Secure Reac)ve Ad Hoc Rou)ng. Hongyang Li

Transcription

1 Secure Reac)ve Ad Hoc Rou)ng Hongyang Li

2 Proac)ve vs. Reac)ve Rou)ng Proac&ve Reac&ve Build routing tables Know path to destination? Route Find path Route 2

3 Why Reac)ve Ad Hoc Rou)ng Unstable network condi)ons: nodes come and go in mobile or vehicular networks. Storage constraint: cannot fit en)re rou)ng table in resource constraint sensor nodes. Re- stabiliza)on may be expensive. 3

4 Dynamic Source Rou)ng (DSR) S S-A S-A-B (S,ID=7) (S,ID=7) (S,ID=7) S A B T (S,ID=7) (S,ID=7) (S,ID=7) S-A-B-T S-A-B-T S-A-B-T 4

5 DSR is not Secure A single compromised node can Pretend to be another node Flood route requests Remove nodes from paths in route requests Modify paths in route requests to create loops Claim any node is a neighbor Two compromised nodes can Short- circuit the route (illustrated later) 6

6 Ariadne Secure Reac)ve Source Rou)ng Building blocks: One- way hash func)on Message Authen)ca)on Code (MAC) TESLA 8

7 One- way Hash Func)on F is a one- way hash func)on if Given X, easy to compute F(X) Given Y, hard to find X such that Y = F(X) 10

8 MAC 11

9 TESLA Goal: efficient source authen)ca)on for mul)cast Problems with past solu)ons: MAC is not safe: any receiver can impersonate the sender Asymmetric cryptography has high overhead Main idea: Use symmetric cryptography. Delay the disclosure of keys. 12

10 TESLA (Simplified) K 1 K 0 = F(K 1 ) sender M MAC(K 1, M ) K 1 attacker K 1 receiver K 0 M MAC(K 1, M ) M ' MAC(K 1, M ') K 1 K 0 = F(K 1 )? 13

11 TESLA (Simplified) sender t s t s + Γ + 2Δ receiver t s + Γ + Δ Assume time error is bounded by, and transmission delay is, what is the earliest time the sender can disclose the key after he sends the data? Δ Γ 14

12 TESLA Key Chain F K 0 K 1... K N 2 F K N 1 F K N K K 0 = F N 2 (K N 2 )? 0 K N 2 Given y, hard to find x s.t. F(x)=y 15

13 TESLA Key Chain What if I do not receive the key from the source? Time K MAC(K, M ) K MAC(K, M ) K K 5 = F 2 (K 7 ) K 0 = F 7 (K 7 )? 16

14 TESLA Divide )me into equal intervals Use one key for each interval Need other mechanism to distribute Requires loosely synchronized )me K 0 17

15 Ariadne: Nota)ons H: one- way hash func)on : shared secret key between S and T K ST : current TESLA key used by A K A K A,0 : the first TESLA key of A MAC(K, M ) : MAC computed on message M using key K 22

16 Ariadne Route Request S A Z T < h S,(),() > h s = MAC(K ST, MSG) K ST Shared secret key between S and T MSG current message < h A,(A),(M A ) > h A = H (A,h s ) M A = MAC(K A, MSG) K A < h Z,(A,Z),(M A, M Z ) > h Z = H (Z,h A ) M Z = MAC(K Z, MSG) Current TESLA Current TESLA key used by A K Z key used by Z T verifies: h Z = H (Z, H (A,h s ))? 23

17 Ariadne Route Reply S A Z T < (M A, M Z ), M T,(K Z,K A ) > < (M A, M Z ), M T,(K Z ) > < (M A, M Z ), M T,() > M T = MAC(K TS, MSG) S verifies: K A? K Z? M A? M Z? M T? 24

18 Ariadne (using MAC) S A Z T < h Z,(A,Z),(M A, M Z ) > TESLA M Z = MAC(K Z, MSG) MAC M Z = MAC(K ZT, MSG) K Z Current TESLA key used by Z K ZT Shared secret key between Z and T 27

19 Ariadne Using TESLA Requires loosely synchronized )me among all nodes. Requires shared secret key between each pair of source and des)na)on. Requires each source to store the first TESLA key of every other node. Requires each node discloses the TESLA key before sending the Route Reply Using MAC Does not require )me synchroniza)on. Requires shared secret key between each pair of nodes 28

20 Ariadne Security Analysis Suppose you compromise a single node Can you pretend to be another node? NO: you need his MAC key shared with the target. Can you claim to be neighbor to all other nodes? NO: you need authen)ca)on from target. Can you flood route requests? YES. Can you drop packets? Sure, but you may lose reputa)on. Can you modify the node list in route request without being detected? NO: you need his TESLA key 29

21 Short- Circuit A]ack against Ariadne S A Z B C Z D T Goal: Convice S that the path S- >A- >Z- >D- >T exists Z a]racts more traffic 30

22 Route Request at First Z S A Z B C Z D T < h A,(A),(M A ) > < H (h A ),(A,Z),(M A,h A ) > (M A, M Z ) 31

23 Route Request at Second Z S A Z B C Z D T < H (C, H (...H (h A ))),(A,Z, B,...,C),(M A,h A, M B,..., M C ) > < H (Z,h A ),(A,Z),(M A, M Z ) > S A Z D T 32

24 Route Reply at Second Z S A Z B C Z D T < (A,Z, D), M T > < (A,Z, B,...,C,Z, D), M T > S A Z D T

25 Route Reply at first Z S A Z B C Z D T < (A,Z, B,...,C,Z, D), M T > < (A,Z, D), M T > S A Z D T 34

26 Discussion Why is the short- circuit a]ack powerful? Any other a]acks that Ariadne cannot completely defend against? How should the source choose from mul)ple paths to the target? Fewest hop- count? Shortest Latency? Is Ariadne Scalable? MAC list too long? 36

27 References Yih-Chun Hu, Adrian Perrig, and David B. Johnson. Ariadne: A Secure On- Demand Routing Protocol for Ad Hoc Networks. MobiCom 02 Adrian Perrig, Ran Canetti, Dawn Song, and J. D. Tygar. Efficient and Secure Source Authentication for Multicast. NDSS 01 Acs, G.; Buttyan, L.; Vajda, I.;, "Provably Secure On-Demand Source Routing in Mobile Ad Hoc Networks," Mobile Computing, IEEE Transactions on, vol.5, no.11, pp , Nov