Secure Multi-Hop Infrastructure Access
presented by Reza Curtmola(joint work with B. Awerbuch, D. Holmer, C. Nita-Rotaru and H. Rubens)
600.647 – Advanced Topics in Wireless Networks
Wireless Infrastructure Access
• Few pure wireless peer to peer apps yet(primarily emergency deployments)
• Un-tethered infrastructure access has been the wireless killer app (countless variations)– Voice communication– Internet access– Local area network access– Data gathering sensor networks– Peripherals (headphones, mice, keyboards)
Single-Hop vs. Multi-Hop• Advantages
– Well established– Lower Complexity
• Issues– Limited coverage
• Range• Quality (gaps)
• Advantages– Increased Coverage– Enhanced performance– Reduced Deployment
Cost– Overall Flexibility
• Challenges– Routing protocol– Mobility– Scalability
Infrastructure Access Security
• Single-Hop– Many years to develop current state of the art
• 1997 – WEP• 2003 – WPA• 2004 – 802.11i / WPA2
– Still outstanding issues? (see NDSS 2004 paper)
• Multi-Hop– Introduces a set of additional security concerns– Existing work focuses only on the security of
the ad hoc scenario
Network Model
Gateway
Authorized Node
Adversary
Revoked Node
Protocol Design Goals• Security comparable to single-hop state of
the art protocols• Additional protection against multi-hop
routing attacks– Black Hole– Flood Rushing– Wormhole
• Efficient protocol operation– Symmetric cryptography– Scalable user management
Adversarial Model• Access Point
– is trusted– able to establish trust relationships with
authorized nodes
• Authenticated nodes are trusted to perform the protocol correctly
• Adversaries are unauthenticated nodes– Perform arbitrary attacks
(e.g. drop, inject or modify packets)– May collude to perform stronger attacks
(e.g. tunnel packets)
Our Solution
• Take an existing solution: Pulse protocol[Infocom ‘04, Milcom ‘04, WONS ‘05]– Multi-hop routing protocol– Optimized for many-to-one communication
pattern– High Scalability
• Mobility• Number of nodes• Number of flows
• Build security mechanisms into it
Pulse Protocol Example
Pro-active Spanning Tree
Node Wishes to Communicate
Sends Packet to Gateway
Cryptographic Protection
• Participating nodes share a network wide symmetric key NSK– Used to secure the routing service– Established and maintained using a broadcast
encryption scheme (BES)
• Source and destination use per flow unicast key (UK) to protect data payload
routingheaders
data payloadseq
numberHMACNSK
ENSK EUK
Secure Reliability Metric
• Secure ACKs are required for each data packet traversing a link
• Protocol gathers history of ACK failures
• Link weights inversely proportional to reliability
• Strategy is similar to ODSBR [WiSe ’02]
Network Model
Gateway
Authorized Node
Adversary
Revoked Node
Adversarial Avoidance Example
Gateway
112
2
1
1
222
2
3
2
3
33
2
Adversarial Avoidance Example
Gateway
112
2
1
1
222
2
3
2
3
33
2
Adversarial Avoidance Example
Gateway
112
2
1
1
222
2
3
2
3
33
21
Adversarial Avoidance Example
Gateway
112
2
1
1
222
2
3
2
3
33
21
Adversarial Avoidance Example
Gateway
112
2
1
1
222
2
3
2
33
21.1
3
Adversarial Avoidance Example
Gateway
112
2
1
1
222
2
3
2
3
33
21.1 1
Wormhole Avoidance Example
Gateway
112
2
1
1
222
2
3
2
33
2
3
Wormhole Avoidance Example
Gateway
112
2
1
1
222
2
3
2
21
2
3
1
Wormhole Avoidance Example
Gateway
112
2
1
1
222
2
3
2
21
2
3
1.1 …
Wormhole Avoidance Example
Gateway
112
2
1
1
222
2
3
2
21
2
3
3.1
Wormhole Avoidance Example
Gateway
112
2
1
1
222
2
3
2
33
2
3
3.1
Attack mitigation
• Injecting, modifying packets – use of NSK
• Replay attack – use of nonces
• Flood rushing – protocol relies on the metric, and not on timing information
• Black hole – unreliable links are avoided using metric
• Wormhole – creation is not prevented, but it is avoided using metric
Key Management• Assumption: each node has a unique
pre-established shared key PSK with the gateway
• Goal: to efficiently manage the Network Shared Key (NSK)– Selected and maintained by the gateway– Add/revoke users– Periodically refreshed
Manually entered as in WEP or WPA / WPA2 personal mode
Automatically generated by interaction with an authentication server as in 802.1x / EAP
or
Broadcast Encryption Scheme
• Center broadcasts a message
• Only a subset of privileged (non-revoked) users can decrypt it
• Our requirements:– Allows unbounded number of broadcasts– Any subset of users can be defined as
privileged– A coalition of all revoked users cannot decrypt
the broadcast
Subset Cover Framework• CS or SD [Crypto ’01], LSD [Crypto ’02]• The set of privileged users is represented as the
union of s subsets of users• A long-term key is associated with each subset• A user knows a long-term key only if he belongs
to the corresponding subset• Center encrypts message s times under all the
keys associated with subsets in the union• LSD Properties
– Each node stores O(log3/2(n)) keys– O(r) message size– O(log(n)) computation at each node
Node Management
• Node addition– Using PSK, a node obtains from the gateway
the current NSK and the set of secrets for the BES
• Node revocation / NSK refresh– Gateway generates a new NSK– Gateway broadcasts encrypted NSK such that
only non-revoked nodes are able to decrypt it– Scalability advantage over Group Key
management in 802.11i which is O(n)
1
3
6
Complete Subtree
1
32
7654
15141312111098
• Broadcast: EK2(KEK), EK7(KEK), EK12(KEK), EKEK(NSK’)
U1 U2 U3 U4 U5 U6 U7 U8
12
2
7
Conclusion
• Protocol provides multi-hop infrastructure access
• Efficient, lightweight security– Entirely based on symmetric cryptography– Prevents a wide variety of attacks– Leverages infrastructure for trust establishment
Real World Implementation• Completed Features
– Linux Kernel Module with 2.4 and 2.6 compatibility• Operates at layer 2• Distributed virtual switch architecture provides seamless bridging
– Pulse Protocol• Shortcuts and gratuitous reply• Instantaneous loop freedom• Fast parent switching (with loop freedom)• Medium Time Metric route selection metric (WONS 2004)
– 50 Nodes deployed across JHU Campus• Tested with Internet Access, Ad hoc Access Points, Voice over IP• Mobility tested at automobile speeds
• In Progress– Security – (NDSS Workshop 2005)
• Flood Rushing, Wormholes, Black holes, any NON-Byzantine attack• In kernel crypto implementation
– Leader Election Algorithm• Fault tolerance, switches pulse source to most accessed destination• Handle merge and partition
– Efficient Tree Flooding• Similar to expanding ring search but with no duplicates
Top Related