An Efficient Broadcast Authentication Scheme in Wireless Sensor Networks

Transcription

1 An Efficient Boadcast Authentication Scheme in Wieess Senso Netwoks Shang-Ming Chang Shiuhpyng Shieh Waen W. Lin {changsm, ssp, Nationa Chiao Tung Univesity / Univesity of Caifonia, Bekeey* 1001 Ta Hsueh Road Hsinchu, Taiwan 300 Chih-Ming Hsieh poais@iii.og.tw Institute fo Infomation Industy 11 th Foo, 106 Ho-ping East Road, Section 2 Taipei, Taiwan 106 ABSTRACT A boadcast authentication mechanism is impotant in wieess senso netwoks, assuing eceives of a packet s vaidity. To povide authentication, some eseaches utiize one way key chains and deayed discosue of keys; howeve, such an appoach equies time synchonization and deayed authentication. Anothe technique uses one-time signatue schemes. Unfotunatey, such schemes suffe fom age key sizes and a imited numbe of uses pe key. To cope with these pobems, we popose an efficient, one-time signatue-based boadcast authentication scheme fo wieess senso netwoks that educes stoage usage and incudes a e-keying mechanism. Keywods Wieess senso netwoks, boadcast, authentication, one time signatue, key enewa. 1. INTRODUCTION A wieess senso netwok (WSN) can cheapy monito an envionment fo divese industies, such as heathcae, miitay, o home [23], [24], [25], [26]. A WSN typicay consists of sevea base stations and thousands of senso nodes, which ae esouce imited devices with ow pocessing, enegy, and stoage capabiities. Distibuting data though wieess communication is aso bandwidth imited. Boadcast authentication is a basic and impotant secuity mechanism in a WSN because boadcast is a natua communication method in a wieess envionment. When base stations want to send commands to thousands of senso nodes, boadcasting is a much moe efficient method than unicasting to This wok is suppoted in pat by the Nationa Science Counci (NSC), the Institute fo Infomation Industy (III), the Taiwan Infomation Secuity Cente at NCTU (TWISC@NCTU), and the Team fo Reseach in Ubiquitous Secue Technoogy at UC Bekeey (TRUST). * Shiuhpyng Shieh is cuenty a visiting pofesso of the Univesity of Caifonia, Bekeey. Pemission to make digita o had copies of a o pat of this wok fo pesona o cassoom use is ganted without fee povided that copies ae not made o distibuted fo pofit o commecia advantage and that copies bea this notice and the fu citation on the fist page. To copy othewise, o epubish, to post on seves o to edistibute to ists, equies pio specific pemission and/o a fee. ASIACCS 06, Mach 21 24, 2006, Taipei, Taiwan. Copyight 2006 ACM /06/0003 $5.00. each node individuay. A message authentication code (MAC) is an authentication tag deived by appying an authentication scheme and a secet key to a message. MAC is an efficient symmetic cyptogaphic pimitive fo two-paty authentication; howeve, MAC is not suitabe fo boadcast communication without additiona modification. Because the sende and its eceives shae the same secet key, any one of the eceives can impesonate the sende and foge messages to othe eceives. That is, both sende and eceives can sign messages. This pobem stems fom the symmetic popety of MAC. Theefoe, to achieve authenticated boadcasts, it is necessay to estabish an asymmetic mechanism in which ony the sende can sign messages, and the eceives can ony veify messages. Howeve, asymmetic cyptogaphic mechanisms ike RSA digita signatues ae significanty moe computationay expensive than symmetic ones. It is impactica to use them in a esouce imited senso netwok. A possibe appoach is to use efficient symmetic pimitives as a too to design a scheme with asymmetic popeties. 1.1 Requiements In addition to the asymmetic mechanism that is needed fo boadcast authentication, designing an efficient boadcast authentication scheme fo wieess senso netwoks sti faces many chaenges. 1. Robust to packet oss. The wieess communication envionment is not eiabe; theefoe, the scheme shoud be abe to cope with the oss of packets duing tansmission. 2. Shot authentication atency. Many WSN appications ae ea time appications, e.g. the tacking of enemy movements on a battefied. To authenticate ea time data, the maximum numbe of additiona packets that need to be eceived befoe a packet can be authenticated shoud be sma. 3. Individua authentication. The eceive shoud veify the eceived packets individuay without depending on othe packets; othewise, the faiue to veify a packet pevents the veification of subsequent packets. 4. Low computation cost. Receives have imited computation powe. Thus, they shoud ony pefom a sma numbe of opeations to veify a packet. 5. Low communication ovehead. Because a WSN is esticted in bandwidth, the numbe of bytes pe packet used fo authentication shoud be sma. 6. Low stoage equiement. Since the stoage space of senso nodes is imited, some data fo authentication ike key 311

2 mateia and signatues stoed in memoy cannot be too age. Ideay, we woud ike a scheme that ecoves fom any oss of packets, has no authentication atency, can individuay authenticate packets, has negigibe ovehead, and has a computation cost simia to what is found in symmetic cyptogaphic pimitives. In pactice, such a pefect scheme is difficut to achieve, and a compomise needs to be found between these equiements. 1.2 Reated Wok Peviousy poposed boadcast authentication schemes oughy divide into two categoies by the cyptogaphic pimitives they use. The fist type is a signatue amotization scheme that utiizes asymmetic pimitives and distibutes the cost of the signatue ove a bock of packets. The second type is a MAC-based scheme which uses symmetic pimitives to design an eaboate scheme that achieves asymmety. EMSS [20], hash tees [22], hash chains [11], and expande gaphs [21] ae exampes of poposed signatue amotization schemes whose main impediment is packet oss. Recenty, some eseaches [1], [4], [5], [14] suggest using easue codes [15], [16], [17] to dea with packet oss. Unfotunatey, these schemes suffe poution attacks [5], a type of Denia-of-Sevice attack aimed at the easue decoding pocedue. Distiation codes [5] sove this pobem at the expense of highe communication ovehead pe packet. Futhemoe, schemes empoying distiation codes equie eceives to buffe the packets befoe veifying signatues. As a consequence, eceives cannot authenticate each packet individuay and equie age stoage space. Because of this buffeing pobem, we wi not use a signatue amotization scheme. Instead, we focus on using an efficient symmetic cyptogaphic pimitive to achieve asymmety. Peig et a. poposed a vey efficient time based steam authentication scheme, caed TESLA [19], and aso povided a tiny vesion fo WSN, caed µtesla [18]. They use pue symmetic pimitives to achieve asymmetic popety by one way key chain and deayed discosue. Howeve, µtesla has some constaints incuding time synchonization of the whoe netwok, inefficient unicast of the initia tust, and deayed authentication. BiBa [2] and HORS [3] ae one-time signatue schemes using one way functions. They ae moe efficient signatue schemes than pubic key signatue schemes and can compae favoaby with symmetic pimitives because the main computations consist of fast, one-way hash function evauations. One-time signatue schemes have some dawbacks, though, such as the imited numbe of signatues that one key pai can geneate and the age size of the pubic key. Ou poposed scheme impoves upon the pobem of age stoage usage. In the next section, we descibe the system achitectue and examine vaious cyptogaphic toos that ou scheme utiizes. We detai ou poposed scheme in section 3. In section 4, we povide a secuity anaysis of ou scheme and aso compae it against othe authentication schemes fo WSNs. Finay, we concude ou findings in section PRELIMINARIES In this section, we fist outine the system achitectue. We then eview some cyptogaphic pimitives used fo authentication and a one-time signatue caed HORS, which is thus fa the fastest one-time signatue scheme fo signing and veifying. Ou scheme can be viewed as an impovement of HORS. 2.1 System Achitectue A WSN may contain one o moe base stations and hundeds o thousands of senso nodes. Figue 2-1 is an exampe of a WSN. Compaed to a base station, a senso node is vey imited in esouces. Fo simpification, we assume that each boadcast message oiginates fom the base station. A senso node can boadcast messages by fist unicasting the message to the base station, which then boadcasts the messages on the senso node s behaf. In addition, messages tansmitted in a senso netwok may each the destination diecty o may be fowaded by some intemediate nodes; howeve, we do not distinguish between them in ou scheme. Futhemoe, we assume a base station shaes a paiwise secet key with each senso node, aowing each senso node to secuey eceive the base station s pubic key. CPU Stoage Communication Bandwidth Opeating system OS code space Figue 2-1. Achitectue of a WSN Tabe 2-1. SmatDust chaacteistics Avaiabe code space 8-bit 4MHz 8KB instuction fash 512 bytes RAM 512 bytes EEPROM 916 MHz adio 10Kbps TinyOS 3500 bytes 4500 bytes Senso nodes ae esouce imited devices. Ou senso node capabiities ae modeed afte SmatDust, a Bekeey poposed senso node pototype whose chaacteistics ae shown in Tabe

3 2.2 Cyptogaphic Pimitives In this section, we intoduce vaious cyptogaphic pimitives and schemes fo authentication Message Authentication Code A message authentication code (MAC) is a symmetic cyptogaphic mechanism that takes as input a k-bit secet key and a message, and outputs an -bit authentication tag. To exchange authentic messages, a sende and eceive must shae the same secet key. Using the secet key, the sende computes the message s authentication tag (o MAC) and appends it to the message. To veify the authenticity of a message, the eceive computes the message s MAC with the secet key and compaes it to the oigina MAC appended with the message. Fo any message, a secue MAC function pevents an attacke without pio knowedge of the secet key fom computing the coect MAC. A MAC achieves authenticity fo point-to-point communications because a eceive knows that a message with the coect MAC must have been geneated eithe by itsef o by the sende Coision Resiient Hash Function A coision-esiient hash function H [10] is a function that maps an abitay ength message M to a fixed ength message digest MD and exhibits the foowing popeties. (1) The desciption of H is pubicy known and does not equie any secet infomation fo its opeation. (2) Given x, it is easy to compute H(x). (3) Given y, in the ange of H, it is computationay infeasibe to find an x such that H(x) = y. (4) It is computationay infeasibe to find two distinct messages (M, M ) that hash to the same esut H(M) = H(M ). The coision-esiient hash function is vey efficient. It ony costs a few micoseconds to compute on a Pentium 800 Hz PC, which is a thousand times cheape than asymmetic pimitives. We suggest using a coision-esiient hash function, ike SHA-1 o RIPEMD-160, to constuct ou signatue scheme Message Authentication Code A Meke hash tee [7], [8], [9] is a mechanism fo cacuating a message digest ove a goup of data items. Figue 2-2 depicts a Meke hash tee. It is constucted fom a binay tee by using the hash of each data item as a eaf in the tee. Each intena node is then computed by taking the hash of the concatenation of its two chiden. Let H be a coision esiient hash function. Then, paent = H( chid eft chid ight ). A Meke hash tee can educe the authentication ovehead needed fo a age goup of data items. Fo exampe, a sende signs the oot of the tee instead of individua data items. The eceive can then veify the authenticity of evey data item by econstucting the tee and compaing the computed hash vaue of the tee, which we ca teehash, with the authenticated oot vaue. To econstuct the tee, the eceive needs a of the data items. An atenative is fo the eceive to veify a data item individuay by computing the teehash using the data item and its authentication path. Iustated in Figue 2-3, the authentication path of the eaf is the vaue of a nodes that ae sibings of nodes on the path between the eaf and the oot. Figue 2-2. Meke hash tee Figue 2-3. Authentication path of Meke hash tee Efficiency of Cyptogaphic Pimitives As exhibited in Tabe 2-2, symmetic cyptogaphic pimitives ike DES and MD5 ae much moe efficient than asymmetic pimitives ike RSA. The one way hash function is amost as efficient as a symmetic ciphe. A expeiments ae pefomed on an 8-byte size input, using the OpenSSL ibaies on an 800 MHz Pentium III Linux station. 2.3 One-time Signatues Fist poposed by Lampot [6] and Rabin [13], one-time signatue schemes ae efficient signatue schemes based on one way functions. These signatue schemes diffe fom pubic key signatue schemes by the numbe of messages each can sign. Using a singe key pai, the fome can ony sign sevea messages, whie the atte can sign an unimited numbe of messages. This is due to the discosue of the pivate key of a onetime signatue scheme shoty afte signing a few messages. Pubic key signatue schemes neve discose a pivate key. 313

4 Tabe 2-2. Efficiency of cyptogaphic pimitives KEY GENERATION Input: Paametes, k, t Output: key pai Pubic Key PK = (k, v 1, v 2,, v t ) Secet Key SK = (k, s 1, s 2,, s t ) 1. Geneate t andom -bit stings (s 1, s 2,..., s t ) 2. Let v i = f(s i ) fo 1 i t Despite this imitation, one-time signatue schemes ae advantageous because of thei speed. Since they ae based on one way functions, thei computation cost is quite ow when compaed with that of asymmetic pimitives. In genea, one-time signatue schemes use the secet key as input to a sequence of one-way functions which geneate a numbe of intemediate esuts that eventuay ead to the pubic key. The one-way popety of the function impies that it is infeasibe to compute the secet key, o any intemediate esut, fom the pubic key. The pivate key is a sef-authenticating vaue. Motivated by the appication of signatues to steam and boadcast authentication, Peig poposed a one-time signatue caed BiBa [2], which featues fast veification and a shot signatue. The disadvantage of BiBa is a onge signing time and age pubic key size than pevious schemes Subsubsections Reyzin and Reyzin poposed a new one-time signatue scheme caed HORS [3], which impoves upon the BiBa scheme by deceasing the time needed to sign and veify messages whie aso educing the key and signatue sizes, making HORS the fastest one-time signatue scheme avaiabe thus fa. The secuity of BiBa depends upon the andom-oace mode, whie the secuity of HORS eies on the assumption of the existence of one-way functions and the subset-esiience as defined in Appendix A. HORS is computationay efficient, equiing a singe hash evauation to geneate the signatue and a few hash evauations fo veification. Due to the age pubic key size (usuay 10K bytes), HORS is not suitabe in a WSN envionment without additiona modifications. Figue 2-4 outines the HORS agoithm whie Figue 2-5 depicts its achitectue. In a typica exampe of HORS, we take paametes =80, t=1024, and f t=160. The pivate key size is 1024 * 80 bits = 10K bytes, and the pubic key size is 1024 * 160 bits = 20K bytes. Since we assume the base station is the sende, the size of the pivate key is manageabe; howeve, the size of the pubic key is too age fo a senso node. SIGNING Input: Message m and SK Output: Signatue = (s i1, s i2,, s ik ) 1. Compute the hash h = H(m) 2. Spit h into k substings (h 1, h 2,, h k ) of ength og 2 t bits each 3. Intepet each h j as an intege i j fo 1 j k VERIFYING Input: Message m, signatue = (s 1, s 2,, s k ), and PK Output: {Accept, Reject} 1. Compute the hash h = H(m) 2. Spit h into k substings (h 1, h 2,, h k ) of ength og 2 t bits each 3. Intepet each h j as an intege i j fo 1 j k 4. accept if fo each j, 1 j k, f(s j ) = v ij eject othewise Figue 2-4. HORS agoithm Figue 2-5. HORS achitectue 3. Poposed Scheme We popose a computationay ightweight one-time signatue scheme that aows senso nodes to authenticate boadcast messages fom a base station in a wieess senso netwok. To attain the asymmetic popety necessay fo boadcast 314

5 authentication, we utiize symmetic cyptogaphic pimitives. Moeove, we mitigate the genea dawbacks of one-time signatue schemes: the use of an extemey age key size and the imitation to authenticate ony a few messages. The poposed scheme efficienty educes the stoage equiement and incudes a e-keying mechanism to sign additiona messages. 3.1 Signatue Scheme Compaed to HORS, ou scheme consumes ess stoage and communication ovehead at the expense of a highe computation cost. This is a wothwhie tadeoff because stoage is a moe pecious esouce than computation powe in a senso node, especiay since ou scheme ony uses a few additiona hash computations. In the emainde of this section, we fist expain the basic idea of ou scheme, foowed by ou geneaized scheme. Finay, we popose a e-keying mechanism fo ou scheme The Basic Idea Fist, the signe must geneate the key pai. The key pai incudes the pivate key, which consists of t andom numbes, and the pubic key, which consists of t hash vaues of these t andom numbes. Fo convenience, we ca these andom numbes pivate bas and thei hash vaues pubic bas. A veifie can efficienty authenticate the pivate bas based on the pubic bas but cannot feasiby compute a vaid pivate ba given a pubic ba. HORS uses the one-way hash function F as a commitment scheme. Given a set of pivate bas, the pubic ba is p i = F( i ). The veifie can easiy authenticate i by veifying p i = F( i ). As peviousy mentioned, the pubic key is composed of t pubic bas. To educe the size of the pubic key, we can eithe educe the ba size o the numbe of bas. Because the ength of pubic ba is eated to the secuity stength of the hash function, we cannot educe the ba size. Thus, we educe the numbe of pubic bas needed by using a Meke hash tee instead of one-way hash function to authenticate the pivate bas, as iustated in Figue 3-1. We pace the oigina pivate bas at the eaves of a binay tee and compute each intena node as the hash of the concatenation of the two chid vaues. The oot node of the hash tee becomes the new pubic key. A change in the pubic key geneation aso effects signatue geneation and veification. The signe geneates the signatue as befoe, by picking k pivate bas out of t pivate bas. Howeve, the signe must affix additiona pubic bas to the signatue. The additiona pubic bas coespond to the authentication path of each picked ba. Using the authentication path, the veifie can vaidate each picked ba by econstucting the path fom picked ba to the oot of the Meke hash tee. One secuity faw occus when an attacke epaces a discosed pivate ba i with pivate ba j. We cannot distinguish between two pivate bas in the same tee. To esove this pobem, we use the uniqueness of each eaf s authentication path. Fo each pivate ba, we concatenate the pubic bas aong its authentication path. Then, we obtain the identity of the pivate ba by appying the hash function to this concatenated vaue. When vaidating a signatue, the veifie fist checks the identity of each pivate ba. Figue 3-1. Key geneation pocedue The Geneaized Scheme We geneaize ou scheme by fist constucting many sma Meke hash tees of height h that hod 2 h pivate bas. The pubic key contains the oot nodes of a the Meke hash tees, and hence educes the key size by a facto of 2 h. Howeve, to authenticate each pivate ba, the signe adds the authentication path of each pivate ba, which equies h veification nodes. Thus, the signatue size inceases by a facto of h. By constucting many Meke tees, we can owe the ovea stoage equiement. As pubic key size deceases, the signatue size inceases. If we ony buid one Meke tee, the combined size of the pubic key and signatue woud not be minima. Theefoe, we need to find an optima baance between the pubic key size and signatue size. We use the paametes in Tabe 3-1 when descibing ou scheme. t k d Tabe 3-1. System Paametes numbe of pivate bas numbe of signatue bas numbe of pubic bas size of ba (bits) -subset esiient Ou poposed scheme compises of thee phases: initia phase, signing phase, and veification phase. In the initia phase, the sende geneates a pivate key and its coesponding pubic key, as shown in Figue 3-2. A pseudoandom geneato poduces a pivate key, which is made of t -bit andom numbes. As outined in Figue 3-3, the PUBLIC_KEY_GENERATION agoithm deives the pubic key, which consists of d hash vaues. Next, the 315

6 sende uses the pivate key in the signing phase to sign a message, as Figue 3-4 shows. Finay, the eceives use the sende s pubic key in the veification phase to vaidate the signatue of the message, as iustated in Figue 3-6. We eaboate upon each phase in the emainde of this section Key Geneation A key pai consists of a pivate key and a pubic key. The pivate key is composed of t -bit andom numbes ceated by a pseudoandom geneato, and the pubic key is deived fom these t andom numbes. Fist, we input t andom numbes into the oneway hash function and output t hash vaues. Then, we sepaate t hash vaues into d goups so that thee ae t/d vaues in each goup. Finay, we use these t/d vaues as the eaves of the binay tee and compute each intemediate node as the hash of the concatenation of the two chid vaues. Thus, we attain d Meke tees, whose oots compise ou pubic key. We note that the oigina pubic key of HORS is t hash vaues geneated fom t andom numbes whie ou pubic key is d Meke tee oots. In a typica case, t = 1024 and d = 32. KEY_GENERATION Input: paametes t, k, d, Output: key pai Pivate Key K pi = (k, s 1, s 2,, s t ) Pubic Key K pub = (k, v 1, v 2,, v n d ) 1. Randomy geneate t -bit andom numbes (s 1,s 2,,s t ) as pivate key 2. K pub = PUBLIC_KEY_GENERATION(k,d,K pi ) 3. Distibute pubic key path is sent ony once. We discuss the dupicate authentication path beow. SIGNATURE_GENERATION Input: message m and K pi Output: signatue = {a i1, a i2,, a ik, bs}, whee a i = (s i, ap i ) (ap is the authentication path of the ba) 1. Compute the hash h = H(m) 2. Spit h into k pieces (h 1,h 2,,h k ) of ength n t bits each 3. Intepet each h j as an intege i j, with 1 j k Figue 3-4. Signatue geneation agoithm The Dupicated Authentication Path To aow a eceive to veify each pivate ba, the sende must incude in the signatue nodes that compise the authentication path. Unfotunatey, the sende may inadvetenty send these additiona nodes mutipe times. Fo exampe, conside Figue 3-5. A sende fist tansmits ba s 0 and its authentication path {v 1, m 23, m 47 }. It then sends s 1 and its authentication path {v 0, m 23, m 47 }. The sende shoud send nodes m 23 and m 47 once since they ae dupicates. Moeove, a eceive can compute v 0 = H(s 0 ). Thus, if a sende seects a diect neighbo of a discosed pivate ba, then no additiona nodes ae equied to be sent. In genea, if a node at height e is a common paent, then a nodes highe than e need not be esent. Theefoe, seected pivate bas that ae cose togethe can educe tansmission ovehead. We note that the uppe bound of the sum of the authentication paths is min(*k*h, the whoe tee). Figue 3-2. Key geneation agoithm PUBLIC_KEY_GENERATION Input: paametes k, d, and K pi Output: K pub 1. Use t bas as pe-image of eaves to buid c Meke tees with height n t. 2. Take n d tee oot as pubic key, with each pubic key coesponding to a sequence peiod. Figue 3-3. Pubic key geneation agoithm Boadcasting Authenticated Messages A sende must sign a messages it boadcasts. To sign a message m, we fist compute h = H(m). Then, we sepaate the hash vaue h into k pieces and egad these pieces as integes, ending up with (i 1, i 2,, i k ) between 0 and t-1. Next, we combine these integes to fom a subset of {0, 1, 2,, t-1} of size at most k. Each intege is an index of pivate bas ( 1, 2,, t ). We pick k pivate bas ( i1, i2,, ik ) and use them, aong with thei associated authentication paths, as the signatue of this message m. Compaed to the oigina HORS, these authentication paths ae added communication ovehead. Fo bette pefomance, the dupicate Figue 3-5. Dupicate authentication path Authenticating Boadcast Messages When a eceive obtains a boadcast message, it must ensue that the message oiginated fom an authentic sende by veifying the signatue of message m with the foowing pocedue. Since the sende wi peiodicay e-key, the eceive must fist decide which of the sende s pubic keys shoud be used to veify the message s signatue. Second, the eceive checks which sequence peiod of that pubic key the sequence numbe fas into. Thid, it computes the hash vaue h = H(m). Fouth, the eceive sepaates the hash vaue h into k pieces and egads these pieces as integes 316

7 (i 1, i 2,, i k ) between 0 and t-1, with each intege as an index to a pivate ba ( 1, 2,, t ). Next, the eceive checks the identities of the bas by uniqueness of authentication path as discussed at the end of section Finay, the eceive veifies each pivate ba by computing the teehash of the pivate ba with its authentication path and checking whethe this teehash is equivaent to the pubic key. A compete match assues the eceive that the pivate ba beongs to the authenticated sende. The veification agoithm is shown as Figue 3-6. SIGNATURE_VERIFICATION Input: message m, signatue, and K pub Output: {tue, fase} 1. Check if m is in cuent sequence peiod 2. Compute the hash h = H(m) Spit h into k piece pieces (h 1,h 2,,h k ) of ength n t bits each Intepet each h j as an intege i j, with 1 j k Compute TN j = i j /(t/d) Check i j with pais (i, TN, H(AP)) If index i j aeady exists, check if H(AP j ) = H(AP) Ese check that each H(AP j ) H(AP) TN j 3. Use Meke tee to veify bas If (TeeHash( j, AP j ) = P TNj then output tue; Ese output fase; Figue 3-6. Signatue veification agoithm 3.2 Re-keying Mechanism Because a singe key pai can ony sign messages, a sende shoud use a new key pai when signing moe than messages. Theefoe, we offe a e-keying scheme as a soution. If one key pai can sign messages, we set the duation of a sequence peiod to. The sequence numbes of the fist pubic key anges fom 0 to -1, the sequence numbes of the second pubic key anges fom to 2-2, and so on, as depicted in Figue 3-7. Each key pai can ony be used fo the duation of its sequence numbes. A eceive must fist check which sequence peiod a eceived message beongs to. 4. DISCUSSION 4.1 Secuity and Pefomance Anaysis In this section, we discuss the system paametes that infuence secuity stength and pefomance of ou scheme. We define these paametes in Tabe 4-1. Highe secuity stength typicay esuts in owe pefomance and vice vesa; theefoe, we aim to povide just enough secuity stength. Thus, we suggest vaues of t = 1024, k =16, and = 4, which affods 64 bits of secuity against a chosen message attack. Fo bute foce attacks, we foow HORS ecommendation of = 80. h t k h 1 f d Tabe 4-1. System paametes cost of computing a hash function size of a pivate ba numbe of pivate bas numbe of bas in the signatue size of pivate ba s identity size of a pubic ba numbe of pubic bas (o tees) numbe of messages one key pai can sign Theoem 1 descibes the secuity stength of ou scheme against bute foce and chosen message attacks. Given a fixed amount of eaves, we can constuct sevea tees instead of just one tee. A deepe tee poduces a smae pubic key size; howeve, the sende must tansmit moe pubic bas pe signatue. Since the eceive concuenty stoes the pubic key and the signatue, we wish to find an optima baance between them. Theoem 2 detemines the numbe of tees that wi geneate the smaest stoage size. Athough we may decease the depth by inceasing the degee of a Meke tee, theoem 3 wi show that a two degee Meke tee is optima. Theoem 1: The paamete decides the secuity stength against a bute-foce attack, whie the paametes k, t, and detemine the secuity stength against a chosen message attack by poviding k(ogt og k og ) bits of secuity. Figue 3-7. Sequence peiod of a pubic key Since a base station shaes a pai-wise secet key with each senso node, the base station unicasts the fist pubic key to each senso node though the authenticated channe. Fo efficiency, the base station may distibute the next pubic key by authenticated boadcast using the od pivate key. Poof: Let f be a one-way function opeating on an -bit input sting. Then the output of the one-way function has ength f. To pefom a bute foce attack against f, attackes deive the pivate ba i fom the Meke tee s eaves using eaf f ). i ( i Because the sende discoses the pivate bas with the signatues, attackes may execute a chosen message attack by coecting the pivate bas to foge a signatue. We assume that the attacke can obtain signatues on messages of its choice (independent of the hash H). The attacke then ties to foge a signatue on any new message m of its choice. We ae inteested in the pobabiity that the advesay is abe to do so without inveting the one-way 317

8 function f. It is tivia to see that, fo each invocation of H, this pobabiity is at most k ( k / t). Lemma 1: The computation cost, communication ovehead, and stoage equiement ae defined beow. Computation cost (of eceive): k h Communication ovehead: d f ( k f k h) Stoage equiement (of eceive): d f k f k h k h Poof: To veify a signatue, the eceive must compute the oot using the eaf and its authentication path, thus, k hash cacuations ae needed. The communication ovehead equies the pubic key size, which consists of d oots, and signatue size, which each consists of k pivate bas and k authentication paths. The stoage equiement incudes the pubic key size, the signatue size, and the pivate ba s identity size. Lemma 2: The tee height is eated to pubic key size by TeeHeight nt n d. Poof: The height of the tee depends on the numbe of pivate bas and the numbe of pubic tee oots. The numbe of eaves of a tee is t/d. The height of the binay tee with t/d eaves is n( t / d) nt n d. Theoem 2: Fo a given secuity stength, we seect a vaue fo the numbe of tees d that wi minimize the equation min( d f k f k (nt n d). Poof: The owest stoage equiement detemines the numbe of tees we must constuct. Combining emma 1 and emma 2, we can find the optima numbe of tees to constuct. Theoem 3: A two degee Meke tee has the owest uppe bound of additiona nodes needed to be sent. Poof: The uppe bound of additiona nodes we tansmit in a signatue is ( d 1) h ( d 1) og d t The WSN possesses the foowing chaacteistics. With a data ate of 10 Kbps, oughy 20 packets of 64 bytes each ae sent evey second. The packet dop ate is at most 5 pecent, and the aveage ength of bust dops is 5 packets. The veification atency shoud be ess than 10 seconds. Accoding to theoem 1, a system with paametes of =80, t=1024, k=16, =4, f t=160 yieds 64-bit secuity. Thus, an attacke needs to pefom 264 hash computations duing a key pai s ifetime to foge a signatue. BiBa [2] povides 58-bit secuity fo a ea-time stock quotes appication; theefoe, we conside 64-bit secuity as sufficient fo ou appication. Using theoem 2, we cacuate an optima pubic key size of 640 bytes, which coesponds to 32 tee oots. Figue 4-1depicts the optima pubic key size. 2.5 x 104 ovehead pubic key (byte) signatue stoage tee numbe Figue 4-1. Optima pubic key size Afte deciding upon the optima numbe of tees, we geneate the key pai using the key geneation agoithm of Figue 3-2. Figue 4-2 iustates the tee constuction fo this exampe. Pivate Key: bit andom numbes Pubic Key: bit hash vaues Numbe of tees: 32 Numbe of eaves: 32 pe tee Tee height: 5 Fo a fixed numbe of eaves t, we find that the equation min(( d 1) og t) d is at a minimum when the degee is two. 4.2 Case Study A municipaity wishes to coect taffic infomation fom sensos distibuted in the steets. The sensos need to authenticate commands fom the base station and etun sensed data though a secue channe. Figue 4-2. Key pai configuation 318

9 4.3 Compaison We compae ou poposed scheme with µtesla [18], an efficient boadcast authentication potoco fo WSNs. Ou scheme has fou main advantages ove µtesla, which we ist beow. 1. No time synchonization equiement. In µtesla, the sende and eceives utiize time synchonization and deayed discosue to achieve asymmety needed fo boadcast authentication, whie ou scheme uses pubicpivate key pais. Thus, ou scheme has no time synchonization equiement, which may be impactica in a age WSN. 2. No buffeing needed by eceive. µtesla equies eceives to buffe a eceived packet unti the coesponding MAC key is discosed. Receives need not buffe eceived messages in ou scheme. 3. Individua authentication of message. Receives can individuay authenticate a eceived packet without waiting fo anothe packet. In µtesla, eceives must wait fo the packet containing the discosed MAC key. 4. Instant authentication of message. With ou scheme, eceives can instanty authenticate a eceived packet. In contast, µtesla equies a eceive to wait one o moe time peiods fo the packet containing the discosed MAC key. We aso compae ou scheme against two othe efficient one-time signatue schemes, BiBa [2] and HORS [3]. Testing at the same secuity eve with system paametes of t=1024, k=16, =10, h=5, ou poposed scheme outpefomed BiBa and HORS in thee aeas: computation, communication, and stoage ovehead. Tabe 4.1 summaizes the esuts of ou expeiment. Geneation ovehead (hash computation) Tabe 4-2. Signatue scheme compaison Veification ovehead (hash computation) BiBa HORS Poposed scheme h= k=17 h=5 Communication (bytes) Stoage (bytes) Enegy cost Lage Lage Sma Time synchonization Yes No No 5. CONCLUSION In this pape, we popose an efficient boadcast authentication scheme fo wieess senso netwoks that utiizes a one-time signatue scheme and e-keying mechanism. Ou scheme exhibits many nice popeties incuding individua authentication, instant authentication, obustness to packet oss, and ow ovehead in computation, communication and stoage. We impove upon the HORS one-time signatue scheme, educing the age key stoage equiement of HORS by using Meke hash tees in geneating the key pai. Despite inceasing computation and communication ovehead, we significanty decease the stoage space usage. We aso devise a simpe but efficient e-keying mechanism fo ou scheme. 6. REFERENCES [1] A. Pannetat and R. Mova, Efficient muticast packet authentication, In Poceedings of the Symposium on Netwok and Distibuted System Secuity Symposium (NDSS 2003), Intenet Society, Feb [2] A. Peig, The BiBa one-time signatue and boadcast authentication potoco, In Poceedings of the Eighth ACM Confeence on Compute and Communications Secuity (CCS-8), pp , Phiadephia PA, USA, Nov [3] L. Reyzin and N. Reyzin, Bette than BiBa: Shot onetime signatues with fast signing and veifying, In Seventh Austaasian Confeence on Infomation Secuity and Pivacy (ACISP 2002), Juy [4] J. M. Pak, E. K. Chong, and H. J. Siege, Efficient muticast packet authentication using signatue amotization, In Poceedings of the IEEE Symposium on Reseach in Secuity and Pivacy, pp , May [5] C. Kaof, N. Sasty, and Yaping Li, Distiation Codes and Appications to DoS Resistant Muticast Authentication, The 11th Annua Netwok and Distibuted System Secuity Symposium, Febuay [6] L Lampot, Constucting digita signatues fom one-way function, Technica Repot SRI-CSL-98, SRI Intenationa, Octobe [7] R. Meke, A Digita Signatue Based on a Conventiona Encyption Function, Poc. CRYPTO'87, LNCS 293, Spinge Veag, pp , [8] R. Meke, A Cetified Digita Signatue, Poc. CRYPTO'89, LNCS 435, Spinge Veag, pp ,1990. [9] R. Meke, Potocos fo pubic key cyptosystems, In Poceedings of the IEEE Symposium on Reseach in Secuity and Pivacy, pp , Ap [10] M. Beae and P. Rogaway, Coision-esistant hashing:towads making UOWHFs pactica, In Advances in Cyptoogy CRYPTO 97, voume 1294 of Lectue Notes in Compute Science, pp , [11] P. Goe and N. Modadugu, Authenticating steamed data in the pesence of andom packet oss, In Poceedings of the Symposium on Netwok and Distibuted Systems Secuity (NDSS 2001), pp , Intenet Society, Feb [12] S. Mine and J. Staddon, Gaph-based authentication of digita steams, In Poceedings of the IEEE Symposium on Reseach in Secuity and Pivacy, pp , May [13] M. O. Rabin, Digitaized signatues, In Richad A. Demio, David P. Dobkin, Anita K. Jones, and Richad J. Lipton, editos, Foundations of Secue Computation, pp Academic Pess, [14] J. M. Pak, E. Chong, and H. J. Siege, Efficient muticast packet authentication using easue codes, ACM Tansactions on Infomation and System Secuity (TISSEC), pp , May

10 [15] J. Byes, M. Luby, M. Mitzenmache, and A. Rege, A digita fountain appoach to eiabe distibution of buk data, In poceedings of ACM SIGCOMM 98, Septembe [16] L. Rizzo, Effective easue codes fo eiabe compute communication potocos, ACMCCR: Compute Communication Review, [17] M. Luby, M. Mitzenmache, M. A. Shokoahi, D. A. Spieman, and V. Stemann, Pactica oss-esiient codes, In ACM Symposium on Theoy of Computing, pp , [18] A. Peig, Robet Szewczyk, Victo Wen, David Cue, and J.D.Tyga, Spins: Secuity potocos fo senso netwoks, Wieess Netwoks, 8: , [19] A. Peig, R. Canetti, D. Song, and J. D. Tyga, Efficient and secue souce authentication fo muticast, In Poceedings of the Symposium on Netwok and Distibuted Systems Secuity (NDSS 2001), pp , Intenet Society, Feb [20] A. Peig, R. Canetti, J. D. Tyga, and D. Song, Efficient authentication and signatue of muticast steams ove ossy channes, In Poceedings of the IEEE Symposium on Reseach in Secuity and Pivacy, pp , May [21] D. Song, D. Zuckeman, and J. D. Tyga, Expande gaphs fo digita steam authentication and obust oveay netwoks, In Poceedings of the IEEE Symposium on Reseach in Secuity and Pivacy, pp , May [22] C. Wong and S. Lam, Digita signatues fo fows and muticasts, In Poceedings on the 6th Intenationa Confeence on Netwok Potocos (ICNP 98), pp , IEEE, Octobe [23] E. Biagioni and K. Bidges, The appication of emote senso technoogy to assist the ecovey of ae and endangeed species, In Specia issue on Distibuted Senso Netwoks fo the Intenationa Jouna of High Pefomance Computing Appications, Vo. 16, N. 3, August [24] E. Biagioni and G. Sasaki, Wieess senso pacement fo eiabe and efficient data coection, In Poceedings of the Hawaiii Intenationa Confeence on Systems Sciences, Januay [25] D. Estin, Embedded netwoked sensing eseach: Emeging systems chaenges, In NSF Wokshop on Distibuted Communications and Signa Pocessing, Nothwesten Univesity, Decembe [26] D. Estin, R. Govindan, J. Heidemann, and S. Kuma, Next centuy chaenges: Scaabe coodination in senso netwoks, In Poc. ACM/IEEE MobiCom, pp , APPENDIX Definition 1: We say that H is -subset-esiient if, fo evey pobabiistic poynomia-time advesay A, P[( j 1 H M 1 i, t, k, M ( M 2 j,..., M 1 ) ] neg ) ( t, k ). t k A ( i,1,1 ) s. t. H i, t, k ( M 1 ) Fix a distibution D on the space of a inputs to H (i.e., on the space of messages). Definition 2: We say that H is -taget-subset-esiient if, fo evey pobabiistic poynomia-time advesay A, P[ M, M 1 s. t. H i, t, k 2,..., M ( M 1 ) D; M j 1 H i, t, k 1 ( M t k A( i,1,1, M,..., M j )] neg( t, k). 1 ) 320