Providing Hop-by-Hop Authentication and Source Privacy in Wireless Sensor Networks

Transcription

1 The 31st Annua IEEE Internationa Conference on Computer Communications: Mini-Conference Providing Hop-by-Hop Authentication and Source Privacy in Wireess Sensor Networks Yun Li Jian Li Jian Ren Department of Eectrica & Computer Engineering Michigan State University East Lansing, MI Emai: {iyun1, ijian6, Jie Wu Department of Computer & Information Sciences Tempe University Phiadephia, PA Emai: Abstract Message authentication is one of the most effective ways to thwart unauthorized and corrupted traffic from being forwarded in wireess sensor networks (WSNs). To provide this service, a poynomia-based scheme was recenty introduced. However, this scheme and its extensions a have the weakness of a buit-in threshod determined by the degree of the poynomia: when the number of messages transmitted is arger than this threshod, the adversary can fuy recover the poynomia. In this paper, we propose a scaabe authentication scheme based on eiptic curve cryptography (ECC). Whie enabing intermediate node authentication, our proposed scheme aows any node to transmit an unimited number of messages without suffering the threshod probem. In addition, our scheme can aso provide message source privacy. Both theoretica anaysis and simuation resuts demonstrate that our proposed scheme is more efficient than the poynomia-based approach in terms of communication and computationa overhead under comparabe security eves whie providing message source privacy. Index Terms Hop-by-hop authentication, symmetric-key cryptosystem, pubic-key cryptosystem, source privacy I. INTRODUCTION Message authentication pays a key roe in thwarting unauthorized and corrupted packets from being circuated in networks to save precious sensor energy. For this reason, many schemes have been proposed in iterature to provide message authenticity and integrity in network communications [1], [2]. These schemes can argey be divided into pubic-key-based and symmetric-key-based approaches. A secret poynomia-based message authentication scheme was introduced in [1]. To thwart the intruder from recovering the poynomia by computing the coefficients of the poynomia, the idea of adding random noise, caed a perturbation factor, to the poynomia was proposed [2]. However, a recent study shows that the random noise can be competey removed from the poynomia using error-correcting code techniques [3]. In this paper, we propose an unconditionay secure and efficient source anonymous message authentication (SAMA) scheme, based on the optima modified EGama signature (MES) scheme on eiptic curves. This MES scheme is secure against no-message attacks and adaptive chosen-message attacks in the random orace mode [4]. Our scheme enabes the intermediate nodes to authenticate the message so that a corrupted packets can be dropped to conserve sensor power. Whie achieving compromise-resiiency, fexibe-time authentication and source identity protection, our scheme does not have the threshod probem. Both theoretica anaysis and simuation resuts demonstrate that our proposed scheme is more efficient than the poynomia-based agorithms under comparabe security eves. To the best of our knowedge, this is the first scheme that provides hop-by-hop node authentication without the threshod imitation, whie having performance better than the symmetric-key based schemes. The distributed nature of our agorithms makes these schemes suitabe for decentraized networks. The major contributions of this paper incude: (i) we deveop a source anonymous message authentication (SAMA) scheme on eiptic curves that can provide unconditiona source anonymity; (ii) we offer an efficient hop-by-hop message authentication mechanism without the threshod imitation; (iii) we devise network impementation criteria on source node privacy protection in WSNs; (iv) we provide extensive simuation resuts under ns-2 and TeosB on mutipe security eves. II. TERMINOLOGY AND PRELIMINARY In this section, we wi briefy describe the terminoogy and the cryptographic toos that wi be used in this paper. A. Mode and Assumptions We assume that the wireess sensor network consists of a arge number of sensor nodes. Each node can be a data source or a data sink, and is capabe of communicating with its neighboring nodes directy. The whoe network is fuy connected through muti-hop communications. We assume that there is a security server (SS) that is responsibe for generating, storing and distributing the security parameters among the network. This server wi never be compromised. However, after depoyment, the sensor nodes may be captured and compromised by attackers. Once compromised, a information stored in the sensor nodes can be accessed by the attackers. The compromised nodes can be reprogrammed and fuy controed by the attackers. However, the compromised nodes wi not be abe to create new pubic keys that can be accepted by the SS and other nodes. Based on the above assumptions, this paper considers both passive attacks and active attacks. Our proposed authentication /12/$ IEEE 3353

2 scheme aims at achieving hop-by-hop message authentication, compromised node resiience and efficiency. B. Terminoogy Privacy is sometimes referred to as anonymity. It generay refers to the state of being unidentifiabe within the ambiguity set (AS). Sender anonymity means that a particuar message is not inkabe to any sender, and no message is inkabe to a particuar sender. Definition 1 (SAMA). A SAMA consists of the foowing two agorithms: Generate (m, Q 1, Q 2,, Q n ): Given a message m and the pubic keys Q 1, Q 2,, Q n of the AS S = {A 1, A 2,, A n }, the actua message sender A t, 1 t n, produces an anonymous message S(m) using its own private key d t. Verify S(m): Given a message m and an anonymous message S(m), which incudes the pubic keys of a members in the AS, a verifier can determine whether S(m) is generated by a member in the AS. The security requirements for SAMA incude: Sender ambiguity: The probabiity that a verifier successfuy determines the rea sender of the anonymous message is exacty 1/n, where n is the tota number of members in the AS. Unforgeabiity: An anonymous message scheme is unforgeabe if no adversary, given the pubic keys of a members of the AS and the anonymous messages m 1, m 2,, m n adaptivey chosen by the adversary, can produce, in poynomia time, a new vaid anonymous message with non-negigibe probabiity. In this paper, the user ID and the user pubic key wi be used interchangeaby without making any distinctions. C. Modified EGama Signature Scheme (MES) Definition 2 (MES). The modified EGama signature scheme consists of the foowing three agorithms: Key generation agorithm: Let p be a arge prime and g be a generator of Z p. Both p and g are made pubic. For a random private key x Z p, the pubic key y is computed from y = g x mod p. Signature agorithm: The MES can aso have many variants [5], [6]. For the purpose of efficiency, we wi describe the variant, caed the optima scheme. To sign a message m, one chooses a random k Z p 1, then computes the exponentiation r = g k mod p and soves s from: s = rxh(m, r) + k mod (p 1), (1) where h is a one-way hash function. The signature of message m is defined as the pair (r, s). Verification agorithm: The verifier checks the signature equation g s = ry rh(m,r) mod p. If the equaity hods true, then the verifier Accepts the signature and Rejects it otherwise. III. RELATED WORK A secret poynomia-based message authentication scheme was introduced in [1]. This scheme offers information theoretic security with ideas simiar to a threshod secret sharing scheme, where the threshod is determined by the degree of the poynomia. When the number of messages transmitted is beow the threshod, the scheme enabes the intermediate node to verify the authenticity of the message through poynomia evauation. However, when the number of messages transmitted is arger than the threshod, the poynomia can be fuy recovered and the system becomes competey broken. To increase the threshod and the compexity for the intruder to break the secret poynomia, random noise, aso caed a perturbation factor, was added to the poynomia in [2]. The main idea is to thwart the adversary from computing the coefficient of the poynomia. However, the added perturbation factor can be competey removed using error-correcting code techniques [3]. The recent progress on eiptic curve cryptography (ECC) shows that the pubic-key schemes can be more advantageous in terms of memory usage, message compexity, and security resiience since pubic-key-based approaches have simpe and cean key management [7]. The existing anonymous communication protocos are argey stemmed from mixnet [8]. A mixnet provides anonymity via packet re-shuffing through a set of mix servers (with at east one being trusted). Recenty, message sender anonymity based on ring signatures was introduced [9]. This approach enabes the message sender to generate a source-anonymous message signature with content authenticity assurance. The origina scheme has very imited fexibiity and very high compexity. Moreover, the origina paper ony focuses on the cryptographic agorithm, and the reevant network issues were eft unaddressed. IV. PROPOSED SOURCE ANONYMOUS MESSAGE AUTHENTICATION (SAMA) SCHEME In this section, we propose an unconditionay secure and efficient source anonymous message authentication scheme (SAMA). Our design enabes the SAMA to be verified through a singe equation without individuay verifying the signatures. A. Proposed MES Scheme on Eiptic Curves Let p > 3 be an odd prime. An eiptic curve E is defined by an equation of the form: E : y 2 = x 3 + ax + b mod p, where a, b F p, and 4a b 2 0 mod p. The set E(F p ) consists of a points (x, y) F p on the curve, together with a specia point O, caed the point at infinity. Let G = (x G, y G ) be a base point on E(F p ) whose order is a very arge vaue N. User A seects a random integer d A [1, N 1] as his private key. Then, he can compute his pubic key Q A from Q A = d A G. 3354

3 Signature generation agorithm: For Aice to sign a message m, she foows these steps: 1) Seect a random integer k A, 1 k A N 1. 2) Cacuate r = x A mod N, where (x A, y A ) = k A G. If r = 0, go back to step 1. 3) Cacuate h A h(m, r), where h is a cryptographic hash function, such as SHA-1, and denotes the eftmost bits of the hash. 4) Cacuate s = rd A h A + k A mod N. If s = 0, go back to step 2. 5) The signature is the pair (r, s). When computing s, the string h A that resuts from h(m, r) sha be converted into an integer. Note that h A can be greater than N, but not onger. Signature verification agorithm: For Bob to authenticate Aice s signature, he must have a copy of her pubic key Q A, then he: 1) Checks that Q A O, otherwise it is invaid 2) Checks that Q A ies on the curve 3) Checks that nq A = O After that, Bob foows these steps to verify the signature: 1) Verify that r and s are integers in [1, N 1]. If not, the signature is invaid. 2) Cacuate h A h(m, r), where h is the same function used in the signature generation. 3) Cacuate (x 1, x 2 ) = sg rh A Q A mod N. 4) The signature is vaid if r = x 1 mod N, it is invaid otherwise. B. Proposed SAMA on Eiptic Curves Suppose that the message sender (say Aice) wishes to transmit a message m anonymousy from her network node to any other nodes. The AS incudes n members, A 1, A 2,, A n, e.g., S = {A 1, A 2,, A n }, where the actua message sender Aice is A t, for some vaue t, 1 t n. In this paper, we wi not distinguish between the node A i and its pubic key Q i. Therefore, we aso have S = {Q 1, Q 2,, Q n }. Authentication generation agorithm: Suppose that m is a message to be transmitted. The private key of the message sender Aice is d t, 1 t N. To generate an efficient SAMA for message m, Aice performs the foowing three steps: 1) Seect a random and pairwise different k i for each 1 i n 1, i t, and compute r i from (r i, y i ) = k i G. 2) Choose a random k i Z p and compute r t from (r t, y t ) = k t G i t r i h i Q i such that r t 0 and r t r i for any i t, where h i h(m, r i ). 3) Compute s = k t + k i + r t d t h t mod N. i t The SAMA of the message m is defined as: S(m) = (m, S, r 1, y 1,, r n, y n, s). C. Verification of SAMA Verification agorithm: For Bob to verify an aeged SAMA (m, S, r 1, y 1,, r n, y n, s), he must have a copy of the pubic keys Q 1,, Q n. Then he: 1) Checks that Q i O, i = 1,, n, otherwise it is invaid 2) Checks that Q i, i = 1,, n ies on the curve 3) Checks that nq i = O, i = 1,, n After that, Bob foows these steps: 1) Verify that r i, y i, i = 1,, n, and s are integers in [1, N 1]. If not, the signature is invaid. 2) Cacuate h i h(m, r i ), where h is the same function used in the signature generation. 3) Cacuate (x 0, y 0 ) = sg n r i h i Q i. i=1 4) The signature is vaid if the first coordinate of (r i, y i ) i equas x 0, invaid it is otherwise. Remark 1. It is apparent that when n = 1, SAMA becomes a simpe signature agorithm. D. Security Anaysis Theorem 1. The proposed source-anonymous message authentication scheme (SAMA) can provide unconditiona message sender anonymity. Theorem 2. The proposed SAMA is secure against adaptive chosen-message attacks in the random orace mode. V. AS SELECTION AND SOURCE PRIVACY The appropriate seection of an AS pays a key roe in message source privacy since the actua message source node wi be hidden in the AS. In this section, we wi discuss techniques that can prevent the adversaries from tracking the message source through the AS anaysis in combination with the oca traffic anaysis. Before a message is transmitted, the message source node seects an AS from the pubic key ist in the SS as its choice. This set shoud incude itsef, together with some other nodes. When an adversary receives a message, he can possiby find the direction of the previous hop, or even the rea node of the previous hop. However, if the adversary is unabe to monitor the traffic of the previous hop, then he wi be unabe to distinguish whether the previous node is the actua source node or simpy a forwarder node. Therefore, the seection of the AS shoud create sufficient diversity so that it is infeasibe for the adversary to find the message source based on the seection of the AS itsef. VI. PERFORMANCE ANALYSIS In this section, we wi evauate our proposed authentication scheme through both theoretica anaysis and simuation demonstrations. We wi compare our proposed scheme with the bivariate poynomia-based symmetric-key scheme described in [2]. A fair comparison of our proposed scheme and the scheme proposed in [2] shoud be performed with n =

4 A. Theoretica Anaysis The secret bivariate poynomia is defined as [1]: f(x, y) = d x d y i=0 j=0 A i,j x i y j, where each coefficient A x,y is an eement of a finite fied F p, and d x and d y are the degrees of this poynomia. d x and d y are aso reated to the message ength and the computationa compexity of this scheme. From the performance aspect, d x and d y shoud be as short as possibe. On the other hand, it is easy to see that the intruders can recover the poynomia f(x, y) via Lagrange interpoation when either more than d y + 1 messages transmitted from the base station are received and recorded by the intruders, or more than d x + 1 sensor nodes have been compromised, In this case, the security of the system is totay broken and cannot be used anymore. This property requires both d x and d y to be very arge for the scheme to be resiient to node compromising attack. An aternative approach based on perturbation of the poynomia was aso expored. The main idea is to add a sma amount of random noise to the poynomia in the origina scheme so that the adversaries wi no onger be abe to sove the coefficients using Lagrange interpoation. However, this technique is proven to be vunerabe to security attacks [3] since the random noise can be removed from the poynomia using error-correcting techniques. Whie hop-by-hop authentication can be achieved through a pubic-key encryption system, the pubic-key-based schemes were generay considered as not preferred, mainy due to their high computationa overhead. However, our research demonstrates that this is not aways true, especiay for eiptic curve pubic-key cryptosystems. In our scheme, each SAMA contains an AS of n randomy seected nodes that dynamicay changes for each message. For n = 1, our scheme can provide at east the same security as the bivariate poynomia-based scheme. For n > 1, we can provide extra source privacy benefits. Even if one message is corrupted, other messages in the network can sti be secure. Therefore, n can be much smaer than the parameters d x and d y. In fact, even a sma n may provide adequate source privacy whie ensuring high system performance. B. Experimenta Resuts In this section, we compare the bivariate poynomia-based scheme and our scheme based on comparabe security eves. 1) Simuation parameter setup: The bivariate poynomiabased scheme is a symmetric-key-based impementation, whie our scheme is based on ECC. This requires us to determine the comparabe key sizes. If we choose the key size to be for the symmetric-key cryptosystem, then the key size for our proposed ECC wi be 2, which is much shorter than the traditiona pubic-key cryptosystem. This progress faciitates the impementation of the authentication scheme using ECC. In our simuation setting, we choose five security eves, which are indicated by the symmetric-key sizes : 24bit, 32bit, 40bit, 64bit, and 80bit, respectivey. The comparabe key sizes of our scheme are 48bit, 64bit, 80bit, 128bit, and 160bit, respectivey. We aso need to determine d x and d y for the bivariate poynomia-based scheme, and the n for our scheme. In our simuation, we seect d x equa d y and choose three vaues for them: 80, 100, and 150. We assume that WSNs do not contain more than 2 16 nodes in our simuation, which is reasonaby arge. For size n of the AS, we choose three vaues in the simuation: 10, 15, and 20. 2) Computationa overhead: For a pubic-key based authentication scheme, computationa overhead is one of the most important performance measurements. Thus we first conducted simuation to measure the process time. The simuations were carried out in 16-bit, 4 MHz TeosB mote. Tabe I shows the process time of our scheme and the bivariate poynomia-based scheme for both authentication generation and verification. In the simuations, we assume that the key ength of our scheme is 2. 3) Communication overhead and message transmission deay: The communication overhead is determined by the message ength. For the bivariate poynomia-based scheme, each message is transmitted in the form of < m, MAF m (y) >, where MAF m (y) is defined as: MAF m (y) = f(h(m), y) = dy j=0 M jy j. MAF m (y) is represented by its d y + 1 coefficients, M i, Z p, 0 i d y, where p (2 1, 2 ) is a arge prime number. The tota ength of the message is (d y + 1). For our scheme, assuming that the network is composed of λ nodes in tota, each ID wi be of the ength: og 2 λ. When n nodes are incuded in the AS, the ength of S is n og 2 λ. Therefore, the tota ength of one message for our scheme is: 4(n + 1) + n og 2 λ. 4) Simuation resuts: The simuation resuts, carried out in ns-2 on a RedHat Linux system, demonstrate that our proposed scheme has a much ower energy consumption and message transmission deay; see Fig. 1(a)&(b). The security eves 1, 2, 3, 4 correspond to symmetric key sizes 24bit, 32bit, 40bit, 64bit, and eiptic curves key sizes 48bit, 64bit, 80bit, 128bit, respectivey. Our simuations aso show that the deivery ratio of our scheme is sighty better than the bivariate poynomia-based scheme; see Fig. 1(c). Our simuation on memory consumption derived in TeosB, see Tabe II, shows that the overa memory consumption for the bivariate poynomia-based scheme is at east 5 times arger than our proposed scheme. VII. CONCLUSION In this paper, we first proposed a nove and efficient source anonymous message authentication scheme (SAMA) based on eiptic curve cryptography (ECC). Whie ensuring message sender privacy, SAMA can be appied to any messages to provide hop-by-hop message content authenticity without the weakness of the buit-in threshod of the poynomia-based scheme. Both theoretica and simuation resuts, conducted using ns-2 and TeosB, show that, in comparabe scenarios, 3356

5 Energy / Joue Fig Security Leve Deay / seconds Security Leve Deivery Ratio Security Leve (a) (b) (c) Performance comparison of our proposed scheme and bivariate poynomia-based scheme: (a) energy consumption, (b) message deay, (c) deivery ratio TABLE I. PROCESS TIME (S) FOR THE TWO SCHEMES (16-BIT, 4 MHZ TELOSB MOTE) POLYNOMIAL BASED APPROACH PROPOSED APPROACH d x, d y = 80 d x, d y = 100 d x, d y = 150 n = 1 GEN VERIFY GEN VERIFY GEN VERIFY GEN VERIFY GEN VERIFY GEN VERIFY GEN VERIFY = = = = = TABLE II. MEMORY (KB) AND TIME (S) CONSUMPTION FOR THE TWO SCHEMES (TELOSB) (F STANDS FOR FLASH MEMORY) POLYNOMIAL BASED APPROACH. PROPOSED APPROACH d x, d y = 80 d x, d y = 100 d x, d y = 150 n = 1 ROM RAM F ROM RAM F ROM RAM F ROM RAM F ROM RAM F ROM RAM F ROM RAM F = = = = = our proposed scheme is more efficient than the bivariate poynomia-based scheme in terms of computationa overhead, energy consumption, deivery ratio, message deay, and memory consumption. ACKNOWLEDGEMENTS This research was partiay supported by the NSF under grants CNS , CNS and CND REFERENCES [1] C. Bundo, A. De Santis, A. Herzberg, S. Kutten, U. Vaccaro, and M. Yung, Perfecty-secure key distribution for dynamic conferences, in Advances in Cryptoogy - Crypto 92, Lecture Notes in Computer Science Voume 740, pp , [2] W. Zhang, N. Subramanian, and G. Wang, Lightweight and compromiseresiient message authentication in sensor networks, in IEEE INFOCOM, (Phoenix, AZ.), Apri [3] M. Abrecht, C. Gentry, S. Haevi, and J. Katz, Attacking cryptographic schemes based on perturbation poynomias. Cryptoogy eprint Archive, Report 2009/098, [4] D. Pointcheva and J. Stern, Security proofs for signature schemes, in Advances in Cryptoogy - EUROCRYPT, Lecture Notes in Computer Science Voume 1070, pp , [5] L. Harn and Y. Xu, Design of generaized EGama type digita signature schemes based on discret ogarithm, Eectronics Letters, vo. 30, no. 24, pp , [6] K. Nyberg and R. A. Rueppe, Message recovery for signature schemes based on the discrete ogarithm probem, in Advances in Cryptoogy - EUROCRYPT, Lecture Notes in Computer Science Voume 950, pp , [7] H. Wang, S. Sheng, C. Tan, and Q. Li, Comparing symmetric-key and pubic-key based security schemes in sensor networks: A case study of user access contro, in IEEE ICDCS, (Beijing, China), pp , [8] D. Chaum, Untraceabe eectronic mai, return addresses, and digita pseudonyms, Communications of the ACM, vo. 24, pp , February [9] R. Rivest, A. Shamir, and Y. Tauman, How to eak a secret, in Advances in Cryptoogy ASIACRYPT, Lecture Notes in Computer Science, vo 2248/2001, Springer Berin / Heideberg,