1. Efficient Distribution of Key Chain Commitments for Broadcast Authentication in Distributed Sensor Networks
Donggang Liu and Peng Ning
Department of Computer Science
NC State University
CSC 774 Adv. Net. Security

2. Background Sensor Networks
One or a few more powerful base stations and a potentially large number of sensor nodes
Inexpensive
Limited resources (computational power, memory space, energy, etc.)
When security is a concern, it is necessary for the sensors to authenticate messages received from base stations.
CSC 774 Adv. Net. Security

3. Ki=F(Ki+1), F: pseudo random function
TESLA
A variation of TESLA
Based on symmetric cryptography
Provide broadcast source authentication by delayed disclosure of authentication keys
Authentication of messages depends on the authenticity of the key chain commits K0.
commitment
Ki=F(Ki+1), F: pseudo random function
Authentication Keys K4 F K3 K2 K1 K0
Kn= R
Divide time into time intervals; associate one key with each interval; keys are chained together via a pseudo random function; distribute the last one of the key chain to the receivers a head of the first interval.
Authenticate messages in a time interval with the corresponding key; do not disclose the authentication key until after a predefined delay.
Security condition: if a receiver gets the messages before the corresponding key is disclosed, it buffers the messages. It then authenticates the buffered messages after receiving the corresponding key. …
Time
Key Disclosure K1 K2
Kn-2
CSC 774 Adv. Net. Security

4. Distribution of Key Chain Commits
TESLA
Digital signatures: Too expensive for sensors
Use the current keys to authenticate the commitment of the next key chain.
Attractive targets for attackers.
Loss of commitment distribution messages  loss of the next key chain  bootstrap again.
New commit K0’
Old key Kn
Old key chain
New key chain
CSC 774 Adv. Net. Security

5. Distribution of Key Chain Commits (Cont’d)
TESLA
Unicast-based secure communication with the base station.
Do not scale to large networks
CSC 774 Adv. Net. Security

6. Techniques Multi-level TESLA Five Schemes
Predetermination and broadcast instead of unicast.
Use high-level key chain to authenticate commitments of low-level key chains.
Tolerate communication failures and malicious attacks.
Five Schemes
Each later scheme improves over the previous one by addressing its limitations.
The final scheme
Low overhead
Tolerate message losses
Scalable to large networks
Resistant to replay attacks and DOS attacks.
CSC 774 Adv. Net. Security

7. Scheme I: Predetermined Key Chain Commitment
Predetermine the TESLA parameters along with the master key distribution
commitment
start time
other parameters
Shortcomings
Long key chain or large time interval?
Difficulties in setting up start time
CSC 774 Adv. Net. Security

8. Scheme II: Naïve Two-Level Key Chains
One high-level key chain and multiple low-level key chains
High-level key chain
Authenticate commitments of low-level key chains
Done through broadcast of Commit Distribution Messages (CDM)
Low-level key chains
Authenticate actual data messages
CSC 774 Adv. Net. Security

9. Scheme II (Cont’d) The two-levels of key chains
Beginning of each high-level interval is denoted as T_{i}.
Since the high-level interval is usually long, we use t+delta_{max} < T_{i+1} as the security condition.
Disclosure lag in the low-level key chains are determined in the same way as TESLA.
Immediate authentication.
CDMi-1=i|Ki,0|H(Ki+1, 0)|MACK’i-1(i|Ki, 0|H(Ki+1, 0 ))|K i-2
CDMi=i|Ki+1,0|H(Ki+2 ,0)|MACK’i(i|Ki+1 ,0|H(Ki+2 ,0 ))|K i-1
CSC 774 Adv. Net. Security

10. Scheme II (Cont’d)
Key disclosure schedule
CSC 774 Adv. Net. Security

11. Scheme II (cont’d) Limitations
Loss of CDM message during high-level interval Ii 
unable to authenticate during Ii+1
Loss of the last several low-level keys 
unable to authenticate the corresponding messages.
CSC 774 Adv. Net. Security

12. Scheme III: Fault Tolerant Two-Level Key Chains
Tolerate CDM message loss:
Periodically broadcast CDM messages
Assume
Probability that a receiver lose a CDM message: pf
Broadcast frequency: F,
Duration of a high-level interval: 0
Reduce loss rate to
Increase overhead by F0 times
Tolerate normal message loss:
Connect the low-level key chains and the high-level key chain
CSC 774 Adv. Net. Security

13. CDMi=i|Ki+1,0|H(Ki+2 ,0) |MACK’i(i|Ki+1 ,0|H(Ki+2 ,0 ))|K i-1
Scheme III (Cont’d)
CDMi=i|Ki+1,0|H(Ki+2 ,0) |MACK’i(i|Ki+1 ,0|H(Ki+2 ,0 ))|K i-1
CSC 774 Adv. Net. Security

14. CDMi=i|Ki+1,0|H(Ki+2 ,0) |MACK’i(i|Ki+1 ,0|H(Ki+2 ,0 ))|K i-1
DOS attacks
CDM messages are more attractive to attackers
DOS attacks against CDM messages
Selective jamming
Smart attacks: only change certain fields in CDM messages 
A receiver cannot discard the messages until it gets the corresponding disclosed key
1. We need at least one later CDM message that contains the authentic disclosed key to verify an earlier CDM message.
2. In order to have immediate authentication of low-level key commitment for interval i, we need at least an authentic CDM message for interval I-2, and a CDM message for interval I-1 that contains the authentic disclosed key.
CDMi=i|Ki+1,0|H(Ki+2 ,0) |MACK’i(i|Ki+1 ,0|H(Ki+2 ,0 ))|K i-1
Image of
Low-level Key Chain
Commitment for Ii+1
Disclosed High-level
Key for Ii-1
Low-level Key Chain
Commitment for Ii+1
MAC
CSC 774 Adv. Net. Security

15. Scheme IV: (Final) Two-Level Key Chains
Randomize CDM distribution to mitigate selective jamming attacks
We assume there are other methods to deal with constant jamming.
Random selection strategy to mitigate smart DOS attacks
Single buffer random selection
Multiple buffer random selection
CSC 774 Adv. Net. Security

16. Scheme IV (Cont’d) Single buffer random selection
Assume each sensor has one buffer for CDM
Initial verification to discard forged CDMi
Authenticate disclosed high-level key.
Authenticate Ki+1,0 if CDMi-1 is authenticated.
For the k-th copy of CDMi that passes the initial verification
Save it in the buffer with probability 1/k.
All such copies have equal probability to be saved.
The probability that a sensor has an authentic CDM
P(CDMi) = 1  p, where
CSC 774 Adv. Net. Security

17. Scheme IV (Cont’d) Multiple buffer random selection
Assume each sensor has m buffers for CDM
Initial verification to discard forged CDMi
Same as before.
For the k-th copy of a CDMi that passes the initial verification
k  m  save it in one available buffer.
k > m  save it in a randomly selected buffer with probability m/k;
All such copies have equal probability to be saved.
The probability that the sensor has an authentic CDM
P(CDMi) = 1  pm, where
CSC 774 Adv. Net. Security

18. Scheme V: Multi-Level Key Chains
m levels of key chains, arranged from level 0 to level m-1 from top down.
Keys in level m-1 are used for authenticating data
Each higher-level key chain is used to authenticate the commitments for its immediately lower-level key chains.
Every two adjacent levels work in the same way as in Scheme IV.
More need to be added here.
CSC 774 Adv. Net. Security

19. Simulation Study Network model Parameters
Emulate broadcast channel over IP multicast
One base station
One attacker
Multiple sensor nodes
Sensors are one-hop neighbors of the base station and the attacker
Parameters
Channel loss rate
Percentage of forged CDM packets
Buffer size at sensors (data packets and CDM packets)
CSC 774 Adv. Net. Security

20. Simulation Study (Cont’d)
Metrics
%authenticated data packets at a sensor node (#authenticated data packets/received data packets)
Average data authentication delay (the average time between the receipt and the authentication of a data packet).
CSC 774 Adv. Net. Security

21. Experimental Results Buffer allocation schemes 95% forged CDM
1 CDM buffers
Multi-buffer random selection.
A data packet has 65 bytes: header (1), index (8), data (40), MAC (8), disclosed key(8). 8 buffers = 448 bytes --> 4 CDM buffers.
56 bytes to store.
A CDM has 41 bytes: header (1), level number and an index (1), next commitment (8), hash of next next commitment (8), MAC (8), disclosed key (8).
For each CDM, 40 bytes for the firs copy, and 8 bytes for the later copies.
1 CDM buffers
CSC 774 Adv. Net. Security

22. Experimental Results (Cont’d)
39 CDM buffers
3 data buffers
%authenticated data packets
95% forged
CDM
CSC 774 Adv. Net. Security

23. Experimental Results (Cont’d)
Average data packet authentication delay
39 CDM buffers
3 data buffers
CSC 774 Adv. Net. Security

24. Conclusion
Developed a multi-level key chain scheme to efficiently distribute commitments for TESLA
Low overhead
Tolerance of message loss
Scalable to large networks
Resistant to replay attacks and DOS attacks
Future work
Reduction of the long delay after complete loss of CDM
Broadcast authentication involving multiple base stations
Adaptive approach to dealing with the DOS attacks
CSC 774 Adv. Net. Security

25. Thank You!
CSC 774 Adv. Net. Security