Secure Aggregation for Wireless Networks Lingxuan Hu David

Scenario High-power base station Thousands of small, low-powered devices with sensors and actuators, communicating

Scenario High-power base station Transmitting each message all the way to the base station

Data Aggregation If you only care about average, max, etc. , aggregate data inside

Integrity of Data Compromised Node With data aggregation, authentication becomes harder. WSAAN 28 Jan

Problem Can we provide the power-saving benefits of in-network data aggregation but limit the

Cryptographic Hash Chains f f (f (f (x))) f f f (x) f (f

µTesla [Perrig, et. al. , 2002] • Initially: sensor nodes know K 0 =

Node Authentication • Before deployment, establish a shared symmetric secret key between each node

Authenticated Sensor Net Each node transmits: N | RN | MAC (KNS, RN) Base

Authenticated Data Aggregation A | RA | MAC (KAS, RA) C C | Aggr

Secure Aggregation • Delayed Aggregation: Only aggregate messages after they have traveled one hop

Protocol Example IDE | Aggr (RA, RB) | MAC (KEi, Aggr (RA, RB) |

IDG | Aggr (RA, RB), Aggr (RC, RD)) | MAC (KGi, Aggr (RA, RB,

Data Transmission Summary • Children send their data reading and MAC (using KNi) to

Data Validation • At some later time, the Base Station reveals KNi for each

Abridged Attack Analysis • Intruder Node (no key material) – Cannot forge sensor readings:

Successful Attacks • Compromised node selectively drops child readings – Nothing to prevent this

Total Kilobytes Transmitted Communication Cost Sensor reading: 22 bytes MAC of message: 8 bytes

Scalability • Base station must broadcast next node key for every node • To

Summary / Moral (? ) • With our protocol, you can get authenticated results

Slides: 21

Download presentation

Secure Aggregation for Wireless Networks Lingxuan Hu David Evans [lingxuan, evans]@cs. virginia. edu http: //swarm. cs. virginia. edu Department of Computer Science University of Virginia Charlottesville, VA

Scenario High-power base station Thousands of small, low-powered devices with sensors and actuators, communicating wirelessly WSAAN 28 Jan 2003 Hu & Evans 2

Scenario High-power base station Transmitting each message all the way to the base station wastes resources. WSAAN 28 Jan 2003 Hu & Evans 3

Data Aggregation If you only care about average, max, etc. , aggregate data inside the network instead of sending it to the base station. WSAAN 28 Jan 2003 Hu & Evans 4

Integrity of Data Compromised Node With data aggregation, authentication becomes harder. WSAAN 28 Jan 2003 Hu & Evans 5

Problem Can we provide the power-saving benefits of in-network data aggregation but limit the amount of damage a single compromised node can do? Rest of Talk: 1. Background: Inexpensive Authentication without Aggregation 2. Secure Aggregation 3. Security and Cost Analysis 4. Scalable Solution WSAAN 28 Jan 2003 Hu & Evans 6

Cryptographic Hash Chains f f (f (f (x))) f f f (x) f (f (x)) time Initially store: K 0 = f 4(x) K 1 = f 3(x) verify f (K 1) = K 0 K 2 = f 2(x) verify f (K 1) = K 0 WSAAN 28 Jan 2003 Hu & Evans x f is a one-way function: easy to calculate f(x), but difficult to invert f. 7

µTesla [Perrig, et. al. , 2002] • Initially: sensor nodes know K 0 = fn(x) base station knows x • Base station messages encrypted using K 1 = fn-1(x) • Nodes store and time stamp messages, but cannot decrypt them (yet) • At time t 1, base station broadcasts K 1 • Nodes verify f (K 1) = K 0 • Nodes use K 1 decrypt earlier messages • Nodes and base station must have loosely synchronized clocks: cannot accept messages encrypted with K 1 after K 1 was revealed WSAAN 28 Jan 2003 Hu & Evans 8

Node Authentication • Before deployment, establish a shared symmetric secret key between each node and base station: KNS • Send readings with a MAC: RA | MAC (KAS, RA) Assumes confidentiality of transmitted readings is not important. We are only concerned with integrity. WSAAN 28 Jan 2003 Hu & Evans 9

Authenticated Sensor Net Each node transmits: N | RN | MAC (KNS, RN) Base station verifies MAC before accepting RN. WSAAN 28 Jan 2003 Hu & Evans 10

Secure Aggregation • Delayed Aggregation: Only aggregate messages after they have traveled one hop • Delayed Authentication: Use µTesla variation to reveal children’s keys to parents to provide delayed authentication WSAAN 28 Jan 2003 Hu & Evans 12

Data Transmission Summary • Children send their data reading and MAC (using KNi) to their parents. • Parents forward the data and MACs they receive to grandparents, along with a calculated MAC of the aggregation • Grandparents forward MACs and aggregate values from parents and a calculated MAC of aggregation WSAAN 28 Jan 2003 Hu & Evans 15

Data Validation • At some later time, the Base Station reveals KNi for each node N that transmitted data, along with MAC (Ki, KNi) • The parent of N uses KNi to verify MAC (KNi, RN) • Nodes increment i to use the next µTesla key • The Base Station broadcasts Ki (which nodes verify) and advances to the new µTesla key WSAAN 28 Jan 2003 Hu & Evans 16

Abridged Attack Analysis • Intruder Node (no key material) – Cannot forge sensor readings: they will be detected when the base station reveals the node MAC keys – Replay attacks ineffective: keys change, can only replay readings within this time period – Denial-of-service attack can succeed (but alerts operator) • Compromised Node (all keys on one node) – Can lie about its own reading – But, cannot alter other nodes readings without getting caught: aggregate will not match calculated aggregate at next level WSAAN 28 Jan 2003 Hu & Evans 17

Successful Attacks • Compromised node selectively drops child readings – Nothing to prevent this (but unlikely to change much without base station noticing) – Can use child snooping to catch it earlier • Compromise two consecutive (parent and grandparent) nodes – Can forge readings for entire subtree WSAAN 28 Jan 2003 Hu & Evans 18

Total Kilobytes Transmitted Communication Cost Sensor reading: 22 bytes MAC of message: 8 bytes Ideal binary network Sensor Nodes Secure Aggregation requires about 3 times the amount of data transmission as Insecure Aggregation, but provides integrity with < ½ the cost of no aggregation. WSAAN 28 Jan 2003 Hu & Evans 19

Scalability • Base station must broadcast next node key for every node • To scale to larger sensor networks, use local µTesla between parent-child – Need base station to validate start of hash chain • Two µTESLA keys are used each time, one for immediate authentication, and another for Authenticate reading later authentication: A Parent IDA | RA | KA 1 | MAC (KA 2, RA) Authenticate the origin of message (node A) immediately WSAAN 28 Jan 2003 Hu & Evans 20

Summary / Moral (? ) • With our protocol, you can get authenticated results without trusting your children at all, and trusting your parents and grandparents not to conspire together against you. • Not trusting your children is reasonable (inexpensive) • Not trusting your parents is expensive: requires over twice the resources of the insecure aggregation protocol http: //swarm. cs. virginia. edu WSAAN 28 Jan 2003 Hu & Evans 21

Related presentations