Presentation is loading. Please wait.

Presentation is loading. Please wait.

Distributed Multiple Secret Key Management for Cluster-based Ad Hoc Networks 分散式多重密鑰管理機制應用於群集 隨意型網路 長庚大學通識中心 李榮宗.

Similar presentations

Presentation on theme: "Distributed Multiple Secret Key Management for Cluster-based Ad Hoc Networks 分散式多重密鑰管理機制應用於群集 隨意型網路 長庚大學通識中心 李榮宗."— Presentation transcript:

1 Distributed Multiple Secret Key Management for Cluster-based Ad Hoc Networks 分散式多重密鑰管理機制應用於群集 隨意型網路 長庚大學通識中心 李榮宗

2 Outline Introduction Background Distributed ID-based multiple secret key management scheme (IMKM) Conclusion 2

3 Introduction Ad-hoc networks and security concerns Authenticated key management protocols Scope of the work Summary of contributions 3

4 Ad-hoc networks and security concerns A mobile ad hoc network (MANET) is an autonomous system of mobile nodes connected through wireless links 4

5 Ad-hoc networks and security concerns (Cont’d) A cluster is a connected graph including a clusterhead (CH) responsible for establishing and organizing the cluster 5 1 2 3 6 5 4 7 8 Cluster head Gateway Node

6 Ad-hoc networks and security concerns (Cont’d) Deploying security mechanisms in MANETs is difficult Absence of fixed infrastructure Shared wireless medium Node mobility Limited resources of mobile devices Bandwidth-restricted Error-prone communication links 6

7 Ad-hoc networks and security concerns (Cont’d) Ad hoc networks are subject to various kinds of attacks Passive eavesdropping Active impersonation Message replay Message distortion key management is particularly difficult to implement in such networks 7

8 Authenticated key management protocols Threshold sharing-based key management with distributed authorities Session key management protocols Two-party authenticated key management protocols Multi-party authenticated key management protocols 8

9 Authenticated key management protocols (Cont’d) Threshold sharing-based key management with distributed authorities Using (t,n) threshold scheme Certificate exchanges consumes much bandwidth Does not provide verifiablity When t shareholders are compromised, the overall system security is broken 9

10 Authenticated key management protocols (Cont’d) Session key management protocol Two-party authenticated key management protocols by bilinear pairings Based on Discrete logarithm problems over elliptic curve groups Is not secure against key revealing attacks Does not provide perfect forward secrecy 10

11 Authenticated key management protocols (Cont’d) Multi-party authenticated key management protocols by bilinear pairings Suffers from the man-in-the-middle attack Suffers from the impersonation attack Disadvantages in number of rounds, pairing- computation and communication bandwidth 11

12 Scope of work In this paper, we address key management issues in cluster-based mobile ad hoc networks We present a fully distributed ID-based multiple secret key management scheme (IMKM) as a combination of ID-based, multiple secret and threshold cryptography ID-based approach eliminates the need for certificate-based public-key distribution 12

13 Scope of work (Cont’d) Multiple secret key update scheme enhances system security and eliminate communication and computation overhead for key update Fully distributed threshold secret sharing scheme solves the single point of failure and compromise tolerance problems Cluster-based mechanism reduces routing overhead and provides more scalable solutions 13

14 Summary of contributions Our IMKM scheme provides complete and solid solutions for key management The overall system security is still guaranteed even when t shareholders are compromised in IMKM. When the network becomes sparse, it is quite difficult to collect t shares to reconstruct the secret. However, it is easy to adjust threshold t in IMKM which makes the system more robust and reliable. 14

15 Background Symmetric and public key cryptography Elliptic curve cryptosystems (ECC) Legrange interpolation polynomial Threshold sharing scheme Shuffling scheme Security schemes for attacks 15

16 Symmetric key and public key cryptography Symmetric key The same key is used to do both encryption and decryption. Advantages: efficient, easy to use Disadvantages: less secure than public key, problem of sharing keys Ex: DES, RC6, MD5, SHA-1, etc. 16

17 Symmetric key and public key cryptography (Cont’d) Public key Motivated by three limitations of symmetric key cryptography, that is, key delivery, key management and user authentication Advantages: encryption is stronger than symmetric key Disadvantages: much processing power, much longer data files are create and transmitted Ex: RSA, ElGamal, ECC, etc. 17

18 Elliptic curve cryptosystems (ECC) Based on the difficulty of solving elliptic curve discrete logarithm problem (ECDLP) (Ex: Q = kP) Smaller key sizes Low communication cost Faster implementation For resource-constrained environments, such as smart cards, and wireless devices 18

19 Elliptic curve cryptosystems (ECC) (Cont’d) RSA & ElGamal Key length ( bits ) ECC Key length ( bits ) Necessary Computing workload ( MIPS ) The ratio of key length 51210610 4 5:1 76813210 8 6:1 102416010 12 7:1 204821010 20 10:1 2100060010 78 35:1 Security comparisons of RSA, ElGamal and ECC 19

20 Legrange interpolation polynomial Given points, where are distinct. Seek a polynomial with degree such that 20

21 Legrange interpolation polynomial (Cont’d) The Lagrangian interpolating polynomial is given by: where n in stands for the nth order polynomial that approximates the function given at data points as and is a weighting function that includes a product of terms with terms of omitted 21

22 Legrange interpolation polynomial (Cont’d) Given a set of three data points {(0,3),(1,9),(2,21)}, we shall determine the Lagrange interpolation polynomial of degree 2 which passes through these points. First, we compute Lagrange interpolation polynomial is: 22

23 Threshold sharing scheme The dealer chooses, and random polynomial Suppose the unique ID of each user is,, then the shares of each user are: That is the polynomial passes through points (1,9), (2,4), (3,5), (4,12), (5,8) 23

24 Threshold sharing scheme (Cont’d) After combining t shares (ex. S 1, S 3, S 5 ), the original polynomial can be reconstructed by using the Legrange interpolation as follows: 24

25 Shuffling scheme To prevent the exposure of shares, the shuffling scheme is introduced First, each pair of nodes (i, j) securely exchange a shuffling factor d i,j One node in the pair adds d i, j to its partial share while the other one subtracts d i, j For node i, it must apply all t −1 shuffling factors, either by adding or subtracting, to its partial share 25

26 Shuffling scheme (Cont’d) When a new member k joins the secret sharing network The shuffled partial share is generated as where and After receives t shuffled partial shares, node k recovers its share as: 26

27 Intrusion detection system (IDS) - Unwanted manipulations to systems Watchdog - Selfish behavior Packet leashes - Wormhole attack Rushing attack prevention (RAP) - Denial of service attack 27 Security schemes for attacks

28 Distributed ID-based multiple secret key management scheme Design goals and system models Network initialization Key revocation Multiple secrets key update scheme Key joining, key eviction Group key agreement protocol Protocol analysis 28

29 Design goals and system models Design goals It must not have a single point of compromise and failure It should be compromise-tolerant Efficiently and securely revoke keys of compromised nodes once detected and update keys of uncompromised nodes Efficient schemes to generate group session key 29

30 Design goals and system models (Cont’d) System models We envision a cluster-based MANET consisting of n clusterheads (CHs) called D-PKGs, D-PKGs are selected to enable secure and robust key revocation and update If a cluster-based routing protocol is used, the clusters established by the routing protocol can also be employed in our security conceptualization The size of the network may be dynamically changing with CH join, leave, or failure over time. 30

31 Design goals and system models (Cont’d) Each CH i has a unique ID, denoted by ID i Communications are potentially insecure and error- prone We assume that compromised CHs will eventually exhibit detectable misbehavior We also assume that adversaries compromise no more than out of n CHs simultaneously, where Nor can adversaries break the underlying cryptographic primitive on which we base our design 31

32 Network initialization Generation of pairing parameters and key initiation System setup: PKG (Private key generator) chooses a random number as the PKG’s private key. is the PKG’s public key. The system parameters of PKG are as follows: 32

33 Network initialization (Cont’d) Key extraction: CH i submits his identity information to PKG. PKG computes and CH i ’s public and private key pair:, PKG preloads the key pair and system parameters on securely. 33

34 Generation of pair–wise keys In order to provide perfect forward secrecy, we modified McCullagh and Barreto’s scheme as follows: 1) Each CH i randomly chooses his ephemeral key, computes and sends to CH j. 2) After exchange the ephemeral values, all CHs can compute their pair–wise keys: 34

35 Generation of pair–wise keys (Cont’d) The above pair-wise key agreement protocol satisfies all the following security properties : Implicit key authentication, Known session key security, No key-compromise impersonation, Perfect forward secrecy, No unknown key-share, No key control. Therefore, it is secure employed in MANETs. 35

36 Verifiable secret sharing 36

37 Verifiable secret sharing (Cont’d) 1) Each CH i, creates a (t,n) threshold sharing of a i,0 by generating a random polynomial of degree t-1 over, as: 2) Each CH i computes and securely sends an encrypted subshare,, to CH j, using pair-wise key. 3) Each CH i broadcasts public values 4) Each CH j verifies that subshare by checking that 37

38 Verifiable secret sharing (Cont’d) 5) Each CH j computes its share key, and broadcasts public key Any subset,, of size t CHs, can determine the master secret key:, where The public key,, of the master secret key, can be generated from any t CHs’ public keys: 38

39 Key revocation The key revocation scheme is comprised of three sub-processes: Misbehavior notification Revocation generation Revocation verification 39

40 Misbehavior notification Upon detection of CH i ’s misbehavior, CH j generates an accusation,, against CH i Securely transmits it to CH v is a time stamp used to withstand message replay attacks is the pair-wise key of CH j and CH v 40

41 Revocation generation When the number of accusations reaches a predefined revocation threshold, t norml CH j, having the smallest IDs, generates a partial revocation, Each CH j sends it to the revocation leader securely The revocation leader checks whether the equation holds. 41

42 Revocation generation (Cont’d) The revocation leader can construct a complete revocation from these partials using Lagrange interpolation: The revocation leader then floods throughout the network to inform others that CH i has been compromised. 42

43 Revocation verification Upon receipt of, each clusterhead verifies it by checking whether the equation holds This means that has been correctly accumulated from all other t-1 unrevoked CHs Each clusterhead then records in its key revocation list (KRL) and declines to interact with it thereafter. 43

44 Multiple secrets key update scheme To resist cryptanalysis, it is a good practice to update keys frequently. At each regular predetermined time interval, updates each CH’s share key,, to by replacing the generator,, with of Key update is quite simple and efficient 44

45 Key joining Scheme I Each CH j creates a new subshare,, and securely sends it to CH k. CH k constructs its share as: CH k creates a (t,n) threshold sharing of by generating a random polynomial of degree, t-1, and securely sends to each CH j. Upon receiving from CH k, each CH j reconstructs the share key, 45

46 Key joining (Cont’d) Scheme II (shuffling scheme) Each CH j generates the partial share for CH k :, where is the Lagrange coefficient, and, where and is the shuffling factor. The shuffled share,, is then returned to CH k. After receiving t partial shares, CH k can construct its share,. 46

47 Key eviction When CH k is revoked, and the number of revoked CHs reaches the predetermined update threshold : Each CH i chooses a random number,, changes its share,, to and securely sends to all unrevoked CH j After receiving all values, each CH j reconstructs the share key, 47

48 Group key agreement protocol We presented an efficient ID-based authenticated group key agreement (AGKA) protocols Scheme Each CH i randomly chooses an ephemeral key, L i. Each CH i constructs a Lagrange interpolating polynomial with degree n-1, as follows: Each CH i then broadcasts 48

49 Group key agreement protocol (Cont’d) Group key computation Each CH j uses the pair–wise session keys,, to recover keys, L i, using the following equation: After recovering all the keys, L i, each CH j computes the group session key as follows: Member leave Reprocesses AGKA protocol 49

50 Protocol analysis Security analysis Share key distribution Group key distribution Performance analysis Comparison in key update Verifiable secret sharing Comparison in group key distribution 50

51 Security analysis Share key distribution We compare the security of IMKM to that of RCBC(MOCA, URSA, AKM) and IBC-K. These five approaches are all based on threshold schemes (robust). When compromised t CHs, the CA’s (RCBC) private key, or the PKG’s (IBC-K) master secret key will be revealed. 51

52 Security analysis (Cont’d) The overall system security is still guaranteed even when t shareholders are compromised in IMKM. With IMKM, even compromise of the PKG does not reveal the master secret key. In summary, IMKM outperforms RCBC and IBC-K with respect to security. 52

53 Security analysis (Cont’d) Group key distribution The proposed authenticated group key agreement (AGKA) protocol satisfies the following security attributes: Implicit key authentication Known session key security Backward and forward secrecy No key-compromise impersonation No unknown key-share 53

54 Performance analysis We compare our IMKM with RCBC, with respect to key updates For RCBC, the duration spans from the first point of contact between a node and random D-CAs, to the point where the last node completes its key update. For IMKM, the key eviction process starts when the revocation leader broadcasts a key update message to other D-PKGs (CHs) and finishes after all the D- PKGs have exchanged the key update materials. 54

55 Performance analysis (Cont’d) Speed (m/s) Network cluster size 10203040 53.7298.10616.17427.977 104.0299.03216.59429.741 153.9649.61317.10330.241 RCBC key update avg completion time (sec) IMKM key update avg completion time (sec ) Speed (m/s) Network cluster size 10203040 599.986132.292149.857198.699 10100.352131.788150.51199.69 1599.09132.439150.489200.767 The key update time includes packet transmission time and all cryptographic processing time. 55

56 Performance analysis (Cont’d) We also count the key update bandwidth overhead in terms of number of messages and bytes. It should be noted that overhead is similar at all mobility speeds, suggesting that both schemes are robust to mobility. 56

57 Performance analysis (Cont’d) 57

58 Performance analysis (Cont’d) 58

59 Performance analysis (Cont’d) Performance of verifiable secret sharing 59

60 Comparison in group key distribution ProtocolRoundScalarPairingsBandwidth Barua’s ID-AGKA<5n(n-1) Du’s ID-AGKA2n(n+5)4n3(n-1) Lin’s AGKA2n2n IMKM Scheme 1nNonen Table 5.4 Comparison of AGKA protocols - Round: The total number of rounds. - Scalar: The total number of scalar multiplications in G 1. - Pairings: The total number of pairing computations. - Bandwidth: The total number of messages sent by CHs. 60 Performance analysis (Cont’d)

61 Conclusion We have proposed a secure, efficient, and scalable distributed ID-based multiple secrets key management scheme (IMKM) for cluster- based MANETs. IMKM is a complete and solid solution for key management, which includes share key, pair- wise key and group key distribution. 61

62 Conclusion (Cont’d) The master secret key is generated and distributed by all clusterheads which leads to more autonomous and flexible key update methods. The proposed IMKM scheme improves on the security and performance of previously proposed key management protocols (i.e., RCBC and IBC-K) for MANETs. 62

63 Conclusion (Cont’d) Besides, we presented an efficient one round ID-based authenticated group key agreement protocols, which minimize the number of rounds and bandwidth usage, as well as satisfies all primary security concerns. 63

64 Thanks! 64

65 Conclusion and future works (Cont’d) Future Works 1) It is very communicationally efficient for constructing a polynomial that passes existing points. But how to update group keys when users leave in MANETs is an unsolved problem. 2) Sybil attack, which is an identity-based attack, and so far, no practical defence has been developed against such attacks for MANETs. 65

66 Conclusion and future works (Cont’d) 3) Multivariate cryptography is faster than RSA and ECC. Which is considered to be the dominant form of cryptography in the 21st century. 66

67 67

68 68

69 69

70 70

71 71

Download ppt "Distributed Multiple Secret Key Management for Cluster-based Ad Hoc Networks 分散式多重密鑰管理機制應用於群集 隨意型網路 長庚大學通識中心 李榮宗."

Similar presentations

Ads by Google