A Key Set Cipher for Wireless Sensor Networks

Transcription

1 A Key Set Cipher for Wireless Sensor etworks Subhsh Kk Abstrct This pper proposes the use of sets of keys, together with corresponding identifiers, for use in wireless sensor networks (WS) nd similr computing resource-constrined pplictions. Such system, with ech user ssigned bunch of privte key vectors with corresponding public identifiers to generte session keys, is hrder to brek thn where single key is used. The set of keys nd identifiers re generted by suitble mthemticl opertion by the trusted prty nd ssigned to users. A specific cryptogrphic system described in the pper is bsed on the use of fmily of self-inverting mtrices derived from the number theoretic Hilbert trnsform (HT) in conjunction with the Blom s scheme. In rndomized version of this scheme, the users chnge their published IDs t will but the prties cn still rech greement on the key by using their individul scling fctors. The rndom protocol increses the security of the system. Keywords: Key sets, number theoretic Hilbert trnsform, cryptogrphy, Blom s scheme, key distribution Introduction Wireless sensor networks (WSs) help to connect vriety of power-constrined devices to the Internet. To ensure security in the communictions with these devices vriety of key mngement schemes (KMS) re used of which the principl ones use key pooling, mthemticl lgorithms, or public key cryptogrphy. The fctors in deciding which scheme to use re bsed on memory requirements, communiction overhed, processing speed, network bootstrpping, connectivity, sclbility, extensibility, nd energy requirement []. Of the mthemticl lgorithms used, the mtrix-bsed Blom scheme hs found mny pplictions such s in Highbndwidth Digitl Content Protection (HDCPv). Ech HDCP-cpble device hs unique set of -bit keys. For ech set of vlues, specil -bit public key clled KSV (Key Selection Vector) is creted. During uthentiction, the prties exchnge their KSVs using Blom's scheme leding to shred -bit number, which is lso used to encrypt dt. The HDCP method is used in DVD, HD DVD, Blu-ry Disc plyers, computer video crds, TVs nd digitl projectors. In the bsic Blom s scheme [], the trusted uthority gives ech user secret key nd corresponding public identifier to enble ny two prticipnts to independently crete shred key for secure communiction. The Blom scheme is different from either key pooling or public key techniques in tht ny two users discover unique key between the two of them. In contrst, there cn be different wys two users cn communicte in network using key pooling, nd in public key cryptogrphy, the users cn chnge their privte nd public keys, if only in principle.

2 Therefore nother wy to distinguish between KMS schemes is whether they involve use of single keys or multiple keys between ny pir of users. The use of multiple keys is of specil dvntge in mking the tsk of the evesdropper more difficult. Such use cn lso be of vlue in forensics. The prdigm of multiple keys for ech user hs ntecedents tht go bck in history in socil systems (in the mny wys personhood is defined) [] nd there exist prllels in the biologicl relm. This ide is of philosophicl vlidity to problems tht go beyond sfegurding wireless sensor networks. In digitl networks, mny individuls mintin different identifiers rnging from two (one t work nd nother t home) to severl. Some of these identities re motivted by the need for nonymity. In this pper we look t wys of enhncing Blom s mtrix bsed scheme so tht it cn support key sets for the users. Such n enhncement poses greter chllenge to the evesdropper s compred to simply incresing the size of the key. The Blom scheme [] is bsed on two different non-squre mtrices X (n m) nd Y (m n) whose product mod p (p is suitbly lrge prime) is the symmetric mtrix K (n n). The mtrix X is used to generte the users keys nd the mtrix Y is used to generte the corresponding public identifiers. An obvious wy to hve lrge key set is to use set of indexed X nd Y mtrices. There exist vriety of wys to determine X nd Y []. We cn ssume tht these indexed mtrices re obtined by mens of suitble liner trnsformtions on n initil member. For this propose the use of HT-circulnt mtrices which re orthogonl in the sme Z p s Blom s mtrix. Given tht the key pirs re bsed on different mtrices, the tsk of breking the system hs been mde more difficult. Since the question of security of the Blom scheme is well nlyzed [],[],[], here we only describe the construction ssocited with the genertion of the key set nd the corresponding system identifiers. We lso present rndomized scheme in which ech user publishes subset of the identifiers nd chnges them with time. This requires scheme to normlize the keys generted by the use of different identifiers. Mtrix Bsed Keys In the Blom scheme, the row i of X represents the secret key of User i (X i, X i,, X im ) nd the column i of Y represents the public identifier of the User i (Y i, Y i,, Y mi ). Let Alice be User i nd Bob be User j. The size of the key nd the public identifier is m. Alice finds the key by multiplying her privte key vector with the identifier (public key) of Bob thus getting K ij. Likewise, Bob multiplies his privte key with the identifier of Alice thus getting K ji. Since the mtrix K is symmetric, Alice nd Bob obtin the sme number which cn be used s the rw key: K ij = X Y () α iα αj

3 Definition. The vlue of K ii will be clled the scle of the key of User i. It will lso be represented by S. We will see lter tht the key scle plys criticl role in the determintion of the common key in the rndomized version of the lgorithm. Exmple. Let X= K= mod, nd Y= mod mod () If Alice is User nd Bob is User, then Alice s secret key: (,, ) Alice s public identifier: (,, ) () Bob s secret key: (,, ) Bob s public identifier: (,, ). () Their shred key is found by computing the inner product of the secret key nd public identifier vectors. The shred key: As computed by Alice: + + = mod = As computed by Bob: + + = mod = The key scles of Alice nd Bob re nd, respectively, nd they will be clled S Alice nd S Bob. Modified Scheme to Generte Key Sets The Trusted Authority cn generte lrge number of equivlent keys by using pproprite mtrix trnsformtions on known solution (Figure ). Given the constrint of fixed m (size of the key), the mtrix trnsformtion cn either be n outer trnsformtion (n n) or n inner trnsformtion (m m).

4 Key Key Key Key Key m Alice ID ID ID ID IDm ID ID ID ID IDm Bob Key Key Key Key Key m The keys of User i re defined s follows: Figure. A mtrix-bsed key-set scheme Tble. User i s Key nd Identifier Set User i: Index Secret Key X(row i) Public Identifier Y(column i) X() Y() X() Y() X() Y()... M X(m) Y(m) Outer trnsformtion: Form new X nd Y by the following trnsformtions: nd X new = UX nd Y new = YV () K new = UXYV = UKV () There re different wys to choose U nd V (ech of which will be n n mtrix) but one esy method would be to pick them s symmetric mtrices. Inner trnsformtion: Form new X nd Y by the following trnsformtions: X new = XR nd Y new = SY () so tht the product below remins symmetric mtrix: K new = XRSY () Specificlly, we will consider the following inner trnsformtions:

5 X new = XR where Y new = R T Y, nd RR T = wi mod p () This will chnge the scles of the keys by the fctor w. The mtrix R in () represents set whose trnspose is its inverse (up to constnt). It is relted to the number theoretic Hilbert trnsform (HT) [], which is derived from the stndrd discrete Hilbert trnsform []-[]. The HT is circulnt mtrix with lternting entries of ech row being zero nd non-zero numbers nd trnspose modulo prime is its inverse. The discrete Hilbert trnsform hs pplictions is vriety of res of signl processing such s spectrl nlysis in -D reconstruction []-[], multilyered computtions [],[], nd cryptogrphy []-[]. A circulnt mtrix is used in the mix columns of the Advnced Encryption Stndrd. Periodic sequences tht re orthogonl for ll shifts nd their potentil pplictions were recently presented [],[]. Some further properties of circulnt mtrices relevnt to our pper re given in []. Exmple Contd. For Alice s User i nd Bob s User j, let us ssume tht Alice decided to use Bob s th identifier. She sends this informtion to Bob in the pre-communiction hndshke so tht Bob will use the corresponding secret key. The key found by Alice nd Bob would now be: K = Alice (secret key ) Bob (identifier ) = Bob (secret key ) Alice (identifier ) If the set of mtrices R is so chosen tht w in eqution () equls, then the key obtined will be sme irrespective of wht row in Tble is chosen. The Mtrix R nd the Key Set Consider the relted mtrix R, which is identicl to HT mtrix with the exception tht its s hve been purged. R =..... mod p () The sequence,,,..., my be considered rndom sequence. For considertion s sequence, we ssume tht the genertor is periodic, i.e. + i = i. If we don t insist on normliztion, it will stisfy the following properties under the condition: i= i mod p = w ()

6 C( k) = i+ k i= i mod p = for ll k () Property mens tht the sequence A =,,,..., my be considered truly rndom sequence with utocorreltion function, C(k), tht is zero everywhere excepting t k=. It is lso cler tht w A would be nother rndom sequence for which the utocorreltion function t the origin will be w mod p nd its vlue everywhere else will be. The pek vlue of the utocorreltion is obtined from the sequence for which w mod p = p-. Let us go bck to Exmple. The mtrix required there is. The generl R mtrix for which b c RR T =wi my be tken to be c b, but since we wnt flexibility regrding w, this could be b c replced by R= b b b () This leds to the conditions: w = + + b mod p () nd + b + b = mod p () Eqution () my be esily solved. We hve b( + ) = mod p. This my be rewritten s p b = mod p () + Since our exmple ws concerning p =, we cn solve () for different choices of nd b s given in Tble below: Tble. Solutions to eqution () for the mtrix b w

7 Suppose we pick = nd b=. For this choice the vlue of w is nd therefore the new key will be the old key multiplied by. The new X nd Y mtrices would now be: X new = mod = () Likewise, the new Y mtrix will be: Y new =R T Y old () In other words, Y new = mod = () The new K mtrix is: K new = () Clerly K new = K s expected. It so turns out tht the choices for the R mtrix for this exmple (Tble ) belong to two groups: Group :

8 Group : In the modified scheme, the secret key nd public identifier will be indexed s follows: Alice s Secret Key nd Public Identifier Tble (User ): Tble. Alice s key, identifier vectors, nd scles Index(,b, c) Secret Key Public Identifier K =S Alice (originl),,,, (,, ),,,, (,, ),,,, (,, ),,,, (,, ),,,, (,, ),,,, Bob s Secret Key nd Public Identifier Tble (User ): Tble. Bob s key nd identifier vectors Index(, b, c) Secret Key Public Identifier K =S Bob (originl),,,, (,, ),,,, (,, ),,,, (,, ),,,, (,, ),,,, (,, ),,,, Mny vrints of this system my be proposed. This includes the cses where the size of the key itself cn vry mking the tsk of the evesdropper even more complex.

9 Use of Rndom Subset of the Key Set We now describe rndom vrint of the scheme outlined in the previous section where ech user rndomly publishes different subset of the public identifier set t different times. This is chieved by the user publishing the rndom subset nd lso nnouncing the time durtion for which it is effective. The chllenge is tht severl mtrices re in ply in the different public identifiers vilble to the users nd the two prties my not shre the sme identifier index. This necessittes the use of the scling fctors by the two prties nd prior greement tht the scling be done with respect to specific index. This greement cn be negotiting in the set-up nd it cretes n dditionl prmeter dding to the security. Here, in our exmple, it will be ssumed tht the scling will be done with respect to index. The key genertion will hve two steps: in the first one, ech user discovers rw key which my be different for different users; in the second, the rw key is chnged using the personl scling fctor by ech prty. In our running exmple, let Alice rndomly pick the identifiers nd, nd let Bob rndomly pick the identifier nd (Figure ). In other words, Alice publishes Index, Public ID,, Index, Public ID,, Bob publishes Index, Public ID,, Index, Public ID,, Alice ID ID ID ID Bob Figure. Rndomized key-set scheme (ech user publishes subset of the IDs) Alice computes her scle K for Bob s Index nd Index nd likewise Bob computes his scle K for Alice s Index nd Index. These scle vlues re: For Alice: Scles for Indices nd re: nd, respectively For Bob, Scles for Indices nd re: nd, respectively In order to initite the discovery of the common key, Alice picks, sy Index ID of Bob, with its sequence,,. Likewise, Bob picks one of the vilble IDs of Alice, sy Index, with the sequence,,.

10 Genertion of Rw Key Alice computes the product (Alice Secret Key Bob s Identifier ) = (,, ) (,, ) = mod. This is Alice s rw key. Bob computes the product (Bob s Secret Key Alice s Identifier ) = (,, ) (,, ) = mod. This Bob s rw key. Genertion of Finl Key The finl key is computed by normlizing the rw key with respect to the common greed identifier index vlue for the communicting prties tht hs been tken to be. Alice s finl key = Alice s rw key S S Alice ( CommonIndex) ( CurrentIndex) Alice () Bob s finl key = Bob s rw key S Bob ( CommonIndex) () S ( CurrentIndex) Bob From Tble, S Alice (CommonIndex=) = nd S Alice (CurrentIndex=)=, nd from Tble, S Bob (CommonIndex=) = nd S Bob (CurrentIndex=) =. Therefore, Alice s finl key= / mod = Bob s finl key = / mod = = mod = () Suppose the common index chosen ws, then the vlues of S Alice (CommonIndex=) = nd S Bob (CommonIndex=) = (both from Tble ), nd plugging these in, the finl key for both the prties turns out to be. The security of the rndom protocol would depend not only on the size of the key nd p, but lso on the number of keys in the key set nd the mnner in which the subsets re chosen nd chnged in the rndom version of the scheme. Conclusions The dvntge of the proposed enhncement (both the complete nd the rndomized versions) to the Blom s scheme is tht it increses the cost of breking the cipher for the evesdropper. The correct common key cn be generted only upon the use of the scling keys s in equtions () nd () nd these re not vilble to the evesdropper. The common index used for the normliztion of the scling need not be published by ny of the prties nd this resides s secret fctor within the node. A description of the use of the cipher

11 proposed in this pper s forml protocol would require severl choices relted to the detils of the system tht will depend on the ppliction in hnd. The Blom-scheme bsed HDCPv ws hcked lthough its use hs continued bsed on legl protections [] nd HDCPv is bsed on different scheme []. The strengthening of the mtrix-bsed Blom s scheme is importnt nd the methods presented in this pper cn be n ttrctive option for resource-limited nodes of sensor network nd in specilized highbndwidth digitl content security. The Blom scheme is relted to threshold secret shring schemes [],[] in the sense tht the system is secure unless certin number of users hve been compromised. It will be interesting to explore nlogs of spce-efficient secret shring schemes [],[] for mtrix-bsed WS key distribution. References. C. Alcrz, J. Lopez, R. Romn, nd H. - H. Chen, Selecting key mngement schemes for WS pplictions. Computers & Security : - (). R. Blom, An optiml clss of symmetric key genertion systems, Advnces in Cryptology: Eurocrypt (T. Beth,. Cot nd I. Ingemrsson, eds.) LCS, - (). S. Kk, Ritul, msks, nd scrifice. Studies in Humnities nd Socil Sciences, Indin Institute of Advnced Study, Shiml (). A. Prkh nd S. Kk, Mtrix bsed key greement lgorithms for sensor networks. Proceedings of IEEE Advnced etworks nd Telecommunictions Conference (ATS ), Bnglore ( ). H. Chn, A. Perrig nd D. Song, Rndom key predistribution schemes for sensor networks, IEEE Sumposium on Reserch in Security nd Privcy, - (). C. J. Colbourn nd J.H. Dinitz, The CRC Hndbook of Combintoril Designs, CRC Press, ). W. Du, J. Deng, Y. S. Hn nd P. K. Vrshney, A pirwise key pre-distribution scheme for wireless sensor networks, Proc. of the th ACM conf. on Computer nd communictions Security, - (). S. Kk, The number theoretic Hilbert trnsform. rxiv:.. S. Kk, The discrete Hilbert trnsform. Proc. IEEE, - (). S. Kk, Hilbert trnsformtion for discrete dt. Interntionl Journl of Electronics, - (). S. Kk, The discrete finite Hilbert trnsform. Indin Journl Pure nd Applied Mthemtics, - (). S.K. Pdl nd K.M.M. Prbhu, Systolic rrys for the discrete Hilbert trnsform. Circuits, Devices nd Systems, IEE Proceedings, - (). F. W. King, Hilbert Trnsforms. Cmbridge University Press (). I.G. Roy, On robust estimtion of discrete Hilbert trnsform of noisy dt. Geophysics, (). S. Kk nd.s. Jynt, Speech encryption using wveform scrmbling. Bell System Technicl Journl, - ()

12 ..S. Jynt nd S. Kk, Uniform permuttion privcy system, US Ptent o.,,, July (). S. Kk, Multilyered rry computing. Informtion Sciences, - (). S. Kk, A two-lyered mesh rry for mtrix multipliction. Prllel Computing, - (). R. Kndregul, The bsic discrete Hilbert trnsform with n informtion hiding ppliction.. rxiv:.. V.K. Kotgiri, The -point nd -point number theoretic Hilbert trnsform. rxiv:.. V.K. Kotgiri, ew results on the number theoretic Hilbert trnsform. rxiv:.. S. Kk, A clss of orthogonl sequences. rxiv:.. V.K. Kotgiri, Rndom residue sequences nd the number theoretic Hilbert trnsform. rxiv:.. S. Kk, Properties of HT-circulnt mtrices. D. Krvets, Intel thretens to sue nyone who uses HDCP crck. Wired (). J. Zho, D. Gu, Y. Li, W. Cheng, On weknesses of the HDCP uthentiction nd key exchnge protocol nd its repir. Mthemticl nd Computer Modelling : - (). G.R. Blkley, Sfegurding cryptogrphic keys. Proceedings of the tionl Computer Conference : (). A. Shmir, How to shre secret". Communictions of the ACM (): (). A. Prkh nd S. Kk, Online dt storge using implicit security. Informtion Sciences : - (). A. Prkh nd S. Kk, Spce efficient secret shring for implicit dt security. Informtion Sciences : - ()