Multicast Security Cryptographic Protocols In Kwan Yu Multicast

Multicast Security Cryptographic Protocols In. Kwan Yu

Multicast Security Issues n Multicast n What is it? n n Applications n n An efficient way to communicate between 1 -to-n or m-to -n hosts Audio/video streaming, conferencing, multi-player gaming, stock quotes distribution, command control communication, and much more. Features n n n Open access to receive data Open membership Open access to send data in a multicast group

Multicast Security Issues n Receiver Access Control n n n Group policy specification functions Authentication & authorization /w public key cryptography Source Authentication n Digital signature, MAC

Multicast Security Issues n Multicast Security Issues (Cont) n Multicast Fingerprint n n n Watermarking is embedding copyright information in the contents Fingerprint is a watermarking for a specific user Desirable features of fingerprint n non-removable, collusion resistance, asymmetric fingerprinting, protection granularity, efficiency

Multicast Security Issues n Multicast Security Issues (Cont) n Multicast Fingerprint (Cont) n Methods n n n Intermediate routers can cooperate with the sender to create a unique stream to each member Sender may multicast the most of data and unicast some of unique data to each member Two different streams can uniquely arbitrate for a different user

Multicast Security Issues n Multicast Security Issues (Cont) n Group Key Management n n Shared group key to encrypt the multicast data Rekey Core functionality for the multicast security Group Key Management Issues n n n Member identification and authentication between GCKS (Group Controller/Key Server) and members Access control to validate the join operation Generation, distribution and installation of key materials. Keys should be regularly changed and key generation should be independent of past and future keys

Multicast Security Issues n Group Key Management Issues(Cont) n n n Forward secrecy to prevent a leaving group member to access the group communication. Backward secrecy to prevent a joining group member to decipher previous messages before its join. Storage requirements. The number of keys necessary to operate the system Size of messages. The message size needed to rekey. Collusion. Members of the group can cooperate to compromise the system security Key independence, decentralized controller, local rekey, number of rounds, number of messages

Multicast Security Issues n Issues & Solutions multicast All receive data Open group Membership Outside member sends data Open access to distributed content No individualization of received data Open access to send data to group Denial of service Eavesdropping No theft deterrence Denial of service Masquerading Multicast receiver access control Group key management Multicast fingerprinting Multicast source access control Multicast source authentication Properties Security issues Security vulnerabilities Security solutions

Multicast Security Architecture n Reference n n RFC 3740 What’s in it n n Overview and rationale of multicast security architecture Reference frameworks of secure multicast protocols

Multicast Security Architecture n GSA (Group Security Association) n SA (Security Association) n n Necessary shared information between two parties for a secure comm. Selectors (destination transport address) Properties (algorithms, modes, key lifetimes, key lengths) Keys for authentication, encryption and signing

Multicast Security Architecture n GSA (Cont) n Def. of GSA n Aggregate of Sas n n REG SA n Unicast SA that a group member uses to pull GSA information from Group Controller/Key Server (GCKS) REKEY SA n SA used for rekeying DATA SA n Shared by among the group members Superset of SAs n Includes Attributes of SA

Multicast Security Architecture n GSA (Cont) GCKS REG REKEY REG REG REKEY Sender Receiver DATA

Multicast Security Architecture n Centralized Multicast Security Reference Framework Multicast Security Policies Group Key Management Policy Sever Group Controller/ Key Server Receiver Multicast Data Handling Sender

Multicast Security Architecture n Distributed Multicast Security Reference Framework Multicast Security Policies Group Key Management Policy Sever Group Controller/ Key Server Receiver Multicast Data Handling Sender Receiver

Multicast Security Architecture n Hierarchically-organized Decentralized Key Distribution GCKS Member Sub GCKS Member . . . . Member Sub GCKS . . Member

Group Key Management Protocol n Reference n n RFC 2093 and RFC 2094 Features n n n Public key algorithm for authentication certificates Pairwise key exchange Member compromise can be solved only by creating a new group GTEK(Group Traffic Encryption Key) for data GKEK(Group Key Encryption Key) for the group key

Group Key Management Protocol n Group Key Generation Create Group Keys 1 (rand #) C O N T R O L L E R Create Group Keys 2 (# for GTEK, GKEK) Negotiate Group Keys 1 (GTEK, GKEK, permission, group id, group member, rekey interval, CRL (compromise recovery list) Negotiate Group Keys 2 M E M B E R

Group Key Management Protocol n Group Key Distribution Create Session Keys 1 (rand #) C O N T R O L L E R Create Session Keys 2 (# for SKEK) Negotiate Session Keys 1 (SKEK, permission, group id, members) Negotiate Session Keys 2 Download Group Keys(GTEK, GKEK, group id, group permission, rekey interval) Key Download Acknowledge M E M B E R

Group Key Management Protocol n Rekey Create Group Keys 1 C O N T R O L L E R Create Group Keys 2 Negotiate Session Keys 1 Negotiate Session Keys 2 Rekey_Multicast M E M B E R

Group Key Management Protocol n Join Request Group Join Create Session Keys 1 C O N T R O L L E R Create Session Keys 2 Negotiate Session Keys 1 Negotiate Session Keys 2 Download Group Keys Key Download Acknowledge M E M B E R

Tree Based Multicast Group Key Management n Reference n n RFC 2627 Features n n The secure removal of a compromised user from the multicast group Transmission efficiency Storage efficiency Net key is a root key used as DEK

Tree Based Multicast Group Key Management n Initialization n n Pair wise KEKs with each user by the public key exchange protocol Key for each node is generated From the parents of leaf nodes up to the root, the server transmits the key for each node encrypted with the keys of each of the node’s children Each leaf has all keys on the path to the root

Tree Based Multicast Group Key Management n Member Deletion n Ex) When the user 11 is deleted n n n New key for F is encrypted with the user 12’s KEK and sent New key for K is encrypted with the new key for F and sent. New key for K is encrypted with the new key for E and sent for the users 9 and 10 New key for N is encrypted with keys of K and L, etc. until a new root key(DEK) is distributed.

Tree Based Multicast Group Key Management n Logical Key Distribution Architecture net key Key O intermediate keys Key M Key N Key I Key A 1 2 Key J Key B 3 4 Key K Key C Key D 5 7 6 Key E 8 9 users 10 Key L Key F 11 12 Key G 13 14 Key H 15 16

Centralized Flat Key Distribution n Architecture n n n Each member has a fixed length id Each bit of id is assigned to a different KEK. Each member is assigned a set of unique KEKs according to the id bit values

Centralized Flat Key Distribution n Flat ID Assignment (e. g 0110) TEK KEK 0. 0 KEK 0. 1 KEK 1. 0 KEK 1. 1 Bit 2 KEK 2. 0 KEK 2. 1 Bit 3 KEK 3. 0 KEK 3. 1 Bit 0 Bit 1 Bit value 0 Bit value 1

Centralized Flat Key Distribution n Join n n Assign KEKs from the KEK space Leave n n KEKs related to the deleted member’s id bits are assigned new KEKs. And new TEK is generated New KEKs are encrypted with the new TEK and the old KEK of that bit. KEKs related to bits not used by the deleted member is used to encrypt the new TEK

Centralized Flat Key Distribution n KEK for Member 0110 Deletion

Scalable Multicast Key Distribution n Reference n n RFC 1949 CBT (Core Based Tree Multicast Routing) n n n RFC 2201 IP layer protocol CBT protocol creates a hard state routing tree among a multicast group. The multicast data follow the fixed multicast tree structure Tree branch is formed when there is at least one member join from a subtree In SMKD, the primary core of CBT establishes the security parameters used in the multicast

Scalable Multicast Key Distribution n Scalability n n With enough information including keys and ACL (group access control list), each router can distribute the group key (DEK) and KEK This operation is dependent on the structure of CBT tree

Scalable Multicast Key Distribution n Multicast Key Distribution using CBT router router router Core B router A Host h A, B, router are non-core routers

Scalable Multicast Key Distribution n Example Protocol

Dual Encryption Protocol n Architecture n Top level nodes may have different KEKs n n n Using several KEKs may extend the key lifetime Each subgroup has a subgroup key Participating group manager will not be given a KEK. Only members have KEK. CC (Capability Certificates) are issued by a higher authority AC (Access Capability) is used to prevent multiple join DEK is encrypted with the KEK and the subgroup key

Dual Encryption Protocol n Key Distribution Tree Top level sender S Key group 1 h 2 g 2 h 5 gi h 6 participant g 1 h 3 p 2 h 4 h 7 h 5 pi member h 6 h 7 hi host

Dual Encryption Protocol n Join

Dual Encryption Protocol n Leave n n The group manager multicast a message containing a new subgroup key encrypted with the rest of group member’s public keys To decrypt the DEK, KEK and subgroup key are necessary. Since the leaving member just has KEK and the old subgroup key, it cannot access the multicast data afterwards ensuring the forward secrecy.

Diffie-Hellman Group Key Distribution n n 3 Protocols are proposed No group controller. All members should cooperate to generate a group key

Diffie-Hellman Group Key Distribution n Version 1

Diffie-Hellman n Version 1 Example

Diffie-Hellman Group Key Distribution n Version 2

Diffie-Hellman n Version 2 Example

Diffie-Hellman Group Key Distribution n Version 3

Diffie-Hellman Group Key Distribution n Join for version 2

Diffie-Hellman Group Key Distribution n Delete for version 2

Reference n n n [1] Paul Judge and Mostafa Ammar, Security Issues and Solutions in Multicast Content Distribution: A Survey, IEEE Network, Jan/Feb 2003. [2] T. Hardjono and B Weis, RFC 3740, IETF, 2004 [3] San. Ford Rafaeli and David Hutchison, A Survey of Key Management for Secure Group Communication, ACM Computing Survey, Vol 35, No. 3, Sept. , 2003. [4] Lakshminath R. Dondeti, Sarit Mukherjee and Ashok Samal, Survey and Comparison of Secure Group Communication Protocols, Technical Report, University of Nebraska-Lincoln, June 1999. [5] Thoams Hardjono and Gene Tsudik, IP Multicast Security: Issues and Directions, Annales de Telecom, 2000.

Reference n n n [6] R. Canetti, J. Garay, G. Itkis, D. Micciancio, M. Naor, and B. Pinkas, Multicast Security: A Taxonomy and Efficient Constructions. IEEE Infocom, NY, USA, March 1999. [7] A. Eskicioglu, Multimedia security in group communications: recent progress in key management, authentication, and watermarking. ACM Multimedia Systems Journal, Special Issue on Multimedia Security, September 2003. [8] H. Harney, C. Muckenhirn, Group Key Management Protocol (GKMP) Specification, RFC 2093, 1997. [9] H. Harney, C. Muckenhirn, Group Key Management Protocol (GKMP) Architecture, 2094, 1997. [10] A. Ballardie, Scalable Multicast Key Distribution, RFC 1949, 1996

Reference n n [11] D. Wallner, E. Harder and R. Agee, Key Management for Multicast: Isssues and Architectures, RFC 2627, 1999. [12] Lakshminath R. Dondeti and Sarit Mukherjee, A Dual Encryption Protocol for Scalable Secure Multicasting, IEEE ISCC, 1999 [13] Michael Steiner, Gene Tsudik and Michael Waidner, Diffie. Hellman Key Distribution Extended to Group Communication, ACM CCS, 1996. [14]Marcel Waldvogel, GErmano Caronni, Dan Sun, Nathalie Weiler and Berhard Plattner, The Versa. Key Frame. Work: Versatile Group Key Management, IEEE Journal on Selected Areas in Communications, 1999.