Network-centric Security Design for Mobile Ad Hoc Networks

Transcription

1 Network-centric Security Design for Mobile Ad Hoc Networks Songwu Lu Students: Hao Yang, Garry Zhong, Haiyun Luo UCLA Computer Science Outline Problem: Network security in MANET 4 key challenges Current Approaches Self-organizing PGP like Centralized/hierarchical server (KDC or PKI) Our approach Credit based bootstrapping Localized authentication Collaborative detection Two-tier notification 1

2 MANET Characteristics Nodes roam freely Dynamic memberships: node join, leave, failure Multihop, error-prone wireless communication Collaborative networking, vulnerable nodes and wireless links Network Security Problem Security part: Authentication Service availability Message privacy Message integrity Non-repudiation Network part: Service ubiquity for mobile users Anywhere, anytime service Scalable design Fault tolerance and robustness: node failures, errorprone wireless communications Node dynamics: node join, leave, sleep 2

3 Four Key Challenges #1: How to build a self-organizing secure network in a dynamic topological MANET? #2: How to design secure system solution in a collaborative networking environment without trusting each individual? #3: How to provide an intrusion-tolerant (instead of intrusion-free) network security solution? Internet versus telephone network analogy #4: How to trade-off btw. cryptography-centric and network performance-centric design? Network community, cryptography community Popular Approaches for Authentication Self-organizing PGP-like approach Centralized or hierarchical approach: KDC or centralized PKI Hierarchical multi-server 3

4 Centralized/Hierarchical Servers Server Server Server Server Dark side: Single point of DOS attack, compromise, failure Longer access design, smaller success ratio Performance: Service Availability Single server: 50% success ratio; PGP like approach: 89% success, given offered network traffic load 60 pkts/sec 4

5 Performance: Robustness Single server: 75% success ratio for 60-node topology; PGP like approach: 92% success ratio for 5% channel errors Performance: Scalability Single server: 38% success for 90-node case; PGP like approach: 90% for 100-node case 5

6 Our Current Effort Prevention+Detection+Reaction: Credit-based design for bootstrapping Localized collaborative authentication Collaborative detection for misbehaving nodes Scalable two-tier alarming Credit-based Design Basic approach: Each node receives an initial credit Good guys get their credits increased over time Ill-behaving guys got their credits decreased or revoked over time How to express credit In proportional to certificate renew period Good guys get their certificates renewed less and less frequently over time 6

7 Localized Collaborative Authentication Trust K local nodes as a group without completely trusting any individual No single point of DOS attack and compromise One-hop wireless communication Performance: Service Availability 7

8 Performance: Robustness Performance: Scalability 8

9 Additional Design Issues What about not K neighbors within one-hop neighborhood? What if network were partitioned? Collaborative detection Detection at each node No special wisdom: watch-dog like design Better designs can be plugged-in Collaborative detection among neighbors Multiple local nodes perform joint detection A majority voting mechanism 9

10 Alarming How to notify nodes once detecting attackers Collaborations among previous neighborhood and current neighborhood Similar to IP fast handover mechanisms Limitation: Computation Latenty: 100ms for Pentium III, 650ms for Pentium II, 200ms Compaq ipaq for 1024-bit key 10

11 Summary For ad hoc network security, Our study shows that the network performance aspect (rather than cryptographic strength) poses greatest challenge for ad hoc network security Self-organization is a good match for dynamic topological MANET Intrusion-tolerant design raises new issues A fundamental issue is how to build collaborative security system solution without completely trusting each individual node. An exciting research problem 11