Computer Science 1 Efficient Self-healing Group Key Distribution With Revocation Capability Archana Rajagopal CSC 774 Presentation Based on Original Slides from Donggang Liu, Peng Ning, and Kun Sun

Computer Science 2 Outline Motivation and background –Secure group communication in MANET Proposed solutions –Novel personal key distribution –Self-healing group key distribution –Improvements to reduce storage and communication overheads Conclusions and future work

Computer Science 3 Secure Group Communications in MANET Problem –How to distribute group keys? Challenges in MANET –Dynamic and volatile –Unreliable communication Lost packets, network partitions, relatively long term failures due to active attacks, …

Computer Science 4 Related Work Extensive results on group key management –Group key distribution Tree-based scheme: LKH, Iolus, … Secret sharing-based scheme: Self-healing, … –Group key agreement GDH,TGDH, … Most existing techniques are not suitable for MANET –No fault tolerance => not applicable –Simple fault tolerance => easy to disrupt, cannot deal with network partitions and active attacks

Computer Science 5 Related Work (cont’d) Two potential candidates for MANET –Self-healing group key distribution Ability to recover lost session keys Staddon et al., Oakland 2002 –Stateless group key distribution Ability to rejoin the group Cannot recover lost keys Naor, Naor, and Lotspiech (SDR), Crypto 2001

Computer Science 6 Desirable Properties Unconditionally secure Self-healing t-revocation capability t-wise forward secrecy t-wise backward secrecy K 1, K 2, …, K i, K i+1 …, K m t comp. users revoked  K 1, K 2, …, K i, K i+1 …, K m t comp. users  join

Computer Science 7 Property of proposed scheme Processing,Communication and Storage overheads depend on number of compromised nodes that may collude together and not on group size.

Computer Science 8 Scheme I: Personal Key Distribution Goal: distribute distinct keys to different members with one broadcast message –A key is a point on polynomial f(x), e.g., f(j) Idea: construct a single polynomial w(x) to distribute shares on f(x) such that –A valid member can only get its own key –Revoked members know nothing about Valid members’ keys Their own keys

Computer Science 9 Scheme I (cont’d) Method: w(x)=g(x)f(x)+h(x) –h(x) is called a masking polynomial. Degree 2t Each member i has one share on h(x), which is h(i). –g(x) is called a revocation polynomial. Degree w(w<=t).If member v is revoked, g(v) =0; otherwise g(v)!=0

Computer Science 10 Scheme I (cont’d) Group manager broadcasts –Revoked user ids {r 1,…,r w } => g(x)=(x-r 1 )(x-r 2 )…(x-r w ) –w(x)=g(x)f(x)+h(x) Communication overhead O(tlogq) Member v is not compromised, but member v’ is compromised w(x)=g(x)f(x)+h(x) v v’ 0

Computer Science 11 Property of Scheme I Scheme I is an unconditionally secure personal key distribution scheme with t-revocation capability

Computer Science 12 Scheme II: (Basic Session Key Distribution) Main idea –Combine the new personal key distribution scheme with the self-healing technique. Distribute p(x) part for all old session and q(x) part for all future sessions K=K= p(x) p(x)g(x)+h(x) q(x) q(x)g(x)+h’(x) +

Computer Science 13 Self Healing Property Group key K j = p j (i) + q j (i) (m+1) polynomials broadcasted for all ‘m’ sessions –{ p 1 (i)… p j (i), q j (i) …. q m (i)} U i receives messages from j 1 and j 2 but not j;where j 1 < j < j 2 How to recover session key for ‘j’? –p j (i) from j 2 and q j (i) from j 1

Computer Science 14 Broadcast Bj = {R j } {P j,i (x) = g j (x)p i (x) + h i,j (x)} i=1…j {Q i,j (x) = g j (x)q i (x) + h j,i+1 (x)} i=j…m

Computer Science 15 Scheme II (cont’d) In session j, given a set of revoked member ids R j ={r 1,…,r wj }, the group manager broadcasts R j and m +1 polynomials Communication overhead O(mtlogq) Storage overhead O(m 2 logq) Member KjKj

Computer Science 16 Properties of Scheme II Unconditionally secure, t-revocation capability Self-healing session key distribution t-wise forward secrecy and t-wise backward secrecy

Computer Science 17 Scheme III: Reduce Storage Overhead Goal: reduce the storage overhead in scheme II Source of storage overhead: shares on masking polynomials Observation: each p i (x) or q i (x) is masked by different masking polynomials in different sessions –Having one masking polynomial for each p i (x) or q i (x) is sufficient –The broadcast messages are public. So it is unnecessary to protect the same polynomial multiple times using different masking polynomial

Computer Science 18 Scheme III (cont’d) In session j, given the sets of revoked member ids {R i } i=1,…,j, the group manager broadcasts {R i } i=1,…,j and m+1 polynomials Communication overhead is still O(mtlogq) Storage overhead is O(mlogq) instead of O(m 2 logq) in scheme II Member KjKj

Computer Science 19 Properties of Scheme III Unconditionally secure, self-healing session key distribution and t-revocation capability t-wise forward secrecy and t-wise backward secrecy

Computer Science 20 Scheme IV: (Less Broadcast Size) Goal: further reduce the communication overhead Observation: having redundant information for all the sessions may be unnecessary –Short term communication failures –Long term but infrequent communication failures Idea: –Sliding window. –Trade off between broadcast size and self-healing capability

Computer Science 21 Variant I For short term communication failures l-session self-healing: self-healing capability in terms of l consecutive sessions

Computer Science 22 Variant II For long-term but infrequent communication failures (l,d)-session self-healing: Can recover the lost session keys if a member receives d consecutive messages within ld sessions

Computer Science 23 Conclusions Our new personal key distribution scheme can be used to –Develop more efficient self healing key distribution schemes Reduced the communication and the storage overhead of session key distribution scheme Proposed two ways to trade off the broadcast size with the self-healing ability

Computer Science 24 Future Work Long-lived self-healing key distribution Stateless group key distribution Supporting multiple groups Performance evaluation

Computer Science 25 Thank You! QUESTIONS?