Technische Universität München WISTP 2007 Mobile Phones as Secure Gateways for Message-Based Ubiquitous Communication 10 th May 2007 W. Bamberger, O. Welter and S. Spitz

Technische Universität München 2 Overview Communication scenario Transport security Platform security Key management Selected attacks

Technische Universität München 3 Communication scenario How does the communication work? Communication scenario Transport security Platform security Key management Selected attacks

Technische Universität München 4 Communication scenario Short range ad-hoc link (e.g. Bluetooth) Web service Logical transport channel Message-based tunnel Randomly passing mobile phone

Technische Universität München 5 Communication scenario External MachineGatewayProxy

Technische Universität München 6 Transport security What security mechanisms are needed for the data transmission? Communication scenario Transport security Platform security Key management Selected attacks

Technische Universität München 7 Requirements ● Integrity ● Authentication / access control ● Non-repudiation ● Confidentiality (optional) ● Anonymity ● Availability ● For machines with very low computation power

Technische Universität München 8 Message constitution ● Message content encrypted for confidentiality ● MAC for access control (Verifiable by each hop/relay) ● MAC for non-repudiation (Only verifiable by proxy in the mobile network) Content MAC-ACHeader MAC-NRMAC-AC

Technische Universität München 9 Non-repudiation keys... Each key has associated a version number and an expiration date.

Technische Universität München 10 Access control keys Each key has associated a version number and an expiration date.

Technische Universität München 11 Key derivation (external machine) Derivation function of the Transport Layer Security (TLS) 1.2 draft Access control keys Non- repudiation key Message key Access control MAC Non-repudiation MAC Encryptio n

Technische Universität München 12 Platform security How can we store and process the keys in a secure manner? Communication scenario Transport security Platform security Key management Selected attacks

Technische Universität München 13 Security architecture in the gateway SIM as an accepted secure processing module

Technische Universität München 14 Key management How are keys renewed? How are keys revoked? Communication scenario Transport security Platform security Key management Selected attacks

Technische Universität München 15 Key update Key renewal request (Key ID, version number) Key renewal response (Encrypted new key, MAC) Gatewa y Prox y = XOR External machine Gatewa y → Overlapping interval of validity

Technische Universität München 16 Key revocation message ● Indicates that a certain key has been compromised ● MAC with the revoked key for validation ● Passed to all gateways and external machines VersionMAC K Key ID

Technische Universität München 17 What does this offer? ● A dynamic symmetric key infrastructure → Improved security ● All access control keys on all devices can be updated automatically → No service intervention necessary ● Non-repudiation keys must be renewed manually (on-site)

Technische Universität München 18 Selected attacks Summarising the system by discussing selected attacks Communication scenario Transport security Platform security Key management Selected attacks

Technische Universität München 19 Attacks on the external machine ● Capturing all packets with a faked gateway →Heuristic for distribution re-transmitted packets among several gateways →Gateway authentication possible

Technische Universität München 20 Attacks on the data packet ● Attacking the MAC →We use message keys →Secure hash functions necessary (see HMAC specification)

Technische Universität München 21 Attacks on the gateway ● Attacking the keys on the SIM →2 key sets →Access control keys are not sufficient (One non-repudiation keys necessary) ● Faked messages (e.g. replay attack) →Access control MAC, nonce

Technische Universität München 22 Attacks on the proxy ● Faked messages (e.g. replay attacks) →Detection: ● 2 MACs ● certain key combinations ● Nonce and other header values →Reaction (depending on the attack): ● Revoking keys ● Refusing the PDP context

Technische Universität München 23 Overall summary ● Introduction of a complex communication system ● SIM as a key storage and processing unit → Slow but rather secure → Available in every mobile phone ● Based on a symmetric key infrastructure for message authentication → Highly dynamic to easily detect and react on attacks

Technische Universität München 24 The End

Technische Universität München 25 Questions? Web service

Technische Universität München 26 Backup

Technische Universität München 27 Key roll-out to the mobile phone A new SIM card contains – an initial set of access control keys – a unique asymmetric key pair (for key management only) – the software With the asymmetric key pair compromised keys can be renewed (see key revocation)

Technische Universität München 28 Key roll-out to the external machine ● Each company has one non-repudiation key and six access control keys ● Deployment is a company internal process ● Balance between security and simplicity ● Example – All keys are handled only in a specific department / room / by a specific person. – They leave this room only encrypted. – There is a master key in every machine with which the keys can be decrypted. – The keys are deployed / renewed on a cheap flash memory in an encrypted form.

Technische Universität München 29 Key storage review ● With the SIM card there is a secure and appropriate key storage and processing area in each mobile phone. → No extra effort necessary ● The security level on the machine's side is company specific. → Each company knows only 6 access control keys and has 1 individual non-repudiation key

Technische Universität München 30 Key update Gateway – Requests a new key with its asymmetric key pair External Machine – Uses only the remaining 5 access control keys – Needs on-site service some time later for key update

Technische Universität München 31 Key roll-out Gateway: A new SIM card contains – an initial set of access control keys – the software – a unique asymmetric key pair (for key management only) External Machine: – Deployment is a company internal process – Each company only has six access control keys and one non-repudiation key – Keys should be encrypted

Technische Universität München 32 Keys of the external machine ● Machines are mainly closed environments ● Hardware break-in thinkable ● Key distribution is a company internal process →Encrypted form for distribution and storage should be forced. →Only 6 access control keys per machine

Technische Universität München 33 Communication scenario Short range ad-hoc link (e.g. Bluetooth) Cellular mobile communication link Web service Backbone network / Internet Randomly passing mobile phone Logical transport channel Message-based tunnel