1. A Mechanism for Communication- Efficient Broadcast Encryption over Wireless Ad Hoc Networks Johns Hopkins University Department of Computer Science Reza Curtmola Seny Kamara

2. WCAN 20062 / 23 The problem Secure content distribution (SCD) in MANETs –source disseminates data to a group of authorized receivers –group is dynamically changing due to revocation and addition of users

3. Seny KamaraWCAN 20063 / 23 Secure content distribution network layer: delivery of data  secure multicast routing application layer: secrecy of data  broadcast encryption

4. Seny KamaraWCAN 20064 / 23 The Setting MANETs –low bandwidth –lossy links –mobility

5. Seny KamaraWCAN 20065 / 23 Broadcast Encryption (BE) BE deals with methods to efficiently broadcast information to a group of authorized users A center broadcasts messages, but only a set of privileged users can decrypt them Dynamically changing group of users

6. Seny KamaraWCAN 20066 / 23 Two flavors of BE Stateful –Users receive initial secrets –Revocation and addition require re-keying –Nodes need to be online to receive key updates Stateless –Users receive initial secrets –No re-keying message sizestorage at the receiver key update size StatefulO(1)O(log n) StatelessO(r)O(1)N/A

7. Seny KamaraWCAN 20067 / 23 Stateful vs. Stateless Simple scenario: –n = # of users r = # of revocations –l = size of each message k = size of session key –d = # of messages between two revocations Stateless Stateful message Key Update revocation

8. Seny KamaraWCAN 20068 / 23 Stateful vs. Stateless Transmission cost: –stateful: O(r·d·l + r·log(n) ·k) –stateless: O(r·d·l + d·r 2 ·k) When r = Ω(log n), stateful is better than stateless (e.g. for n=1024, after r=10 revocations, stateful is more efficient)

9. Seny KamaraWCAN 20069 / 23 Limitations of MANETs Limited bandwidth favors the use of stateful BE Standard application of stateful BE is not possible Key updates may be lost: –lossy links –network partitions caused by node mobility –receivers go offline How to still take advantage of the low communication cost of stateful BE? Reliable message delivery!

10. Seny KamaraWCAN 200610 / 23 Reliable message delivery interactive solutions –scalability and connectivity issues –undesirable Focus of this talk: –a mechanism for non-interactive reliable message delivery –application to stateful BE in MANETs

11. Seny KamaraWCAN 200611 / 23 Reliable message delivery scalability storage per node recovery time scalability – rules out interactive solutions simple non-interactive solution: –connected nodes store all messages from the source –disconnected nodes need to encounter one node –high storage requirement per node: r · q bits

12. Seny KamaraWCAN 200612 / 23 Reliable message delivery – our approach Each node stores a “piece” of the message Partitioned nodes can leverage node mobility to recover missed messages Mechanism based on erasure codes Allows trade-off between: –message recovery time –amount of storage at each node Mobility is crucial and beneficial

13. Seny KamaraWCAN 200613 / 23 Erasure codes C has minimum distance d (m can be recovered from any λ – d + 1 symbols of c) examples: Reed-Solomon codes, Tornado codes 123… l message m encode 123… λ codeword c decode 123… l message m

14. Seny KamaraWCAN 200614 / 23 Example

15. Seny KamaraWCAN 200615 / 23 Recovery Time Each node stores a symbol uniformly at random How many encounters are needed (on average) – to recover a message? –to recover multiple messages?

16. Seny KamaraWCAN 200616 / 23 Recovery Time - single message Symbols are equally dispersed throughout network Symbols are uniformly distributed over network Each encounter is equivalent to sampling a symbol uniformly at random Coupon collector’s problem –Uniform distribution of n elements –Number of samples to collect all n elements

17. Seny KamaraWCAN 200617 / 23 Recovery Time - single message Expected recovery time as a func. of symbols Expected recovery time as a func. of storage

18. Seny KamaraWCAN 200618 / 23 Take stateful BE scheme (e.g., LKH) Distribute key updates with RMDM Instantiated with Rejoining node needs to encounter (on average) at most –Each node stores σ bits –n = 1024, k = 128,  = 160 (20 bytes) E[T] = 11 Reliable Stateful Broadcast Encryption Size of symbol Size of key update

19. Seny KamaraWCAN 200619 / 23 Advantages of our solution leverages mobility to achieve reliable message delivery allows trade-off between message recovery time and node storage ability to leverage the resources of unauthorized nodes

20. Seny KamaraWCAN 200620 / 23 Simulation Setup node density varied between 50-200 nodes / km 2 nodes randomly placed within a 1500 x 1500 meter square area random way-point mobility model node maximum speed varied between 2 and 20 m/s

21. Seny KamaraWCAN 200621 / 23 Experiments Time required to encounter one node Time required to encounter ten nodes 8 seconds 77 seconds Reasonable time values for high node densities

22. Seny KamaraWCAN 200622 / 23 Conclusions Limitations of MANETs –Low bandwidth calls for stateful BE –Node mobility precludes standard stateful BE Can be overcome by provisioning with RMDM Our solution –Tradeoff between storage & recovery time – Leverage unauthorized nodes

23. Seny KamaraWCAN 200623 / 23 Thank You Questions? Authors Johns Hopkins University Department of Computer Science Reza Curtmola (crix@cs.jhu.edu) Seny Kamara (seny@cs.jhu.edu)