Authenticated addressing in networks

Transcription

1 Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Technische Universität München Diploma thesis semi final presentation Authenticated addressing in networks Blaž Primc, University of Ljubljana Supervisors TUM: Marc Oliver Pahl, Heiko Niedermayer, Andreas Müller, Holger Kinkelin

2 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1 Task 2 Task 3 Task 4 Outlook 2

3 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1 Task 2 Task 3 Task 4 Outlook 3

4 Goals Authone project Autonomous functionality inside (home )networks Prerequisites Network entity addressing Network entity identification Diploma thesis Goal: provide Authone framework with capabilities for Network entity addressing Network entity identification 4

5 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1 Outlook Task 2 Task 3 Task 4 5

6 Home network Network entities Users Devices Home gateway 6

7 Identities Identity is... based on public key cryptography signed by issuing special node Special node(s) (e.g. home gateway) Issues identities Each network entity must be registered Provides lookup service 7

8 Addressing EntityID is... hash over entity s public key Identity BobPDA Home B Authone address... EntityID consists of entityids entityid.homeid.authone is bounded to identity supports inter home addressing BobPDA ID = hash(pubkey BobPDA ) HomeB ID = hash(pubkey HomeB ) Authone address = BobPDA ID.HomeB ID.authone Lookup service Translates Authone address to IP address Provided by special node(s) (e.g. home gateway) IP address 8

9 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1: entity registration Task 2: address lookup inside home network Task 3: establish trust relationship between homes Task 4: address lookup outside home network Outlook 9

10 Task 1: entity registration Goals Register new device at home network Procedure User Fills new device registration request details Unregistered device Sends registration request details to home gateway Home gateway Creates identity Updates DNS records Sends identity to the new device 10

11 Task 1: entity registration Goals Register new device at home network Unregistered device BobLaptop Afterwards we can Address the new device using the Authone address Identify the new device 11

12 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1: entity registration Task 2: address lookup inside home network Task 3: establish trust relationship between homes Task 4: address lookup outside home network Outlook 12

13 Task 2: address lookup inside home network Goals Resolve Authone address to IP address Procedure Registered device Sends DNS query to home gateway Special node (e.g. home gateway) Local DNS answers Logged on BobLaptop at Home B: $ BobPDA.authone BobPDA DNS query BobLaptop DNS response 13

14 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1: entity registration Task 2: address lookup inside home network Task 3: establish trust relationship between homes Task 4: address lookup outside home network Outlook 14

15 Task 3: establish trust relationship between homes Goals Securely exchange identities between homes Challenges No pre established security context Secure exchange of information over wireless Procedure Authenticated Diffie Hellman key exchange Identity exchange and verification Home B Home A Home A Device A Home B Device B 15

16 Task 3: establish trust relationship between homes Goals Securely exchange identities between homes Procedure: Authenticated Diffe Hellman key exchange Device A and Device B perform DH key exchange and hash DH secret key Device A displays 1st part of hash (ABCD) Device B displays 2nd part of hash (EFGH) User A and User B verbally exchange hashes and enter them into devices User A enters 2st part of hash to Device A (EFGH) User B enters 1st part of hash to Device B (ABCD) Device A ABCD and Device B verify Verbal if exchange input matches the calculated EFGH hash OK. DH key exchange OK. Home A Home B 16

17 Task 3: establish trust relationship between homes Goals Securely exchange identities between homes Procedure: Identity exchange and verification Device A sends Home A and Device A identity Device B Validates presented identities Sends a challenge to Device A Device A responds to challenge Device B verifies response and stores the identities Challenge Home A Response Device A Home A Home B 17

18 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1: entity registration Task 2: address lookup inside home network Task 3: establish trust relationship between homes Task 4: address lookup outside home network Outlook 18

19 Task 4: address lookup outside home network Goals Resolve foreign home Authone address to IP address Challenges How do we contact Home B from Home A? Home A???THE INTERNET Home B Logged on AlicePDA at Home A: $ BobPDA.HomeB.authone 19

20 Task 4: address lookup outside home network Goals Resolve foreign home Authone address to IP address Identity Solution entityid = hash(public_key) Distributed Hash Table Overlay network Provides lookup service similar to hash table (key,value) Key based addressing of DHT nodes Put all home gateways in one DHT HomeID is the home gateway s address in DHT Homes with trust relationship can find and securely communicate with one another Possession of public key: we can generate entityid, thus we can address home gateway in DHT 20

21 Task 4: address lookup outside home network BobPDA Goals Resolve foreign home Authone address to IP address Home A DHT DNS reply DHT reply: My IP and port DNS query: DHT query: Forwards Device A s Home B tell me DNS query your IP and port Home B Forward DNS query DNS reply Logged on AlicePDA at Home A: $ BobPDA.HomeB.authone AlicePDA 21

22 Task 4: address lookup outside home network Demo 22

23 Presentation overview Motivation Goals Diploma thesis Concepts Home network Identities Addressing Tasks Task 1: entity registration Task 2: address lookup inside home network Task 3: establish trust relationship between homes Task 4: address lookup outside home network Outlook 23

24 Outlook Work still in progress Authone framework fundamental part 24

25 The end Thank You! 25