Download presentation

Presentation is loading. Please wait.

Published byKathy Spire Modified over 4 years ago

1
Self-Healing in Wireless Networks

2
The self-healing property is expected in many aspects in wireless networks: – Encryption algorithms – Key distribution mechanisms – System protection

3
3 Overview of the DES A block cipher: – encrypts blocks of 64 bits using a 64 bit key – outputs 64 bits of ciphertext A product cipher – basic unit is the bit – performs both substitution and transposition (permutation) on the bits Cipher consists of 16 rounds (iterations), each with a 48-bit round key generated from the 64-bit key

4
4 Generation of Round Keys Round keys are 48 bits each

5
5 Encipherment

6
6 The f Function

7
7 S-Box – There are eight S-Box, each maps 6-bit input to 4- bit output – Each S-Box is a look-up table – This is the only non-linear step in DES and contributes the most to its safety P-Box – A permutation

8
8 DES Modes Electronic Code Book Mode (ECB) – Encipher each block independently Cipher Block Chaining Mode (CBC) – Xor each plaintext block with previous ciphertext block – Requires an initialization vector for the first one – The initialization vector can be made public Encrypt-Decrypt-Encrypt Mode (2 keys: k, k) Encrypt-Encrypt-Encrypt Mode (3 keys: k, k, k )

9
9 CBC Mode Encryption init. vector m1m1 DES c1c1 m2m2 c2c2 sent … … …

10
10 CBC Mode Decryption init. vector c1c1 DES m1m1 … … … c2c2 m2m2

11
11 Self-Healing Property What will happen if a bit gets lost during transmission? – All blocks will not be aligned When one bit in a block flipped, only the next two blocks will be impacted. – Plaintext “heals” after 2 blocks

13
13 Stateless and self-healing key distribution – In wireless network, the packets can get lost because of various reasons – We cannot encrypt the new key with the previous key – Revocation capability: forward and backward secrecy – Stateless and self-healing key distribution – Resilient to collusion

14
14 In secure multicast, group keys are updated periodically – Reduce impacts of key compromise – Adapt to group member changes – How to distribute keys over unreliable channel Self-healing – A user may recover the lost packet by combining information before and after the packet (imagine a sandwich)

15
15 Approach: polynomial based – t: resilience to collusion – m: the number of sessions – R j : set of users that are revoked in session j – Manager seeks to distribute group key and personal key to each user over a broadcast channel

16
16 Approach 1: self healing but not revocation – Generate 3m t-degree polys: H 1 to H m, L 1 to L m, and P 1 to P m – Generate m session keys K 1 to K m – For session j, with both P j and K j, we can calculate Q j = K j – P j – Every node i gets the values H 1 (i)+L 1 (i), H 2 (i)+L 2 (i), - --, H m (i)+L m (i)

17
17 At session j, the manager broadcasts H 1 +P 1, ---, H (j-1) +P (j-1), H j +P j, L j +Q j, L (j+1) +Q (j+1), ---, L m +Q m Every node i can evaluate H j (i)+L j (i)+K j and recovers K j At the same time, the node will get H 1 (i)+P 1 (i), H 2 (i)+P 2 (i), ---, H (j-1) (i)+P (j-1) (i), L (j+1) (i)+Q (j+1) (i), ---, L m (i)+Q m (i) Self healing is possible since K j = P j (i)+Q j (i)

18
18 Problem: – We can easily add new nodes: just give it the values H j (i)+L j (i) – However, we cannot kick nodes out: no revocation – To support revocation, we cannot always use the same group of covering functions

19
19 Revocation – t-revocation capability – Manager generates a large number N, and a t- degree bi-variate polynomial s(x, y) – Every node gets N and s(i, i) – We want to distribute f(i) to every node i if it is still in the group, where f(x) is a t-degree poly – The group of revoked nodes are: w1, w2, ---, wt

20
20 Manager broadcasts: – f(x)+s(N, x) and {wj, s(wj, x)} (j=1 to t) – For every non-revoked node i, it can calculate s(wj, i), which is a value on the polynomial s(x, i). It can get t shares. – Together with s(i, i), it can recover s(x, i) – Node i can calculate s(N, i), and recover f(i) – All revoked nodes only get t shares, and cannot recover the polynomial

21
21 Advantages – Every node gets a personal key – Can be combined with the self-healing approach – The broadcast overhead is O(t^2), and has nothing to do with the size of the network – Problem: we need t revoked nodes (or fake IDs)

23
23 Efficient self-healing key distribution and revocation – A novel personal key distribution approach – Drastically reduce communication and storage overhead compared to the previous approach – Still t revocation – Still based on polynomials

24
24 A personal key distribution mechanism – For a t-degree poly f(x), we want to provide f(i) only to node i – Each legal member gets a different personal key – Revoked members cannot get their shares – Through true broadcast – Need a revocation poly and masking poly

25
25 Notations: – f(x): key share polynomial (t-degree) – g(x): revocation polynomial (up to t degree) – h(x): masking function (2t degree) Every node gets h(i) during initiation. Group manager broadcasts f(x) * g(x) + h(x) and the revoked nodes. Construct g(x) based on revoked nodes

26
26 How does a legal node recover the personal key share? Why a revoked node cannot? It is robust against up to t colluders. Advantages: – Communication overhead is only O(t) – Storage overhead is constant – Do not need fake IDs

27
27 Self-healing with revocation capability – Split each session key into two parts – Support self-healing property

28
28 If the network lifetime is m session – We generate m(m+1) 2t-degree masking function h i,j (x). So every session we have m+1 masking function – Each node v gets the values h i,j (v) during initiation – For the session key Ki = p i (x) + q i (x), where p and q are t-degree polys

29
29 In session j, the manager broadcasts – The revoked set Rj – g j (x) * p i (x) + h j, i (x), i = 1 to j – g j (x) * q i (x) + h j, i (x), i = j to m Every non-revoked node v will recover p 1 (v) to p j (v), and q j (v) to q m (v) The revoked nodes cannot

30
30 The nodes need to store m(m+1) values The broadcast message has the size of O(mt). And the previous approach has O(mt^2) Disadvantage – The set of revoked nodes is monotonic.

31
31 Reducing the storage overhead – The previous approach needs m(m+1) masking functions, so every node needs to store m(m+1) values – In fact, 2m masking functions are enough: m functions for the p share of the key, and m functions for the q share of the key

32
32 Reducing communication overhead – For short term network partition, we do not need the node to recover a key used long time ago.

Similar presentations

© 2020 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google