Self-Healing in Wireless Networks

The self-healing property is expected in many aspects in wireless networks: – Encryption algorithms – Key distribution mechanisms – System protection

3 Overview of the DES A block cipher: – encrypts blocks of 64 bits using a 64 bit key – outputs 64 bits of ciphertext A product cipher – basic unit is the bit – performs both substitution and transposition (permutation) on the bits Cipher consists of 16 rounds (iterations), each with a 48-bit round key generated from the 64-bit key

4 Generation of Round Keys Round keys are 48 bits each

5 Encipherment

6 The f Function

7 S-Box – There are eight S-Box, each maps 6-bit input to 4- bit output – Each S-Box is a look-up table – This is the only non-linear step in DES and contributes the most to its safety P-Box – A permutation

8 DES Modes Electronic Code Book Mode (ECB) – Encipher each block independently Cipher Block Chaining Mode (CBC) – Xor each plaintext block with previous ciphertext block – Requires an initialization vector for the first one – The initialization vector can be made public Encrypt-Decrypt-Encrypt Mode (2 keys: k, k) Encrypt-Encrypt-Encrypt Mode (3 keys: k, k, k  )

9 CBC Mode Encryption  init. vector m1m1 DES c1c1  m2m2 c2c2 sent … … …

10 CBC Mode Decryption  init. vector c1c1 DES m1m1 … … …  c2c2 m2m2

11 Self-Healing Property What will happen if a bit gets lost during transmission? – All blocks will not be aligned When one bit in a block flipped, only the next two blocks will be impacted. – Plaintext “heals” after 2 blocks

13 Stateless and self-healing key distribution – In wireless network, the packets can get lost because of various reasons – We cannot encrypt the new key with the previous key – Revocation capability: forward and backward secrecy – Stateless and self-healing key distribution – Resilient to collusion

14 In secure multicast, group keys are updated periodically – Reduce impacts of key compromise – Adapt to group member changes – How to distribute keys over unreliable channel Self-healing – A user may recover the lost packet by combining information before and after the packet (imagine a sandwich)

15 Approach: polynomial based – t: resilience to collusion – m: the number of sessions – R j : set of users that are revoked in session j – Manager seeks to distribute group key and personal key to each user over a broadcast channel

16 Approach 1: self healing but not revocation – Generate 3m t-degree polys: H 1 to H m, L 1 to L m, and P 1 to P m – Generate m session keys K 1 to K m – For session j, with both P j and K j, we can calculate Q j = K j – P j – Every node i gets the values H 1 (i)+L 1 (i), H 2 (i)+L 2 (i), - --, H m (i)+L m (i)

17 At session j, the manager broadcasts H 1 +P 1, ---, H (j-1) +P (j-1), H j +P j, L j +Q j, L (j+1) +Q (j+1), ---, L m +Q m Every node i can evaluate H j (i)+L j (i)+K j and recovers K j At the same time, the node will get H 1 (i)+P 1 (i), H 2 (i)+P 2 (i), ---, H (j-1) (i)+P (j-1) (i), L (j+1) (i)+Q (j+1) (i), ---, L m (i)+Q m (i) Self healing is possible since K j = P j (i)+Q j (i)

18 Problem: – We can easily add new nodes: just give it the values H j (i)+L j (i) – However, we cannot kick nodes out: no revocation – To support revocation, we cannot always use the same group of covering functions

19 Revocation – t-revocation capability – Manager generates a large number N, and a t- degree bi-variate polynomial s(x, y) – Every node gets N and s(i, i) – We want to distribute f(i) to every node i if it is still in the group, where f(x) is a t-degree poly – The group of revoked nodes are: w1, w2, ---, wt

20 Manager broadcasts: – f(x)+s(N, x) and {wj, s(wj, x)} (j=1 to t) – For every non-revoked node i, it can calculate s(wj, i), which is a value on the polynomial s(x, i). It can get t shares. – Together with s(i, i), it can recover s(x, i) – Node i can calculate s(N, i), and recover f(i) – All revoked nodes only get t shares, and cannot recover the polynomial

21 Advantages – Every node gets a personal key – Can be combined with the self-healing approach – The broadcast overhead is O(t^2), and has nothing to do with the size of the network – Problem: we need t revoked nodes (or fake IDs)

23 Efficient self-healing key distribution and revocation – A novel personal key distribution approach – Drastically reduce communication and storage overhead compared to the previous approach – Still t revocation – Still based on polynomials

24 A personal key distribution mechanism – For a t-degree poly f(x), we want to provide f(i) only to node i – Each legal member gets a different personal key – Revoked members cannot get their shares – Through true broadcast – Need a revocation poly and masking poly

25 Notations: – f(x): key share polynomial (t-degree) – g(x): revocation polynomial (up to t degree) – h(x): masking function (2t degree) Every node gets h(i) during initiation. Group manager broadcasts f(x) * g(x) + h(x) and the revoked nodes. Construct g(x) based on revoked nodes

26 How does a legal node recover the personal key share? Why a revoked node cannot? It is robust against up to t colluders. Advantages: – Communication overhead is only O(t) – Storage overhead is constant – Do not need fake IDs

27 Self-healing with revocation capability – Split each session key into two parts – Support self-healing property

28 If the network lifetime is m session – We generate m(m+1) 2t-degree masking function h i,j (x). So every session we have m+1 masking function – Each node v gets the values h i,j (v) during initiation – For the session key Ki = p i (x) + q i (x), where p and q are t-degree polys

29 In session j, the manager broadcasts – The revoked set Rj – g j (x) * p i (x) + h j, i (x), i = 1 to j – g j (x) * q i (x) + h j, i (x), i = j to m Every non-revoked node v will recover p 1 (v) to p j (v), and q j (v) to q m (v) The revoked nodes cannot

30 The nodes need to store m(m+1) values The broadcast message has the size of O(mt). And the previous approach has O(mt^2) Disadvantage – The set of revoked nodes is monotonic.

31 Reducing the storage overhead – The previous approach needs m(m+1) masking functions, so every node needs to store m(m+1) values – In fact, 2m masking functions are enough: m functions for the p share of the key, and m functions for the q share of the key

32 Reducing communication overhead – For short term network partition, we do not need the node to recover a key used long time ago.