). 3. A. Allen, In ed. N. J. Totowa, Uneasy Access: Privacy for Women in a Free Society. Rowman and Littlefield, (1988). 4. Privacy. http://en.wikipedia.org/wiki/Privacy. 5. Universal declaration of human rights, (1948). United Nations General Assembly, Paris. 6. S. Warren and L. Brandeis, The right to privacy, Harvard Law Review. 4, 193–220, (1890). 7. M. Weiser, The computer for the twenty-first century, Scientific American. pp. 94–104, (1991). 8. G. A. Gow. Privacy and ubiquitous network societies - background paper. In Proc. ITU Workshop on Ubiquitous Network Societies, Geneva, Switzerland (April, 2005). 9. F. Gaudino and et al. State of the art. In eds. S. Armenia and G. Morabito, DISCREET D2103. (2006). http://www.ist-discreet.org. 10. I. F. Akyildiz, T. Melodia, and K. R. Chowdhury, A survey on wireless multimedia sensor networks, Computer Networks. 51(4), 921–960, (2007). 11. X. Y. Wang, S. Chen, and S. Jajodia. Tracking anonymous peer-to-peer voip calls on the internet. In Proc. ACM Conference on Computer Communications Security (CCS 2005), Alexandria, Virginia, USA (November, 2005). 12. M. G. Reed, Member, P. F. Syverson, and D. M. Goldschlag, Anonymous connections and onion routing, IEEE Journal on Selected Areas in Telecommunications. 16(4), 482–494, (1998).

Location Privacy

135

13. L. Tang, X. Hong, and S. Vrbsky. Camouflaging mobility for itinerary privacy in mobile ad-hoc networks. In Proc. IEEE Workshop on Security, Privacy and Authentication in Wireless Networks (WoWMoM 2008), Newport Beach, California, USA (June, 2008). 14. M. K. Reiter and A. V. Rubin, Crowds: Anonymity for web transactions, ACM Transactions on Information and System Security. 1(1), 66–92, (1998). 15. R. T. Maheswaran, J. P. Pearce, E. Bowring, P. Varakantham, and M. Tambe, Privacy loss in distributed constraint reasoning: A quantitative framework for analysis and its applications, Autonomous Agents and Multi-Agent Systems. 13(1), 27–60, (2006). 16. D. Agrawal and C. C. Aggarwal. On the design and quantification of privacy preserving data mining algorithms. In Proc. ACM SIGMOD International Conference on Management of Data, Dallas, Texas, USA (May, 2000). 17. A. Serjantov and G. Danezis. Towards an information theoretic metric for anonymity. In Proc. Workshop on Privacy Enhancing Technologies (PET), San Francisco, California, USA (March, 2002). 18. A. R. Beresford and F. Stajano, Location privacy in pervasive computing, IEEE Pervasive Computing. 13(1), 44–55, (2003). 19. S. Armenia, G. Morabito, and S. Palazzo. Analysis of location privacy/energy efficiency tradeoffs in wireless sensor networks. In Proc. IFIP Networking, Atlanta, Georgia, USA (May, 2007). 20. C. R. Shannon, A mathematical theory of communication, Bell System Technical Journal. 27, 379–423 and 623–656, (1948). 21. S. Basagni, M. Conti, S. Giordano, and I. Stojmenovic, Mobile ad hoc networking. (Wiley-IEEE, 2004). 22. S. Chapkin, B. Bako, F. Kargl, and E. Schoch. Location tracking attack in ad hoc networks based on topology information. In Proc. 2nd IEEE International Workshop on Wireless and Sensor Networks Security (WSNS), Vancouver, Canada (October, 2006). 23. D. Ferrara, L. Galluccio, A. Leonardi, G. Morabito, and S. Palazzo. Macro: An integrated mac/routing protocol for geographical forwarding in wireless sensor networks. In Proc. IEEE Conference on Computer Communications (Infocom), Miami, Florida, USA (March, 2005). 24. Mobile anonymity, anodr and motion-mix. http://http://netlab.cs.ucla. edu/cgi-bin/usemod10/wiki.cgi?ANODR_Motion%-MIX. 25. D. Goldschlag, M. Reed, and P. Syverson, Onion routing, Communications of the ACM. 42(2), 39–41, (1999). 26. J. Kong and X. Hong. ANODR: Anonymous on demand routing with untraceable routes for mobile ad hoc networks. In Proc. ACM Mobihoc 2003, Annapolis, Maryland, USA (June, 2003). 27. C. Shields and B. N. Levine. A protocol for anonymous communications over the internet. In Proc. ACM Conference on Computer Communication Security (CCS), Athens, Greece (November, 2000). 28. H. Choi, P. McDanial, and T. F. L. Porta. Privacy preserving communication in manets. In Proc. 4th Annual IEEE Communications Society Conference on Sensor, Mesh and Ad Hoc Communications and networks (SECON), San Diego, California, USA (June, 2007).

136

S. Armenia et al.

29. Y. Zhang, W. Liu, and W. Lou. Anonymous communications in mobile ad hoc networks. In Proc. IEEE Conference on Computer Communications (Infocom), Miami, Florida, USA (March, 2005). 30. J. Freudiger, M. Raya, M. Flegyhzi, P. Papadimitratos, and J.-P. Hubaux. Mix-zones for location privacy in vehicular networks. In Proc. First International Workshop on Wireless Networking for Intelligent Transportation Systems (WiN-ITS 2007), Vancouver, Canada (August, 2007). 31. B. Parno and A. Perrig. Challenges in securing vehicular networks. In Proc. Fourth Workshop on Hot Topics in Networks (HotNets-IV), College Park, Maryland, USA (November, 2005). 32. F. Dotzer. Privacy issues in vehicular ad hoc networks. In Proc. of the Workshop on Privacy Enhancing Techniques (PET), Cavtat, Croatia (May, 2005). 33. J. P. Hubaux, S. Capkun, and J. Luo, The security and privacy of smart vehicles, IEEE Security & Privacy Magazine. 2(3), 49–55, (2004). 34. D. Chaum, Untraceable electronic mail, return addresses, and digital pseudonyms, Communications of the ACM. 24(2), 84–90, (1981). 35. K. Sampigethaya, L. Huang, M. Li, R. Poovendran, K. Matsuura, and K. Sezaki. CARAVAN: Providing location privacy in vanets. In Proc. Embedded Security in Cars (ESCAR), Cologne, Germany (November, 2005). 36. L. Galluccio, G. Morabito, and S. Palazzo, Spontaneous group management in mobile ad-hoc networks, Wireless Networks. 10(4), 423–438, (2004). 37. C. Ozturk, Y. Zhang, W. Trappe, and M. Ott. Source-location privacy for networks of energy-constrained sensors. In Proc. IEEE Workshop on Software Technologies for Embedded and Ubiquitous Computing Systems (WSTFEUS), Vienna, Austria (May, 2004). 38. P. Kamat, Y. Zhang, W. Trappe, and C. Ozturk. Enhancing source-location privacy in sensor network routing. In Proc. IEEE International Conference on Distributed Computing System (ICDCS), Columbus, Ohio, USA (June, 2005). 39. B. Hoh and M. Gruteser. Protecting location privacy through path confusion. In Proc. IEEE/CreateNet International Conference on Security and Privacy in Emerging Areas in Communication Networks (SecureComm), Athens, Greece (September, 2005). 40. Y. Xi, L. Schwiebert, and W. Shi, Preserving Source Location Privacy in Monitoring-Based Wireless Sensor Networks. Department of Computer Science, Wayne State University, (2006). 41. R. Posner, In The Economics of Justice. Cambridge: Harvard University Press, (1981). 42. G. Danezis, S. Lewis, and R. Anderson. How much is location privacy worth? In Proc. Fourth Workshop on the Economics of Information Security, Cambridge, California, USA (June, 2005).

Chapter 5 On-Demand Anonymous Routing (ODAR)

Lichun Bao, Rex Chen and Denh Sy Bren School of Information and Computer Sciences University of California, Irvine, CA 92697 {lbao, rex, dsy}@ics.uci.edu Routing in wireless ad hoc networks are vulnerable to traffic analysis, spoofing and denial of service attacks due to open wireless medium communications. Anonymity mechanisms in ad hoc networks are critical security measures used to mitigate these problems by concealing identification information, such as those of nodes, links, traffic flows, paths and network topology information from harmful attackers. We propose ODAR, an On-Demand Anonymous Routing protocol for wireless ad hoc networks to enable complete anonymity of nodes, links and sourcerouting paths/trees using Bloom filters. We simulate ODAR using JSim, and compare its performance with AODV in certain ad hoc network scenarios.

1. Introduction Privacy concerns are increasing in the Internet and wireless networks due to the mounting intrusions and attacks. Anonymity that hides the identities of various components or parts of a network communication is one of the countermeasures. Strong anonymity in network communication prevents address spoofing, route forgery, and certain denial of service (DoS) attacks by concealing the true identity of the traffic. In the Internet, several network-based anonymity approaches provide anonymous communication between end-nodes, including DC-nets,8 Crowds,21 MIX networks,7 and Onion Routing.13 Crowds network is a randomized packet forwarding network that obscures the packet senders by randomly throwing each packet between Crowd network nodes for a variable number of times before delivering them to the final destination. However,

137

138

L. Bao, R. Chen and D. Sy

Crowds provides no recipient anonymity, and no anonymity against a global attacker or a local eavesdropper.21 MIX networks and Onion Routing use cryptographic algorithms to establish anonymous paths as well as encrypting the data packets. In Onion routing, to construct an anonymous path, a packet origin must store and maintain information about the topology of the Onion router network, out of which a number of Onion routers are selected by the packet origin to construct the path. In addition, each node on the path is supplied with a symmetric key for encrypting and decrypting data packets, and getting instructions for the next hop router in the path. When a data packet is ready to send, the source recursively encrypts the packet and the next hop information with the symmetric keys along the path. This creates a layered structure, in which it is necessary to decrypt all outer layers of the onion in order to retrieve an inner layer. In ad hoc networks, efficient anonymity is still an elusive topic. Similar approaches to Onion routing have been used. However, keeping up-to-date information about the topology of the network is complex in the presence of dynamic ad hoc topologies. Therefore, a trapdoor mechanism is used to collect the source route between communicating pairs. A trapdoor is a common concept in cryptographic functions that defines a one-way function between two sets.24 A global trapdoor is an information collection mechanism in which intermediate nodes may add information elements, such as node IDs, into the trapdoor. Only certain nodes, such as the source and destination nodes can unlock and retrieve the elements using pre-established secret keys. The design of a global trapdoor requires end-to-end key agreement between the source and destination nodes. AnonDSR provides a security parameter establishment (SPE) component to manage shared secrets between end-systems.23 Global trapdoors are used in several proposals, such as SDAR (Secure Distributed Anonymous Routing),3 AnonDSR (Anonymous DSR)23 and SDDR (Secure Dynamic Distributed Routing).12 Both SDAR and AnonDSR implement onion routing scheme by collecting the symmetric keys created by intermediate nodes using a global trapdoor managed by the source and destination nodes, thus providing both route anonymity and end-to-end data privacy. However, the identities of intermediate nodes on the source route are still visible to the source and destination nodes in such schemes. ANODR15 used onion routing, but is different from above approaches in that each forwarding node adds an encrypted layer to the route request

On-Demand Anonymous Routing (ODAR)

139

message like an onion. The source and destination nodes do not necessarily know the forwarding node IDs. The destination node ID in the route request is encrypted in a trapdoor that only the destination can decrypt. Kong et al. further proved that ASR27 is a variant of ANODR.16 Because the global trapdoor depends on public key encryption, AnonDSR and SDAR are better for high-end nodes that can run public key cryptography efficiently, while ANODR and ASR are more suitable for low-end nodes and medium mobility.18 ASRP (Anonymous Secure Routing Protocol) provides authenticated anonymous on-demand routing by setting up virtual circuits between neighbors in ad hoc networks.9 The virtual circuit IDs and data packets are encrypted with shared secrets between neighbors. MASK is another anonymous routing protocol that establishes virtual circuits between source and destination, and uses pseudo-link IDs for path presentations.26 Unfortunately, concealing the node, link or path identities in data packets may not be sufficient for traffic anonymity due to timing analysis.20 A technique called mixing can thwart this attack, such as sending reordered messages, inserting dummy messages, or introducing random delays.7 We propose ODAR, an On-Demand Anonymous Routing protocol, which provides node, link and path anonymities in ad hoc networks based on Bloom filters. The use of Bloom filters additionally gives ODAR the storage-, processing- and communication-efficiencies, making it suitable in the ad hoc network environments. Castelluccia et al. were the first to use Bloom filters to compress source route information after the source route is discovered using DSR.6,14 However, no research was found so far that uses Bloom filters for anonymous source routing purposes. The rest of the chapter is organized as follows. Section 2 describes the essential idea of anonymous routing using Bloom filters. Section 3 presents the anonymity mechanisms to various types of nodes on the source route, and a key distribution mechanism for secret establishment in ad hoc networks. Section 4 specifies ODAR route maintenance mechanism. Section 5 evaluates ODAR using simulations. Section 6 concludes the chapter.

2. ODAR Data Forwarding 2.1. Network Assumptions We assume that a wireless ad hoc network consists of energy-, storage-, processing- and communication-constrained nodes that are deployed over

140


a wide range of areas. The resources available at each node in the ad hoc network could be heterogeneous in that they possess different memory-, processing- and communication-capabilities, and take different roles to maintain the network communication functionalities. Wireless neighbors can communicate with one another via the wireless channel with high probability of success. The network topology is relatively static for the duration of manageable communication sessions. Many sources of information can work for the identification purposes, such as IP, URI, URL or MAC addresses or special attributes provided during the ad hoc network deployment. For communication initialization and anonymity purposes, we assume that only the source node knows the identity of its intended destination when it wants to establish the connection. The source does not have to know the whole network topology for communication purposes, and no node has to obtain the global view of the network. 2.2. Anonymity Goals We intend to provide the following anonymities in ODAR: • Identity anonymity: A node receiving or sending data packets cannot be identified by its neighbors. It is computationally difficult for adversaries to search and determine the node’s true identity. • Route/path anonymity: A node forwarding packets must not be able to infer the identities of other nodes that also participate in the data forwarding. • Topology/location anonymity: Routing information maintenance does not reveal the distance, neighbor link information of a node, or the true routing path or tree information. Nor can they be deduced from routing information in the packets. These goals are very different from other related security problems in routing such as resistance to route disruption or “denial-of-service” attacks. In fact, the attackers may avoid such aggressive schemes, in an attempt to be as “invisible” as possible, until it traces, locates and/or physically destroys the assets. 2.3. Bloom Filter A Bloom filter is a space-efficient probabilistic bit-vector data structure for storing the elements of a set, and testing whether or not any given element


141

is a member of the set.1 A Bloom filter is defined by the size or the number of bits in the filter N , the number of hash functions k, and the highest number of elements n that it can hold under a false positive threshold P . Traditional hash table is a special case of Bloom filter where k = 1. Usually, elements are only added to the set in Bloom filters, but not removed. There is a well-known result about the relations between these parameters, as shown in Eq. (1).1 n = −N/ ln P, where k ≈ − log2 P.

(1)

Bose et al. provides a slightly more accurate analysis of the relationship between N , n, k and P .2 Bloom filters are widely used in resource routing in peer-to-peer networks, packet tracing, packet counting, and packet forwarding problems.4 For clarity in the following discussions, Bloom filter elements are often represented by their identifiers directly in figure illustrations, instead of being transformed into the k bits derived from the hash functions. 2.4. Source Routing Using Bloom Filters For the anonymous routing purpose, we use source routing for packet forwarding, wherein the packet is attached with the path information. 8

8

mType bSize bDest Header Fig. 1.

11111111 11111111

0−128

0−4096

Payload

Packet header format and Payload for source routing.

Figure 1 illustrates the packet header format in ODAR. The message type mType indicates the type of message contained in the Payload field. The destination bDest is a Bloom filter that contains the node IDs on the source route from the packet origin to the destination, and its size is specified by field bSize. For clarity in our presentations, nodes are denoted in their plaintext forms in the source route. In Section 3, we describe how source, destination and intermediate forwarding nodes are securely anonymized. Although variable in applications, the exemplary field sizes in the ODAR packet header are denoted atop each field.

142


A

mType bSize DATA

B

64

bDest {A,D,E,G}

D C

1111 1111 Payload

G

E F

Fig. 2.

Source routing process in ODAR.

Figure 2 illustrates how a packet is forwarded in the ad hoc network. When a packet is sent out to reach its destination or predefined intermediate nodes, the complete path information is encoded in the bDest address field of the packet using Bloom filters. When an intermediate node receives the packet, the node inspects the Bloom filter bDest to see if its ID is in the Bloom filter. If true, the node simply rebroadcasts the packet. To avoid routing loops, each node maintains a history of forwarded packets using Bloom filters by extracting and hashing the packet identification information, such as the header fields and portions of the payload. If a packet has been sent before, a node simply discards the packet. The application of Bloom filters in the bDest field of data packets provides one of the anonymities in ODAR that conceals the network topology and path information, as well as the origin and destination information. For clarity, the above table provides the symbol notation and the corresponding meanings for key establishment, anonymity and path maintenance in ODAR. Specifically, six types of ODAR packets are indicated in Fig. 3, and will be used when we describe anonymous data forwarding, key establishment and path finding operations in the rest of the chapter. 3. Anonymity We differentiate two types of identification for anonymous routing — the end-host names and the forwarding node names. In anonymous routing, the forwarding nodes’ identities are known only by the nodes themselves, and no pseudonyms are necessary. However, the destination’s identity has to be known beforehand for the source to search the corresponding path. Therefore, the destination ID requires pseudonym generation methods. We provide anonymity mechanisms for the intermediate forwarding nodes and the end-hosts, respectively.


A, B etc. YA Ya XA Xa KaB

Node identifiers. The long-term public key of node A. The session public key of node A. The long-term private key of node A. The session private key of node A. The shared secret between the source A and destination B.

sh(x)k

Secure hash function on input bit-string x with key k, such as SHA-111 or HMAC.17

KSProp KREQ

Message to propagate key server path. Message to request the public key of a node. Message for key server to send a public key to a node. Message to search for a source route. Message to answer a source route query. Data packet.

KREP RREQ RREP DATA

Fig. 3.

143

Notation.

3.1. Intermediate Node Anonymity As shown in the source routing process in Fig. 2, the IDs of the forwarding nodes are hashed into the bDest Bloom filter. Data packets are routed correctly as long as the forwarding nodes can find out that they are members of the bDest Bloom filter. Therefore, a simple anonymous mechanism can be used, where a node generates a secret random number for itself, and uses it as a key in secure hash functions to derive the index keys of the Bloom filter. In addition, several private random keys can be iterated in the secure hash functions so that index key generations are further obfuscated in the bDest Bloom filter at a specific intermediate node. This way, attackers cannot recognize the nodes that are actively forwarding traffic. However, the node needs to carry out several rounds of secure hash operations when looking up the bDest Bloom filter in packet forwarding.

144


3.2. End-Host Anonymities In network communication, names are involved at different layers of the networking stack, and reflects information such as topological or geographic locations, application-specific semantics, or data-object attributes. For anonymity purposes, these identities are replaced with pseudonyms. Interpretation of pseudonyms can only be done by nodes with knowledge of the true names, such as the node itself or the source nodes that have knowledge of the names. In addition, pseudonyms allow nodes to use longer and more complicated addressing architecture in ad hoc networks, such as 128bit IPv6 or URL addresses. Diffie-Hellman algorithm has been widely used in key distribution and management protocols for establishing a shared secret over an unprotected communications channel.10,19 In Diffie-Hellman algorithm, a prime number q and its primitive root g is chosen and published in the network. When two nodes A and B need to share a key, node A generates a private random value XA < q, and computes a public value according to Eq. (2). YA = g XA mod q.

(2)

Similarly, node B generates a private value XB < q and a public value YB = g XB mod q. Each side keeps the private random numbers secret, and makes the public Y values available to the other side. Then the shared symmetric key is derived at both nodes A and B according to Eq. (3). KAB = YAXB = YBXA = g XA XB mod q.

(3)

We refer to the public and private values as keys in this chapter. In ODAR, each node possess two types of private keys. The first type is used to generate a long-term public value Y for accepting new incoming connections, and the other is session-based to create short-term public keys for connecting with destination nodes. We differentiate the long- and shortterm keys with upper and lower cases, respectively. That is, we denote the long-term public key of a node A by YA , and the short-term session key by Ya . Similarly, the long- and short-term private keys are denoted by XA and Xa , respectively, as shown in Fig. 3. 3.2.1. Key Server In ad hoc networks, it is necessary to implement a public key distribution mechanism for session-key generations. A comprehensive survey on key distribution mechanisms can be found in Ref. 5.


145

For simplicity, we assume that the ad hoc network has only one key server to hold the public keys of all other nodes for key storage and distribution purposes. The space requirement on the key server is linear with regard to the number of nodes in the network. Because ad hoc network topology changes frequently, and new nodes may join and leave the network frequently, the key server needs to maintain its presence by periodically propagating its public key with a key server message KSProp to all interested nodes. Additionally, the KSProp message also carries the traversed source route from the key server so as to establish the route from the key server to every other node in the network, thus providing the path for a node to request the public keys of other nodes later.

11111 11111

64

YKS

Header

Fig. 4.

8

0−128

bSize bRoute Payload

Key server propagation packet format.

The KSProp message is placed in the payload of an ODAR packet, and its format is illustrated in Fig. 4, in which YKS is the public key of the key server, bRoute is the source route, and bSize is the bit-size of bRoute. 3.2.2. Key Distribution A shared secret between the source and destination node is necessary to hide the source and destination identities during the source route request and response phases. The shared key derivation is achieved through the Diffie-Hellman algorithm after retrieving the long-term public key of the destination through the key server. (3) RREQ(Y a , sh(B+1) KaB)

(1) KREQ(B)

G

B

A (2) KREP(B, Y B) Fig. 5.

(4) RREP(Y a , sh(B+2) KaB)

Key distribution during source route construction.

The key distribution mechanism for anonymous end-to-end communication is illustrated by four steps (1)-(4) in Fig. 5 using four types of messages.

146


Figure 5 illustrates that the source node A retrieves the public key YB of the destination node B from the key server G, and finds the route to node B anonymously. We explain the meanings of the messages as follows.

11111 11111 Header

Fig. 6.

64

64

Dst

YDst

Payload

Public key request and reply packet format.

Figure 6 shows the format of both KREQ and KREP messages. Dst is the publicly known pseudonym of the destination, and YDst is the field for placing the public key of the destination.

11111 11111 11111 11111

64

RREQ RREP

64

0−128

Ys Dst bSize bRoute Ys Dst

Header

Fig. 7.

8

Payload

Source route request and reply packet format.

Figure 7 presents the route request and reply message formats, respectively. Field Ys contains the session key of a source node S. Dst is the securely hashed destination pseudonym, which equals to sh(B + 1)KaB in step (3) of Fig. 5, or sh(B + 2)KaB in step (4) of Fig. 5. Fields bRoute and bSize define the Bloom filter for storing the source route. In step (4) route reply phase, the source route is provided in the ODAR header field. B+1 and B+2 are for authentication purposes. 3.2.3. Anonymity in the Route Discovery The anonymous key distribution and mutually authenticated source route discovery are described as follows: Step (1) Node A sends out a key request message KREQ to the key server G for the public key of node B. The key request message does not reveal the


147

identity of node A except for indicating that some node wants to contact node B of the network. Step (2) Upon receiving the key request message, key server G looks through its public key table and finds the public key YB associated with identifier B, then responds with a key reply message KREP to node A using the same source route contained in the key request message. Step (3) Once node A gets the public key of node B, it generates a session key Ya based on a private key Xa according to Eq. (2), and computes a session secret KaB using YB , Xa according to Eq. (3). Afterward, node A uses key KaB to securely hash B + 1 by secure hash function sh(B + 1)KaB , the result of which is used to identify the destination. Then, node A sends the route request message RREQ to find the source route to node B with two pieces of information — session key Ya as node A’s pseudonym, and destination sh(B + 1)KaB as node B’s pseudonym. These pseudonyms are only recognizable by node A and node B, respectively. Step (4) When the source route request message RREQ arrives at node B, node B is able to use its long-term private key XB , generated initially, and the session key Ya to derive the shared secret KaB , and recompute sh(B + 1)KaB to see if it is the intended destination of the message. Since this is true, node B generates the route reply message RREP along with the session key Ya and another secure pseudonym sh(B +2)KaB using key KaB . Pseudonym sh(B + 2)KaB authenticates node B to node A so that node A can assert session key Ya maps to the true source route to node B in the reply message. Steps (3) and (4) do not reveal any source and destination information with the key acquisition process. Therefore, the end-host anonymity is guaranteed. Furthermore, node B does not know who it is communicating with. Stronger Mutual authentication of nodes A and B can be added to the existing mechanism, but is outside the scope of this chapter on anonymity. In step (3), because session key Ya can change per destination, the traffic characteristics per node are concealed as well. 4. ODAR Routing Control Routing control protocols are generally categorized into two types — proactive and reactive. ODAR is a reactive on-demand routing control algorithm,

148

1 2 3 4 5 6 7


/* Routing Protocol Initialization */ Init (I) { if (I ≡ KEY SERVER) { new pktKeyServer (KSProp, YI ); pktKeyServer.bRoute += sh(I + 1)KI ; Broadcast (pktKeyServer); } } Fig. 8.

ODAR specification: Initialization.

and follows the usual route request and reply mechanism as used by other similar protocols, such as DSR14 and AODV.22 The packet formats used by route request and reply mechanisms are defined in Fig. 7 when we describe the anonymity of ODAR. The path discovery process is activated when an outgoing packet coming from the application layer cannot find a route to the destination and starts by the node sending out a RREQ message to the network. If the destination receives the RREQ message, it responds with a route reply message RREP to return the complete source route to the source. Figures 8-10 specify ODAR related functions, such as ODAR initialization Init(), packet transmission SendPkt() and packet processing Process(), respectively, using C-style pseudo-codes. The notation scheme is that data structure names and their members are written in true-type font, function names and reserved words are in bold-face font, and comments are in italic font. The local node’s ID is represented by symbol I. The variable and function names are mostly self-explanatory. Specifically, local data structures of node I include: • mySessionInfo is an array of all end-to-end session information, such as the session identifier Yi , destination ID, anonymous source route bDest, and the packet queue manager Queue of the session. • Bloom filter myPktSent records the packets that node I has sent out. The packet identification information include ODAR packet header plus fields YS and Dst of the payload field if the message is route request RREQ. • myKeyKS and myPathKS store the public key and path to the key server. • The key server node also maintains a key list PublicKeyList, storing all node IDs and their public keys in the network.


149

/* Send a packet to destination D with session key Yi */ SendPkt (I, Yi , D, pkt) 1 { 2 if (Yi ∈ mySessionInfo and mySessionInfo[Yi ].bDest6=0) { // Route to D exists. 3 pkt.bDest = mySessionInfo[Yi ].bDest; 4 Broadcast (pkt); 5 } 6 else { // Find the route to node D. 7 mySessionInfo += (Yi , D); 8 if (mySessionInfo[Yi ].YD 6=0) { // If have the public key of D, then send RREQ. 9 KiD = Diffie-Hellman(Yi , YD ); 10 new pktPath (RREQ, Yi , sh(D + 1)KiD ); 11 pktPath.bRoute += sh(I + 1)KI ; /* Secure hash */ 12 Broadcast (pktPath); 13 mySessionInfo[Yi ].Queue += pkt; 14 } 15 else if (myKeyKS6=0) { // If have no key of D, then request it from key server 16 new pktKey (KREQ, myKeyKS, D); 17 pktKey.bDest = myPathKS; 18 Broadcast (pktKey); 19 mySessionInfo[Yi ].Queue += pkt; 20 } 21 else { // No key server, no communication. 22 Drop (pkt); 23 } 24 } 25 } Fig. 9.

ODAR specification: Outgoing packet transmission.

In function Init() of Fig. 8, the node checks whether it is the key server KEY SERVER. If so, it sends out the KSProp message to initialize the key distribution infrastructure (Init lines 2-6). In SendPkt() of Fig. 9, the node checks whether it has the source route to the destination. If yes, the packet is directly sent out (SendPkt lines 2-5). Otherwise, the packet is for a new session, and the node looks up the session information list to find the public key of the destination. If the node has contacted the destination before, it has the public key, and a new route request is sent to the network(SendPkt lines 8-14). Otherwise, the public key of the destination has to be requested from the key server first(SendPkt lines 15-20). If the key server is unknown so far, the packet has to be dropped (SendPkt lines 21-24).

150


/* Process packet pkt received Process (I, pkt) 1 { 2 bool forward = false; 3 if (pkt∈ myPktSent) { // Loop prevention. 4 return; 5 } 6 switch (pkt.mType) { 7 case KSProp: 8 if (myPathKS ≡ 0) { // Save key server’s public key and path. 9 myKeyKS = pkt.YKS ; 10 myPathKS = pkt.bRoute; // Remember the path. 11 myPathKS += sh(I + 2)XI ; // Keep growing the path. 12 pkt.bRoute += sh(I)XI ; 13 forward = true; 14 } 15 case KREQ or KREP: 16 if (pkt.mType ≡ KREQ and I ≡ KEY SERVER) { 17 pkt.mType = KREP; // Retrieve the key. 18 pkt.YDst = PublicKeyList (pkt.Dst); 19 forward = true; 20 } 21 else if (pkt.mType ≡ KREP and sh(I + 2)XI ∈ pkt.bDest) { 22 mySessionInfo.Process (pkt.Dst, pkt.YDst ); 23 } 24 else if (sh(I)XI ∈ pkt.bDest) { 25 forward = true; 26 } 27 case RREQ: 28 KsI = Diffie-Hellman(pkt.Ys , YI ); 29 if (sh(I + 1)KsI ≡ pkt.Payload.Dst) { // Reached destination, send RREP. 30 pkt.mType = RREP; 31 pkt.bSize = pkt.Payload.bSize; 32 pkt.bDest = pkt.Payload.bRoute + sh(I + 2)KI ;

Fig. 10.

33 34 35 36

pkt.Payload.Dst = sh(I + 2)KsI ; forward = true;

37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 }

}

} else { // Keep searching for destination. pkt.bRoute += sh(I)XI ; forward = true; } case RREP: if (sh(I + 1)XI ∈ pkt.bDest and pkt.Payload.Ys ∈ mySessionInfo) { // Arrived at source of the RREQ. mySessionInfo += (Ys , pkt.bDest); mySessionInfo[Ys ].Queue.Process (); } else if (sh(I)XI ∈ pkt.bDest) { forward = true; } case DATA: if (sh(I)XI ∈ pkt.bDest) { forward = true; } else if (sh(I + 1)XI ∈ pkt.bDest) { // Process payload at source. ProcSource (pkt.Payload); } else if (sh(I + 2)XI ∈ pkt.bDest) { // Process payload at destination. ProcDest (pkt.Payload); }

if (forward ≡ true) { Broadcast (pkt); // Hash into Bloom filter. myPktSent += pkt; }

ODAR specification: Packet processing.

In Process() of Fig. 10, the node asserts that it has not sent the packet before (Process lines 3-5). Then, the packet is processed according to its type. If the packet is key server propagation message KSProp, the node records the source route (Process lines 10-11) and keeps propagating the packet (Process lines 12-13). If the packet is a key request KREQ, and the node is the key server, a key reply is sent back (Process lines 16-20). Otherwise, if the packet is a key reply KREP, the node checks if it is the destination of this packet and processes the key information if so (Process lines 21-23). The node may also forward the packet if it is on the source route (Process lines 24-26). In case the packet is a routing control message for route request RREQ, the node first checks if it is the destination. If so, a route reply message


151

RREP is composed and sent (Process lines 28-35). Otherwise, the node keeps propagating it (Process lines 36-39). In case the packet is a route reply message RREP, the node first checks if it is the origin of the source route in the packet. If so, the node records it and processes queued messages accordingly (Process lines 41-44). Otherwise, the node forwards the packet if it is on the source route (Process lines 45-47). In case the packet is a data packet DATA, the node either forwards it (Process lines 49-51) or processes it (Process lines 52-57). Note that in source route, the source and destination nodes stores themselves differently. The source I always identify itself with ID I+1, while the destination with I+2. This is for the direction of the data flow, which effects how the application layer processes the packet. Several functions are not specified further in Figs. 8-10, such as APIs provided either by the lower layer (e.g., Broadcast which sends a packet through the wireless medium), or by the upper layer (e.g., ProcSource and ProcDest which process the packet payload information at the source and destination nodes, respectively). Diffie-Hellman is the shared secret computation function according to the public and private keys using Eq. (3).

5. Evaluations 5.1. Security Analysis ODAR provides a novel use of Bloom filters for efficient and anonymous routing in ad hoc networks. The bDest field in data packets contains the whole source route information in a single Bloom filter. ODAR can provide different levels of anonymity as implemented in Section 3. First, the true node identities are hidden by using pseudonyms. Secondly, forwarding node identities are hidden by securely hashing the node identity into Bloom filters of the source routes. Third, the source route is completely hidden due to the node ID encryption and Bloom filter storage (Section 2.4). The “man-in-the-middle” attack commonly known to the Diffie-Hellman method poses limited threat to the source route anonymity because the public key of the key server can be easily certified and distributed beforehand for authentication. ODAR inherently thwarts address spoofing attacks because the source routes are anonymous and network topology information is hidden from the perspective of any node. Therefore, the success rate of a spoofed packet getting through the network is exponentially reduced.

152


Nonetheless, ODAR does present some shortcomings. In the routing information aggregation process, high saturation ratio of the source route Bloom filter can all raise the false positive rates in the source routes, thus causing unnecessary packet forwarding. Furthermore, ODAR cannot prevent nodes on the source path from injecting invalid packets and staging denial of service attacks in ad hoc networks, which consume the energy of the network nodes. Due to space limitations, we have not discussed the scalability problem in ODAR, which can be solved by three approaches: increasing the size of the bDest Bloom filter, providing multiple bDest fields, or applying hierarchical routing architecture. 5.2. Simulations ODAR was simulated using J-Sim,25 a component based network simulator written in Java. In the simulations, a hundred homogeneous nodes are arranged such that nodes are approximately 80 meters (m) apart from each other in a 400 × 1600m2 rectangular area. The Free Space propagation model was used with channel bandwidth 2 Mbps. A CBR traffic flow is created in each simulation between two nodes that are two, four, and eight hops aways in three scenarios, respectively. The rate of the CBR traffic is 10 packets/second, and each packet size is 512 bytes. The simulations ran for 100 seconds. For comparison purposes, AODV routing algorithm was also simulated in the same environments as ODAR, therefore a total of six different test scenarios are generated, three each for ODAR and AODV. AODV uses IEEE 802.11 DCF using DATA/ACK procedure with no RTS/CTS, while ODAR uses IEEE 802.11 DCF broadcast mechanism without ACK. In the simulations, the numbers of control and data packets in the whole network are collected as well as the numbers of data packets injected and received at the source and destination nodes, which are used to compute the delivery ratios. Figure 11 presents the number of control and data packets for ODAR and AODV, respectively. In AODV, control packets consist of neighbor HELLO packets, route request, route reply, and route errors. Control packets in ODAR are attributed to packets for initial flooding of key server path and route discovery packets in the routing control algorithm. In all scenarios, the number of packets in ODAR was about 4,000, while that of AODV was much higher at 230,000 packets due to continuous HELLO packets. This is more clearly illustrated in the following Fig. 12.


Fig. 11.

153

Total number of packets generated.

ODAR

AODV

Number of Control Packets

4500 4000 3500 3000 2500 2000 1500 1000 500 0 0

5

10

15

20

Time (second)

Fig. 12.

The numbers of control packets in ODAR and AODV.

Figure 12 presents a comparison on the number of control packets in ODAR and AODV. For ODAR, initially there are large number of packets, which represents flooding of the key server propagation followed by the routing control algorithm. For AODV, the initial spike is a result of route request and route reply. Thereafter, the number of control packets are HELLO messages for neighborhood maintenance, and remains relatively constant over the time interval in AODV. In contrast, no more control packets are sent after the path finding algorithm is completed at about three seconds into the simulation in ODAR.

154


ODAR

AODV

Number of Control Packets

4500 4000 3500 3000 2500 2000 1500 1000 500 0 0

10

20

30

40

Time (second)

Fig. 13.

Control packets in ODAR and AODV in similar settings.

ODAR

AODV

100% 90% Delivery Ratio

80% 70% 60% 50% 40% 30% 20% 10% 0% 2

3

4

5

6

7

8

Number of Hops

Fig. 14.

Delivery ratios for AODV and ODAR.

For a fair comparison, we virtually turned off the neighborhood maintenance messaging by setting the HELLO message intervals at 30 seconds in AODV. Figure 13 compares the number of control packets in ODAR and the modified AODV, in which a spike appears at approximately 30 second. As we can see that ODAR performs close to AODV in terms of control overhead under similar settings. Figure 14 illustrates the delivery ratios of ODAR and AODV, respectively. AODV achieves higher delivery ratios than ODAR when the number of hops to traverse increases. The reason lies not in the routing


155

protocol but in the MAC layer acknowledgments and the backoff mechanisms. AODV benefits from MAC layer acknowledgments with retransmission, while ODAR does not. In ODAR, reliability based on retransmissions needs to be handled by the higher level protocols. 6. Summary We have presented ODAR, a novel On-Demand Anonymous Routing protocol in ad hoc networks using Bloom filters. We have described the mechanisms to efficiently store source routes anonymously, and to forward data packets anonymously. A key management mechanism is described to provide strong anonymity for end-to-end communications. Performance comparison between ODAR and AODV indicates ODAR has comparable control overhead to AODV. Acknowledgment We would like to thank the California Institute for Telecommunications and Information Technology (Calit2) at the Irvine division for providing the authors of this chapter with spaces and equipments. We sincerely acknowledge and thank Prof. Michael Goodrich and Prof. Gene Tsudik for their insightful suggestions and discussions on various security issues of ODAR during the process of designing the protocol. References 1. B.H. Bloom. Space/time trade-offs in hash coding with allowable errors. Communications of ACM, 13(7):422–426, Jul. 1970. 2. P. Bose, H. Guo, E. Kranakis, A. Maheshwari, P. Morin, J. Morrison, M. Smid, and Y. Tang. On the False-Positive Rate of Bloom Filters. Submitted Under Review, 2004. 3. A. Boukerche, K. El-Khatib, L. Xu, and L. Korba. A novel solution for achieving anonymity in wireless ad hoc networks. In Proc. of the 1st ACM PE-WASUN, 2004. 4. A. Broder and M. Mitzenmacher. Network applications of Bloom filters: a survey. In Proc. of the 40th Annual Allerton Conference on Communication, Control, and Computing, 2002. 5. S.A. Camtepe and B. Yener. Key Distribution Mechanisms for Wireless Sensor Networks: a Survey. Technical report, Department of Computer Science, Rensselaer Polytechnic Institute, Troy, NY, Mar. 23 2005. TR-05-07.

156


6. C. Castelluccia and P. Mutaf. Hash-Based Dynamic Source Routing. In IFIP Networking, LNCS 3042, pages 1012–23, 2004. 7. D. Chaum. Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms. Communications of the ACM, 4(2), Feb. 1982. 8. D. Chaum. The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability. Journal of Cryptography, 1(1):65–75, 1988. 9. Yi Cheng and Dharma P. Agrawal. Distributed Anonymous Secure Routing Protocol in Wireless Mobile Ad Hoc Networks. In OPNETWORK 2005, Aug. 2005. 10. W. Diffie and M. Hellman. New Directions in Cryptography. IEEE Transaction on Information Theory, 22:644–654, Nov. 1976. 11. E. Eastlake and P. Jones. RFC 3174 - US Secure Hash Algorithm 1 (SHA1). Technical report, IETF, Sep. 2001. 12. K. El-Khatib, L. Korba, R. Song, and G. Yee. Secure dynamic distributed routing algorithm for ad hoc wireless networks. In International Conference on Parallel Processing Workshops (ICPPW), 2003. 13. D. Goldschlag, M. Reed, and P. Syverson. Onion Routing for anonymous and private internet connections. Communications of the ACM, 42(2):39C4, 1999. 14. D.B. Johnson and D.A. Maltz. Mobile Computing, chapter Dynamic Source Routing in Ad Hoc Wireless Networks, pages 153–181. Kluwer Academic Publishers, 1996. 15. J. Kong and X. Hong. ANODR: ANonymous On Demand Routing with Untraceable Routes for Mobile Ad-hoc Networks. In MOBIHOC, 2003. 16. Jiejun Kong, Xiaoyan Hong, Mario Gerla, and M.Y. Sanadidi. Comparison: ASR is a Variant of ANODR. Technical report, UCLA, 2005. 17. H. Krawczyk, M. Bellare, and R. Canetti. RFC 2104 - HMAC: KeyedHashing for Message Authentication. Technical report, Network Working Group, 1997. 18. Jun Liu, Jiejun Kong, Xiaoyan Hong, and Mario Gerla. Performance Evaluation of Anonymous Routing Protocols in Mobile Ad-hoc Networks. In IEEE Wireless Communications and Networking Conference (WCNC), Las Vegas, Nevada, USA, Apr. 3-6 2006. 19. R. C. Merkle. Secure Communication over an Insecure Channel. Communication of ACM, 21:294C99, Apr. 1978. 20. J.-F. Raymond. Traffic Analysis: Protocols, Attacks, Design Issues, and Open Problems. DIAU Lecture Notes in Computer Science, page 10C29, 2000. 21. M. K. Reiter and A. D. Rubin. Crowds: Anonymity for Web Transactions. ACM Transactions on Information and System Security, 1(1):66–92, Nov. 1998. 22. E. M. Royer and C. E. Perkins. Multicast Operation of the Ad hoc OnDemand Distance Vector Routing Protocol. In Proc. of MOBICOM, pages 207–218, Seattle, WA, Aug. 1999. 23. R. Song, L. Korba, and G. Yee. AnonDSR: Efficient Anonymous Dynamic Source Routing for Mobile Ad-Hoc Networks. In ACM Workshop on Security of Ad Hoc and Sensor Networks (SASN), 2005.


157

24. W. Stallings. Cryptography and Network Security: Principles and Practice. Prentice Hall, Upper Saddle River, NJ, Jul. 15 1998. 25. H. Tyan. J-Sim. http://www.j-sim.org/. 26. Y. Zhang, W. Liu, and W. Lou. Anonymous communications in mobile ad hoc networks. In Proc. of the 24th International Conference of the IEEE Communications Society (INFOCOM), 2005. 27. B. Zhu, Z. Wan, M. Kankanhalli, F. Bao, and R. Deng. Anonymous secure routing in mobile ad-hoc networks. In Proc. of the 29th Annual IEEE International Conference on Local Computer Networks (LCN), pages 102–8, 2004.

Chapter 6 NTRU-Based Confidential Data Transmission in Telemedicine Sensor Networks Fei Hu Department of Electrical and Computer Engineering, University of Alabama Tuscaloosa, AL 35487, USA [email protected]

Xiaojun Cao Department of Computer Science, Georgia State University Atlanta, GA 30303, USA [email protected]

Kyle Wilhelm, Marcin Łukowiak Department of Computer Engineering, Rochester Institute of Technology Rochester, New York 14623, USA

Stanisław Radziszowski Department of Computer Science, Rochester Institute of Technology Rochester, New York 14623, USA

This chapter discusses the security requirements of medical sensor networks and describes a low-complexity/energy-efficient medical privacy preserving scheme which is based on NTRU algorithms. Unlike the current works that apply NTRU algorithms in pure software, this chapter focuses on the hardware implementation of NTRU algorithms since a hardware implementation offers many advantages such as energy consumption and execution speed. This chapter provides a study of many of the recommended practices and suggested optimizations with particular emphasis on polynomial arithmetic and parameter selection.

159

160

F. Hu et al.

1. Introduction Tele-healthcare monitoring recently gained significant popularity and momentum due to its flexibility and cost-efficiency in combining mobile computing, medical sensor, and communication technologies for healthcare [1–3]. The Tele-healthcare systems represent the evolution of e-health systems from traditional desktop telemedicine platforms to wireless/mobile configurations. For example, Tele-healthcare for cardiac monitoring would largely benefit our society by: (i) enhancing accessibility to care for underserved populations (such as in rural/remote areas), (ii) containing cost inflation as a result of providing appropriate care to cardiac patients in their homes/communities, and (iii) improving quality as a result of providing coordinated and continuous care for cardiac patients and highly effective tools for decision support. As more and more elders with diseases go to nursing homes, it is very important to build regional Tele-healthcare systems to continuously and automatically monitor the elders’ ECG, heart rate, SpO2, and blood pressure. Much research has been conducted in applying the emerging wireless technologies in Tele-healthcare monitoring (see for example, [1, 4–6]). Recently, a promising wireless telemedicine technology, called Cardiac Sensor Networks (CSNs), was proposed to closely monitor changes in elders’ vital signs and provide feedback to help maintain an optimal cardiac health status. In general, the nursing homes monitoring systems should meet the following requirements: (1) Reliability: Radio-based wireless networks are suitable to patients’ mobility behavior. However, the impact of radio interference and propagation distortions (such as radio reflection, diffraction, and scattering) often lead to wireless transmission errors. The wireless error rate is around 2% [7]. It is higher than traditional wired networks such as cable-based medical networks. Obviously, one cannot tolerate many medical data errors because each piece of cardiac data could carry important medical information. For example, a sudden heart failure may produce an abnormal ECG signal that lasts for only a few seconds. The transmission error of such a segment of ECG data is disastrous to the capture of sudden heart failure events.

NTRU-Based Confidential Data Transmission in Telemedicine Sensor Networks

161

(2) Low-cost: The overall health care expenditures in the United States reached $1.8 trillion in 2004 with almost 45 million Americans uninsured and over 20% of US GDP will be consumed in healthcare by 2010 [8, 9]. For nursing homes that are for regional areas, expensive infrastructures should be avoided. Instead, a low-cost, short-distance Tele-healthcare system could be a promising alternative solution [1–3, 5]. (3) Security: U.S. HHS issued patient privacy protections as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA includes provisions designed to encourage electronic transactions and also requires new safeguards to protect the security and confidentiality of health information. Most health insurers, pharmacies, doctors and other health care providers are required to comply with these federal standards [10]. This chapter starts with an introduction of a typical Tele-healthcare system, namely cardiac sensor networks. Coupled with such telemedicine sensor networks, the general NTRU encrypt algorithm [14] is examined to enhance the system security. Many of the recommended practices and suggested optimizations with emphasis on polynomial arithmetic and parameter selection are analyzed while a RTL-level design (via VHDL) and implementation are presented. 2. Cardiac Sensor Networks (CSNs) As shown in Figure 1, a CSN sensor, which could have different purposes, such as detecting ECG, heart rate, SpO2 or blood pressure, typically includes a sensing chip to sense healthcare parameters, a microcontroller to perform local data processing (such as data compression) and networking operations (such as communicating with a neighbor sensor), and a radio transceiver to send/receive healthcare sensed data over the air. The entire CSN sensor is powered by batteries with a lifetime of several months to one year. Note that a CSN sensor is different from traditional wearable medical devices that are also marketed as “portable” – but this does not always indicate that they are small and have wireless communication capability. Most of such appliances are much heavier and larger than a CSN sensor.

F. Hu et al.

162

ECG signal SpO2 value ••• •••

Sensing Chip

Microcontroller

Radio Transceiver

Fig. 1. CSN sensor hardware components.

Fig. 2. Cardiac Sensor Network (CSN) for nursing homes.

Because each patient’s cardiac sensor has limited wireless communication range due to the low-power transceiver and tiny antenna in each sensor, CSN adopts a patient-to-patient (or hop-to-hop) cardiac transmission relay scheme. That relay scheme can automatically search neighbor sensors or relays, and use them to forward the medical sensed data to a remote medical monitoring center as shown in Figure 2. If the patient is close enough to the monitoring center, a cardiac sensor can directly communicate with the monitoring center. To enhance the reliability of the system, the CSN design also considers patients’ mobility behaviors through a dynamic CSN routing protocol that automatically searches alternative patient-to-patient paths to send the cardiac data to the monitoring center [1–5]. The above CSN concept meets the requirements of nursing home cardiac telemedicine design. For example, the CSN system features lowcost, due to the following two reasons. First, with the advance of MEMS (Micro-Electro-Mechanical-System) and chip integration technology, the


163

cost of a sensor keeps dropping. It is predicted that each MEMS-based sensor price would be around one dollar in the near future [11, 13]. Secondly, the CSN concept does not need any infrastructure (such as expensive base-stations, wireless routers, medical PDAs, etc.). The entire network uses only patients’ sensors or cheap tiny relays to perform hopto-hop transmission. System reliability is ensured through redundant deployments of the sensors/relays and robust algorithms [1–5]. While there exists several secure, well documented, asymmetric algorithms, most require large amounts of memory along with significant computation time. This chapter reviews the application of a very efficient, low overhead, public key encryption algorithm that supports a high level of security called NTRU. Unlike public key security algorithms which require complicated mathematical operations on very large integers, NTRU is polynomial based and can be implemented by utilizing basic matrix operations on small integers, which are particularly attractive in resource-constrained system such as the cardiac sensor network with limited memory, power, and computing capabilities. Although NTRU encryption/decryption algorithms could be implemented in pure software such as in C/C++/Java [14], real-time sensor data authentication and intrusion detection with lower complexity and energy consumption are expected in CSN systems (typically the stream decryption time cannot go beyond 100 micro-seconds [15]). In order to speed up the security algorithms, a hardware approach is necessary. This chapter presents a series of optimizations in the NTRU circuit design to achieve the required operation speed with low-power dissipation. This work represents one of the pioneer works on the study of the NTRU-based security schemes for sensor networks. 3. NTRU Algorithms [12, 14] NTRU algorithm is an asymmetric key encryption algorithm invented in the mid-1990s, which employs certain rings of polynomials with convolution multiplication [12, 14]. The NTRU encryption algorithm relies on the presumed difficulty of factoring certain polynomials in such rings into a quotient of two polynomials having very small coefficients. Breaking the cryptosystem is strongly related, though not equivalent, to

F. Hu et al.

164

the algorithmic problem of lattice reduction (solving the closest vector problem) in certain lattices [14]. Careful choice of parameters is necessary to thwart some published attacks [12]. This section starts with the basic introduction of modular arithmetic and algebraic structures that are used in the NTRU’s cryptographic primitives, followed by a detailed description of the NTRU cryptosystem. 3.1. Modular Arithmetic In mathematics, modular arithmetic, also termed as modulo arithmetic, is a system of arithmetic for integers, where only the remainder is kept in the division process. In general, the expression a = b (modulo m)

(1)

means that a and b have the same remainder when they are divided by the modulus, m. Numbers with the same modulus may be added, subtracted, and multiplied as is done with the ordinary mathematic equations. For example, (10 modulo 23) + (7 modulo 23) = 17 modulo 23

(2)

(10 modulo 23) × (7 modulo 23) = 70 modulo 23

(3)

If there are no common factors between a and m, then one can find an inverse b such that a × b = 1 (modulo m) . Hence, the inverse of 10 (modulo 23) is 7, since 7 × 10 = 70 = 1 (modulo 23) . Euclidean algorithm is a fast algorithm that can be used to check if a and m own common factors and compute the inverse accordingly [16, 17].

3.2. Truncated Polynomial Rings The basic collection of objects used by the NTRU Public Key Cryptosystem is the ring R. This ring consists of all truncated polynomials of degree N-1 and integer coefficients (i.e., a0 , a1 … aN −1 ) as in Eq. (4).

a = a0 + a1 X + a2 X 2 + a3 X 3 + … + aN − 2 X N − 2 + aN −1 X N −1

(4)


165

The set of all such polynomials is denoted by R, where polynomials can be added in the usual way by adding their corresponding coefficients. However, the multiplication among such polynomials is truncated by replacing power X N with 1, power X N −1 with X, power X N − 2 with X 2 , and so on. For example, suppose N = 3, and take two polynomials a = 1 + X − X 2 and b = 1 − X − 2 X 2 , then a + b = (1 + X − X 2 ) + (1 − X − 2 X 2 ) = 2 − 3 X 2

(5)

a * b = (1 + X − X 2 ) * (1 − X − 2 X 2 ) = 1 − 4 X 2 − X 3 + 2 X 4

= 1− 4X 2 −1+ 2X = 2X − 4X 2

(6)

Similarly, the distributive law holds true as a * (b + c) = a * b + a * c . Clearly, the above addition and truncated multiplication rules make R into a ring. 3.3. NTRU Algorithm The NTRU algorithms combine the ring of truncated polynomials R with the modular arithmetic to reduce the integer coefficients by applying modulo operation on all the original coefficients of a polynomial. Thus, a (modulo q) denotes dividing each coefficient of polynomial a by q and taking the remainders. Accordingly, Eq. (1) can be extended as following by replacing the integers a and b with polynomials from R. a = b (modulo q )

(7)

which represents that every coefficient of the difference a - b is a multiple of q. The inverse modulo q of polynomial a is a polynomial A such thata a * A = 1 (modulo q )

a

(8)

Note that not all polynomials have an inverse modulo q. However, there are fast algorithms that determine if a polynomial has inverse and compute the inverse whenever existing (see http://www.ntru.com/cryptolab/tech_notes.htm for more details).

F. Hu et al.

166

3.3.1. Notations Before the elaborations of the detailed encryption/decryption process, the following list shows the notations adopted in the NTRU algorithms. N

The dimension of the polynomial ring used in NTRU. The polynomials will have degree N-1.

p

The small modulus. As in the final step in decryption, the coefficients of the message are reduced through modulo p.

q

The large modulus. Usually, the coefficients of the truncated polynomials will be reduced through modulo q.

f, g

Polynomials from R.

fp

The inverse polynomial of f modulo p (this is part of the private key).

fq

The inverse polynomial of f modulo q.

h

The public key (A polynomial).

m

The plaintext message.

r

A polynomial used with h to encode a message.

e

The encrypted message.

Note that p and q must have no common factors in order to ensure security. Table 1 lists some possible value settings for NTRU parameters at various security levels [12, 14]. Table 1. NRTU parameters. N

q

p

Moderate Security

167

128

3

Standard Security

251

128

3

High Security

347

128

3

Highest Security

503

256

3


167

3.3.2. Public/Private Key In order to create a public/private key pair for the NTRU Public Key Cryptosystem, two “small” polynomials f and g are randomly chosen in the ring of truncated polynomials R. Then, the inverse f modulo q and the inverse of f modulo p can be computed. For the simplicity of illustration, we set N = 11, p = 3, and q = 32 ; f and g are chosen as in Eqs. (9) and (10). f = −1 + X + X 2 − X 4 + X 6 + X 9 − X 10

(9)

g = −1 + X 2 + X 3 + X 5 − X 8 − X 10

(10)

By adopting the Almost Inverse algorithm in [18, 27], the inverse polynomials of f modulo p and f modulo q can be obtained as following. fp = 1 + 2X + 2 X 3 + 2X 4 + X 5 + 2X 7 + X 8 + 2X 9

(11)

fq = −1 + X 2 + X 3 + X 5 − X 8 − X 10

(12)

Then, the public key h can be calculated in Eq. (13) while the pair of polynomials f and fp serve as the private key.

h = pfq * g = 8 + 25 X + 22 X 2 + 20 X 3 + 12 X 4 + 24 X 5 + 15 X 6 + 19 X 7 + 12 X 8 + 19 X 9 + 16 X 10 (modulo 32)

(13)

3.3.3. Encryption Now suppose Alice wants to send a message to Bob using Bob’s public key h. Alice converts her message in the form of a polynomial m. In addition, Alice randomly chooses another small polynomial, r as the “blinding value” to obscure the message (similar to the way that the ElGamal algorithm [19] uses a one-time random value when encrypting). Then the encrypted message e can be computed by using Bob’s public key h as Eq. (14) e = r*h + m (modulo q )

(14)

F. Hu et al.

168

As an example, suppose that Alice would like to send the message m = −1 + X 3 − X 4 − X 8 + X 9 + X 10 to Bob using Bob’s public key in Eq. (13) and choose the random polynomial r as r = −1 + X 2 + X 3 + X 4 − X 5 − X 7 . Then, the encrypted message is e = r*h + m (modulo 32) = 14 + 11X + 26 X 2 + 24 X 3 + 14 X 4 + 16 X 5 + 30 X 6 + 7 X 7 + 25 X 8 + 6 X 9 + 19 X 10 (modulo 32)

(15)

3.3.4. Decryption To decrypt the received message e, the receiver (e.g., Bob) first computes the polynomial a = f *e (modulo q ) by using his private polynomial f and b = a (modulo p ) . Then the original message c from the sender (e.g., Alice) can be obtained in Eq. (16) by using the other private polynomial fp. c = f p *b (modulo p )

(16)

For example, suppose Bob receives the encrypted message e as in Eq. (15), then Bob can decrypt the message by computing the polynomials a, b, and c sequentially by using his private keys f and fp. a = f *e (modulo 32) = 3 − 7 X − 10 X 2 − 11X 3 + 10 X 4 + 7 X 5 + 6 X 6 + 7 X 7 + 5 X 8 + 3 X 9 − 7 X 10 (modulo 32)

(17)

b = a (modulo 3) = − X − X 2 + X 3 + X 4 + X 5 + X 7 − X 8 − X 10 (modulo 3)

(18)

c = f p * b (modulo 3) = −1 + X 3 − X 4 − X 8 + X 9 + X 10 (modulo 3) (19) The decrypted message c is exactly the same as the sent message m. The detailed proof of the NTRU algorithm can be found in [12, 14]. 4. NTRU Security Algorithm: Hardware-Based Implementation Although many sources provide a basic description of the NTRU system [14, 12, 21], as is the case with many cryptosystems, additional steps


169

should be taken to protect the system from certain types of attacks. The IEEE 1363.1 draft standard for Public-Key Cryptographic Techniques provides a central reference for public-key techniques when applying NTRU algorithms [20]. In order to support the functions of key generation, encryption and decryption, IEEE 1363.1 defines a mask generation function (MGF), index generation function (IGF) and a blinding polynomial generation method (BPGM) which are based on an underlying hash function. The mask generation function is used to ensure a reasonably random distribution of bits after encryption and to ensure that a single bit of the output is dependent on multiple input bits. From a security standpoint, the encrypted text will require a much larger search space to discover and should be less vulnerable to attack if it has been sufficiently randomized. An index generation function, similar to the MGF except that it is state aware and can therefore be called multiple times, is used to provide a source of reasonably random indices. The output indices from IGF are then used by BPGM to create the blinding polynomial based on the message being encrypted [20]. 4.1. NTRU System Components and Design To comprehensively evaluate and analyze the application of NTRU public key encryption algorithm in Telemedicine system such as Cardiac Sensor Networks (CSNs), the hardware implementation of NTRU algorithms and an IEEE 1363.1 system can be conducted through a hybrid behavioral and structural VHDL (Very Large Integrated Circuit Hardware Description Language) model as shown in Figure 3. Components that are easily translatable to hardware are implemented using structural models, while some of the more complex components are written using behavioral style code. Two main goals are considered during the design and implementation of NTRU algorithms together with the IEEE 1363.1 system model. The first goal is to make the system as modular as possible to facilitate the changing of individual modules without need for re-creation of the entire model. The modules are mainly separated around the boundaries of the algorithms presented in the standard and each of the functional blocks is a sensible division.

F. Hu et al.

170

Fig. 3. Interaction of IEEE 1363.1 system components.

Components Testing Case

Hash Algorithm (SHA)

Hash Algorithms (SHA) Mask Generation Function

VHDL models

Index Generation Function

Verification

Blinding Polynomial Generation Function Polynomial Inversion

Behavioral

VHDL

Key Generation Protocol

Structural or Mixed

Encryption Operation Decryption Operation Polynomial convolution multiplication Integer Modular inversion

Fig. 4. NTRU hardware design and testing procedure.

The second goal is to make the system flexible with regard to changing the top-level system parameters. Although the system could have been created in a manner similar to the algorithm blocks defined in


171

the IEEE 1363.1 draft standard, the choice here is instead made to use generic declarations to control each module. Usage of the generics in each module allows the system testbench to control the parameters used in testing without modification of each individual module but also allows for a reduced number of inputs and outputs compared to that needed for a dynamically changing system. The full modules for key generation, encryption and decryption are wrapped in a testbench that provides inputs based on available testing data and check for the expected outputs. Following the design flow in Figure 4, the final model becomes a testing platform for the necessary pieces of the IEEE 1363.1 draft standard with the ability to be piece-wise adapted for further study and optimization. 4.2. Multiplication and Secure Hash Algorithm Modules In order to facilitate the convolution multiplications of a general system, a model is created to handle all of the necessary cases as shown in Figure 5. The model accepts two polynomials modulo p, two polynomials modulo q or a combination of the both. The output polynomial can be reduced via modulo an integer input, modn, to allow for special cases and also allow a scaling of the output polynomial, through the integer input scale, before reduction for calculations such as the public key where the output needs to be scaled by p. The type of input used and whether or not the output is scaled is controlled by the input datyp. The calculation that daclk(std_logic)

CONVMULTGEN

datyp(std_logic_vector(3)) qina(std_logic_vector(N*cl2q)) qinb(std_logic_vector(N*cl2q))

qout(std_logic_vector(N*cl2q)) Generic Parameters: N,nLen,q,p,cl2q,cl2p

pout(std_logic_vector(N*cl2p))

pina(std_logic_vector(N*cl2p)) pinb(std_logic_vector(N*cl2p)) scale(Integer)

m2out(std_logic_vector(nLen*8))

modn(Integer)

Fig. 5. NTRU VHDL design module: general convolution multiplication.

172

F. Hu et al.

Fig. 6. Block diagram for SHA1.

performs the convolution multiplication is the basic algorithm, taking N2 operations, where each operation is a multiplication and an addition. The calculation is initiated by a rising edge on the daclk and is calculated immediately due to the behavioral nature of the model. In addition to the modulo p and modulo q outputs, there is a modulo two output used for directly inputting into the mask generation function. The generic values cl2q and cl2p are used throughout the system and represent the number of bits that should be used to store each coefficient in q and p respectively. The underlying building block for the mask generation function and index generation function is a hash function. Under the current draft standard of IEEE 1363.1, the Secure Hash Algorithm (SHA) family of hashes is used as specified in [22], which has been well researched. A VHDL procedure is constructed for each version of SHA needed. The example in Figure 6 shows the internal usage of the procedure to calculate the hash along with a wrapper module to allow for control of the inputs and output of the hash, although this is merged with the inputs and outputs of the functional blocks in which the procedure is included. Upon a rising edge transition on the daclk input, the current 512-bit block of the input message of msize is processed and output to hashv. Subsequent rising edges on the daclk will continue to cause processing on the mblock input using the previous hash values until either a reset occurs or the full number of bits in the message have been processed. Although the choice of using a procedure caused the hash implementation to generate one MGF and one IGF model for each SHA version, the impact is minimal and the model could be easily adapted to a


173

new hash procedure or modified to calculate the hash in a separate module. The decision on which hash function to use is determined by the security level, k, desired. The recommendation is to choose a hash function with output length greater than or equal to k, although the recommended parameters for security level k = 160 use SHA-256 instead of SHA-1b. 4.3. Generation Function Modules The mask generation function (MGF) model is mainly a wrapper for either the SHA-1 or SHA-256 procedure, so that the hash can be called multiple times. As shown in Figure 7, the zblock is based on the modulo operation inputs to the MGF in terms of bytes. The number of input blocks, numblk, is calculated to be the number of hash input blocks needed to fit nLen + 32 bits, where the additional 32 bits are needed for a counter. If the output of the hash function is long enough to produce nLen bytes of output, then only one iteration is executed, otherwise the counter is incremented and the hash function is called again. The hash output of each consecutive iteration is concatenated together until enough data has been buffered that it can be XOR’ed with the entire message construct. The value of oLen is the number of hash output blocks that are needed for the masking operation.

Fig. 7. Block diagram for MGF. b

It should be noted that the National Institute of Standards and Technology (NIST) is currently accepting submissions for a new hash algorithm to augment the FIPS 180-2 Secure Hash Standard. The new algorithm, dubbed “SHA-3”, will seek to provide better security compared to the previous SHA functions, in light of advancements in the cryptanalysis of hash functions [24].

174

F. Hu et al.

Fig. 8. Block diagram for IGF.

Fig. 9. Block diagram for BPGM.

The index generation function model also wraps around either the SHA-1 or SHA-256 procedure as shown in Figure 8, but adds extra functionality to maintain status for subsequent calls and to control the output integer value on each call. The input zblock is the seed data and all of the sample parameter sets use pkLen = 0. Zero bytes of the public key are used in the seed data, so it is not considered in the calculation for the maximum length of the seed data. Although the input zblock is expanded based on the maximum message size, the input octL is used during the calculation of the hash to determine how many bytes of message data are actually present. The parameter numblk is used in a similar fashion to the mask generation function; it is used to create a buffer that will fit the maximum length input data for input into the hash algorithm. The blinding polynomial generation method (BPGM) model (in Figure 9) is implemented as a simple state machine used to generate the


175

blinding polynomial r. The state machine enters an active state upon a high input on the strtgen, at which point it clocks the daclk input to the index generation function to receive a pseudo-random index. The index received is checked in the polynomial r and set if the coefficient is not already non-zero. If a coefficient can successfully set, the remaining count of coefficients that need to be set is decremented by one until the full dr coefficients have been assigned. Once the full number of coefficients has been assigned, the gendone signal is set high and the output polynomial data is held valid until the strtgen signal is set low. If the strtgen signal is set low before the state machine reaches the output holding state, then the output polynomial will be held valid for only one clock cycle. 4.4. Key Generation and Encryption/Decryption Modules The key generation primitive (KGP) model interfaces with the convolution multiplication module and the inverse polynomial module to generate the private and public keys as in Figure 10. The KGP is implemented as a state machine which is activated and deactivated in a similar manner to the blinding polynomial generation method state

Fig. 10. Block diagram for KGP.

176

F. Hu et al.

machine. The KGP accepts as input the random polynomials F and g, which are obtained from available test data. The state machine starts by calculating the private f. The inverse polynomial module is then used and the output is checked to make sure that the inverse of the private key exists modulo q. If the inverse does not exist, the state machine returns to loading the input value for the polynomial F and starts the calculation of the private key and its inverse again. If the inverse of the private key does exist, the state machine loads the value of the random polynomial g and calculates the inverse modulo q. Although it is not necessary for g to be invertible, the calculation of security used in the IEEE 1363.1 draft standard requires that the public key be invertible modulo q, which in turn requires each of its components to be invertible modulo q. In the same manner as with F, if the inverse of g does not exist, the state machine reloads the value of g and recalculates the inverse. The consequence of implementing the KGP this way is that the testbench which operates the KGP must respond to the invalid inverse signals to ensure that new random polynomials are input in case of an inversion failure; otherwise the state machine will enter an infinite loop. After validating that the private key and g have valid inverses modulo q, the inverse of the private key and the polynomial g are used as inputs to the convolution multiplication module along with p as the input scale quantity so that the calculation of the public key is accomplished all at the same time. The private key, f, and public key, h, are then held valid on the output until the strtgen is driven low. The polynomial inversion modulo q module combines the algorithms for polynomial division, Extended Euclidean Algorithm and inversion of a polynomial modulo a prime as shown in Figure 11. The module takes a

Fig. 11. Block diagram for inversion mod q.


177

polynomial modulo q as an input and is activated by a rising edge on the daclk input. The implementation is behavioral, so the algorithm runs during one clock cycle and outputs the inverse of the input polynomial and whether the inverse is valid. The inverse polynomial is held on the output and state is maintained, so the module should be reset to clear all stored values before another inverse polynomial calculation is executed. Similarly, the encryption and decryption operation modules are shown as in Figures 12–13. The encryption process retrieves the public key from the key generation primitive via the testbench. The testbench also provides the input message, from testing data, to the encryption operation and drives the strtenc signal to enable encryption. The message construct, M, and index generation function seed data, sData, are formed and the seed data is sent directly to the index generation function. The blinding polynomial generation method module is then activated, after which the output blinding polynomial, r, is multiplied by the public key, h, using the convolution multiplication module. The output modulo is received from the convolution multiplication module through the mask generation function and masked with the message construct. Finally, ENCRYPT

clk(std logic)

endenc(std_logic)

strenc(std_logic)

strtgenb(std logic)

genbdone(std_logic)

strtgenr(std_logic) sData(std_logic_vector(db+maxLen*8+24))

genrdone(std logic) polym(std_logic_vector(maxLen*8)) octL(std_logic_vector(ILen*8)) polyh(std_logic_vector(N*cl2q)) polyb(std_logic_vector(db)) ployr(std_logic_vector(N*cl2q)) cmm2out(std_logic_vector(nLen*8)) cmqout(std_logic_vector(N*cl2q)) mgfv(std_logic_vector(oLen*hLen*8))

Generic Parameters N,nLen,q,p,cl2q,cl2p,db,bLen, Ilen,maxLen, dm0, OID,oLen, zeromsk, hLen

polye(std_logic_vector(N*cl2q)) cmdaclk(std_logic) cmdatyp(std_logic_vector(3)) cmmodn(integer) cmscale(integer) cmqina(std_logic_vector(N*cl2q)) cmqinb(std_logic_vector(N*cl2q)) mgfdaclk(std_logic) mgfreset(std logic) mgfzblk(std_logic_vector(nLen*8))

Fig. 12. Block diagram for encryption operation.

F. Hu et al.

178

Fig. 13. Block diagram for decryption operation.

the encryption operation forms the ciphertext. An additional parameter, zeromsk, is pre-generated so that the mask used in the encryption operation does not have to be dynamically created for each parameter set. The decryption operation module is set up in the testbench to accept the ciphertext, e, from the encryption operation module and the private key, f, from the key generation primitive module. The decryption module uses internal states to execute the decryption primitive to recover the candidate decrypted polynomial. The candidate value is recovered and taken modulo two to be used in the mask generation function. The resultant mask is XOR’ed with the candidate polynomial and the candidate message construct, is retrieved and held as an output from the decryption operation module. Although the candidate message construct is verified manually using the testing data, it should be noted that the blinding polynomial generation method module could easily be integrated with the decryption operation module for automated verification of the data. 5. NTRU Optimizations Given the limited power and computing resources in sensor networks [3, 11, 13, 23–25], optimization of the corresponding NTRU circuits and parameters based on the NTRU algorithm to enhance the system efficiency is desirable.


179

5.1. Multiplication Operation The NTRU algorithms include different multiplication calculations during the encryption, decryption and key generation processes as elaborated in Section 3.3. And polynomial multiplication is the most time consuming part. Hence, enhancing the control unit circuit to take advantage of the sparse polynomials and store/access the coefficients of a polynomial can speed up the encryption/decryption processes. First, adopting products of low Hamming weight polynomials to decompose r(x) in Eq. (14) can significantly reduce the star multiplication time by taking r(x) to be a product of polynomials with fewer ones [26]. Specifically, suppose that r(x) = r1(x)*r2(x), where r1 and r2 are binary polynomials with d1 and d2 ones, respectively. Then r(x) will have approximately d1 × d2 ones. Notice that the computation of the product r(x)*h(x) = r1(x)*(r2(x)*h(x)) requires only (d1+d2)*N operations, so the computational time is largely reduced. From a hardware implementation viewpoint, a path-equalized multiplier with two sets of coefficients from low Hamming weight polynomials can be employed. Second, alternative equation forms are suggested to take advantage of sparse polynomials. During the final step of the decryption process, the inverse of the private key modulo the small modulus p is multiplied by the candidate value to obtain the candidate plain text. One of the optimizations is to choose the form of the private key to be f = 1 + p *F, where F is a random polynomial with dF non-zero coefficients. By choosing the private key in this form, the inverse modulo p of the private key can eliminate the need for the final convolution multiplication during decryption. Additional savings are achieved in terms of storage and key generation computations, as the inverse of the private key modulo p does not need to be stored or computed. In addition, the suggested form, f = f1* f2 + f3, constructed from polynomials f1, f2, and f3 having df 1, df 2 and df 3 non-zero coefficients respectively, would require (df 1 + df 2 + df 3)*N operations instead of (df)*N operations per coefficient. For example, with N = 251 and df = 90, one might choose df 1 = df 2 = df 3 = 9. A multiplication of polynomial a by f would require (df) N = 22590 operations per coefficient. Using the alternative representation, the result could be calculated in three steps by a * f1, (a * f1) * f2, and a * f3, leading to only (df 1 + df 2 + df 3)*N = 6777 operations per coefficient.

180

F. Hu et al.

Third, operating under the assumption that construction of a message using a binary small modulus can simplify the multiplication process. This in fact can be achieved through efficient multiplication of a binary polynomial with a large modulus reduced polynomial by representing the binary polynomial with a vector of positions of the non-zero elements. While such an approach might be applicable to a larger modulus, the efficiency of storing the positions of non-zero elements would be reduced with the need to store what value the non-zero elements are. Optimizations can also be made to perform faster reduction of certain classes of moduli, such as Mersenne primes [27], which are of the form p = 2x − 1. An example of a fast algorithm for reduction of Mersenne primes is as follows: Modular inversion of integers is used during key generation in the NTRU system depending on the choice of inversion used for polynomials. Polynomial inversion using the Extended Euclidean Algorithm requires an integer modular inversion per iteration and one final inversion to calculate the result. For smaller moduli, the inverse can often be easily stored in a lookup table, however, the Extended Euclidean Algorithm can also be used for large moduli. To calculate the inverse modulo the power of a prime, an algorithm based on Newton’s iteration is presented in [12, 27]. Although the algorithm is presented for convolution polynomials, the same method is applicable to integers as well. 5.2. Parallelism Operations in the Arithmetic Units To improve NTRU throughput at circuit level, two possible approaches – parallelization and pipelining of the Arithmetic Units (AUs) are presented in Figure 14. Adding memory elements (registers) to the inputs and outputs of the AUs will allow the use of multiple instances of AU component (between 2 and K (K

Security in Ad-hoc and Sensor Networks (Computer and Network Security)

Trust and Security in Collaborative Computing (Computer and Network Security)

Guide to Computer Network Security (Computer Communications and Networks)

Network and System Security

Wireless Sensor Network Security (Cryptology and Information Security) (Cryptology and Information Security)

Computer Network Security. Theory and Practice

Computer, Network & Internet Security

Computer, Network & Internet Security

Guide to Computer Network Security

Security of e-systems and computer networks

Security of e-Systems and Computer Networks

Computer Security and Cryptography

Computer Security and Cryptography

Network security

Network Security Principles and Practices

Internet Firewalls and Network Security

Network security principles and practices

Network Security Policies and Procedures

Network Security Technologies and Solutions

Internet Firewalls and Network Security

Internet Firewalls and Network Security

Mobile and Wireless Networks Security

Network Security Policies and Procedures (Advances in Information Security)

Handbook of Security and Networks

Firewall Design and Analysis (Computer and Network Security)

Security and privacy in social networks

Wireless and Mobile Network Security: Security Basics, Security in On-the-shelf and Emerging Technologies

Computer Security: Art and Science

Computer and information security handbook

Computer and information security handbook

Security in Ad-hoc and Sensor Networks (Computer and Network Security)

Trust and Security in Collaborative Computing (Computer and Network Security)

Guide to Computer Network Security (Computer Communications and Networks)

Network and System Security

Wireless Sensor Network Security (Cryptology and Information Security) (Cryptology and Information Security)

Computer Network Security. Theory and Practice

Computer, Network & Internet Security

Computer, Network & Internet Security

Guide to Computer Network Security

Security of e-systems and computer networks

Security of e-Systems and Computer Networks

Computer Security and Cryptography

Computer Security and Cryptography

Network security

Network Security Principles and Practices

Internet Firewalls and Network Security

Network security principles and practices

Network Security Policies and Procedures

Network Security Technologies and Solutions

Internet Firewalls and Network Security

Internet Firewalls and Network Security

Mobile and Wireless Networks Security

Network Security Policies and Procedures (Advances in Information Security)

Handbook of Security and Networks

Firewall Design and Analysis (Computer and Network Security)

Security and privacy in social networks

Wireless and Mobile Network Security: Security Basics, Security in On-the-shelf and Emerging Technologies

Computer Security: Art and Science

Computer and information security handbook

Computer and information security handbook

Recommend Documents