Defense Against Selfish PUEA in Cognitive Radio Networks Based on Hash Message Authentication Code

Transcription

1 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar Defense Aganst Selfsh PUEA n Cogntve Rado Networks Based on Hash Message Authentcaton Code Wald Ramadan Ghanem, Mona Shokar, and Moawad I. Dessouky (Correspondng author: Wald Ramadan Ghanem) The Department of Electronc and Electrcal Communcaton, Menoufa Unversty, Egypt (Emal: wald.ghanem.eng@eee.org) (Receved Dec. 11, 2015; revsed and accepted Dec. 26, 2015) Abstract Cogntve rado network (CRN) s a very astute technology developed to solve the spectrum shortage problem n wreless communcaton by utlzng the unused bands, where a secondary user (SU) utlzes the free spectrum of the prmary user (PU) n an opportunstc manner. The CRN defnes the free spectrum sessons usng an ntellgent and sophstcated process called a spectrum sensng. The spectrum sensng encounters a securty problem called prmary user emulaton attack (PUEA). In ths problem, an attacker mmcs the PU sgnal to force the SUs to leave the free band. In ths paper, a proposed model based on hash message authentcaton code (HMAC) s used to detect the PUEA n CRN. HMAC s used to trustng the PU transmsson, whch s not clarfed untl now. A shared secret key s used between the SU and the PU to acheve an accurate dentfcaton of the PU sgnal from the attacker. The effectveness of the proposed approach s analyzed through both theoretcal analyss and Smulaton. Results show that the proposed method s completely defeated the selfsh PUEA and acheves effcent spectrum sharng, moreover, t provdes a good detecton of the PU when error correctng codes are used. Keywords: Cogntve rado network (CRN), hash message authentcaton code (HMAC), physcal layer authentcaton, prmary user emulaton Attack (PUEA) 1 Introducton Cogntve rado (CR) has attracted a strong attenton recently to solve the spectrum shortage problem [19]. Spectrum scarcty becomes a serous challenge to the emergng wreless technologes. In lcensed networks, the prmary users operate n ther allocated lcensed bands. It s recognzed that the lcensed bands are generally underutlzed and ther occupaton fluctuates temporary and geographcally n the range of 15-85%. In a typcal Cogntve Rado (CR) system, the PU s the spectrum lcense holder and the SU s an unlcensed user who ntends to use the spectrum opportunstcally. CR s based on Dynamc Spectrum Access (DSA), where the Prorty s gven to the PU n the sense that SU can only transmt, f ts transmsson s deemed to be a harmless to the PU. The SU s not allowed to transmt when the PU s transmttng [1]. Unused bands (Whte spaces) are dentfed through spectrum sensng process [24], then they are used by the SUs for data transmsson, the spectrum sensng process s contnuously performed to determne the whte spaces, f the prmary user s detected, then the SU must vacate the band for hm. The CR networks are exposed to many attacks one of these attacks s called PUEA. The PUEA s consdered as a physcal layer attack, where a selfsh user (attacker) mmcs the PU sgnal to confuse the SUs to leave the band for hm. Ths leads to low spectrum utlzaton n CRN. PUEA has been studed n many researches. R. Chen proposed to use the locaton of the prmary user to dentfy the PUEA n [9]. S. Annand made an analytcal model based on Fenton s approxmaton and Markov nequalty n [4]. Z. Jn et al. Presented a NeymanPearson composte hypothess test n [15]. and a Wald s sequental probablty rato test to detect the PUEA was descrbed n [16]. Z. Chen showed how the attacker can emulate the PU sgnal to confuse the SU and used an advanced strategy called varance detecton to mtgate the effect of an attacker usng the dfference between the communcaton channel of PUEA and PU n [10]. C. Chen et al made a jont poston verfcaton method to enhance the postonng accuracy n [14]. Cooperatve Spectrum Sensng n CRN n the Presence of the PUEA s proposed n [8]. Fegn Bao et al studed the PUEA wth natonal secondary users n CRN

2 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar and usng a hybrd method based on Energy Detecton (ED) and Varance Detecton n [5]. Kapl M. Borle has developed a physcal layer authentcaton scheme for wreless communcaton n [7]. Advanced encrypton standard was used to mtgate PUEA n [2]. More researches dscussed ths problem wll be found n [3, 6, 12, 13, 21, 22]. In ths paper, a proposed Physcal layer authentcaton based on hash message authentcaton code (HMAC) s used to detect the PUEA n cogntve rado networks whch s not clarfed untl now. Moreover, dfferent codng technques wll be appled. The HMAC s used to generate a tag at the transmtter, ths tag s appended to the message and sent over the channel. At the recever the secondary user separates the message and tag and regenerates a new tag from the shared key and the receved message. By comparng the two tags, the SU determnes f the sgnal comes from the PU or from the attacker. The proposed method provde a good detecton of the PU and t s completely defeated the PUEA under any condton and ables a hgh spectrum usage and hgh effcency. The performance of the system s measured usng the probablty of false alarm and probablty of detecton. The rest of ths paper s organzed as follows In Secton 2, the problem formulaton wll be explaned. In Secton 3, the system model of the system s ntroduced. In Secton 4 the performance metrcs wll be presented. In Secton 5, the analytcal Model Evoluton wll be explaned. In Secton 6 numercal and smulaton results wll be ncluded. Fnally conclusons wll be drawn n Secton 7 2 Problem Formulaton The PUEA s consdered one of the man threats n CRNs. In ths problem, an attacker emulates the PU sgnal to confuse the SU to leave the free spectrum sesson as shown n Fgure 1. The attacker receves the sgnal from the prmary user and emulates t and retransmts the sgnal agan to the SUs. The SUs suppose that the transmsson comes from the PU and therefore, they leave the free spectrum. The PUEA destroys the spectrum sensng process. In Fgure 1, there are three users as follow: Prmary User: A user who has hgher prorty or legacy rghts for the usage of a specfc part of the Spectrum. Secondary User: A user who has a lower prorty and therefore explots the spectrum n such a way that t does not cause any nterference to PUs. Selfsh PUEA: the am of ths attacker s to maxmze the spectrum usage for hmself, by takng the free band and preventng the others SUs from usng t. Ths attacker can mmc the prmary user power, modulaton, sgnal characterstcs and any characterstcs of the PU sgnal. Thus the detecton of the attacker becomes extremely dffcult. The authentcaton s a proper method to solve ths problem. By authentcatng the transmsson between the PU and the SU, ths problem wll be solved easly. 3 System Model In ths secton, the system model wll be descrbed, then the block dagram of the proposed system, whch ncludes the attackers wll be explaned. Fnally the flow chart of the system wll be done as shown n fgure 2. The PU message runs nto the HMAC algorthm to produce the frst HMAC (TAG A) [23], then ths tag s padded wth the message usng TDMA, both of them are encoded, modulated and transmtted to the SUs as shown n fgure.2. The SU ntern runs the message porton of the transmsson through the HMAC algorthm usng the same key that was used by the PU, producng a second HMAC (TAG B), The SU compares the two tags. If they are dentcal the transmsson s assumed to be from the PU and the SU must stop ts transmsson, otherwse a PUEA s n progress. The attacker don not have the same key used by the PU and assumed to be not ntellgent enough to extract the key, therefore, he cannot authentcate hs transmsson. If the attacker uses another key, the SU defnes hm correctly. In Fgure 3, the flow chart of the proposed model s descrbed as follows, frst, a random data represents the PU message s generated, ths data s appled to the HMAC functon to generate the TAG A. The TAG A and the message are added together usng TDMA, then the message s encoded, modulated and transmtted on the channel. The SU receves the data demodulates and decodes t. Then SU separates the TAG from the message, and apples the message part to HMAC to produces a second tag (TAG B). And compares the two tags, f the two tags are dentcal, then the data s consdered from the PU, otherwse, the attacker s n progress and the SU must punsh hm.

3 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar Fgure 1: The basc concept of PUEA n CRN Fgure 2: Block dagram of the proposed system

4 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar Fgure 3: Flow chart of the proposed model

5 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar Performance Matrces In ths secton, the system performance s analyzed by usng false alarm probablty and detecton probablty [10]. Most exstng works on cogntve sensng focused on performng a hypothess testng to decde the presence of the prmary user. H0: the sgnal s from the prmary user H1: the sgnal s from the attacker Probablty of false alarm (PFA): When the sgnal s consdered from the prmary user, the probablty that the SU falsely Identfy the sgnal as from the attacker s defned by [10]: P F A = P r(h 1 \H 0 ). (1) If ths case happens, the SU wll attempt to access the network and cause nterference to the PU. Then the SU may be punshed as an attacker. Hence the SU may use a strategy to make PFA as small as possble whle the attacker wants to make PFA as large as possble. Probablty of Prmary User detecton (PDP): When the sgnal s deeded from the PU, the probablty that the SU classfes t as from the prmary use, P DP = P r(h 0 \H 0 ) = 1 P F A. (2) If ths case happens, the SU wll attempt to access the network and cause nterference to the PU. Then the SU may be punshed as an attacker. Hence the SU may use a strategy to make PFA as small as possble whle the attacker wants to make PFA as large as possble. Probablty of Msdetecton (PMD): When the sgnal s counted from the attacker, the probablty that the SU classfes falsely t as from the prmary user s detonated by, P MD = P r(h 0 \H 1 ). (3) If ths happens, the vctm wll gve up accessng the network, although the spectrum band s vacant, and the attacker launches a successful PUEA and takes the spectrum resources. Another wdely matrces s the probablty of detecton of the attacker PDA. The SU should take a strategy to make the PDA as large as possble. 5 Analytcal Model Evoluton P DA = P r(h 1 \H 1 ) = 1 P MD. (4) The authentcaton tag s formed usng a Key based HMAC, even a sngle bt n the tag or the message wll destroy the authentcaton between the SU and the PU. The probablty of false alarm s calculated analytcally for the uuencoded BPSK under AWGN. The Probablty of False Alarm for Uuencoded BPSK Under AWGN The probablty of false alarm s related to the probablty of one bt occurs n the tag or the data. Assume the channel s a bnary symmetrc channel wth error probablty equal to P, the bt error occurs ndependently. Hence, the probablty of m errors n a block of n bts s gven by [20]. ( ) n P (m, n) = P m (1 P ) n m (5) k The probablty of false alarm s measured by calculatng the probablty of one error occur and more, therefore, the probablty of false alarm s gven by P F A = P r(atleastonebterror) (6) ( ) n = P m (1 P ) n m (7) k m=1

6 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar The channel error rate of BPSK under AWGN s gven by [20]: P = 0.5erfc( Eb N o ). (8) The probablty of false alarm of uuencoded BPSK s done by put Equaton (8) nto Equaton (6): P m = m=1 ( ) n (0.5erf c( k Eb N o ) m )(1 (0.5erfc( For Coded BPSK Usng a Lnear Block Codng (BCH Code) P tag CW n P tag b =t tag +1 1 n tag ( n tag =t tag +1 Eb N o ))) n m (9) ) P (1 P ) n (10) ( n tag For smplcty equally wll be used the probablty of false alarm s gven by: P F A = 1 (1 P tag = 1 (1 CW ) L K tag =t tag +1 ( n tag ) P (1 P ) n (11) ) P (1 P ) n ) L K tag (12) The probablty of False Alarm of BPSK under AWGN usng block code s done by substtute Equaton (6) nto Equaton (12): ( ) n tag Eb P F A = 1 (1 (0.5erf c( )) m Eb (1 (0.5erfc( )) n ) L K N o N tag (13) o =t tag +1 The overall probablty of detecton of the prmary user of BPSK under AWGN when error correctng block code block code s done by: ( ) n tag Eb P DP = (1 (0.5erf c( ))) m Eb (1 (0.5erfc( )) n ) L K N o N tag (14) o =t tag +1 More about authentcaton and encrypton wll be found n [11, 17, 18]. 6 Smulaton And Numercal Results In ths secton, the effectveness of the HMAC authentcaton method wll be valdated through analytcal and smulaton. The smulaton parameters of the system wll be tabulated n table 1. Frst the data s generated by the PU as a random data of length 18bytes, ths data s prepared frst to apply as the nput of the HMAC functon to produce an output wth a length of 20 bytes by takng the left 18 bytes n the output to produce TAG A. The TAG A s appended to the message usng TDMA algorthm, then encoded, modulated and sent both of them on the channel. The SU separates the message and TAG A. The receved message s appled to HMAC to produce TAG B. The SU compares the two tags. If the two tags are dentcal, then the transmsson s represented by PU, otherwse s done by the attacker. Mont Carol smulaton s used, for every packet we run tmes and calculate the probablty of the false alarm and detecton. In Fgure 4 the probablty of false alarm vares by changng the SNR db usng BPSK under AWGN channel model. As the SNR ncreases the probablty of the PFA decreases. The smulaton and the analytcal soluton gves the same results. It s also show that, usng a good error correctng code decreases the PFA. At SNR=2dB, the PFA=100% for the uuencoded BPSK, when usng BCH (7, 4, 1) the PFA s decrease by 15%, when usng BCH (31, 16, 3) the PFA s decreased by 60%. In Fgure 5, the probablty of false alarm vares by changng the SNR db under AWGN channel model when the error correctng code s a reed solomn code. As the SNR ncreases the probablty of the PFA s decreases. At

7 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar Fgure 4: The PFA versus the SNR for a dfferent BCH codes Table 1: Smulaton parameters Smulaton parameters N=1000 Data length of the PU 16bytes HMAC code length 16 bytes Total PU data 36 bytes Channel AWGN Modulaton type BPSK S/N db 0:20 db Encodng types BCH, Reed solomn Hash method used SHA-1 Fgure 5: PFA V.s SNR for Uuencoded and encoded usng RS (n, k) codes

8 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar SNR=1dB the PFA=100% for the uuencoded, when usng RS (88, 36), RS (120, 36), RS (160, 36) and RS (240, 36) the PFA s decrease by 10%, 30 %, 60% and 98% respectvely. In Fgure 6 the probablty of detecton (PDA) s vared accordng to SNR db. The SU detect the attacker at each value of the SNR and acheve 100% detecton of PUEA under all cases. In ths smulaton the attacker tres many keys to confuse the SU but he cannot. The two curves are dentcal. Fgure 6: PDA of BPSK under AWGN 7 Conclusons In ths paper, a new method s proposed to solve the prmary user emulaton attack n cogntve rado networks. In ths model, the prmary user uses a hash message authentcaton code (HMAC) to authentcate ts transmsson. The new method helps the secondary user to defnes the attackers, by appendng a tag n the transmsson and sends the tag and the message on the channel. At the recever the SU separates the tag from the message and a new tag s generated from the receved message and the shard key. If the two tags are the same, then the transmsson s consdered from the PU, otherwse, the PUEA s n progress. The smulaton results show that the new method completely defeats the PUEA and provdes good detecton of the prmary user. In future, more error correctng codes and channel models wll be used. Acknowledgments The authors gratefully acknowledge the anonymous revewers for ther valuable comments. References [1] I. F. Akyldz, W.-Y. Lee, M. C. Vuran, and S. Mohanty, Nextgeneraton/dynamc spectrum access/cogntve rado wreless networks, Computer Networks, vol. 50, no. 13, pp , [2] A. Alahmad, M. Abdelhakm, J. Ren, and T. L, Defense aganst prmary user emulaton attacks n cogntve rado networks usng advanced encrypton standard, IEEE Transactons on Informaton Forenscs and Securty, vol. 9, no. 5, pp , [3] A. Alahmad, T. Song, and T. L, Sub-band detecton of prmary user emulaton attacks n ofdm-based cogntve rado networks, n 2014 IEEE Global Conference on Sgnal and Informaton Processng (GlobalSIP 14), pp , Atlanta-GA, Dec [4] S. Anand, Z. Jn, and K. P. Subbalakshm, An analytcal model for prmary user emulaton attacks n cogntve rado networks, n 3rd IEEE Symposum on New Fronters n Dynamc Spectrum Access Networks (DyS- PAN 08), pp. 1 6, Chcago, USA, Oct

9 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar [5] F. Bao, H. Chen, and L. Xe, Analyss of prmary user emulaton attack wth motonal secondary users n cogntve rado networks, n 2012 IEEE 23rd Internatonal Symposum on Personal Indoor and Moble Rado Communcatons (PIMRC 12), pp , Sydney-NSW, Sept [6] J. Blesa, E. Romero, A. Rozas, and A. Araujo, Pue attack detecton n cwsns usng anomaly detectton technques., EURASIP Journal on Wreless Communcatons and Networkng,, vol. 2013, no. 1, pp , [7] K. Borle, B. Chen, and W. Du, A physcal layer authentcaton scheme for counterng prmary user emulaton attacks, n IEEE Internatonal Conference on Acoustcs, Speech and Sgnal Processng (ICASSP 13), pp , Vancouver, BC, May [8] C. Chen, H. Cheng, and Y. Yao, Cooperatve spectrum sensng n cogntve rado networks n the presence of the prmary user emulaton attack, IEEE Transactons on Wreless Communcaton,, vol. 10, no. 7, pp , [9] R. Chen, J. Park, and J. Reed, Ensurng trustworthy spectrum sensng n cogntve rado networks, n Proceedngs of the IEEE Workshop Network Technology Software Defned Rado Networks(2006), pp , Reston, USA, sept [10] Z. Chen, T. Cooklev, C. Chen, and C. Plmalaza-Raez, Modelng prmary user emulaton attacks and defenses n cogntve rado networks, n IEEE Internatonal Conference on Communcatons (ICC 09), pp , Scottsdale, AZ, Dec [11] Y. Dou, W. Jang, and C. Ma, Improved fault attack aganst eta parng, Internatonal Journal of Network Securty, vol. 16, no. 1, pp , [12] W. R. Ghanem, M. Shokr, and MI Dessouky, Investgaton of puea n cogntve rado networks usng energy detecton n dfferent channel model, Crcuts and Systems: An Internatonal Journal, vol. 2, no. 2/3/4, pp. 1 11, [13] M. Haghghat and S. M. S. Sadough, Smart prmary user emulaton n cogntve rado networks: defence strateges aganst radoaware attacks and robust spectrum sensng., Transactons on Emergng Telecommuncatons Technologes,, vol. 26, no. 9, pp , [14] L. Huang, L. Xe, H. Yu, W. Wang, and Y. Yao, Ant-pue attack based on jont poston verfcaton n cogntve rado networks, n 2010 Internatonal Conference on Communcatons and Moble Computng (CMC 10),, pp , Shenzhen, Aprl [15] Z. Jn, S. Anand, and K. P. Subbalakshm, Mtgatng prmary user emulaton attacks n dynamc spectrum access networks usng hypothess testng, n IEEE Internatonal Conference on Communcatons (ICC 09), pp. 1 5, Dresden, USA, June [16] Z. Jn and K. P. Subbalakshm, Detectng prmary user emulaton attacks n dynamc spectrum access networks, n IEEE Internatonal Conference on Communcatons (ICC 09), pp. 1 5, Dresden, USA, June [17] C. C. Lee, C. H. Lu, and M. S. Hwang, Guessng attacks on strong-password authentcaton protocol., Internatonal Journal of Network Securty, vol. 15, no. 1, pp , [18] C. Ln, Y. Lv K. L, and C. C. Chang, Cphertext-audtable dentty-based encrypton., Internatonal Journal of Network Securty, vol. 17, no. 1, pp , [19] J. Mtola and G. Q. Magure, Cogntve rados: Makng software rados more personal, IEEE Personal Communcaton, vol. 6, no. 4, pp , [20] J. G. Proaks and M. Saleh, Dgtal Communcatons (5ed), Englsh. USA: McGraw-Hll Educaton, [21] M. J. Saber and S. M. S. Sadough, Optmal soft combnaton for multple antenna energy detecton under prmary user emulaton attacks, AEU-Internatonal Journal of Electroncs and Communcatons,, vol. 69, no. 9, pp , [22] A. A. Sharf, Morteza Sharf, and Mr Javad Musev Nya, Secure cooperatve spectrum sensng under prmary user emulaton attack n cogntve rado networks: Attack-aware threshold selecton approach, AEU- Internatonal Journal of Electroncs and Communcatons,, vol. 7, no. 2/3/4, pp , [23] W. Stallngs, Cryptography and Network Securty: Prncples and Practce (5ed). USA: Prentce-Hall, [24] H. Urkowtz, Energy detecton of unknown determnstc sgnals, Proceedngs of the IEEE, vol. 55, no. 4, pp , Wald R Ghanem receved the B.Sc. degree n communcaton engneerng from Electronc Engneerng, Menoufa Unversty, Egypt, n May 2011, and he s currently workng toward the MSc degree n Electrcal communcaton engneerng. Hs current research nterests are cogntve rado networks, Localzaton, wreless securty, encrypton and optmzaton algorthms. Mona Shokar receved the B.Sc., and M.Sc. degrees n electroncs engneerng from Menoufa Unversty, Menoufa, Egypt, n 1993, and 1997, respectvely. She receved the Ph.D. degree from Kyushu Unversty, Japan, n She receved VTS chapter IEEE award from Japan, n She publshed about 70 papers untl She receved

10 Internatonal Journal of Electroncs and Informaton Engneerng, Vol.4, No.1, PP.12-21, Mar the Assocated Professor degree n Presently, she s an Assocated Professor at Menoufa Unversty. Her research nterests nclude adaptve array antennas, CDMA system, WIMAX system, OFDM system, game theory, next generaton networks and optmzaton algorthms. Moawad I. Dessouky receved the B.Sc. (Honors) and M.Sc. degrees from the Faculty of Electronc Engneerng, Menoufa Unversty, Menouf, Egypt, n 1976 and 1981, respectvely, and the Ph.D. from McMaster Unversty, Canada, n He joned the teachng staff of the Department of Electroncs and Electrcal Communcatons, Faculty of Electronc Engneerng, Menoufa Unversty, Menouf, Egypt, n He has publshed more than 200 scentfc papers n natonal and Internatonal conference proceedngs and journals. He has receved the most cted paper award from Dgtal Sgnal Processng journal for Hs current research areas of nterest nclude spectral estmaton technques, mage enhancement, mage restoraton, super resoluton reconstructon of mages, satellte communcatons, and spread spectrum technques.