3/25/ /25/2014 Sensor Network Security (Simon S. Lam) 1

Transcription

1 Sensor Network Security 3/25/2014 Sensor Network Security (Simon S. Lam) 1 1

2 References R. Blom, An optimal class of symmetric key generation systems, Advances in Cryptology: Proceedings of EUROCRYPT 84, Lecture Notes in Computer Science, Springer-Verlag, 209: , Wenliang Du, Jing Deng, Yunghsiang S. Han, and Pramod Varshney, A Pairwise Key Pre-distribution Scheme for Wireless Sensor Networks, Proceedings of the 10th ACM Conference on Computer and Communications Security, Washington DC, October /25/2014 Sensor Network Security (Simon S. Lam) 2 2

3 Motivation Ad hoc networks with no trusted infrastructure support Sensors have limited computation, storage, and energy resources Standard solutions to enable key agreement between computing devices are not appropriate o Public key algorithms o Trusted server 3/25/2014 Sensor Network Security (Simon S. Lam) 3 3

4 Pre-distribution of symmetric keys Naïve solution each node has the same master key o One node compromised => entire network compromised m For a network of N nodes, each node is preinstalled with N-1 symmetric keys for all other nodes o Not scalable 3/25/2014 Sensor Network Security (Simon S. Lam) 4 4

5 Random key pre-distribution Each node has a random subset of k symmetric keys from a large pool of keys Key-sharing graph (G,V) nodes i and j in V have an edge between them if and only if: o Node i and j are within transmission range of each other, and o Nodes i and j have a common key o [Eschenauer and Gligor 2002] Suppose nodes are randomly distributed. o Increase the transmission range of nodes => The key-sharing graph is connected with a high probability o If two nodes have a path between them in G, they can use the path (each edge is protected by a key) to exchange a symmetric key for subsequent communications More scalable but o nodes need to be trusted o communications relayed by a compromised node are compromised 3/25/2014 Sensor Network Security (Simon S. Lam) 5 5

6 Blom s key pre-distribution scheme -secure property When an adversary compromises less than or equal to nodes, uncompromised nodes are perfectly secure. When an adversary compromises more than nodes, all pairwise keys of the entire network are compromised 3/25/2014 Sensor Network Security (Simon S. Lam) 6 6

7 Pre-deployment phase A trusted controller first constructs a ( +1)xN matrix, G, over a finite field GF(q), where o N is the number of nodes o G is public information o q is a prime number larger than n (number of bits in key) Then the controller o creates a random ( +1)x( +1) symmetric matrix D over GF(q) o Matrix D is secret known only to the controller o The controller computes an Nx( +1) matrix A= (D.G) T where (D.G) T is the transpose of matrix D.G 3/25/2014 Sensor Network Security (Simon S. Lam) 7 7

8 Pre-deployment phase (2) Because D is symmetric, we have A.G = (D.G) T.G = G T.D T.G = G T.D.G = G T.A T = (AG) T Thus, AG is a symmetric matrix to be denoted by K = AG, where K ij = K ji, for all 1 i, j N, which can be used as the pairwise key between nodes i and j 3/25/2014 Sensor Network Security (Simon S. Lam) 8 8

9 Blom s key pre-distribution The controller stores the kth row of matrix A in node k, and the kth column of matrix G at node k When nodes i and j need to communicate confidentially, o they first exchange their columns of G (which is public info) in plaintext o then i and j compute K ij and K ji, respectively, using each node s private info (row of A) and received column of G 3/25/2014 Sensor Network Security (Simon S. Lam) 9 9

10 Blom s scheme illustrated private public Node i has Node j has If any +1 columns of G are linearly independent, then the above scheme is -secure 3/25/2014 Sensor Network Security (Simon S. Lam) 10 10

11 An example of matrix G Let each pairwise key be an element in the finite field feld GF(q), where q is the smallest prime number larger than 2 n o for keys represented by n bits Let s be a primitive element of GF(q) and N < q. o each nonzero element in GF(q) can be represented by some power of s o s i s j for i j 3/25/2014 Sensor Network Security (Simon S. Lam) 11 11

12 An example of matrix G (cont.) A Vandermonde matrix any +1 columns of G are linearly independent s, s 2, s N are all distinct any +1 columns of G are linearly independent only the seed s k of the kth column is stored in node k 3/25/2014 Sensor Network Security (Simon S. Lam) 12 12

13 Key pre-distribution idea of Du et al. (2003) The controller creates ω key spaces. For each key space, a tuple (D,G) is created as in Blom s scheme The controller pre-installs matrix rows and columns of a random subset of key spaces in each node 3/25/2014 Sensor Network Security (Simon S. Lam) 13 13

14 A key-sharing graph is also used Nodes i and j have an edge between them if and only if: o Nodes i and j are within transmission range of each other o Nodes i and j have a common key space Suppose nodes are randomly distributed. o Key-sharing graph is connected with a higher probability if There are more key spaces per node Each node has a longer transmission range o Two nodes with a path between them in the graph can communicate by first exchanging a key using encrypted links in the path but forwarding nodes need to be trustedt 3/25/2014 Sensor Network Security (Simon S. Lam) 14 14

15 Comparison with Blom s For a fixed node memory size, they compare Blom s scheme for a single key space with a larger and a deterministic -secure threshold ω key spaces, each node is randomly assigned key spaces. The threshold property is probabilistic: Given that x nodes are captured by an adversary, calculate the probability of at least one key space is compromised It is a soft threshold h which h is higher h than Blom s deterministic threshold, 3/25/2014 Sensor Network Security (Simon S. Lam) 15 15

16 Soft thresholds Fixed node memory size m =200, ω = 50 Du s m =( + 1) =5 =4 =3 Blom s is -secure, = m -1 = 199, deterministic i ti 3/25/2014 Sensor Network Security (Simon S. Lam) 16 16

17 Proposal of Du et al. (more) Given x nodes are compromised, some communications of other nodes are compromised since nodes also serve as relays Authors claim scalability, flexibility, and higher resilience to node capture compared to prior work More details in the paper 3/25/2014 Sensor Network Security (Simon S. Lam) 17 17

18 The End 3/25/2014 Sensor Network Security (Simon S. Lam) 18 18