Efficient and Resilient Key Discovery based on Pseudo-Random Key Pre-Deployment

Transcription

1 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 1 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment Roerto Di Pietro, Luigi V. Mncini, nd Alessndro Mei Deprtment of Computer Science University of Rome L Spienz, Itly

2 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 2 Wireless Sensor Networks Lrge numer of low-end processor sensors;

3 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 2 Wireless Sensor Networks Lrge numer of low-end processor sensors; sensors do not rely on ny infrstructure; wireless communictions; no se sttions;

4 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 2 Wireless Sensor Networks Lrge numer of low-end processor sensors; sensors do not rely on ny infrstructure; wireless communictions; no se sttions; sensors re ttery equipped; energy is n issue; no symmetric cryptogrphy;

5 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 2 Wireless Sensor Networks Lrge numer of low-end processor sensors; sensors do not rely on ny infrstructure; wireless communictions; no se sttions; sensors re ttery equipped; energy is n issue; no symmetric cryptogrphy; sensors re not tmper resistnt.

6 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 2 Wireless Sensor Networks Lrge numer of low-end processor sensors; sensors do not rely on ny infrstructure; wireless communictions; no se sttions; sensors re ttery equipped; energy is n issue; no symmetric cryptogrphy; sensors re not tmper resistnt. Gol: ny pir of sensors should e le to gree on privte key. Compromise of few sensors should not compromise the whole network.

7 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 3 Eschenuer nd Gligor s Seminl Work First, uild lrge pool P of p rndom keys. P

8 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 3 Eschenuer nd Gligor s Seminl Work First, uild lrge pool P of p rndom keys. Key Pre-Deployment For ech sensor s, rndomly select m keys from the pool nd ssign them to the sensor s; P

9 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 3 Eschenuer nd Gligor s Seminl Work First, uild lrge pool P of p rndom keys. Key Pre-Deployment For ech sensor s, rndomly select m keys from the pool nd ssign them to the sensor s; P Key Discovery Two sensors discover common keys nd gree on suset of them to secure the chnnel.

10 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 4 Follow-ups Multi-pth key enforcement: Chn, Perrig, nd Song (S&P 2003); key shring + Blom s scheme: Du, Deng, Hn, nd Vrshney (CCS 2003); key shring + Blundo s scheme: Liu nd Ning (CCS 2003); loction sed predistriution of keys: Liu nd Ning (SASN 2003); coopertive protocol: Di Pietro, Mncini, nd Mei (SASN 2003); pseudo-rndom predistriution of keys: Zhu, Xu, Seti, nd Jjodi (ICNP 2003).

11 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 5 The Olivious nd the Smrt Attcker The olivious ttcker: the next sensor to e tmpered with is chosen rndomly;

12 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 5 The Olivious nd the Smrt Attcker The olivious ttcker: the next sensor to e tmpered with is chosen rndomly; Defn 1. Assume tht the ttcker s gol is to collect suset T of the keys in the pool. The ttcker hs lredy compromised numer of sensors, nd hs collected ll their keys in set W. For every sensor s in the WSN, the key informtion gin G(s) is rndom vrile equl to the numer of keys in the key ring of s which re in T nd re not in W.

13 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 5 The Olivious nd the Smrt Attcker The olivious ttcker: the next sensor to e tmpered with is chosen rndomly; Defn 1. Assume tht the ttcker s gol is to collect suset T of the keys in the pool. The ttcker hs lredy compromised numer of sensors, nd hs collected ll their keys in set W. For every sensor s in the WSN, the key informtion gin G(s) is rndom vrile equl to the numer of keys in the key ring of s which re in T nd re not in W. the smrt ttcker: the next sensor to e tmper with is sensor s, where s mximizes E[G(s) I(s)], the expecttion of the key informtion gin G(s) given informtion I(s) tht the ttcker knows on sensor s key ring.

14 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction Ech sensor rodcsts the indexes (colors) of its keys;

15 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction lue! Ech sensor rodcsts the indexes (colors) of its keys;

16 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction red! lue! Ech sensor rodcsts the indexes (colors) of its keys;

17 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction green! red! lue! Ech sensor rodcsts the indexes (colors) of its keys;

18 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! Ech sensor rodcsts the indexes (colors) of its keys;

19 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! yellow! Ech sensor rodcsts the indexes (colors) of its keys;

20 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! pink! yellow! Ech sensor rodcsts the indexes (colors) of its keys;

21 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! red! pink! yellow! Ech sensor rodcsts the indexes (colors) of its keys;

22 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! cyn! red! pink! yellow! Ech sensor rodcsts the indexes (colors) of its keys;

23 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! cyn! red! pink! yellow! Ech sensor rodcsts the indexes (colors) of its keys;

24 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! cyn! red! pink! yellow! Ech sensor rodcsts the indexes (colors) of its keys; Informtion lek: Also the possile ttcker cn know the colors of the keys in ech sensor;

25 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! cyn! red! pink! yellow! Ech sensor rodcsts the indexes (colors) of its keys; Informtion lek: Also the possile ttcker cn know the colors of the keys in ech sensor; Energy: k messges hve to e sent nd received.

26 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 6 Index Notifiction ornge! green! red! lue! cyn! red! pink! yellow! Ech sensor rodcsts the indexes (colors) of its keys; Informtion lek: Also the possile ttcker cn know the colors of the keys in ech sensor; Energy: k messges hve to e sent nd received. Authentiction: Sensor is not sure of the identity of.

27 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys;

28 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys;

29 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys;

30 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys;

31 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys;

32 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys;

33 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys;

34 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys; Informtion lek: The ttcker cnnot know the colors of the keys in ech sensor (if he does not know the secret keys);

35 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys; Informtion lek: The ttcker cnnot know the colors of the keys in ech sensor (if he does not know the secret keys); Energy: k messges hve to e sent nd received.

36 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 7 Chllenge Response Ech sensor rodcsts chllenge encrypted with ech of its keys; Informtion lek: The ttcker cnnot know the colors of the keys in ech sensor (if he does not know the secret keys); Energy: k messges hve to e sent nd received. Authentiction: Sensor is not sure of the identity of.

37 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 8 Pseudo-Rndom Assignment of Keys Keys to e ssigned re selected using pseudo-rndom numer genertor, strting from pulicly known seed dependent on the sensor s id.

38 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 8 Pseudo-Rndom Assignment of Keys Keys to e ssigned re selected using pseudo-rndom numer genertor, strting from pulicly known seed dependent on the sensor s id.

39 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 8 Pseudo-Rndom Assignment of Keys Keys to e ssigned re selected using pseudo-rndom numer genertor, strting from pulicly known seed dependent on the sensor s id. Informtion lek: Also the possile ttcker cn know the colors of the keys in ech sensor;

40 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 8 Pseudo-Rndom Assignment of Keys Keys to e ssigned re selected using pseudo-rndom numer genertor, strting from pulicly known seed dependent on the sensor s id. Informtion lek: Also the possile ttcker cn know the colors of the keys in ech sensor; Energy: 0 messges hve to e sent nd received.

41 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 8 Pseudo-Rndom Assignment of Keys Keys to e ssigned re selected using pseudo-rndom numer genertor, strting from pulicly known seed dependent on the sensor s id. Informtion lek: Also the possile ttcker cn know the colors of the keys in ech sensor; Energy: 0 messges hve to e sent nd received. Authentiction: Sensor is proilisticlly sure of the identity of.

42 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 9 Pseudo-Rndom Functions Defn 2. A pseudo-rndom function is n efficient (deterministic) lgorithm which given n h-it seed, y, nd n h-it rgument, x, returns n h-it string, denoted f y (x), so tht it is infesile to distinguish the responses of f y, for uniformly chosen y, from the responses of truly rndom function.

43 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 9 Pseudo-Rndom Functions Defn 2. A pseudo-rndom function is n efficient (deterministic) lgorithm which given n h-it seed, y, nd n h-it rgument, x, returns n h-it string, denoted f y (x), so tht it is infesile to distinguish the responses of f y, for uniformly chosen y, from the responses of truly rndom function. We ssume we hve ccess to pseudo-rndom function f y, where y is uniformly chosen;

44 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 9 Pseudo-Rndom Functions Defn 2. A pseudo-rndom function is n efficient (deterministic) lgorithm which given n h-it seed, y, nd n h-it rgument, x, returns n h-it string, denoted f y (x), so tht it is infesile to distinguish the responses of f y, for uniformly chosen y, from the responses of truly rndom function. We ssume we hve ccess to pseudo-rndom function f y, where y is uniformly chosen; s consequence of the ove definition, the output of f y cn e delt with s eing rndom for ll our purposes.

45 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 10 New Key Discovery For ech sensor, for ech key k of the pool: 1. Compute z = f y ( k);

46 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 10 New Key Discovery For ech sensor, for ech key k of the pool: 1. Compute z = f y ( k); 2. if z 0 mod (p/m) then ssign key k to sensor.

47 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 10 New Key Discovery For ech sensor, for ech key k of the pool: 1. Compute z = f y ( k); 2. if z 0 mod (p/m) then ssign key k to sensor. Informtion lek: The ttcker cnnot know the colors of the keys in ech sensor (if he does not know the secret keys): f y is one-wy;

48 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 10 New Key Discovery For ech sensor, for ech key k of the pool: 1. Compute z = f y ( k); 2. if z 0 mod (p/m) then ssign key k to sensor. Informtion lek: The ttcker cnnot know the colors of the keys in ech sensor (if he does not know the secret keys): f y is one-wy; Energy: 0 messges hve to e sent nd received.

49 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 10 New Key Discovery For ech sensor, for ech key k of the pool: 1. Compute z = f y ( k); 2. if z 0 mod (p/m) then ssign key k to sensor. Informtion lek: The ttcker cnnot know the colors of the keys in ech sensor (if he does not know the secret keys): f y is one-wy; Energy: 0 messges hve to e sent nd received. Authentiction: Sensor is proilisticlly sure of the identity of.

50 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 10 New Key Discovery For ech sensor, for ech key k of the pool: 1. Compute z = f y ( k); 2. if z 0 mod (p/m) then ssign key k to sensor. Informtion lek: The ttcker cnnot know the colors of the keys in ech sensor (if he does not know the secret keys): f y is one-wy; Energy: 0 messges hve to e sent nd received. Authentiction: Sensor is proilisticlly sure of the identity of. On verge, m keys re ssigned to ech sensor;

51 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 11 New Key Discovery Security Constrint: t lest m m keys in ech vlid sensor; Hrdwre Constrint: t most m keys in ech vlid sensor; if sensor does not meet either the security of the hrdwre constrint, it must e discrded; Prolem: how mny sensors hve to e generted in order to find vlid one, depending on pool size nd m? Answer: just constnt numer! Theorem 1. Provided tht p m, sensor cn e generted in time O(p) such tht its key ring is composed of t lest m o(m) keys nd t most m keys, with high proility.

52 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 12 Experiments on Sensor Genertion % 95% 99% itertions key ring size

53 Efficient nd Resilient Key Discovery sed on Pseudo-Rndom Key Pre-Deployment p. 13 Experiments on Attcks Olivious ttker - IN, CR, PKIT Olivious ttker - New 95% Smrt ttker - IN, PKIT Smrt ttker - CR, New 99% sensors to corrupt key ring size