An Advanced Signature System for OLSR Daniele Raffo Cédric Adjih Thomas Clausen Paul Mühlethaler 2004 ACM Workshop on Security of Ad Hoc and Sensor Networks (SASN 2004) October 25, 2004 Washington DC, USA

Index Overview of ADVSIG - Advanced Signature System Overview of the OLSR protocol Attacks against routing Topology changes step by step Link state steps (Required proofs) Link state atomic information ADVSIG control message Example of a HELLO/TC + ADVSIG ADVSIG protocol Conclusion An Advanced Signature System for OLSR Daniele Raffo SASN

Overview Signature of control messages. An attacker compromises a node X capturing its private key: now what? We can still check (to some degree) whether the topology information supplied by X is valid or not. This is because the information must be consistent with the information supplied in the past. Hence we have designed a security scheme in which this past information is embedded in a signature message called ADVSIG. The ADVSIG message has to be sent coupled with the standard HELLO and TC control messages. An Advanced Signature System for OLSR Daniele Raffo SASN

The OLSR protocol: overview OLSR is a proactive link state routing protocol for ad hoc networks. Periodic exchange of control messages: HELLOslinks with neighbors (link state), MPR selection 1 hop only, no forwarding TCsbi-directional links with nodes flooded via MPR in the entire network An Advanced Signature System for OLSR Daniele Raffo SASN

The OLSR protocol: overview Optimized flooding via Multipoint Relays (MPRs): each node selects MPRs from among its neighbors, such that a message emitted by that node and relayed by its MPRs will be received by all nodes 2 hops away. standard flooding MPR broadcast An Advanced Signature System for OLSR Daniele Raffo SASN

Attacks against routing We assume that a PKI and message signatures have already been deployed, so that identity spoofing is not possible. We make the hypothesis that a node has been compromised, so it is able to send false information in nonetheless correctly signed messages. We call this link spoofing : a node declares non-existant neighbors in its HELLO and TC messages. Results: the other nodes store an incorrect topology of the network  unreachable nodes and/or conflicting routes. An Advanced Signature System for OLSR Daniele Raffo SASN

Topologia non facit saltus Main idea: network topology changes step by step. We could therefore reuse topology information at time t i-1 to prove the validity of topology information at a later time t i. An Advanced Signature System for OLSR Daniele Raffo SASN t 1 (empty) t 2 A: ASYM_LINK t 3 B: SYM_LINK t 4 A: SYM_NEIGH / MPR_NEIGH BA

Link state steps (Required proofs) When A has the following link state with B... (HELLO) ASYM_LINK SYM_LINK SYM_NEIGH or MPR_NEIGH (TC) neighbor t i An Advanced Signature System for OLSR Daniele Raffo SASN this means that B recently had the following link state with A (not neighbor) ASYM_LINK or SYM_LINK SYM_LINK or SYM_NEIGH SYM_NEIGH or MPR_NEIGH t i-1

Link state atomic information The minimal quantity of certified link state information to be exchanged consists of: (information sent by node A concerning neighbor B) B’s address B’s link state with respect to A timestamp of creation signature of these three fields by A This atomic information is supplied by A as fresh new (Certificate), received and stored in a table by B, and reused afterward (Proof) by B to prove its actual link state. This actual link state information is spread by B in the form of a Certificate, and so on... Note that at bootstrap (ASYM_LINKs) there will be no Proof to give! An Advanced Signature System for OLSR Daniele Raffo SASN

ADVSIG control message We propose an ADVSIG message embedding Certificates’ and Proofs’ timestamps and signatures (along with a global timestamp and signature). This ADVSIG message is generated and sent along with any HELLO or TC. As an example, the next pages will show a HELLO + ADVSIG that advertises links with three neighbors, and a TC + ADVSIG that reports a neighbor. An Advanced Signature System for OLSR Daniele Raffo SASN

HELLO + ADVSIG | Reserved | Htime | Willingness | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | | Neighbor Interface Address | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | : Certificate address link state timestamp of creation signature Proof address of the node sending this HELLO link state can be extrapolated (see “Required proofs”) timestamp of creation signature An Advanced Signature System for OLSR Daniele Raffo SASN | Sign. Method | Reserved | MSN Referrer | | Global Timestamp | | Global Signature | | Signature of Certificate #1 | | Signature of Certificate #2 | | Signature of Certificate #3 | : | Timestamp of Proof #1 | | Signature of Proof #1 | | Timestamp of Proof #2 | | Signature of Proof #2 | | Timestamp of Proof #3 | | Signature of Proof #3 | :

HELLO + ADVSIG | Reserved | Htime | Willingness | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | | Neighbor Interface Address | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | : Certificate address link state timestamp of creation signature Proof address of the node sending this HELLO link state can be extrapolated (see “Required proofs”) timestamp of creation signature An Advanced Signature System for OLSR Daniele Raffo SASN | Sign. Method | Reserved | MSN Referrer | | Global Timestamp | | Global Signature | | Signature of Certificate #1 | | Signature of Certificate #2 | | Signature of Certificate #3 | : | Timestamp of Proof #1 | | Signature of Proof #1 | | Timestamp of Proof #2 | | Signature of Proof #2 | | Timestamp of Proof #3 | | Signature of Proof #3 | :

HELLO + ADVSIG | Reserved | Htime | Willingness | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | | Neighbor Interface Address | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | : Certificate address link state timestamp of creation signature Proof address of the node sending this HELLO link state can be extrapolated (see “Required proofs”) timestamp of creation signature An Advanced Signature System for OLSR Daniele Raffo SASN | Sign. Method | Reserved | MSN Referrer | | Global Timestamp | | Global Signature | | Signature of Certificate #1 | | Signature of Certificate #2 | | Signature of Certificate #3 | : | Timestamp of Proof #1 | | Signature of Proof #1 | | Timestamp of Proof #2 | | Signature of Proof #2 | | Timestamp of Proof #3 | | Signature of Proof #3 | :

TC + ADVSIG | ANSN | Reserved | | Advertised Neighbor Main Address | : TC messages contain no Certificates, because they do not carry link state information Proof address of the node sending this TC link state can be extrapolated (see “Required proofs”) timestamp of creation signature An Advanced Signature System for OLSR Daniele Raffo SASN | Sign. Method | Reserved | MSN Referrer | | Global Timestamp | | Global Signature | | Timestamp of Proof #1 | | Signature of Proof #1 | :

ADVSIG protocol | Reserved | Htime | Willingness | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | | Neighbor Interface Address | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | : When you generate a HELLO/TC message: 1. compute the Signature of Certificate (HELLO only) 2. find the required proof in your table, and copy the Timestamp of Proof and Signature of Proof 3. compute the Global Signature 4. send the HELLO/TC + ADVSIG messages An Advanced Signature System for OLSR Daniele Raffo SASN | Sign. Method | Reserved | MSN Referrer | | Global Timestamp | | Global Signature | | Signature of Certificate #1 | | Signature of Certificate #2 | | Signature of Certificate #3 | : | Timestamp of Proof #1 | | Signature of Proof #1 | | Timestamp of Proof #2 | | Signature of Proof #2 | | Timestamp of Proof #3 | | Signature of Proof #3 | :

ADVSIG protocol | Reserved | Htime | Willingness | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | | Neighbor Interface Address | | Link Code | Reserved | Link Message Size | | Neighbor Interface Address | : When you receive a HELLO/TC + ADVSIG messages: 1. check that the Global Timestamp is valid 2. check that the Global Signature is valid 3. for each advertised link/neighbor in the HELLO/TC, rebuild the required proof and check that the Timestamp & Signature of Proof are valid 4. (HELLO only) if the advertised link is with you, extract the proof relevant to you and store it in your table If any of these tests fail, discard the HELLO/TC + ADVSIG. An Advanced Signature System for OLSR Daniele Raffo SASN | Sign. Method | Reserved | MSN Referrer | | Global Timestamp | | Global Signature | | Signature of Certificate #1 | | Signature of Certificate #2 | | Signature of Certificate #3 | : | Timestamp of Proof #1 | | Signature of Proof #1 | | Timestamp of Proof #2 | | Signature of Proof #2 | | Timestamp of Proof #3 | | Signature of Proof #3 | :

Conclusion This system protects the network against false routing information issued by a lone attacker multiple attackers that do not communicate between each other The network is still vulnerable to connected attackers in collusion (wormhole, etc.), or an attacker failing to forward messages (DoS). Heavy overhead, but improves robustness against isolated attackers. An Advanced Signature System for OLSR Daniele Raffo SASN