Application of Signatures Based Authentication Schemes in Wireless Sensor Networks

Transcription

1 Application of Signatures Based Authentication Schemes in Wireless Sensor Networks 1 Project Description The objective of this project is to implement an online/offline digital signature based broadcast authentication scheme on wireless sensor nodes, and inspect the efficiency of the scheme in terms of sensor nodes resources consumed by the scheme. These resources include memory and battery power of sensor nodes and the time consumed by the sensor nodes to run this scheme. To achieve this objective, a test sensor network will be set up and proposed digital signature based authentication scheme will be implemented on the actual sensor nodes. Statistics about the sensor nodes resource consumption will be recorded and analyzed. ID-based online/offline signature schemes from Elliptic Curve Cryptography and Pairing based Cryptography will be used in authentication scheme. 1.1 Background Knowledge Wireless Sensor Networks A Wireless Sensor Network (WSN) is a wireless ad hoc network consisting of a large number of small, low cost devices called sensor nodes or motes. A typical sensor node consists of a battery, radio communications, micro-controller, and sensors. These senor nodes have very limited resources, i.e., limited processing capability, battery power and storage. They are usually deployed in an open environment to sense or monitor physical or environmental changes like temperature, pressure, vibration etc. and report/relay this data to other sensor nodes over a wireless network. The final destination of this data is the base station, a powerful device (e.g., laptop), which connects sensor network to the outer network. Sensor nodes are different than the traditional computers in the following ways: Processors of sensor nodes are very slow and lack support for some arithmetic and logic operations. Memory available for security codes is very low. Battery power is the most critical resource of the sensor nodes. Security needs to limit its consumption of energy. 1

2 Figure 1: A wireless sensor network An overview of physical characteristics of some of commercially available sensor motes is given in Table 1. Crossbow (Mica Motes) Moteiv (T-mote Sky) Ambient System (SP-3000T SmartPoint) Processor 4-8 MHz 8MHz 16MHz Memory 128KB Flash, 4KB RAM 48KB Flash, 10KB RAM 1MB Flash, 10KB RAM Data Rate Kbps 250Kbps 250Kbps Range 100m 125m 50m Frequency 868/916 MHz - 2.4GHz 2.4GHz 2.4GHZ Table 1: Physical characteristics of some of commercially available sensor motes Online/Offline Signature Schemes Online/Offline signature schemes [4] divide the process of message signing into two phases, the Offline phase and the Online phase. The Offline phase, which consists of complex computations, is performed before the message to be signed becomes available. Once the message is known, the Online phase starts. This phase retrieves the partial signature calculated during the Offline phase and performs some minor quick computations to obtain the final signature. The Online phase is assumed to be very fast, consisting of small computations. The Offline phase can be performed by a resourceful device. Online/Offline allows a resource constrained sensor node to sign a message quickly, once it has some critical event to report. 2

3 1.1.3 ID-based Online/offline Signature ID-based Cryptography [6] allows a user to use his identity information (ID) such as name, phone number, address etc., which is unique to him, as his public key, while the corresponding private key is generated by a private key generator (PKG). In ID-based signature schemes, a message signed with a signer s private key can be verified using signer s ID. ID-based cryptography eliminates the need of a certificate signed by a certification authority to extract the public key for the verification of a signed message. Online/offline signature schemes combined with ID-based cryptography results in ID-based online/offline signature schemes [7, 5], where a message signed with a signer s private key is verified using signer s ID. Appendix B gives examples of ID-based online/offline signature schemes Elliptic Curve Cryptography (ECC) Elliptic Curve Cryptography (ECC) is a kind of public-key cryptography based on the algebraic structure of elliptic curves over finite fields. An elliptic curve is a plane curve which consists of the points satisfying the equation y 2 = x 3 +ax+b along with a distinguished point at infinity. For ECC based protocols, it is assumed that finding the discrete logarithm of an elliptic curve element is unfeasible. For example, let P and Q be two points on an elliptic curve such that kp = Q, where k is a scalar. Given P and Q, it is computationally unfeasible to obtain k, if k is sufficiently large. It is called Elliptic Curve Discrete Logarithm Problem (ECDLP). Hence, the main operation involved in ECC is point multiplication, i.e. multiplication of a scalar k with any point P on the curve to obtain another point Q on the curve. Point multiplication is achieved by two basic elliptic curve operations Point doubling, adding a point J to itself to obtain another point L i.e. L = 2J. Point addition, adding two points J and K to obtain another point L i.e., L = J + K. For example, to find Q = kp, if k = 23 then kp = 23.P = 2(2(2(2P)+P)+P)+P. One main advantage of ECC is its small key size. A 160-bit key in ECC is considered to be as secured as 1024-bit key in RSA Pairing based Cryptography Pairings in elliptic curve cryptography are functions which map a pair of elliptic curve points to an element of the multiplicative group of a finite field. Let n be a positive integer. Let G 1 and G 2 be abelian groups written in additive notation with identity element 0. Suppose that G 1 and G 2 have exponent n (i.e., [n]p = 0 for all P G 1,G 2 ). Suppose G 3 is a cyclic group of order n written in multiplicative notation with identity element 1. A pairing is a function ê : G 1 G 2 G 3 satisfying the following additional properties: 3

4 1. Bilinearity: ê(ap,bq) = ê(p,q) ab for all P, Q G 1,G 2 and a, b Z q. 2. Non-degeneracy: There exist P, Q G 1,G 2 such that ê(p,q) Computability: There exists an efficient algorithm to compute ê(p, Q) for all P, Q G 1,G 2. 2 Experiments Set up a test sensor network, implement the proposed broadcast authentication protocol on it, observe/measure empirical statistics about the energy and time consumption by the implementation of the proposed scheme. 2.1 Methodology The experiment will adapt the following approach involving implementation, testing and a report writing phase Implementation Implement a testbed sensor network Testing Setup a PC to install sensor nodes Setup sensor nodes hardware Install necessary softwares on PC and sensor nodes Configure hardware and softwares Test whether sensor nodes communicate with each other which requires sending packets from a sensor node and receiving from other sensor nodes. Perform experiments on sensor nodes Implement cryptographic operations on sensor nodes Perform signature generation on one sensor node Perform signature verification on rest of the sensor nodes Monitor the memory consumed by the cryptographic code Record time and energy consumption of signature generation and verification 2.2 Report writing Write a report describing all experimental details and results 4

5 2.3 Objectives There are three objectives that have to be achieved within the scope of this experiment. First, to develop a sensor network testbed. Second, to optimally implement cryptographic operations on resource constrained sensor nodes. Third, to record and evaluate the results, i.e. processing requirement, memory used and battery power consumed. 3 Hardware and Software Details 3.1 Hardware Details Sensor node hardware, selected for this project, is MICA2 mote from Crossbow [1]. The characteristics of MICA2 mote are given in appendix A. MICA2 radio operates on 868/916 MHz frequency band, which is a license-free frequency band for Europe. MICA2 mote provides a balance between the processing speed and the energy consumption for sensor nodes MICA2 Product Summary The MICA2 Motes come in three models according to their RF frequency band: the MPR400 (915 MHz), MPR410 (433 MHz), and MPR420 (315 MHz). The Motes use the Chipcon CC1000, FSK modulated radio. All models utilize a powerful Atmega128L micro-controller and a frequency tunable radio with extended range. The MPR4x0 and MPR5x0 radios are compatible and can communicate with each other. (The x = 0, 1, or 2 depending on the model / frequency band.) Figure 2: Photo of a MICA2 (MPR4x0) without an antenna 5

6 3.1.2 Battery Power The MICA2 form factors are designed to match up with two AA batteries; however any battery combination (AAA, C, D, etc., cells) can be used provided that the output is between 2.7 VDC to 3.6 VDC. Mote Hardware Platform Standard Battery (#required) Typical Battery Capacity (ma-hr) Practical Operating Voltage Range (V) MICA2 AA (2) 2000, Alkaline 3.6 to 2.7 Table 2: Characteristics of MICA2 battery Radio The radio used by the MICA2 is ISM band RF transceiver designed for low-power and low-voltage wireless applications. It uses Chipcons CC1000 radio that employs FSK (frequency shift keying) with Manchester encoding and an effective data rate of 38.4 kbps. Radio Considerations: The radio on MICA2 is capable of multiple channel operation, within the intended band of operation. The MPR420/MPR520 can span up to 4 channels of operation in the 315 MHz band, the MPR410/MPR510 can span up to 4 channels of operation in the 433 MHz band ( MHz). The MPR400/MPR500 can operate in two frequency regions: MHz (up to 4 channels) and MHz (up to 54 channels). The actual number of possible channels is higher for all the MICA2 motes. However, it is recommended that the adjacent channel spacing should be at least 500 khz to avoid adjacent channel interference thereby reducing the number of available channels MIB510 Serial Interface Boards MICA2 motes can be reprogrammed using MIB510 Serial Interface board. The MIB510 interface board, shown in figure 3, is a multi-purpose interface board. It supplies power to the devices through an external power adapter option. This serial interface board serves two main purposes (1) It allows the user to reprogram any mote by plugging the mote directly into the base (2) operates as part of the root node interface giving the PC a data conduit onto the radio based sensor network. However, programming a mote requires a special operating system, TinyOS, to be installed on PC. 3.2 Software Details The MICA2 motes use a special operating system called TinyOS. TinyOS is an opensource operating system designed for wireless embedded sensor networks. It is released 6

7 Figure 3: MIB510 Serial Interface Board used in MICA2. under the BSD license. It features a component-based architecture which enables rapid innovation and implementation while minimizing code size as required by the severe memory constraints inherent in sensor networks. TinyOS s component library includes network protocols, distributed services, sensor drivers, and data acquisition tools all of which can be used as-is or be further refined for a custom application. TinyOS was originally developed as a research project at the University of California Berkeley, but has since grown to have an international community of developers and users. TinyOS has been implemented in language called nesc. This language is an extension to C language. It has been designed to embody the structuring concepts and execution model of TinyOS. For further details of TinyOS and nesc, see online available tutorial at [3] and [2], respectively. 3.3 Requirements Summary Hardware: MICA2 motes by Xbow Operating Systems: Linux and TinyOS Programming Languages: nesc and C 4 Data Analysis For broadcast authentication: Total message size will be observed (packet size). Storage requirement will be observed. Memory consumed for cryptographic code will be observed. Time and energy to generate a signature will be observed. Time and energy to compute offline part of a signature. 7

8 Time and energy to compute online part of a signature. Time and energy to verify a signature will be observed. All experimental results will be the averages of ten runs of protocol. References [1] MICA2. [Online]. Available: [2] nesc: A Programming Language for Deeply Networked Systems. [Online]. Available: [3] TinyOS. [Online]. Available: [4] S. Even, O. Goldreich, and S. Micali, On-Line/Off-Line digital signatures, in Proc. Advances in Cryptology CRYPTO 89, ser. LNCS, vol Springer Berlin, 1990, pp [5] Q. Ren, Y. Mu, and W. Susilo, Mitigating phishing with ID-based online/offline authentication, in Proc. Australasian conference on Information Security, AISC 08. Australian Computer Society, Inc., 2008, pp [6] A. Shamir, Identity-based cryptosystems and signature schemes, in Proc. CRYPTO 84 on Advances in cryptology, ser. LNCS. NY, USA: Springer-Verlag, 1985, pp [7] S. Xu, Y. Mu, and W. Susilo, Efficient authentication scheme for routing in mobile ad hoc networks, in Proc. EUC 05 Workshops, ser. LNCS, vol Springer, 2005, pp

9 A Characteristics of MICA2 Processor/Radio Board MPR400CB Remarks Processor Performance Program Flash Memory 128K bytes Measurement (Serial) Flash 512K bytes >100,000 Measurements Configuration EEPROM 4K bytes Serial Communications UART 0-3V transmission levels Analog to Digital Converter 10 bit ADC 8 channel, 0-3V input Other Interfaces DIO,I2C,SPI Current Draw 8 ma Active mode < 15 µa Sleep mode Multi-Channel Radio Center Frequency 868/916 MHz ISM bands Number of Channels 4/ 50 Programmable, country specific Data Rate 38.4 Kbaud Manchester encoded RF Power -20 to +5 dbm Programmable, typical Receive Sensitivty -98 dbm Typical, analog RSSI at AD Ch.0 Outdoor Range 500 ft 1/4 Wave dipole, line of sight Current Draw 27 ma Transmit with maximum power 10 ma Receive < 1 µa Sleep Electromechanical Battery 2X AA batteries Attached pack External Power V Connector provided User Interface 3 LEDs User programmable Size (in) 2.25 x 1.25 x 0.25 Excluding battery pack (mm) 58 x 32 x 7 Excluding battery pack Weight (oz) 0.7 Excluding batteries (grams) 18 Excluding batteries Expansion Connector 51-pin All major I/O signals Table 3: Characteristics of MICA2 mote B ID-based Online/Offline Signature Schemes Definition 2. ID-based online/offline signature (IBOOS) scheme consists of five algorithms as follows: 1. System Setup (SS): SS is is a probabilistic algorithm that inputs a security parameter 1 k and outputs a master secret key SK PKG and system parameters SP. 2. Key Extraction (KE): KE is a deterministic algorithm that inputs a user s identity ID i and master secret key SK PKG and outputs a corresponding private key. 9

10 D IDi KE(ID i,sk PKG ). 3. Offline Signing (OffSign): OffSign is an algorithm that inputs a signing key D IDi and system parameters SP and outputs an offline signature. S O f f Sign(D IDi,SP). 4. Online Signing (OnSign): OnSign is an algorithm that inputs a message m and an offline signature S and outputs an online signature. σ OnSign(m,S). 5. Signature Verification (Ver): Ver is a deterministic algorithm that inputs a message m, user s identity ID i, signature σ and system parameters SP and returns 1 if the signature is valid and 0 if not. 0/1 Ver(m,ID i,σ,sp). Two concrete ID-based online/offline signature schemes are discussed in Appendices B.1 and B.2. B.1 First IBOOS Scheme (through Chameleon Hash) The first IBOOS scheme is proposed by Ren et. al. [5]. Setup. The system parameters are (G,G M,q,P,ê,P pub,h 0,h 1,H c ) where G is an additive cyclic group with a prime order q generated by P and G M is a cyclic multiplicative group with same order. Let ê : G G G M be a bilinear mapping with the following properties: 1. Bilinearity: ê(ap,bq) = ê(p,q) ab for all P, Q G, and a, b Z q. 2. Non-degeneracy: There exist P, Q G such that ê(p, Q) Computability: There exists an efficient algorithm to compute ê(p, Q) for all P, Q G. For a random s Z q, master public key is computed as P pub = sp while s is kept as master secret key. H 0 : {0,1} G and h 1 : {0,1} Z q. Chameleon hash function H c is defined as follows: H c (P pub,id s,m,b r,c r ) = B h 1(m) C r, Where m = Message to sign ID s = Signer s identity B = ê(p,h 0 (ID s )) C = ê(p pub,h 0 (ID s )) Extract. Given an identity ID s, the corresponding private key is S IDs = s 1 H 0 (ID s ). Compute D = ê(p,s IDs ), B = ê(p,h 0 (ID s )) and C = ê(p pub,h 0 (ID s )). For a random r 0 Z q and a message m 0, compute (B r 0,C r 0) and a hash value h = H c (P pub,id s,m 0,B r 0,C r 0) = B h1(m 0) C r 0, and store the tuple (m 0,B,C,D,B r 0,C r 0,h). OffSign. Retrieve h and calculate the partial signature σ i SS(h) using secret key of the original underlying signature scheme. OnSign. Given a message m i, compute B r i = B r 0D (h1(m 0) h1(m i )) 10

11 C r i = C r 0B (h1(m 0) h1(m i )) The message-signature pair is then (m i,b r i,c r i,σ i ). Verify. Compute h = H c (P pub,id s,m i,b r i,c r i) = B h1(m i) C r i where B = ê(p,h 0 (ID s )) and C = ê(p pub,h 0 (ID s )) and check whether (B,C,B r i,c r i) is a valid Diffie-Hellman tuple. If true, then verify original signature σ i. B.2 Second IBOOS Scheme (without Hash Value) The second IBOOS scheme is proposed by Xu et. al. [7]. Setup. The system parameters are (G 1,G 2,q,P,ê,P pub,h 0,H 1 ) where G 1 is a cyclic additive group generated by P with a prime order q. G 2 is the cyclic multiplicative group with same order q. Let ê : G 1 G 1 G 2 be a bilinear mapping with the following properties: 1. Bilinearity: ê(ap,bq) = ê(p,q) ab for all P, Q G 1, and a, b Z q. 2. Non-degeneracy: There exist P, Q G 1 such that ê(p,q) Computability: There exists an efficient algorithm to compute ê(p, Q) for all P, Q G 1. For a random s Z q, P pub = sp, H 0 : {0,1} G 1 and H 1 : {0,1} G 1 Z q. The master secret key is s. Extract. Given an identity ID, the corresponding private key D ID is computed as D ID = sh 0 (ID) and Q ID = H 0 (ID). OffSign. Pick a random number r Z q and a random secret number x Z q, output the offline signature pair (S,R), where S = 1 r D ID, R = xp. OnSign. Given a message m, compute online signature as σ = H 1 (m,r)x + r. The resulting signature is a triple (S,σ,R). Verify. Check whether (P pub,σp H 1 (m,r)r,s,q ID ) is a valid Diffie-Hellman tuple. Correctness. ê(σp H 1 (m,r)r,s) = ê(xh 1 (m,r)p + rp H 1 (m,r)r, 1 r D ID) = ê(h 1 (m,r)xp + rp H 1 (m,r)xp, 1 r D ID) = ê(rp, 1 r sq ID) = ê(p pub,q ID ) 11