Know Your Neighbor, Keep Your Distance and other cautionary tales for wireless systems

Transcription

1 Know Your Neighbor, Keep Your Distance and other cautionary tales for wireless systems Panos Papadimitratos Joint work with M. Poturalski, M. Fleury, J.-P. Hubaux, and J.-Y. Le oudec Wireless Systems Wireless local area networks (WLNs) Link to the Internet Wireless ccess Point 5 6 1

2 Wireless Systems (cont d) WLNs, Personal rea (PNs), d hoc Networks Wireless Systems (cont d) Radio Frequency Identification (RFID) Tagged object Reading signal ID Detailed object information Wi-Fi and luetooth enabled devices ID ack-end database L.. Illustration: Ericsson, ca Wireless Systems (cont d) Sensor networks Wireless Systems (cont d) Tactical ad hoc networks Military Search-and-rescue Node photos: Xow 9 1 Wireless Systems (cont d) Vehicular ad hoc networks (VNETs) Wireless Systems (cont d) set of basic elements Radio link establishment Direct wireless communication Multi-hop communication Distance to other reachable devices Device localization and own positioning pplication performance measurable in the physical world Illustration: C2C-CC

3 Wireless Systems Security set of basic elements KYN, KYD, and other cautionary tales for wireless systems nti-jamming techniques Secure Neighbor Discovery Secure data communication Secure ranging Distance bounding Secure localization and positioning Know Your Neighbor Vehicular Communications transportation safety KYN, KYD, and other cautionary tales for wireless systems Neighbor Discovery (ND) Secure Neighbor Discovery C Neighbor Discovery (ND) node discovers other nodes it can directly communicate with D Neighbor Discovery (ND) (cont d) Neighbor Discovery (ND) (cont d) Hello, I m R is neighbor of if and only if it can receive directly from Link (,) is up is neighbor of R R, i.e., (,) may be up while (,) is down 17 R Simple, widely used solution, but not secure Easy to attack Mislead that is its neighbor, when this is not the case 18 : is my neighbor ; is added in my Neighbor List 3

4 ttacking ND Securing ND M Hello, I m Hello, I m C Hello, I m Z Single adversary appears as multiple neighbors 19 : Neighbor List = {, C,, Z} (1) n, (2), n, n,, Sig (, n,n, ), Cert C (K,) n attempt Message authenticity and replay protection n, n are nonces ob essentially challenges lice to provide a hello message 2 ttacking ND (cont d) Relay or Wormhole ttack Simply relay any message, without any modification ttacking ND (cont d) Long-range relay / wormhole The attacker relays messages across large distances : Neighbor List = {} Hello, I m Hello, I m M 1 M out-of-band or 2 private channel Hello, I m : Neighbor List = {} M ttacking ND: Implications Routing in multihop ad hoc networks ttacking ND: Implications (cont d) Routing in multihop ad hoc networks

5 ttacking ND: Implications (cont d) Routing in multihop ad hoc networks ttacking ND: Implications (cont d) RFID-based access control 25 ttacker close to the access-granting RFID tag Relays signals from and to her accomplice, who obtains access Z. Kfir and. Wool, Picking virtual pockets using relay attacks on contactless smartcard, SECURECOMM 5 26 Securing Two-Party ND asic ideas uthentication Node-to-node distance estimation P x>r : P not neighbor Y<R : P neighbor x 27 y R Securing Two-Party ND (cont d) Use message time-of-flight to measure distance Distance ounding [1] Temporal Packet Leashes [2] SECTOR [3] Use node location to measure distance Geographical Packet Leashes [2] [1] S. rands and D. Chaum, Distance-bounding protocols, EUROCRYPT 93 [2] Y.-C. Hu,. Perrig, and D.. Johnson. Packet leashes: defense against wormhole attacks in wireless networks, IEEE INFOCOM 3 [3] S. Capkun, L. uttyan, and J.-P. Hubaux, SECTOR: Secure Tracking of Node Encounters in Multi-hop Wireless Networks, CM SSN 3 28 Securing Two-Party ND (cont d) re these protocols [1,2,3] achieving secure ND? Can any protocol, including and similar to [1,2,3], which can measure time, solve the secure ND problem? Is there any provably secure ND protocol? Note: Measurements can be *very* accurate None of the above protocols secures ND No (secure) ND protocol that relies on time measurements does 29 Traces and Events Trace is a set of events C 3 5

6 Feasible Traces Setting S System execution: feasible trace Traces feasible with respect to: Θ S Θ S,P Θ S,P, Θ - Setting S - Protocol P - dversary E {,, C, D, E, D F, G, H } F H G Trace θ Feasible wrt Setting S Causal and timely message exchange Trace θ Feasible wrt Setting S (cont d) Causal and timely message exchange v signal propagation speed Local Trace Protocol P Local view Protocol ctions

7 Trace θ Feasible wrt Protocol Correct nodes follow the protocol Trace θ Feasible wrt dversary dversarial nodes can only relay messages with minimum delay Denote the adversary as: Neighbor Discovery Specification Neighbor Discovery Specification (cont d) Protocol P solves Neighbor Discovery for adversary if 1) Discovered neighbors are actual neighbors 2) It is possible to discover neighbors Protocol P solves Two-Party Neighbor Discovery for adversary if 1) Discovered neighbors are actual neighbors 2) It is possible to discover neighbors in the ND range R 39 4 T-protocol Impossibility Theorem:No T-protocol can solve Neighbor Discovery for adversary if. Proof (sketch): ny T-protocol P that satisfies ND2 cannot satisfy ND1 Observation: Physical proximity does not necessarily imply correct nodes are able to Results T-protocol ND impossibility (general case) T-protocol solving ND (restricted case) TL-protocol solving ND (general case) M. Poturalski, P. P., and J-P. Hubaux, Secure Neighbor Discovery in Wireless Networks: Formal Investigation of Possibility, CM SICCS 28 M. Poturalski, P. P., and J-P. Hubaux, Secure Neighbor Discovery: Is it Possible? LC-REPORT-27-4, 27 communicate directly

8 Protocol P CR/TL Challenge-Response/Time-and-Location ND Properties Revisited (cont d) Correctness: challenge message response message vailability: authenticator message T P protocol specific duration Protocol P CR/TL (cont d) Theorem: Protocol P CR/TL satisfies the Neighbor Discovery Specification: Correctness (ND1) vailability (ND2 CR/TL ) Under the assumptions: i. ny processing delay relay > ii. Equality of maximum information propagation speed and wireless channel propagation speed v adv = v Summary Secure Neighbor Discovery Prerequisite for: Networking protocols Various applications System security Hard problem Proven secure solutions Implementation not easy in practice M. Poturalski, P. P., and J.-P. Hubaux, Towards provable secure neighbor discovery in wireless networks, CM CCS FMSE dditional Readings Overview P. P., M. Poturalski, P. Schaller, P. Lafourcade, D. asin, S. Capkun, and J-P. Hubaux, "Secure Neighborhood Discovery: Fundamental Element for Mobile d Hoc Networking," IEEE Communications Magazine, February 28 Implementation R. Shokri, M. Poturalski, G. Ravot, P. P., and J.-P. Hubaux, Low- Cost Secure Neighbor Verification Protocol for Wireless Sensor Networks, CM WiSec, March 29 lternative: Detect relays (aka wormholes) E.g., statistically and centrally Chapter 6 of Security and Cooperation in Wireless Networks, by L. uttyan and J.-P. Hubaux, Cambridge Press, 27 KYN, KYD, and other cautionary tales for wireless systems Keep Your Distance

9 KYN, KYD, and other cautionary tales for wireless systems Ranging / Distance ounding (D) Secure Ranging / Distance ounding Ranging : Obtains d(,), an estimate of d,, the actual, distance Distance bounding : Obtains D(,), a bound s.t. d, D(,) 49 5 ttacking Ranging / D ttack Implications, exchange a sequence of messages, including own measurements (e.g., times of arrival) The attacker,, provides fake inputs, to manipulate (shorten or lengthen) the d(,) calculated by Caution uthentication does not solve the problem Computation delays could dwarf measurements 51 Safe Storage Manipulation of calculated distance Illegitimate physical space access Defeating a theft detection system 52 ttacking Ranging / D (cont d) Verifier Verifier Verifier Prover Dishonest Prover Colluding Dishonest 53 Prover Mafia Fraud or Relay ttack Distance Fraud ttack Terrorist Fraud ttack Securing Ranging / D (cont d) uthenticated ranging can defeat relay (mafia fraud) attacks To defeat the distance fraud attacks: Distance-related measurements based on sufficiently fast and simple actions by the honest prover dishonest prover cannot perform the same action faster than an honest prover dishonest prover cannot appear closer to the verifier than it actually is 54 9

10 Distance ounding S. rands and D. Chaum, Distance-bounding protocols, dvances in Cryptology, EUROCRYPT (RE) Distance ounding (cont d) Distance bounding [rands & Chaum] Phase 1: Prover sends out a commitment to a random n-bit value Phase 2: Rapid it Exchange (RE); the Verifier sends 1-bit challenges to Prover, which then XOR s this with the corresponding bit of the comment t each RE, the verifier measures the round-trip (V-P- V) delay Phase 3: The Prover opens the commitment and the Verifier calculates the distance bound (the maximum of all RE-measured delays) Success of attack: 1/2 n n attacker can only guess the 1-bit responses 56 Summary [CapkunH3] - Mutual D [CapkunHubaux6] - No RE - uth. ranging [SingleePreneel7] - noise-tolerant, ½ n [randschaum93] - Mafia-resistant, ½ n [HanckeKuhn5] - Noise-tolerant, w/o noise ¾ n [MunillaOP6] - Void challenges, 3/5 n 57 old fonts: Design for resistance to terrorist fraud attacks [ussardagga4] - symmetric crypto - Proof of Knowledge [ReidGNTS6] - Symmetric crypto, ¾ n [Piramuthu7] - 7/8 n [TuPiramuthu7] [MunillaPeinado8] - 4-REs, 9/16 - [voinetchamkerten9] n [KimKSP8] - HK ¾ n n½ n, memory cost - 1/2 n [MeadowsPPChS7] [NikovVauclair8] - Rapid it-chunk Exchange [SchallerSchC9] References [voinetchamkerten9] G. voine and. Tchamkerten, n Efficient Distance ounding RFID uthentication Protocol: alancing False-cceptance Rate and Memory Requirement, ISC 29 [randschaum93] S. rands and D. Chaum, Distance-bounding protocols, EUROCRYPT 93 [ussardagga4] L. ussard and W. agga, Distance-ounding Proof of Knowledge Protocols to void Terrorist Fraud ttacks, EUROCOM Tech. Report, RR-4-19, 24 [CapkunH3] S. Capkun, L. uttyan, and J.-P. Hubaux, SECTOR: Secure Tracking of Node Encounters in Multi-hop Wireless Networks, SSN 23 [CapkunHubaux6] S. Capkun and J.P. Hubaux, Secure positioning in wireless networks, JSC 26 [HanckeKuhn5] G. Hancke and M. Kuhn, n RFID Distance ounding Protocol, SecureComm 25 [KimKSP8] C.H. Kim, G. voine, F. Koeune, F.-X. Standaert and O. Pereira, The Swiss-Knife RFID Distance ounding Protocol, ICISC References (cont d) [MeadowsPPChS7] C. Meadows, R. Poovendran, D. Pavlovic, L. Chang, and P. Syverson, Distance bounding protocols: uthentication logic analysis and collusion attacks, Sec. Loc. and Time Sync. for Wireless Sensor and d Hoc Networks, 26 [MunillaOP6] J. Munilla,. Ortiz and. Peinado, Distance ounding Protocols with Void Challenges for RFID, RFIDSec26 [MunillaPeinado8] J. Munilla and. Peinado, ttacks on Singelee and Preneel's protocol, eprint, 28 [NikovVauclair8] V. Nikov and M. Vauclair, Yet nother Secure Distance-ounding Protocol, eprint, 28 [Piramuthu7] S. Piramuthu, Protocols for RFID tag/reader authentication, Decision Support Systems 27 [ReidGNTS6] J. Reid, J. Nieto, T. Tang, and. Senadji, Detecting relay attacks with timing-based protocols, SICCS 27 [SchallerSchC9] P. Schaller,. Schmidt, D. asin, S. Capkun, Modeling and Verifying Physical Properties of Security Protocols for Wireless Networks, CSF 29 [SingleePreneel7] D. Singelee and. Preneel, Distance ounding in Noisy Environments, ESS 27 [TuPiramuthu7] Y.-J. Tu and S. Piramuthu, RFID Distance ounding Protocols, RFID Technology ttacks at the Physical Layer External adversaries at the physical layer: Early Detection / Late Commit J. Clulow, G. Hancke, M. Kuhn, and T. Moore, So Near and Yet So Far: Distance-ounding ttacks in Wireless Networks, ESS 26 Objective: Reduce measured distance pproach: Take advantage of redundancy at the physical layer 6 1

11 ttacks at the Physical Layer (cont d) ssume OOK: 1 ttacks at the Physical Layer (cont d) Early Detection : an adversarial receiver does not wait for the end of the symbol Late Commit : an adversarial transmitter can defer its signal transmission 1 1 RX TX Honest Transmitter dversarial Receiver dversarial Transmitter Honest Receiver ttacks at the Physical Layer (cont d) Honest TX ttacks at the Physical Layer (cont d) Honest TX dversarial RX Early detection dversarial RX Early detection dversarial TX dversarial TX Late commit Honest RX Honest RX Result : Premature arrival Distance decreasing attack ttacks at the Physical Layer (cont d) Impulse Radio Ultra Wide and (IR-UW) Highly precise (sub-meter) ranging Resilience to multipath propagation IEEE a standard No rapid bit exchange ttacking IR-UW Ranging Distance-decreasing relay attack IEEE a standard Mandatory modes Energy detector receiver Early detection (ED) and late commit (LC) combined Distance decrease of up to 14m Success rate can be made arbitrarily high Transmitted signal Received signal Sampled signal (energy detector receiver) M. Fleury, M. Poturalski, P. P., J.-Y. Le oudec, and J.-P. Hubaux, Distance-decreasing ttacks gainst Secure Impulse Radio Ranging, CM WiSec

12 ttacking IR-UW Ranging (cont d) ttacking IR-UW Ranging (cont d) RX TX preamble payload Early detection (ED) preamble payload Late commit (LC) preamble payload RX 496 ns preamble symbol preamble payload TX Challenge : Transmission time and payload are not known to the adversary in advance 67 45ns ~ 135m Distance decrease Preamble 68 ttacking IR-UW Ranging (cont d) ttacking IR-UW Ranging (cont d) RX RX acquisition TX TX 496ns 45ns Preamble Preamble 69 7 ttacking IR-UW Ranging (cont d) ttacking IR-UW Ranging (cont d) Start Frame Delimiter (SFD) - - RX cquisition S RX Early SFD Normal detection SFD detection - - TX 496ns 45ns S TX S Preamble Preamble

13 ttacking IR-UW Ranging (cont d) ttacking IR-UW Ranging (cont d) Start Frame Delimiter (SFD) Start Frame Delimiter (SFD) RX Early SFD detection - - RX Early SFD detection - - TX Late SFD commit - - TX Late SFD commit Preamble Time-shift: 45ns Preamble ttacking IR-UW Ranging (cont d) ttacking IR-UW Ranging (cont d) RX TX 124ns ~7ns 8ns 1 inary PPM RX TX 124ns 8ns inary PPM 1 enign receiver >< > < 1 Payload Payload ttacking IR-UW Ranging (cont d) RX TX Payload 124ns 8ns inary PPM LC ED >< > < 1 ttacking IR-UW Ranging (cont d) RX TX Payload 124ns 8ns inary PPM LC 1 > < > < Relay time-shift 45ns = 512ns 62ns = half symbol duration early detection time 78 ED 13

14 ttacking IR-UW Ranging (cont d) ttacking IR-UW Ranging (cont d) Packet Error Ratio 1.7d Packet Error Ratio 4d RX SNR [d] Payload: Early detection Payload: Late commit 79 8 SNR [d] ttacking IR-UW Ranging (cont d) Probability of attack success Early detection SNR (RX) Late commit SNR () Summary (cont d) Physical layer attacks are PHY-specific For IR UW: >99% attack success probability 4d (RX) and 6d () higher than SNR necessary for benign operation Easily to mount attacks External adversaries High gain antennas Increased transmision power Placement close to victim devices Summary (cont d) Jail relay??? Know Your Neighbor, Keep Your Distance and other cautionary tales for wireless systems Panos Papadimitratos Joint work with M. Poturalski, M. Fleury, J.-P. Hubaux, and J.-Y. Le oudec panos.papadimitratos@epfl.ch