Efficiently Authenticating Code Images in Dynamically Reprogrammed Wireless Sensor Networks PerSec 2006 Speaker: Prof. Rick Han Coauthors Jing Deng and Prof. Shiv Mishra University of Colorado at Boulder Department of Computer Science

Reprogramming Wireless Sensor Networks (WSNs) Reprogramming in situ sensor nodes through wireless medium. –Important for sensor network management. Patch buggy code, change run-time parameters. Install new applications and unanticipated features. Very important for hostile and/or rugged terrain. General properties of WSNs –Resource constraints –Tree-structured routing FireWxNet MobiSys 2006 Base station Tree-structured topology of WSN

Secure Reprogramming in WSNs Security is critical for Reprogramming. –Scientific applications – lives may depend on the data (FireWxNet) –Military applications –Commercial applications – inject false code Types of attacks: –Prevent an adversary from injecting malicious or bogus code image to sensor nodes. Data authenticity and integrity – a focus of this paper –Prevent an adversary from a DoS flooding attack – our approach has resilience to this –Prevent an adversary from understanding program code Confidentiality – not a focus of this paper –In WSNs, an adversary can compromise a node! Efficiently protect authenticity and integrity of program code image disseminated from base station

A System Model for Reprogramming Sensor Nodes BS n m … Entire code image is segmented into pages, each page contains a certain number of packets. Page level: a node has to receive page by page sequentially. Packet level: a node broadcasts all packets in a page in “Round-Robin” way. After receiving ACK/NACK messages from neighbors nodes, it broadcasts lost packets, and so on, until all packets are received by neighbors. program code Provides an efficient way to reliably disseminate a large amount of data to the entire network. Deluge, others… 24,5,n n 2

Threat Model and Security Goals Threat Model –Adversary can eavesdrop on all packets nearby. –Adversary can inject (any types of ) data nearby. –Adversary can compromise a sensor node and obtain all information inside it, including code image and keys. –Adversary cannot compromise the base station. Security Goals 1.Protect authenticity and integrity of code image. Adversary cannot inject his malicious program code even given compromised sensor nodes. 2.Preventing adversary from launching Denial of Services attacks by flooding bogus packets. Every node can verify the authenticity of code image as soon as it receives it. Otherwise adversary can inject bogus packets to launch DoS attacks or force a node to drop correct data. 3.Low cost. The communication/computing overhead are acceptable. BS Does not protect against: –Local jamming attacks. Can countermeasure it. –Data confidentiality. M M M

Limiting Public Key Operations Difficult to construct a pure symmetric key approach. –Global key –Transitory global key - to deal with node compromise, but still has problems… –Pairwise keys – issues raised in earlier talk, etc. –Key distribution problem Are public key algorithms feasible on standard sensor nodes? Yes, just barely. –Computing overhead RSA –2-3 seconds (512 bits of key) on mica2. Elliptic Curve Cryptographic algorithm –D. Malan: 40 seconds to encrypt 16 bytes of data on MICA2 –P. Ning: TinyECC takes 12 to 16 seconds to verify a signature on MICAz –V. Gupta: Sizzle from Sun, hundreds or thousands milliseconds on Atmel chip (haven’t seen source code yet) –Communication overhead: RSA: 512 bits of key, Elliptic curve : 168 bits of key Our approach: –combine public key and fast cryptographic hash schemes, but limit public key executions –Predistribute the public key of the base station, and a cryptographic hash

Signed Hash Tree Scheme Motivation: to make our scheme more efficient when some data packets are lost. Solution: send all hashes first, then send data packets. Build a hash tree, hashes in high level packets can be used to authenticate hashes/data in low level packets. –P 2,0 =Hash(P 3,0 )||Hash(P 3,1 ) Send packets from high level to low level. After a node received packet P, it can receive disordered children (hash/data) packets of P. An attacker can’t modify packets undetected Compromise reveals public key and hash A node can verify immediately each packet, even if out of order Sender can disseminate packets similar to Round-Robin. P 4,0 P 4,1 P 4,2 P 4,3 P 4,4 P 4,5 P 4,6 P 4,7 P 3,0 P 3,1 P 3,2 P 3,3 P 2,0 P 2,2 P 1,0 signature

New Results: Compare to a Signed Hash Chain Scheme Similar approaches published in operating systems, SenSys 05 poster, etc. The base station has a private key, and all sensors have the public key. Each packet contains the secure hash value of next packet. The first packet P 0 value contains the signature of the secure hash value signed with private key. When a node receives packet P 0, it can verify the authenticity of the hash value H 1 with the public key. When a node receives packet P k, it can verify its authenticity with H k it received before. Protects data authenticity and integrity. Problems: –Maliciously breaking the chain => can’t verify subsequent packets –Not efficient when packet loss rate is high. –To verify packet H k, B have to receive all packets from H 0 to H k-1. (cannot run Round-robin scheme with NACK) A B

New Results: Linked Hash-tree Scheme Motivation –Conform with code dissemination protocol of Deluge – enforces per page ordering, so can out-of-order packets within a page, but not out-of- order pages => per-page public key! –Reduce memory cost Each page contains a hash tree for code image authentication. Use a signed hash chain to link the root nodes of all hash trees. To appear in IPSN 2006

New Results: Simulations Scenario –A node disseminates 32KB data to 20 neighbors. Packet size 128B, hash size 4B. Hash chain scheme is very expensive since every receiver needs to send an ACK message back to sender. Hash tree scheme consumes too much memory. Hybrid hash chain/tree scheme has feasible moderate cost. (more simulation results are in the IPSN paper) Deluge4KB Hash Chain4 bytes Hash Tree32KB Hybrid4.1KB Memory Consumption

Summary Presented a signed hash tree scheme for efficient and secure dissemination of code to WSNs –Form a signed hash tree –Release hashes a priori –Immediate verification –Out-of-order verification New results show that a hybrid signed chain-tree is the best combination of low overhead, low memory, and low delay –performance is close to insecure Deluge scheme

Fine