Date post: | 12-Jan-2016 |
Category: |
Documents |
Upload: | eileen-brittany-rose |
View: | 214 times |
Download: | 0 times |
Key Managementin Mobile and Sensor Networks
Class 17
Outline
Challenges in key distribution, trust bootstrapping
Pre-setup keys (point-to-point, public) Resurrected ducking PGP trust graph Trusted third party (TTP)• Kerberos, SPINS • PKI
Key infection Random-key predistribution
Key Management
Goal: set up and maintain secure keys• Public keys for signature verification or node-to-
node key setup
• Shared keys for confidentiality or authenticity
• Group keys for secure group communication
Challenges• Trust establishment (Class example?)
• Node compromise
• Dynamic node addition/removal
Network Architectures
Closed networks, centralized deployment (trusted authority controls and deploys nodes)• All-pairs shared keys, or all public keys
• PKI, TTP (Kerberos, SPINS)
• Zhou & Haas threshold key management
• Randomkey predistribution
Open networks, autonomous deployment• Resurrected duckling
• PGP web of trust
• Key infection
Full Key Deployment
Symmetric case• All-pairs shared keys (need O(n2) keys)
• Challenge: node addition
Asymmetric case• Distribute every node’s public key (n keys)
• Nodes can easily set up secure shared keys
Trusted Key Management Center
Symmetric case• Trusted third party (TTP) shares key with each node
(n keys)
• Set up key between two nodes through TTP
• Kerberos, SPINS key agreement protocol
Asymmetric case• Public-key infrastructure (PKI)
• Certification authority (CA) signs public keys of nodes
• All nodes know CA’s public key
Zhou & Haas Key Management PKI drawbacks• Revocation requires on-line PKI
• Single point of failure, CA replication increases vulnerability to node compromise
Distributed CA Model, tolerates t faulty nodes Threshold signatures• Signing needs coalition of t+1 correct nodes
• Secret sharing prevents t malicious nodes from reconstructing CA private key
Proactive security• Defend against mobile adversary
Discussion How can share refreshing tolerate faulty nodes? How can we tolerate compromised combiner?• Who decides to be a combiner?
How can we bootstrap this system?• How can we introduce a new node?
Why should node sign a message?• How does node authenticate message?
Is signature combination expensive if we have t faulty nodes?
How efficient are these mechanisms?
Randomkey Predistribution
Scenario: deploy 104 mote sensor from airplane
Goal: set up secure node-to-node keys Simple approaches impractical• Network-wide secret key
• Pairwise shared key with every other node
• Pairwise shared key with neighbors
• Public key infrastructure
Basic Random Key Scheme Eschenauer and Gligor, ACM CCS 2002 Observation: no need for all pairs of nodes to
be able to communicate to get a connected network
For any 2 nodes, if they can communicate with some probability p, then the network is a random graph that is connected with high probability (e.g. 0.999)
p is a given parameter, dictated by communication range and density of deployment of the nodes
Basic Random Key Scheme
2128 Total Key Space
Key Pool P
Randomly choose |P| keys
Randomly choose m keys
Key ring of node A
Key ring of node B
Pick |P| s.t probability of any 2 nodes sharing at least 1 key = p
Key capture
Security of the basic scheme is dependent on the adversary not knowing the key pool P
Suppose adversary can compromise sensor nodes and read the keys off their key rings
E.g., adversary captures node X and discovers key k. If node A and B were communicating using key k, the adversary can now eavesdrop although neither A or B was compromised.
How can we improve resilience to node capture?
q-Composite Keys scheme
Require any 2 nodes to share at least q keys to communicate
Adversary must discover all q keys to eavesdrop
To maintain probability of communication between any 2 nodes = p, must reduce size of key pool (samples from a smaller pool are more likely to overlap)
Smaller key pool keys are more likely to be reused
Resilience vs node capture
Duckling Key Establishment
Anderson and Stajano, IWSP ‘99 Problem: how can we set up keys in a
ubiquitous computing environment?• Devices use wireless communication
• How to set up a key between household devices and PDA?
Solution: set up keys using trusted communication channel• Physical contact establishes a secure channel
Duckling Security Model 1
Assumes wireless communication Goals• Availability–Guard against jamming and battery exhaustion
–“Sleep deprivation torture attack”
• Secure transient association with device–Even in absence of a trusted server
–Security assiciations keep changing, as devices change owners, or owner changes controller
Duckling Security Model 2
Life cycle “similarities”• Life cycle of a device– Buy device in store
– Unpack it at home
– Device breaks or gets a new owner
• Life cycle of a duckling– Duckling is in egg
–When duckling hatches, first object is viewed as mother: imprinting
– Duckling dies
• Device ownership similar to duck’s soul
Duckling Security Model 3
Device life cycle• Imprinting: device meets master when it
wakes up
• Reverse metempsychosis: device dies and gets new owner
• Escrowed seppuku: manufacturer can kill device to enable renewed imprinting
Physical contact establishes secure key during imprinting phase
PGP Web of Trust
Problem: how can we establish shared keys in ad hoc network without trusted PKI?
Approach: use PGP web of trust approach Jean-Pierre Hubaux, Srđan Čapkun and
Levente Buttyán: The Quest for Security in Mobile Ad Hoc Networks, MobiHoc 2001
Distributed storage of local certificates Nodes issue certificates (sign others’ keys), as in PGP Each node stores the certificates that it issued (out-
bound certificates) and the certificates that other nodes issued for it (in-bound certificates)
u
v
Creating the subgraphs Each node builds up its own out-bound and in-
bound subgraphs To establish secure communication, u and v
merge their subgraphs and see if they intersect
u
v
Key Infection Ross Anderson and Adrian Perrig, 2001 Goal: Light-weight key setup among neighbors Assumptions:• Attacker nodes have same capability as good nodes• Attacker nodes less dense than good nodes• Attacker compromises small fraction of good nodes
Basic key agreement protocol
• A * : A, KA
• B A : { A, B, KB }KA
• KAB = H( A | B | KA | KB )
Key Infection
AB
M4
M2
M3
M1
Broadcast keys with maximum signal strength
Key Whispering Extension
AB
M4
M2
M3
M1
Broadcast keys with minimum signal strength to reach neighbor
Secrecy Amplification
AB
C
DE
A & B share KAB, A & C share KAC, , etc.
Strengthen secrecy of K’AB
• A C : { B, A, NA }KAC
• C B : { B, A, NA }KCB
• B D : { A, B, NB }KBD
• D E : { A, B, NB }KDE
• E A : { A, B, NB }KAE
• K’AB = H( KAB| NA | NB )
Key Infection Summary Highly efficient Detailed analysis in progress Preliminary simulation results: • Nodes uniformly distributed over a plane
• D (density): average # of nodes within radio range
• # of attacker nodes = 1% of good nodes
• Table shows fraction of compromised links
D Basic Whisper SA SA-W
2 1.1% 0.4% 1.0% 0.3%
3 1.8% 0.6% 1.4% 0.5%
5 2.9% 1.0% 2.4% 0.8%
Discussion
Tradeoff• Trust perimeter and security?
• Security and management?