Secure Ad-Hoc Routing Protocols

Transcription

1 Secure Ad-Hoc Routing Protocols ARIADNE (A secure on demand RoutIng protocol for Ad-Hoc Networks & TESLA ARAN (A Routing protocol for Ad-hoc Networks SEAD (Secure Efficient Distance Vector Routing Protocol for Ad-Hoc Network

2 Routing Transfer of information from one router to another router Routing has been divided into two categories Distance Vector Protocol Link State Protocol Drawback Periodic updates required. Routing loops possible

3 Ad-hoc Routing. The Difference Nodes are mobile Each node is router as well as host Problems Nodes are resource constrained Limited CPU power Limited Memory Limited Battery Power Network Bandwidth limited

4 Ad-Hoc Routing requirements Secure Minimum communication requirements Minimum computational requirements Minimum energy consumption

5 Attacks Modification Fabrication Impersonation Dropping Packets Denial Of Service

6 Ad-hoc routing Protocols Classes of routing protocols On-Demand (static Distance Vector Routing protocols DSR DSDV Security extensions ARAN Ariadne SEAD

7 ARIADNE Overview Secure extension of DSR Uses symmetric cryptosystem with asymmetric primitive TESLA used to achieve the asymmetric primitive Why TESLA? Broadcast Authentication

8 Timed Efficient Stream Loss-tolerant Authentication Broadcast Authentication Protocol. How it works? Requires MAC and One-Way Hash-key chain and shared secret key Delayed key disclosure Requires the sender and receiver to loosely synchronize their time

9 One Way chains Diagram : Generate Disclosure is opposite of generation. F(K1 F(K2 F(K l -1 K Kl-2 0 K 1 K l-1 F(K l F ( - One way Hash Function. K l - Random Value. Use/Reveal

10 Time Synchronization Diagram : t R δ tr,n (t S,N K s -1 t S t R Receiver time at sending the query t S - Sender time - Max Synchronization error δ - Actual Synchronization error K s -1 - Private key of Sender N - Nonce by Receiver

11 TESLA Sketch Cont d Authenticate the keys F(K i = K i-1 K 0 F(K 1 K 1 F(K 2 K2 F(K 3 K3 F(K 4 K 4 F(K 5 K 5 F (K 1 F (K 2 F (K 3 F (K 4 Generate MAC keys using F hash function Time K 1 K 2 K 3 K 4 K 5 interval M 1, MAC K 1 (M 1 M 2, MAC K 2 (M 2, M 3, MAC K 3 (M 3, M 4, MAC K 4 (M 4, M 5, MAC K 5 (M 5, Key Disclosure Delay, K 1 K 2 K 3 d = 2

12 TESLA Sketch Cont d Simplified TESLA protocol: Perfect time synchronization F function not used K 0 F(K 1 K 1 F(K 2 K 2 F(K 3 K 3 F(K 4 F(K 5 K 4 K 5 Key Disclosure Delay, Time interval M 1, d = 2 M 2, M 3, M 4, Sender s time Time interval MAC K1 (M 1 MAC K2 (M 2, MACK3 (M 3, K 1 MAC K4 (M 4, K 2 Receiver s time Message M 1 accepted

13 TESLA Sketch Cont d Simplified TESLA protocol: Perfect time synchronization F function not used K 0 F(K 1 K 1 F(K 2 K2 F(K 3 K3 F(K 4 F(K 5 K K 5 4 Time interval Sender s time M 1, M 2, M 3, M 4, Time interval MAC K1 (M 1 MAC K2 (M 2, MACK3 (M 3, K 1 MAC K4 (M 4, K 2 Receiver s time Message M 1 rejected

14 TESLA Sketch Cont d Simplified TESLA protocol: F function not used but only loose synchronization K 0 F(K 1 K 1 F(K 2 K2 F(K 3 K3 F(K 4 F(K 5 K K 5 4 Time interval Sender s time M 1, M 2, M 3, M 4, Time interval MAC K 1 (M 1 MAC K 2 (M 2, MAC K 3 (M 3, K 1 MAC K 4 (M 4, K 2 Receiver s time Message M 1 rejected - synchronization error

15 ARIADNE Assumptions All nodes are aware about Assumes a shared-key setup between sender and receiver All assumptions that are valid for TESLA

16 Design Goals Authentication of Target Shared Key. Authentication of Data in Route Requests. TESLA Digital Signatures MACs A mechanism to verify that no node is missing. Per Hop Hashing.

17 ARIADNE FLOW DIAGRAM Share key between source and destination Send Route Request Yes Node!= Target No Target generates MAC covering entire message Send Reply Each Node appends its Tesla Key Append node name to the node list Extend hash chain Compute MAC with Tesla secret key and add this MAC to the MAC chain Source verifies all MACs End of Route Discovery

18 Route Maintenance A node returns a Route Error if it cannot reach a node. Route replies have to be authenticated. Route Reply Packet: Route Error Sending Addr Receiving Addr Time Inter Error MAC Tesla Key Sending Addr Error Encountering Node. Receiving Addr Error Node. Time Interval TESLA interval. Authentication delayed since packets are buffered. The routes are stored till authentication is received in terms of TESLA key. Once the authentication is received all the routes are removed.

19 ARAN Overview Requirements Prevent alteration of data in route request and reply.

20 Certification Requires a Trusted authority T, to issue certificates. Format of certificate T -> cert A = [ IP A, K A, t, e ] K -1 t. IP A = IP Address of A. K A = Public key of A t = Time the certificate was issued. e = Time the certificate expires. K -1 t = Private key of T. IP Address A Public Key A Creation Time Time to Live

21 ARAN Route Discovery Route Request from A -> X { [REP, IPa, CertX, Na,t ] [REP, IPa, CertX, Na, t] Kx-1 Kx-1 }Kc-1CertC { [REP, IPa, CertX, Na,t ]Kx-1 }Kb-1 CertB A { [RDP, IPx, CertA, Na,t ]Ka-1} { [RDP, IPx, CertA, Na,t ] Ka-1 } Kc-1 CertC B C X Kb-1 CertB [REP, IPx, CertA, Na, t] Ka-1

22 Route Maintenance Each node deletes route if no traffic is detected for certain interval of time. Data received on deleted ROUTE causes ERR. ERR Packet : Same Packet used for Broken links and Deleted routes. All ERR messages should be signed. A node tries certain number of times before generating a ERR packet. B -> C : {[ERR, IP A, IP x, CERT B, Nb, t ] K B -1 }. ERR = Error packet. IPa = IP address of source. IPx = IP address of destination. Nb & t = Nonce and timestamp to ensure freshness. Difficult to determine whether the ERR packet was generated due to broken link or not.

23 SEAD Secure Efficient Ad hoc Distance vector routing protocol Secure Extension of DSDV Uses one-way hash functions to authenticate routing updates.

24 Assumptions All nodes should be aware of the network diameter (m A mechanism to distribute commitment of a chain Every node generates a hash chain of length (n, which is divisible by (m

25 Metric & Sequence # Authentication A node computes one-way hash chain and shares the commitment with the network. It uses one-way hash chain to authenticate routing updates let h0, h1, h2.hn be hash chain values i = sequence number Then, K = n/m -i An element from hkm, hkm+1..hkm+m-1 used to authenticate routing update. If metric is j, 0<j<m, then hkm+j is used to authenticate routing update for that sequence #

26 SEAD Metric Authentication Metric Seq_No = Metric Seq_No = Metric Seq_No = Hash Values

27 Security Analysis Attacks ARIADNE ARAN SEAD Modification Yes Yes No Impersonation Yes Yes Yes Fabrication Yes Yes Yes Packet Dropping Yes/ Discovered later No, if node compromised No Gratuitous detour Yes Yes No Eavesdropping No No No DoS No/Proposes a scheme No No Unauthorized Participation Yes Yes Yes

28 Performance Analysis ARIADNE and SEAD Packet Delivery ratio Average Latency Packet delivery ratio Average Latency Packet delivery ratio SEAD DSDV DSR ARIADNE Average Latency SEAD DSDV DSR ARIADNE X Pause Time Pause Time

29 Performance Analysis (contd Packet Overhead Byte Overhead Packet Overhead Byte Overhead Paket Overhead SEAD DSDV DSR ARIADNE X Byte Overhead SEAD DSDV DSR ARIADNE Pause Time Pause Time

30 Performance Analysis... ARAN Average packet Latency delivery fraction Average Routing load (Packets Average Packet Delivery Fraction ARAN AODV Node Speed (m/s Average Routing Load (packets AODV ARAN Node Speed (m/s

31 ARAN Average Routing load (bytes Average Path Length Average Routing Load (bytes AODV ARAN Node Speed (m/s Average Path Length AODV ARAN Node Speed (m/s

32 Performance Analysis ARAN Average Data Packet Latency Average Data Pakcet Latency(ms AODV ARAN Node Speed (m/s

33 Conclusion Ariadne Innovative Design Memory expensive Requires Time Synchronization Extremely Secure

34 Conclusion SEAD Better Performance than Ariadne Fundamentally difficult to secure Distance vector protocol Does not handle modern attacks Black hole, Gray hole etc. Difficult to incorporate security features to guard against future security attacks

35 Conclusion ARAN High Performance overhead Authenticity dependent on IP address of a mobile node Doubtful Security heavily dependent on Certification Authority Has a good key Revocation feature

36 References Kimaya Sanzgiri, Bridget Dahill, Brian Neil Levine, Clay Shields, Elizabeth Belding-Royer ARAN Yih-Chun Hu, David B Johnson, and Adrian Perrig, ARIADNE Time efficient stream loss-tolerant Authentication. Yih-Chun Hu, David B Johnson, and Adrian Perrig, SEAD Adrian Perrig, Ran Canetti, J.D. Tyagar, Dawn Song, TESLA

37 THANK YOU!