Anonymous Communications in Mobile Ad Hoc Networks Yanchao

Anonymous Communications in Mobile Ad Hoc Networks Yanchao Zhang, Wei Liu and Wenjing Lou Presented by Vivian Bates and Kevin Walker

Outline § I Introduction § II Preliminaries and Models § III MASK System Model § IV Performance Evaluation § V Related Work § VI Conclusion 2

Definitions • MANETs • Mobile Ad hoc NETwork • Ad hoc communication • Allows devices anytime and anywhere to establish communication without the aid of a central infra structure • Anonymous communication • Sender and/or receiver identities hidden from outside observers • Traffic analysis • A passive attack when an adversary observes network traffic in order to infer sensitive information about applications and/or the system • Pairing • Creation or exchange of a link key between two devices. • Link key • Authentication key used to establish a link between devices 3

Basic Mobile Ad Hoc 4

Mobile Ad Hoc Networks (MANETs) § SELF-CONFIGURATION § A system configures its own network-based services and applications in response to the needs of user and the environment of the system § SELF-MAINTENANCE § Dynamic routing § Point-to-point link failure covered 5

Mobile Ad Hoc Networks (MANETs) Personal cell phones laptops Military military battlefields operations (tanks, planes and soldiers) Civilian meeting rooms boats and small aircrafts sport stadiums Emergency homeland security scenarios police and firefighters rescue missions 6

Military Traffic Analysis § Frequent communications — can denote planning § Rapid, short, communications — can denote negotiations § A lack of communication — can indicate a lack of activity, or completion of a finalized plan § Frequent communication to specific stations from a central station — can highlight the chain of command § Who talks to whom — can indicate which stations are 'in charge' and which aren't, which further implies something about the personnel associated with each station § Who talks when — can indicate which stations are active in connection with events, which implies something about the information being passed and perhaps something about the personnel/access of those associated with some stations § Who changes from station to station, or medium to medium — can indicate movement, 7 fear of interception

8

Counter Measurements to Prevent Interception or Detection § LPI/LPD Communication Techniques § Spread spectrum modulation § Effective power control § Directional antennas § Traffic Padding § End to End Encryption and/or Link Encryption on Data Traffic 9

MASK An Anonymous On-Demand Routing Protocol § A novel anonymous on-demand routing protocol § § Based on a cryptographic concept termed MASK Anonymous neighborhood authentication § Based on dynamically changing pseudonyms of nodes § not real identifiers or network-layer addresses and /or MAC addresses § Anonymous route discovery and data forwarding § Based on pairwise shared link identifiers (Link. IDs) between neighbors 10

Preliminaries and Models Pairing Concept Let G 1, G 2 be two groups of the same prime order q View G 1 as an additive group and G 2 as a multiplicative group Pairing is a computable bilinear map f : G 1 x G 1 ----> G 2 satisfying the following properties: § Bilinearity § Non-degeneracy § Computability 11

Adversarial Model § Active § Visible attacks § Radio jamming § Do. S attacks § Countermeasures: frequency hopping § Passive § Invisible attacks § Eavesdropping § Inject a small amount of small packets for better traffic analysis § Countermeasures: spread spectrum, traffic padding, LPI/LPD communication techniques 12

Network Model § Nodes within transmission range § Wireless links are symmetric § Each MAC interface is set for “promiscuous” mode § Each node can manipulate source addresses 13

Performance Evaluation Cryptographic Implementation 1. Anonymous neighborhood authentication 2. Hop by hop link encryption/decryption of routing replies (ARREPs) and data packets • • Tate pairing bilinear map f SHA-1 (hash function H 1 and H 2) for collision resistance RC 6 (symmetric algorithm) The computational overhead and end to end packet delay are affordable. – – – 1000 pairs costs 2. 4 ms New established shared < S Key, Link. ID> pairs can generate new pairs instantly. Hop-by-hop link encryption/decryption are not time consuming 14

Communication Performance of MASK with AODV 20 packet loads: MASK and AODR similar • MASK – – 40 packet loads: MASK outperforms AODR • MASK – Network wide flooding of ARREQs Packets not always routed along the shortest paths – • AODV – **Expanding ring search method ** advantage • **Virtual multi-path (simultaneously maintaining several pre-hops and next-hops for one given destination) **Random selection of next-hops ( load balancing method) AODV – Unreachable next-hops are dropped 15 »

Routing Performance Continued (Fig b) Average Nodal Speed MASK is comparable or lower routing overhead than AODV ( **conducts route discovery less frequently than AODV) (Fig c) Average Packet Delay MASK behaves worst than AODV under normal traffic load (per-hop random delay, fixed encryption/decryption delay, Tate pairing operation) MASK recorded an advantage over AODV under heavy traffic load (the virtual multi-path effect and processing delay helped to mitigate the possible MAC layer collisions ** Advantage 16

MASK OBJECTIVES § Sender and relationship anonymity § Concealment of who is sending or receiving a particular packet (end to end communication) § Concealment of who is talking to who(point to point transmission) § Untraceability and unlocatability § A particular packet can not be traced back to its source or to its destination § Anonymous neighborhood authentication § Neighboring nodes to achieve mutual authentication without disclosing their real identifiers § Low cryptographic overhead and high routing efficiency § Utilizing pairing, efficient hash functions and symmetric –key algorithms § Routing efficiency comparable to AODV protocol § Resistance to a wide range of adversarial attacks § Message coding, flow recognition, and timing analysis 17

MASK ACHIEVEMENTS § {Strong} Sender and relationship anonymity § Concealment of who is sending or receiving a particular packet (end to end communication) § Concealment of who is talking to who(point to point transmission) § {Flowed under a strong adversarial model} Untraceability and unlocatability § A particular packet can not be traced back to its source or to its destination § {Pairwise secret <SKEY, Link. ID> pairs prevented detection} Anonymous neighborhood authentication § Neighboring nodes to achieve mutual authentication without disclosing their real identifiers § {Comparable routing performance with the classic AODV protocol} Low cryptographic overhead and high routing efficiency § Utilizing pairing, efficient hash functions and symmetric –key algorithms § Routing efficiency comparable to AODV protocol § {Immune } Resistance to a wide range of adversarial attacks § Message coding, flow recognition, and timing analysis 18

MASK ACHIEVEMENTS CONTINUED Instead of using on demand route discovery , cryptographic “trapdoor” that would guarantee unconditional anonymity MASK provided conditional anonymity utilizing the destination ‘s identifier in ARREQs to achieve much better routing efficiency tradeoff Internal adversaries residing on forward path may know the sender and/or receiver identifiers of a particular packet but can not match the identifier to a particular node. 19

Related Work WIRED NETWORKS Chaum Mixes-a layered object that route data through a chain of pre deployed intermediate nodes. Reed Onion routing protocol-data wrapped in a series of encrypted layers AD HOC NETWORKS Jiang Traffic Padding- generated dummy traffic into the network Kong and Hong ANODR- an anonymous on demand routing protocol using “trapdoor” 20

MASK System Model • Bootstrapping – Trust authority determines MASK system parameters – <G 1, G 2, f, H 1, H 2> • G 1, G 2 => q-order cyclic groups • f => bilinear mapping function • H 1, H 2 => collision-resistant cryptographic hash functions – Nodes are blind to the system master key, g. 21

Anonymous Neighborhood Authentication • Two neighboring nodes can have a trustable relationship without revealing their real identifiers or party membership. • Three conventional approaches in large-scale MANETs. – Network-Wide Shared Key – vulnerable to single node compromise. – Each node shares pairwise keys with all other nodes – lack of scalability…too many keys to bootstrap! – Nodes have mutual authentication based on public-key certificates – could disclose identity or party membership based on the CA who issues the certificate. 22

MASK System Model • Nodes use dynamically changing pseudonyms instead of real identifiers. • Trust Authority supplies – PSi => set of collision-resistant pseudonyms. – Si => secret point set – Discrete Logarithm Problem is believed to be hard. • Given P and Q within a set, hard to find and integer n such that Q=n. P 23

Anonymous Neighborhood Authentication • All is not lost! MASK allows us to establish pairwise shared link keys and link identifiers based on system parameters. – i. e. the TA does not have to issue all the nodes a key, they can create their own. 24

Anonymous Neighborhood Authentication • 1. 2. 3. 4. 5. Alice and Bob communicate with a random pseudonym picked from their set. Alice needs to be authenticated and Bob sees this. Bob calculates a session key based on Alice’s pseudonym and the secret point corresponding to his pseudonym, and an authenticator based on the key and the two random nonces. After receiving Bob’s reply, Alice can calculate the session key and authenticate Bob based on his authenticator. Alice sends out a similar authenticator to Bob. We have anonymous authentication between Alice and Bob! 25

Anonymous Neighborhood Authentication • After a successful handshake, Alice and Bob can compute Г pairs of shared session keys and link identifiers based on the previous key used, the two random nonces, and a sequence number. • The collision resistant hash functions and bilinear mapping ensure unique pairs within the network. • There is no apparently relationship between the key/identifier pairs between two nodes with the same random nonces due to the hashes. 26

Anonymous Neighborhood Authentication • Each node keeps a neighbor table filled with each neighbor’s key, link identifier, and current pairwise sequence number. • Each pairwise set of nodes needs to have a simple agreement on how to synchronize the use of the key/link identifier pairs. • When Г pairs have been used, Alice and Bob need to increment their nonces by one and generate another set of Г pairs. – Synchronization of the pairs is implicitly guaranteed via this mechanism. 27

Anonymous Neighborhood Authentication • Since only the TA can link a given pseudonym to a node, the eavesdropper Trudy learns nothing of importance. – Trudy is blind to party membership, real identifiers, and the party itself. – Trudy cannot calculate the shared key/link identifier pair either. • Anonymous Authentication has been achieved! 28

Anonymous Route Discovery • Basic System Setup – Each node has • Neighbor table • Forwarding route table – – <dest_id, dest. Seq, pre-link, next-link> • Reverse route table – <dest_id, dest. Seq, pre-hop-pseudonym> • Target link table – Current node is the final destination for the packets bearing the link identifiers in this table. 29

Anonymous Route Discovery • Anonymous Route Requests (ARREQ) – <ARREQ, ARREQ_id, dest. Seq, PSx> – ARREQ_id is a globally unique identifier for this request. – dest. Seq is the last known sequence number for the destination. – PSx is the active pseudonym of the source. 30

Anonymous Route Discovery • C receives an ARREQ for the first time – It inserts an entry into its reverse route table with the source of the ARREQ – Rebroadcasts the ARREQ after changing the pseudonym field to its own. • ARREQs with previously seen ARREQ_ids are simply discarded. • This continues until all nodes have broadcast the ARREQ, including the destination. – This prevents the destination being singled out as the one who did not broadcast the ARREQ. 31

Anonymous Route Discovery • Anonymous Route Replies (ARREP) – <Link. ID, {ARREP, dest_id, dest. Seq}SKey> – Link. ID is the next to be used link identifier between the current node and the next hop. – {ARREP, dest_id, dest. Seq}SKey is encrypted with a symmetric cipher. So only the node with the corresponding Link. ID will be able to decrypte by retrieving the corresponding key from its neighbor table. – Any intermediate node may also send an ARREP if it contains a fresh entry in its forwarding route table for the dest_id. 32

Anonymous Data Forwarding • Packet format: <next-Link. ID, MASK payload> – When forwarding data, nodes randomly select a next hop from their forwarding route table for the destination. This continues at each node until the packet reaches its destination. – This random routing allows packets of the same flow to travel through different paths to the destination node which will confuse adversaries who are trying to acquire network traffic patterns. – MASK does not always use the best path and may introduce extra delay. However, for security sensitive applications, its worth it. – Nodes use anonymous route error packets to inform the network to remove next-link information for nodes that have left the network. 33

Attacks against MASK

Message Coding Attack • When adversaries can easily link and trace packets that do not change their contents or lengths during transmission. • MASK Countermeasures – Random padding is applied to every forwarded packet. Each node has discretion on the amount of padding. – Encryption between different links will make the packet appear different on different links. 35

Flow Recognition and Message Replay Attacks • When adversaries can recognize packets that belong to a same ongoing communication flow or replay older messages. • MASK Countermeasures – Uncorrelated Link. IDs between different hops – Multipath packet forwarding diffuses the path – Link. IDs between two nodes are changed on a per-packet basis, or at least periodically. – Message replay attacks are thwarted by the dynamically changing Link. IDs. 36

Timing Analysis Attack • Adversaries can divide the network into smaller areas to ascertain whether a source or destination is in a particular area by observing that certain packets do not come into or out of that area during a certain time interval. – Heavy traffic load helps prevent this • MASK Countermeasures – Destination nodes can forward forged packets with fake Link. IDs. – Nodes can randomly send out forged dummy packets with fake Link. IDs for misdirection. 37