1. LOGO A Public Key Cryptographic Method for Denial of Service Mitigation in Wireless Sensor Networks O. Arazi, H. Qi, D. Rose IEEE SECON 2007 proceedings 20082065 Myunghan Yoo August 2, 2008

2. Progress  Problem & background  Solution  Discussion

3. Public Key Cryptography  Use private and public keys  Given public key, easy to compute -> anyone can lock  Only those who has private key compute its inverse -> only those who has it can unlock, vice versa. P D E()D() Key Attacker P KeKe KdKd C P C=E(P, K e ) P=D(C, K d ) Insecure channel Key

4.  For Privacy - Encrypt M with Bob’s public key : C = e K (B p,M) - Decrypt C with Bob’s private key : D = d K (B s,C) * Anybody can generate C, but only Bob can recover C to M. Usage of PKC (I) e k (, ) M BPBP d k (, ) C M BSBS Public directory Alice : A p Bob : B p Chaum : C p.

5. Usage of PKC (II) d k (, ) M AsAs e k (, ) C M ApAp Alice : A p Bob : B p Chaum : C p. Public directory - Encrypt M with Alice’s private key : C = d K (A s,M) - Decrypt C with Alice’s public key : D = e K (A p,C) * Only Alice can generate C, but anybody can verify C.  For authentication (Digital Signature)

6. Motivation & Objective  Public Key Cryptography (PKC)  Denial-of-Service Attack in PKC  With repeated & meaningless requests to normal nodes to establish a session key, the adversary causes attacked normal nodes to waste energy resources ProsCons ResilienceHigh computational overhead ScalabilityWeak against DoS attacks Decentralized key management

7. Objective & Key Idea  Objective  Mitigating Denial-of-Service (DoS) attacks  Key Idea  Loading heavy computational burden on the instigator

8. Progress  Problem & background  Solution  Discussion

9. Overview of Proposed Scheme Stage A: Alice proving her validity to Bob A relatively energy draining procedure on Alice’s part Stage B: Bob proving her validity to Alice A relatively low energy draining procedure on Bob’s part If successful If successful: both users hold an ephemeral shared secret key

10. The Instigator Proving Its Validity AliceBob n A ID A CR A (CR A ) e mod n CA = H(n A, ID A ) If so, generates a message, m, such that: t= m e mod n A t t d A mod n A = m x: LSB of message m compares n A : Alice’s public key, ID A : Alice’s public key ID, CR A : Alice’s certificate signed by CA with its private key, e, n CA : CA’s public key CR A = [H(n A, ID A )] d ca mod n CA H(n A, ID A ) = n A ID A 512 bits or 1024 bits

11. Message m  x: Significant bits to identify the instigator  y and z: Factors of an ephemeral key z 212bits y 200bits x 100bits Example of message m where the length of m is 512 bits.

12. Overview of Proposed Scheme Stage A: Alice proving her validity to Bob A relatively energy draining procedure on Alice’s part Stage B: Bob proving her validity to Alice A relatively low energy draining procedure on Bob’s part If successful If successful: both users hold an ephemeral shared secret key

13. The Approached Node Proving Its Validity  Key Transport  Elliptic Curve Digital Signature Algorithm (ECDSA)  Self-Certified DH Fixed Key-Generation

14. Key Transport AliceBob Stage A If successful n B, CR B, ID B, S B Validation of the values: (CR B ) e mod n CA = H(n B, ID B ), (S B ) e mod n B = y If successful K AB-final = z Stage B: S B = y d B mod n B

15. ECDSA AliceBob Stage A If successful (C, L) Calculates h = L-1, q1 = y · h mod ordG, q2 = C · h mod ordG, P = q1 · G + q2 · V, and C’ is scalar of P If C’ = C K AB-final = z Stage B: V = u · G C is scalar of V L = u -1 (y + dB · C) mod ordG

16. Self-Certified DH Fixed Key-Generation Stage A If successful Self-Certified DH Fixed Key-Generation K AB-temp = K AB (generated by Alice) = n A x [H(ID B, n B ) x n B + n CA ] = K BA (generated by Bob) = n B x [H(ID A, N A ) x n A + n CA ] Stage B: K AB-final = H(K AB-temp, m’) n B, CR B, ID B AliceBob

17. Implementation Results Time (msec)Energy (J)Total AliceBobAliceBobTimeEnergy Stage A2301.02105.80.469231.02106.27 Stage B Key Transport2.042300.938105.8232.04106.738 ECDSA1005046.3223.1615069.48 Fixed Key50 23.16 10046.32 Time (msec)Energy (mJ) Total consumptionBoth stages Key Transport463.06213.01 ECDSA381.02175.75 Fixed Key331.02152.6 Using 1024-Bit RSA and 160-bit ECC on the Intel MOTE 2 Platform from 312 MHz core clock

18. Progress  Problem & background  Solution  Discussion

19. Contribution  This paper may be the first try of DoS attack mitigation for PKC

20. Discussion  Unclear environment of implementation  communication distance between Alice and Bob  Yet, unsuitable PKC in the WSN  Incoherent logic  Applying to only a suspicious node is needed  DoS attack with incomplete stage A

21. DoS attack with incomplete stage A AliceBob n A ID A CR A (CR A ) e mod n CA = H(n A, ID A ) If so, generates a message, m, such that: t= m e mod n A t t d A mod n A = m x: LSB of message m compares n A : Alice’s public key, ID A : Alice’s public key ID, CR A : Alice’s certificate signed by CA with its private key, e, n CA : CA’s public key CR A = [H(n A, ID A )] d ca mod n CA H(n A, ID A ) = n A ID A 512 bits or 1024 bits Completed part Incompleted part

22. THANK YOU Q&A