Computer Science CSC 774 Advanced Network Security Topic 7. Wireless Sensor Network Security Dr. Peng Ning CSC 774 Adv. Net. Security 1 Wireless Sensor Networks 1. Network protocol (e.g., routing) 2. Data management (e.g., aggregation) 3. Localization and time synchronization 4. Energy management, robustness,etc. 5. Security Communication and processing module sensor Node to node Group communication Node to sink Location? a. Key management b. Broadcast authentication c. Security of fundamental services d. Detection of attacks, etc. Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 2 1 Wireless Sensor Networks (Cont’d) • Composed of – Low cost, low power, and multifunctional nodes – Wireless communication in short distances • Sensor node – – – – Sensing Data processing Communication Unattended Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 3 Dr. Peng Ning 4 Security in Sensor Networks • Sensor network security – – – – – – – Key management Point-to-point authentication Encryption Broadcast authentication Secure localization Secure clock synchronization … Computer Science CSC 774 Adv. Net. Security 2 Challenges in Sensor Network Security • Resource constraints – Limited storage, computation, and communication • Expensive mechanisms such as public key cryptography is not practical – Depletable resources (e.g. battery power) • Resource consumption attacks • Threat of node compromises – Sensor nodes are usually deployed in an unattended fashion – Subject to node captures Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 5 Challenges (Cont’d) • Local computation/communication v.s. global threat – Sensor network applications often depend on local computation and communication due to resource constraints – A determined attacker may • Attack any node in a network, and • Use information gathered from compromised nodes to attack non-compromised ones Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 6 3 Research Problems • Cryptographic services – Broadcast authentication – Key management • Security mechanisms for fundamental services – – – – Clock synchronization Secure location discovery Secure aggregation and in-network processing Cluster formation/cluster head election Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 7 Research Problems (Cont’d) • Securing sensor network applications – Intruder detection – Tracking of moving targets –… • Intrusion detection – A desirable component – Require different solutions than traditional techniques • Others Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 8 4 Computer Science CSC 774 Network Security Topic 9.1 Key Pre-distribution in Wireless Sensor Networks Dr. Peng Ning CSC 774 Adv. Net. Security 9 Establishing Pairwise Keys in Sensor Networks • Traditional techniques are not practical in sensor networks – Public cryptography: not practical – Key distribution centers (KDC): not practical Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 10 5 Computer Science Probabilistic Key Pre-Distribution Dr. Peng Ning CSC 774 Adv. Net. Security 11 Probabilistic Key Pre-Distribution • Basic idea – Assign a random subset of keys of a key pool to each node – Two nodes can establish secure communication if they have at least one common key i A set of random keys Computer Science j CSC 774 Adv. Net. Security Dr. Peng Ning 12 6 Probabilistic Key Pre-Distribution (Cont’d) • Key distribution (three phases) – Key pre-distribution – Shared-key discovery – Path-key establishment Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 13 Probabilistic Key Pre-Distribution (Cont’d) • Key pre-distribution – Generate a large pool of P keys and their ids – For each sensor, random draw k keys out of P without replacement • This forms the key ring of the sensor – Load the key ring into the memory of the sensor – Save the key ids of each key ring and the sensor id on a trusted controller – For each node, load the i-th controller node with the key shared with that node. Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 14 7 Probabilistic Key Pre-Distribution (Cont’d) • Key pre-distribution (Cont’d) – Parameters k and P are critical • Only a small number of keys need to be placed on each node’s key ring • Any two nodes share at least a key with a chosen probability Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 15 Probabilistic Key Pre-Distribution (Cont’d) • Shared-key discovery – Each node discovers its neighbors in wireless communication range with which it shares keys – Method 1: • Each node broadcasts the list of key ids on its key ring • Give an adversary additional knowledge of key distribution • No direct ways to comprise keys Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 16 8 Probabilistic Key Pre-Distribution (Cont’d) • Shared-key discovery (Cont’d) – Method 2 (private shared-key discovery) • For each key on a key ring, each node broadcasts a list – α, EKi(α), i= 1, …, k, where α is a challenge • If a node receives this list, it tries to decrypt each ciphertext with every key it has • The node establishes a shared key if it can successfully decrypt a cipher-text Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 17 Probabilistic Key Pre-Distribution (Cont’d) • Path-key establishment – Assign a path-key to selected pairs of nodes that • Are in wireless communication range • Do not share a common key • But are connected by two or more links at the end of shared-key discovery – Established through those links Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 18 9 Probabilistic Key Pre-Distribution (Cont’d) • Revocation – Revoke the entire key ring of a compromised node – A controller node broadcasts a single revocation message containing a signed list of key ids for the revoked key ring • The controller generates a signature key Ke, and unicasts it to each node by encrypting it with the key they share. – Each node verifies the signed list of key ids, and removes those key from its key ring Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 19 Probabilistic Key Pre-Distribution (Cont’d) • Re-keying – Restart shared-key discovery and path-key discovery Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 20 10 Analysis • Model a sensor network as a random graph – All the sensor nodes are the vertices in the graph – There is an edge between two vertices if the corresponding nodes share a common key • Analysis questions – What should be the expected degree (d) of a node so that a sensor network with n nodes is connected? – Given d and the size of a neighborhood (n’), what should be the key ring size (k) and key pool size (P) for a network with n nodes? Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 21 Analysis (Cont’d) • What should be the expected degree (d) of a node so that a sensor network with n nodes is connected? – Answered by random graph theory – G(n, p): a graph of n nodes for which the probability that a link exists between two nodes is p. – d = p * (n-1): expected degree of a node (i.e. the average number of edges connecting that node with its neighbors). • Erdös and Rényi’s Equation: – Given a desired probability Pc for graph connectivity and number of nodes, n, the threshold function p is defined by: Pc = lim Pr[G(n, p) is connect] = e$e n "# – where p= ! $c ln(n) c + and c is any real constant. n n Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 22 ! 11 Analysis (Cont’d) Computer Science CSC 774 Adv. Net. Security 23 Dr. Peng Ning Analysis (Cont’d) • Given d and the size of a neighborhood (n’), what should be the key ring size (k) and key pool size (P) for a network with n nodes? – p’: probability of sharing a key between any two nodes in a neighborhood (p’=d/(n’-1)) – p’ = 1 − Pr[two nodes do not share any key] p'= 1" ((P " k)!) 2 (P " 2k)!P! • Simplify with Stirling’s approximation n!" 2# n ! p'= 1" (1" k p) 1 2 $n e 1 2(P "k + ) 2 (1" 2k p) Computer Science n+ 1 (P "2k + ) 2 ! CSC 774 Adv. Net. Security Dr. Peng Ning 24 ! 12 Analysis (Cont’d) Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 25 Improvements for the Probabilistic Key Pre-Distribution • q-composite key pre-distribution – Two nodes have to have at least q shared keys to derive a valid pairwise key – Better resilience when the number of compromised nodes is small • Multi-path enforcement – Derive each path key through multiple nodedisjoint paths, each of which derives one sub-key – Path key is the XOR of all sub keys – Better resilience to compromised nodes in key paths Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 26 13 Random Pairwise Keys Scheme • Approach – Calculate the smallest probability p of two nodes being connected so that the entire network is connected with a high probability. – Consider a network of n nodes – Each node needs to store np pairwise keys • Limitation – The network size is limited by n=m/p, where m is the available memory on each node for keys Computer Science CSC 774 Adv. Net. Security 27 Dr. Peng Ning Computer Science Polynomial Pool Based Key Pre-Distribution Dr. Peng Ning CSC 774 Adv. Net. Security 28 14 Outline • Background – Polynomial based key predistribution • A framework for key predistribution in sensor networks – Polynomial pool based key predistribution • Two efficient key predistribution schemes – Random subset assignment – Grid based key predistribution • Efficient implementation in sensor networks • Conclusion and future work Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 29 Polynomial Based Key Predistribution • By Blundo et al. [CRYPTO ‘92] – Developed for group key predistribution – We consider the special case of pairwise key predistribution • Predistribution: t i j – The setup server randomly generates f (x, y) = " aij x y , i, j= 0 where f (x,y) = f (y, x) – Each sensor i is given a polynomial share f(i, y) • Key establishment: ! – Node i computes f (i, y = j) = f (i, j) – Node j computes f (j, y =i) = f (j, i) = f (i, j) Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 30 15 Polynomial Based Key Predistribution (Cont’d) • Security properties (by Blundo et al.) – Unconditionally secure for up to t compromised nodes • Performance – Storage overhead at sensors: (t +1)log q bits – Computational overhead at sensors: t modular multiplications and t modular additions – No communication overhead • Limitation – Insecure when more than t sensors are compromised – An invitation for node compromise attacks Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 31 Polynomial Pool Based Key Predistribution • A general framework for key predistribution based on bivariate polynomials – Let us use multiple polynomials • A pool of randomly generated bivariate polynomials • Two special cases – One polynomial in the polynomial pool • Polynomial based key predistribution – All polynomials are 0-degree ones • Key pool by Eschenauer and Gligor Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 32 16 Polynomial Pool Based Key Predistribution (Cont’d) • Phase 1: Setup – Randomly generates a set F of bivariate t-degree polynomials – Subset assignment: Assign a subset of polynomials in F to each sensor A subset: {fj(i, y), …, fk(i, y)} f1 (x,y), f2(x,y), …, fn (x,y) i Random polynomial pool F Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 33 Polynomial Pool Based Key Predistribution (Cont’d) • Phase 2: Direct Key Establishment – Polynomial share discovery: Communicating sensors discover if they share a common polynomial • Pairwise keys can be derived if they share a common polynomial. – Two approaches: • Predistribution: – Given predistributed information, a sensor can decide if it can establish a direct pairwise key with another sensor. • Real-time discovery: – Sensors discover on the fly if they can establish a direct pairwise key. Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 34 17 Polynomial Pool Based Key Predistribution (Cont’d) • Phase 3: Path Key Establishment – Establish pairwise keys through other sensors if two sensors cannot establish a common key directly – Path discovery • Node i finds a sequence of nodes between itself and node j such that two adjacent nodes can establish a key directly • Key path: the above sequence of nodes between i and j – Two approaches • Predistribution – Node i can find a key path to node j based on predistributed information • Real-time discovery – Node i discover a key path to node j on the fly Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 35 Random Subset Assignment Scheme • An instantiation of the polynomial pool-based key predistribution. • Subset assignment: random A random subset: {fj(i, y), …, fk(i, y)} f1 (x,y), f2(x,y), …, fn (x,y) i Random polynomial pool F Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 36 18 Random Subset Assignment (Cont’d) • Polynomial share discovery – Real-time discovery Broadcast IDs in clear text. Broadcast a list of challenges. fj, …, fk α, Ekv(α), v = 1, …, m. i i Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 37 Random Subset Assignment (Cont’d) • Path discovery – i and j use k as a KDC – Alternatively, i contacts nodes with which it shares a key; any node that also shares a key with j replies. – Each key path has 2 hops i j k Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 38 19 Probability of Sharing Direct Keys between Sensors s'=2 s'=3 s'=4 s'=5 1.2 1 0.8 p 0.6 0.4 0.2 0 0 10 20 30 40 50 60 70 80 90 s • s: polynomial pool size • s’: number of polynomial shares for each sensor • p: probability of sharing a polynomial between two sensors Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 39 Probability of Sharing Keys between Sensors d=20 d=40 d=60 d=80 d=100 1.2 1 0.8 Ps 0.6 0.4 0.2 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 p • d: number of neighbors • p: probability that two sensors share a polynomial • ps: probability of sharing a common key Note: each key path is at most two hops Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 40 20 Dealing with Compromised Sensors • Comparison with basic probability and q-composite schemes – Probability to establish direct keys p = 0.33 – Each sensor has storage equivalent to 200 keys RS(s'=2,s=11,t=99) q-composite(q=1) Basic probabilistic RS(s'=3,s=25,t=66) q composite(q=2) RS(s'=4,s=43,t=49) q composite(q=3) Fraction of compromised links between noncompromised sensors 1.2 1 0.8 0.6 0.4 0.2 0 0 100 200 300 400 500 600 700 800 900 1000 Number of compromised nodes Computer Science CSC 774 Adv. Net. Security 41 Dr. Peng Ning Dealing with Compromised Sensors (Cont’d) • Comparison with random pairwise keys scheme – Assume perfect security against node compromises • Each polynomial is used at most t times in our scheme – Each sensor has storage equivalent to 200 keys Probability of sharing a common key RS(s'=2,t=99) RS(s'=6,t=32) RS(s'=10,t=19) Random pairwise keys 1.2 1 0.8 0.6 0.4 0.2 0 0 500 1000 1500 2000 2500 3000 3500 4000 Maximum supported network size Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 42 21 Grid Based Key Predistribution • Create a m×m grid • Each row or column is assigned a polynomial • Assign each sensor to an interaction • Assign each sensor the polynomials for the row and the column of its intersection – Sensor ID: coordinate • There are multiple ways for any two sensors to establish a pairwise key Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 43 Grid Based Key Predistribution (Cont’d) • Order of node assignment Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 44 22 Grid Based Key Predistribution (Cont’d) • Polynomial share discovery – No communication overhead Same column Same row Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 45 Grid Key Predistribution (Cont’d) • Path discovery – Real-time discovery – Paths with one intermediate node – Paths with two intermediate nodes – They know who to contact! Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 46 23 Properties 1. Any two sensors can establish a pairwise key when there is no compromised node; 2. Even if some sensors are compromised, there is still a high probability to establish a pairwise key between non-compromised sensors; 3. A sensor can directly determine whether it can establish a pairwise key with another node. Computer Science CSC 774 Adv. Net. Security 47 Dr. Peng Ning Dealing with Compromised Sensors • Comparison with basic probabilistic scheme, q-composite scheme, and random subset assignment scheme Fraction of compromised links between non-compromised sensors – Assume each sensor has storage equivalent to 200 keys Basic probabilistic(p=0.014) q-composite(q=1,p=0.014) RS(s'=2,s=287,t=99,p=0.014) Grid-based(N=20000,p=0.014) 1.2 Basic probabilistic(p=0.33) q-composite(q=1,p=0.33) RS(s'=2,s=11,t=99,p=0.33) 1 0.8 0.6 0.4 0.2 0 0 2000 4000 6000 8000 10000 12000 14000 16000 18000 20000 Number of compromised nodes Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 48 24 Dealing with Compromised Sensors (Cont’d) • Probability to establish pairwise keys when there are compromised sensors – d: number of non-compromised sensors to contact – Assume each sensor has storage equivalent to 200 keys Probability to establish pairwise keys d=1 d=7 d=3 d=9 d=5 1.2 1 0.8 0.6 0.4 0.2 0 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Fraction of compromised nodes Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 49 Implementation • Observations – Sensor IDs are chosen from a field much smaller than cryptographic keys • Field for cryptographic keys: Fq • Field for sensor IDs: Fq’ – Special fields: q’=216+1, q’ = 28+1 • No division operation is needed for modular multiplications Key: n bits l bits each f1 (i,y) Polynomials over Fq’ Computer Science f2 (i,y) fr(i,y) Sensor ID j CSC 774 Adv. Net. Security Same storage as 1 polynomial over Fq Dr. Peng Ning 50 25 Implementation (Cont’d) • Lemma 1. In this implementation, the entropy of the key for a coalition of no more than t other sensors is r " [log 2 q'#(2 # 2 l +1 )] q' "n $ where l = "log 2 q'# and r = # % . #l% • Examples – 64 ! bit keys ! – When q’=216+1, the above entropy is 63.9997 bits ! – When q’ = 28+1, the above entropy is 63.983 bits Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 51 TinyKeyMan • Polynomial pool based key pre-distribution on TinyOS – http://discovery.csc.ncsu.edu/software/TinyKeyMan/ Computer Science CSC 774 Adv. Net. Security Dr. Peng Ning 52 26