1. Revocation Games in Ephemeral Networks Maxim Raya, Mohammad Hossein Manshaei, Márk Félegyházi, Jean-Pierre Hubaux CCS 2008

2. Misbehavior in Ad Hoc Networks Packet forwarding Routing A M B Large scale High mobility Data dissemination 2 Traditional ad hoc networksEphemeral networks Reputation systems? Solution to misbehavior:

3. Reputation vs. Local Revocation Reputation systems: – Often coupled with routing/forwarding – Require long-term monitoring – Keep the misbehaving nodes in the system Local Revocation – Fast and clear-cut reaction to misbehavior – Reported to the credential issuer – Can be repudiated 3

4. Tools of the Revocation Trade Wait for: – Credential expiration – Central revocation Vote with: – Fixed number of votes – Fixed fraction of nodes (e.g., majority) Suicide: – Both the accusing and accused nodes are revoked Which tool to use? 4

5. How much does it cost? Nodes are selfish Revocation costs Attacks cause damage How to avoid the free rider problem? Game theory can help: models situations where the decisions of players affect each other 5

6. Example: VANET CA pre-establishes credentials offline Each node has multiple changing pseudonyms Pseudonyms are costly Fraction of detectors = 6

7. Revocation Game Key principle: Revoke only costly attackers Strategies: – Abstain (A) – Vote (V): votes are needed – Self-sacrifice (S) benign nodes, including detectors attackers Dynamic (sequential) game 7

8. Game with fixed costs 1 3 2 A V VS S A 3 2 VS A 3 VSAVSAVSA Cost of abstaining Cost of self-sacrifice Cost of voting All costs are in keys/message 8 A: Abstain S: Self-sacrifice V: Vote

9. Assumptions: c > 1 1 3 2 A V VS S A 3 2 VS A 3 VSAVSAVSA Equilibrium Game with fixed costs: Example 1 9 Backward induction

10. Assumptions: v < c < 1, n = 2 1 3 2 A V VS S A 3 2 VS A 3 VSAVSAVSA Equilibrium Game with fixed costs: Example 2 10

11. Theorem 1: For any given values of n i, n r, v, and c, the strategy of player i that results in a subgame-perfect equilibrium is: n i = Number of remaining nodes that can participate in the game n r = Number of remaining votes that is required to revoke Game with fixed costs: Equilibrium Revocation is left to the end, doesn’t work in practice 11

12. Game with variable costs S 1 2 A V V 3 2 S A S 12 Number of stagesAttack damage

13. Theorem 2: For any given values of n i, n r, v, and δ, the strategy of player i that results in a subgame-perfect equilibrium is: Game with variable costs: Equilibrium Revocation has to be quick 13

14. Optimal number of voters Minimize: Duration of attack Abuse by attackers 14

15. Optimal number of voters Minimize: Fraction of active players Duration of attack Abuse by attackers 15

16. RevoGame Estimation of parameters Choice of strategy 16

17. Evaluation TraNS, ns2, Google Earth, Manhattan 303 vehicles, average speed = 50 km/h Fraction of detectors Damage/stage Cost of voting False positives 50 runs, 95 % confidence intervals 17

18. Revoked attackers 18

19. Revoked benign nodes 19

20. Social cost 20

21. Maximum time to revocation 21

22. Global effect of local revocations 22 How many benign nodes ignore an attacker?

23. False positives and abuse 23 How many benign nodes ignore a benign node?

24. Conclusion Local revocation is a viable mechanism for handling misbehavior in ephemeral networks The choice of revocation strategies should depend on their costs RevoGame achieves the elusive tradeoff between different strategies 24