A Novel Privacy Preserving Authentication and Access Control Scheme for Pervasive Computing Environments Authors: Kui Ren, Wenjing Lou, Kwangjo Kim, and Robert Deng Sources: IEEE Transactions on Vehicular Technology, 55(4), pp , July Reporter: Chun-Ta Li ( 李俊達 )

2 22 Outline  Pervasive computing environments (PCE)  Motivations  The proposed scheme  Analysis  Comments

3 Pervasive computing environments  Definition Integrates digital devices (such as computers, handheld devices, sensors and actuators) seamlessly with everyday physical devices (such as electrical appliances and automobiles). Three components [James Kurose and Keith Ross, 2004]  Nomadic computing: wireless-technology  Sensor-based smart spaces: environment-monitoring  Mobile computing data management Sensor network

4 Pervasive computing environments  Service-Oriented Architecture

5 Pervasive computing environments  Sample PCE Authentication Server Router Public Internet Public Internet Gateway Access Point Printer User Fax Scanner Scientific Device

6 Motivations  Providing explicit mutual authentication between mobile user and the service  Allowing mobile user to anonymously interact with the service  Enabling differentiated service access control among different users  Providing flexibility and scalability to both user and service sides  Generating fresh session keys to secure the interaction  Efficiency of communication, computation and management overheads

7 The proposed scheme  Notations

8 The proposed scheme (cont.)  System architecture Mobile User Authentication Server Service Access Point 1. Registration 2. Authorization 3. Access Request 4. Authentication Request 5. Authentication Acknowledgement 6. Access/Reject

9 The proposed scheme (cont.)  User authorization protocol Credential generation Mobile user U (a certificate CertU) Service provider S 1. Generate two nonces: r’ U and r” U 2. Sign her own ID with a nonce r” U  {U, r” U } PriK U 3. Compute the anchor value C 0  h(r” U, U, {U, r” U } PriK U ) Non-repudiation property 4. Compute the credential chain C n  h n (C 0 ), with length n 5. Blind C n as C U  {r’ U } PubK SID * C n

10 The proposed scheme (cont.)  User authorization protocol Credential authorization Mobile user U (a certificate CertU) Service provider S U, C U, CertU, SID authorization request 6. Verify CertU with PubK S 7. Sign C U as C S  {C U } PriK SID = r’ U * {C n } PriK SID CSCS authorization confirmation 8. Compute C S /r’ U  (C n, {C n } PriK SID )

11 The proposed scheme (cont.)  User operational protocol Mobile user U Service provider S Access point P 1. Generate a nonce: r U 2. Send {r U, C n, {C n } PriK SID } PubK S 3. Send {r U, C n, {C n } PriK SID } PubK S secure tunnel 4. Decrypt r U, C n 5. Store C n 6. Send r U, C n secure tunnel 7. Generate a nonce: r P 8. Compute K UP =h(C n, r P, r U, 0). K’ UP =h(C n, r P, r U, 1) 9. Send r P, {r U, P} K UP access acknowledgement access request access acknowledgement

12 The proposed scheme (cont.)  User operational protocol Mobile user U Service provider S Access point P 10. Compute K UP =h(C n, r P, r U, 0), K’ UP = h(C n, r P, r U, 1). 11. Decrypt and verifies r U, C n, P 12. Encrypt X m 0 = {m 0 } K’ UP 13. Compute h K UP (X m 0 ) 14. Send r P, r U, X m 0, h K UP (X m 0 ) 15. Verify X m 0 using K UP 16. Decrypt m 0 using K’ UP … r P, r U, X m i, h K UP (X m i ) authenticated data traffic

13 Analysis

14 Comments  Cryptanalysis of anonymity property Service provider S Step 1: Get U, C U = {r’ U } PubK SID * C n in Credential Authorization phase Step 2: Sign C U as C S  {C U } PriK SID = r’ U * {C n } PriK SID Step 3: Store U, C U, C S = {C U } PriK SID = r’ U * {C n } PriK SID in their own DB Step 4: Get C n, {C n } PriK SID in User Operational phase Step 5: Compute C S / {C n } PriK SID to derive r’ U Step 6: Compute C’ U = {r’ U } PubK SID * C n to verify whether C’ U = C U holds or not. Step 7: If it holds, S confirms that mobile user U accesses the service; otherwise, S continually executes the previous Steps from 4 to 6.

15 Comments (cont.)  Efficiency improvement in user operational phase compared C j with all C j s stored in S’s DB  Time complexity is O(n) if there are n users in DB solution: User i generates a T ID in access request message and sends it to service provider to store the T ID of user i  Time complexity is O(1)

16 Comments (cont.)  Service abuse problem No one can derive the value of C n unless user itself and thus anyone can fabricate an invalid Cn with a valid Cert U to access the service without limits even than a valid user can deny his accesses. Cert U must keep secret for outsiders {U, C U, CertU, SID} PubK S Mobile user U (a certificate CertU) Service provider S