Topology-aware Key Management Schemes for Wireless Multicast

Transcription

1 Topoogy-aware Key Management Schemes for Wireess Muticast Yan Sun, Wade Trappe,andK.J.RayLiu Department of Eectrica and Computer Engineering, University of Maryand, Coege Park Emai: ysun, Wireess Information Network Laboratory (WINLAB), Rutgers University Emai: Abstract In secure muticast appications, key management must be empoyed to provide access contro to the muticast content. In wireess networks, where the error rate is high and the bandwidth is imited, the design of key management schemes shoud pace emphasis on reducing the communication burden associated with key updating and improving the reiabiity of key distribution. The topoogy-matching key management () scheme has been proposed to reduce the communication burden associated with rekeying by matching the key tree to the network topoogy and ocaizing the transmission of rekeying messages. This scheme, however, is ony suitabe for homogeneous networks where mobies users are uniformy distributed in the service area and experience simiar deay and transmission error rates. In this paper, we present an improved topoogy-aware key management scheme that is suitabe for a arge-scae ceuar wireess network where the heterogeneity of the network is taken into consideration. The proposed scheme not ony reduces the communication overhead, but aso improves the reiabiity of the key distribution. I. INTRODUCTION The rapid progress in muticast networking has ed to the depoyment of many muticast services, such as streaming stock quotes, video conferencing and communa gaming [1]. At the same time, there has been significant advancements in buiding a goba wireess infrastructure that wi free users from the confines of static communication networks. When wireess connections finay become ubiquitous, consumers wi desire to have muticast appications running on their mobie devices. Before the wireess muticast market can be successfu, access contro mechanisms must be depoyed in order to guarantee that ony authorized users can access the muticast content. Access contro is achieved by encrypting the content using an encryption key, known as the session key (SK), which is shared by a egitimate group members. A trusted third party, known as the key distribution center (KDC), is responsibe for generating and securey communicating key materia to the group members. Since users may join and eave at any time, rekeying messages need to be sent to update keys in order to prevent the eaving user from accessing future communication and prevent the joining user from accessing previous communication. Rekeying messages must be deivered reiaby because the oss of rekeying messages resuts in severe performance degradation [2]. Further, in rea-time muticast appications the rekeying messages shoud be deivered in a timey manner so that users receive the rekeying messages before the new key takes effect. In wireess muticast scenarios, where the bandwidth is imited and the data typicay experience a higher transmission error rate than in conventiona environment, the key management design shoud pace emphasis on improving the reiabiity of key distribution as we as reducing the communication burden associated with key updating, especiay when there are many users and frequent additions to or deetions from the group membership. In [3], a communication-efficient key management scheme, caed topoogy-matching key management (), was introduced for secure wireess muticast. By matching the key tree to the network topoogy and ocaizing the transmission of rekeying messages, the scheme significanty reduces the communication cost of rekeying messages compared with the traditiona schemes [2], [4], [5] that are independent of the network topoogy. This scheme, however, is suitabe ony for homogeneous networks where mobie users are uniformy distributed in the service area and experience simiar deay and transmission error rates. In this paper, we present an improved topoogy-aware key management scheme that is suitabe for a arge-scae ceuar wireess network, where users do not have the same join/departure/mobiity behavior and the network conditions may vary. Athough focusing on the communication overhead reduction, we prove that the proposed method can aso be used to improve the reiabiity of key distribution with minor modifications. In addition, we present a unicast-assisted topoogy-matching key management () scheme, which empoys both unicast and muticast communication to deiver rekeying messages. The scheme further improves the performance of the proposed method. The rest of the paper is organized as foows. Section II introduces the concept of the and the schemes. Section III defines the performance measure and formuates the optimization probem. Section IV describes a tree design procedure considering the heterogeneity of the network. The simuation resuts are presented in Section V, foowed by the concusion in Section VI. II. TOPOLOGY-MATCHING KEY MANAGEMENT TREE In this section, we introduce the idea of matching the key tree to the network topoogy, and outine a procedure to design topoogy-aware key management schemes. A common cass of muticast key management schemes empoy a tree hierarchy for the maintenance of keying materia [2] [4] [5], as depicted in Figure 1. Each user stores his private key u i, the session key K s, and a set of key encrypting GLOBECOM /3/$ IEEE

2 K S Kε SK Service Provider Network K K K 1 K 1 K 1 K 11 KEKs K K 1 K 1 K 11 K 11 K 1 K 11 K u1 u2 u3 u16 Fig. 1. A typica key management tree Users Private Keys keys (KEKs) on the path from himsef to the root of the key tree. The session key (SK) is used to encrypt the muticast content. KEKs are a set of auxiiary keys, which are used soey for the purpose of updating the SK and other KEKs. A user s private key is ony known by that user and the KDC. Since the member join operation can be achieved without transmitting rekeying messages [5], we sha ony focus on member departure. It is observed that most rekeying messages are ony usefu to a subset of users. For exampe, when user 16 eaves the muticast service, a of the keys he possesses, {K s,k ɛ,k 1,K 11,K 111 }, shoud be updated. The message used to update K 111 is ony usefu to user 15, the message used to update K 11 is ony usefu to user 13,14,15, the message used to update K 1 is ony usefu to user 9, 1,, 15, and the message used to update K ɛ and K s are usefu to a users. Therefore, rekeying messages do not have to be sent to every user in the muticast group. This observation motivates us to design a key management tree that matches the network topoogy in such a way that the neighbors on the key tree are aso physica neighbors on the network. Particuary, the key tree is designed to match the ceuar network topoogy depicted in Figure 2. This ceuar network mode, as proposed in [6], consists of mobie users, base stations () and supervisor hosts (). s administer the s and hande most of the routing and protoco detais for mobie users. The service provider, the s, and the s are connected through a wireine backbone, whie the s and the mobie users are connected through wireess channes. The key management tree is designed in three steps: Step 1: Design a subtree for the users under each. These subtrees are caed user subtrees. Step 2: Design subtrees which govern the key hierarchy between the s and the s. These subtrees sha be caed subtrees. Step 3: Design a subtree which governs the key hierarchy between the s and the KDC. This subtree sha be caed the subtree. Figure 3 iustrates an exampe of a key tree that matches the network topoogy shown in Figure 2. By deivering the rekeying messages ony to the users who need them, we can take advantage of the fact that the key tree matches the network topoogy, and ocaize the deivery of rekeying messages to sma regions of the network. This essens the amount of traffic oad as we as enhances the reiabiity of key distribution. Fig. 2. Base Station Non group members group members A ceuar wireess network mode Simiar to [3], we assume that the s and the s have the knowedge of whether the rekeying messages are usefu for the users under them. Using this knowedge, which can be conveyed in the rekeying message header, it is possibe to make ony a subset of s or s transmit messages. That is, a wi muticast a message to their s if the message is usefu to at east one of its s, and a wi muticast if the message is usefu to at east one of its users. When unicast connections between s and s are avaiabe and the number of s that need the messages, denoted by T bs, is sma, it is possibe to reduce the amount of communication by using unicast channes as opposed to muticast channes. Muticast routing protocos do not have the abiity to target message deivery to specific subsets of users. Therefore, when muticasting is empoyed, a rekeying message is sent to the entire group of s, regardess of whether or not a s need that message. Unicast, however, achieves an advantage since it aows for the rekeying message to be sent ony to those s that need that message. Therefore, we propose a transmission strategy between s and s as: When T bs T th, the sends rekeying messages to the s who need the messages using unicast. When T bs >T th, the muticast rekeying messages to a of its s. The threshod T th shoud be determined from the reative cost of the unicast communication compared to the muticast communication. In the reminder of the paper, wi represent the topoogy-matching key management scheme with the first transmission strategy and unicast-assisted () wi represent the topoogy-matching key management scheme using both unicast and muticast communications. Traditiona key management trees, such as those in [4], [5], are independent of the network topoogy, and we ca them Topoogy Independent Key Management () trees. When using a tree, the users are scattered a over the network, and therefore, it is not possibe to ocaize the deivery of rekeying messages. The comparison amongst, and schemes wi be further discussed through simuations in Section V. In the mobie environment, the user wi subscribe to a muticast service under an initia host agent, and through the course of his service move to different ces and undergo handoff to different base stations. Since the and trees depend on the network structure, the physica GLOBECOM /3/$ IEEE

3 ocation of a user affects the user s position on the key management tree. In this paper, we assume that the handoffs ony occur between s under the same, and the efficient handoff scheme proposed in [3] is empoyed to hande user reocation on the key tree. III. PERFORMANCE MEASURE A. Communication Overhead As discussed in the previous section, rekeying messages are first muticast/unicast to s, then broadcast to mobie users. We first define severa variabes as foows. The muticast-message-size is defined as the size of the rekeying messages muticast from the th to its s, denoted by Sm. The unicast-message-size is defined as the size of the rekeying messages unicast from the th to its s, denoted by Su. The wireess-message-size is defined as the size of the rekeying messages broadcast by the s to mobie users under the th, denoted by Sw. n sh denotes the number of s in the system. Under the th, there are n bs s, each of which has n user users. n sh and n bs are assumed to be fixed during the service. Then, the communication cost of the key management schemes is described by wireine cost C wire, wireess cost C wireess, and tota cost C T,as: C wire = αme[s m]+α ue[s u], (1) =1 C wireess = αwe[s w], (2) =1 C T = γ C wireess +(1 γ) C wire, (3) where E[.] is the expectation over the statistics governing the user joining and eaving behavior. Here, γ 1 is the wireess weight, which represents the importance of the wireess cost. {αm}, {αu} and {αm} are sets of weight factors that describe the reative importance of the muticast-messagesize, unicast-message-size, and wireess-message-size under the th, respectivey. The threshod T th in the scheme sha be chosen as α m α. When the s administer u areas with simiar physica network structure and conditions, we approximate {αm}, {αu} and {αm} by 1. B. Reiabiity of Key Distribution The reiabiity of key distribution is critica for key management schemes in wireess networks where the transmission error rate is usuay higher than that in conventiona wireine environment. The oss of rekeying messages resuts in severe performance degradation [2]. If a user oses one key, he not ony wi be unabe to access muticast content encrypted by this key, but aso may not be abe to acquire future keys from future rekeying messages. We introduce three error probabiities for each : (1) the probabiity that one user cannot receive a rekeying message Fig. 3. KDC A Topoogy Matching Key Management Tree correcty from the, denoted by p w; (2) the probabiity that one cannot receive a rekeying message correcty from the through muticast channe, denoted by p m; and (3) the probabiity that one cannot receive a rekeying message correcty from the through the unicast channe, denoted by p u, where =1, 2,,n sh. Users packet oss is assumed to be independent. We define the reiabiity measure P s as the probabiity that a users receive rekeying messages correcty with the average muticast-message-size, unicast-message-size and wireess-messages-size, i.e. P s = and og P s = (1 p w) n user E[S w ] (1 p m) n bs E[S m ] (1 p u) E[S u ], (ˆα w E[S w]+ˆα me[s m]+ˆα ue[s u] ), (4) where ˆα w = n user og(1 p w), ˆα m = n bs og(1 p m), and ˆα u = og(1 p u). Comparing (4) with (1)-(3), it is seen that P s is cosey reated with C T. The techniques that reduce the communication cost can be easiy extended to improve the reiabiity of the key distribution. Particuary, when choosing αw =ˆα w/γ, αm = ˆα m/(1 γ), and αu = ˆα u/(1 γ), the soution that minimizes the tota communication cost in (3) woud maximize P s in (4). Thus, we ony focus on reducing the communication overhead in the remainder of the paper. IV. OPTIMIZATION AND SUBTREE DESIGN In this section, we formuate the optimization probem and describe the key tree design procedures. When a user eaves the service, the keys that need to be updated are divided into three categories: (1)thekeysonthe user subtree, (2) the keys on the subtree, and (3) the keys on the subtree. We can prove that C T = p (k)g (k)a 1(k)+ p (k)g (k)a 2(k) =1 k =1 k ( ) + A 3 p (k)g (k), (5) =1 k where p (k) is the probabiity mass function of the number of users under the th, and G (k) is the probabiity that one of the k users eaves from the th. Here, A 1(k), A 2(k) and A 3 describe the communication cost due to updating keys in category 1, 2, and 3 respectivey, when there are k users GLOBECOM /3/$ IEEE

4 Kε ( q q 5, β β 5 ) ( q 1 + q 2 + q 3, β 1 + β 2 + β 3 ) K K ( q 1 + q 2, β 1 + β 2 ) 1 2 ( q 1, β 1 ) ( q 2, β 2 ) Fig. 4. K s ( q 4 + q 5, β 4 + β 5 ) ( q 3, β 3 ) ( q 4, β 4 ) ( q 5, β 5 ) An exampe of the subtree C sh Comparison of different subtree Design Methods (II) Baanced tree GD Agorithm Optima Tree under the th and one of them eaves. We can prove that the structure of the user-subtrees ony affects A 1(k), the structure of the -subtrees ony affects A 2(k), and the structure of the -subtrees ony affects A 3. Equation (5) indicates that the user subtrees, subtrees and subtree can be designed and optimized separatey. Particuary, the user subtrees under the th shoud be designed to minimize k p (k)g (k)a 1(k), the subtree under the th shoud be designed to minimize k p (k)g (k)a 2(k), and the subtree shoud be designed to minimize n sh ( =1 A 3 k p (k)g (k) ). This is a desired property because optimizing the subtrees separatey reduces the dimension of the search space for optima tree parameters. We use the ALX tree structure proposed in [3] to design user subtrees and subtrees. Since the design method is very simiar to what has been presented in [3], we ony discuss the design of the subtree in this paper. In a typica ceuar network, each administers a arge area where both the user dynamics and the network conditions may differ significanty from the areas administered by other s. The ALX tree structure, which treats every eaf equay, is not suitabe for buiding the subtree. Instead, the heterogeneity may be addressed by buiding a tree where the s have varying path engths from the root to their eaf node. The root of the subtree is the KDC, and the eaves are the s. The design goa is to minimize the third term in equation (5), which we denote by C sh and is given by C sh = q A 3, (6) =1 where q = k p (k)g (k). Letβ be the communication cost of transmitting one rekeying message to a the users under the th. Based on the definition of α 1 and α 2 in Section II, it is easy to show that β =(1 γ)α m + γn bs α w. The vaue of A 3 can be cacuated directy from {β }.For exampe, if the subtree has the structure iustrated in Figure 4 and a user eaves the service from 1, then, A 1 3 =2(β 1 +β 2 )+2(β 1 +β 2 +β 3 )+2(β 1 +β 2 +β 3 +β 4 +β 5 ). The goa of subtree design is to find a tree structure that minimizes C sh given β and q. However, it is very difficut to do so based on (6). Thus, we compute C sh inadifferent way. We sha assign a pair of positive numbers, caed a cost pair, to each node on the tree as foows: the cost pair of the eaf node that represents the th is (q,β ); the cost pairs of the intermediate nodes are the eement-wise summation of Fig The number of s Comparison of severa subtree design methods their chidren nodes cost pairs, as iustrated in Figure 4. The cost pairs of a intermediate nodes are represented by (x m,y m ), where m =1, 2,,M, and M is the tota number of intermediate nodes on the tree. Then, we can prove that C sh can aso be cacuated as C sh = n M m=1 x m y m, where n is the degree of the -subtree. This new formuation eads to a tree construction method for n =2as: 1) Labe a the eaf nodes together with their cost pairs, and mark them to be active nodes. 2) Choose two active nodes, (x i,y i ) and (x j,y j ), such that (x i +x j ) (y i +y j ) is minimized among a possibe pairs of active nodes. Mark those two nodes to be inactive and merge them to generate a new active node with the cost pair (x i + x j,y i + y j ). 3) Repeat step 2 unti there is ony one active node eft. This method, which we ca greedy- subtree-design (GD) agorithm, can be easiy extended to n>2cases. We can prove that the GD agorithm produces the optima soution when β 1 = β 2 = β nsh, but it is not optima in genera. The performance of the GD agorithm wi be demonstrated through simuations in Section V. V. SIMULATION RESULTS We first compare the subtree generated using the proposed GD agorithm with the optima tree obtained by exhaustive search, and with a baanced tree that treats each equay. In the simuation, haf of the {β } are randomy seected from [1, 2], which represent rura areas, and the other haf of {β } are randomy seected from [11, 12], which represent metropoitan areas. In addition, q is chosen to be proportiona to β, where = 1, 2,,n sh, and {q } are normaized so that q =1. In Figure 5, the communication cost due to updating keys on -subtrees, C sh,isshownfor different subtree design methods. Since exhaustive search is computationay very expensive, it is ony done for 1 and fewer s. It is observed that the performance of the GD agorithm is very cose to the optimum. Compared with the baanced tree, the GD agorithm reduces C sh by up to 18%. Figure 6 demonstrates the performance of, and schemes in systems with one. Simiar to [7], we empoyed a homogeneous ceuar network that consists of 12 concatenated ces, and wrap the ce pattern to avoid edge effects. The mobiity mode proposed in [8] is adopted. GLOBECOM /3/$ IEEE

5 15 x 15 One, R=4 mie, V max =5 mie/hr, 1/µ = 2 minute 6 x 17 mutipe, R=4 mie, V max =5 mie/hr, 1/µ = 2 minute wireess cost 1 5 wireess cost 4 2 performance ratio wireine cost x / / user join rate (λ) Fig. 6. Performance Comparison for different user join rate R denotes the radius of the ces, and V max denotes the maximum speed of the mobie users. The M/M/ queueing mode is used to describe the membership dynamics for a muticast service. We define the performance ratio η as the tota communication cost of the tree divided by the tota communication cost of the tree. Figure 6 shows the simuation resuts of wireine cost, wireess cost and the performance ratio for different user join rates, when R =4 mies, V max = 5 mies per hour, γ = 2/3, αm/α u = n bs /4, and the average service time is 2 minutes. Compared with the scheme, scheme reduces the wireess cost but increases the wireine cost, whie scheme reduces both wireess cost and wireine cost. For this particuar simuation setup, the wireine cost of the scheme is ony about 5% of the wireine cost of the scheme. The simuation resuts of the performance ratio indicate that the scheme reduces the tota communication cost to 35-45% and the scheme reduces the tota communication cost to 32-43% of the tota communication cost of the scheme. In Figure 7,, and schemes are compared when the system contains mutipe s, under which users have the same joining/eaving/mobiity behavior and experience the same network conditions. When n sh 2, the and scheme reduce both the wireess and wireine cost. The advantages of the and trees are more significant when the system contains more s. Athough the tree aways has smaer wireine cost, the difference between the and scheme becomes ess significant when the number of s is arge. In this case, the communication cost of the and schemes can be as ow as 2% of the communication cost of the trees. This indicates an 8% reduction in the communication cost. A more compicated system containing 5 s with user joining rate 5, 1, 15, 2 and 25 per second respectivey was aso simuated. When R =4mies, V max =5mies/hr, and average service time is 2 minutes, the wireess cost of the and scheme is 21.8% of that of the performance ratio wireine cost 6 x / /.2 the number of Fig. 7. Performance comparison for different number of s scheme, the wireine cost of the scheme is 35.9% of that of the scheme, and the wireine cost of the scheme is 32.% of that of the scheme. VI. CONCLUSION In this paper, we presented a topoogy-aware key management scheme that is suitabe for a arge-scae ceuar wireess network, where users do not have the same join/departure/mobiity behavior and the network conditions may vary under different s. Simuations were performed for different user join rates and varying number of s. Compared with the traditiona key management schemes that are independent of the network topoogy, the proposed scheme can significanty reduce the communication cost by up to 8%. In addition, we presented the scheme, which empoys both unicast and muticast communication in the deivery of rekeying messages and can further reduce the wireine communication of rekeying messages by about 5%. We aso showed that the proposed methods can be used to enhance the reiabiity of the key distribution. REFERENCES [1] S. Pau, Muticast on the Internet and its appications, Kuwer Academic Pubishers, [2] M.J. Moyer, J.R. Rao, and P. Rohatgi, A survey of security issues in muticast communications, IEEE Network, vo. 13, no. 6, pp , Nov.-Dec [3] Y. Sun; W. Trappe; K.J.Ray Liu, An efficient key management scheme for secure wireess muticast, Proc. of IEEE Internationa Conference on Communication, pp , May 22. [4] C. Wong, M. Gouda, and S. Lam, Secure group communications using key graphs, IEEE/ACM Trans. on Networking, vo. 8, pp. 16 3, Feb. 2. [5] M. Wadvoge, G. Caronni, D. Sun, N. Weier, and B. Pattner, The VersaKey framework: Versatie group key management, IEEE Journa on seected areas in communications, vo. 17, no. 9, pp , Sep [6] K. Brown and S. Singh, ReM: Reiabe muticast for mobie networks, Computer Communication, vo. 2.1, no. 16, pp , June [7] M. Rajaratnam and F. Takawira, Noncassica traffic modeing and performance anaysis of ceuar mobie networks with and without channe reservation, IEEE Trans. on Vehicuar Technoogy, vo. 49, no. 3, pp , May 2. [8] M. M. Zonoozi and P. Dassanayake, User mobiity modeing and characterization of mobiity patterns, IEEE Journa on Seected Areas in Communications, vo. 15, no. 7, pp , Sep GLOBECOM /3/$ IEEE