Identity-Based Cryptography and Its Applications in Wireless Networks

4/17/2012The Explorer

Contents

● Backgrounds

● Identity-Based Cryptography

● Improved Efficiency of Identity-Based Cryptography for Wireless

Sensor Networks

● Identity-Based Cryptography for Vehicular Networks

● Identity-Based Cryptography for Distributed Social Network

Platforms

● Summary

Security in Wireless NetworksSymmetric Key Algorithms – AES, 3DES, IDEA

● Faster operation

● One time-pad, proved unbreakable

Challenge(s):

Establishing shared secret key

Asymmetric Key Algorithms – Diffie-Hellman, RSA

● Solves key sharing problem

Challenge(s):

● Slower operation and heavy computation

● Public Key Infrastructure is costly

Identity-Based Cryptography (IBC)

● Public key derived from publicly known identity representing a

user (Ex: email address, domain, IP address)

● Eliminates the need for a public key distribution infrastructure

● Useful for Wireless networks where pre-distribution of

authenticated keys is inconvenient or infeasible due to technical

restraints

● Current efficient IBC schemes based on bilinear pairings on

elliptic curves

How IBC works?

Private Key Generator(PKG)

MasterPrivate Key

MasterPublic Key

Alice

Alice’sPrivate Key

Bob

MasterPublic Key

Bob’sPrivate Key

Preliminary, offline activities

1. Obtain Master Public Key 3. Obtain Master

Public Key2. Authenticate and receive Alice’s

Private Key4. Authenticate

and receive Bob's Private Key

MasterPublic Key

Advantages of IBC

● No public key distribution infrastructure, authenticity of public

keys are guaranteed implicitly

● Possible to encode additional information into the identifier like

time-stamp to signify freshness

● Master secret key can be destroyed for fixed user systems with

no key revocation ---> Debatable !

Discussion on IBC

What do you think are the assumptions or limitations of using

the Identity based Cryptography?

Paper I:

Efficient online/offline identity-based signature for wireless sensor network –

Liu et al.(Int'l Journal of Info. Sec. 2010)

Need for Authentication in Wireless Sensor Networks

● Applications in Commercial and Industrial areas to monitor and

collect data

● Deals with sensitive data like reporting radiological levels to

base stations in Nuclear Power plants

● Authentication of sensed data becomes important.

● Limiting factors -

● Limited battery power in sensors

● Public key scheme is good, but PKI becomes costly for the

sensors

Efficient online/offline identity-based signature for wireless sensor network

● Paper Overview

● Proposes use of Identity Based Signatures, public key generated using user's identity

● Usage of online/offline signatures, as originally proposed in “On-line/off-line digital signatures – Goldreich et al.”

● Provides multi-time usage of the offline storage, which allows the signer to re-use the offline pre-computed information in polynomial time

● Demonstrate fesability of scheme in the WSN environment with an actual implementation on the MicaZ platform

Online/Offline IBS Scheme (1)

● The security of our scheme will be reduced to the hardness of the Discrete Logarithm (DL) problem in the group in which the signature is constructed.

● (Discrete Logarithm (DL) Assumption)

● Given a group G of prime order q with generator g and element gx G ∈

● Where x is selected uniformly at random from Z*q ● The discrete logarithm (DL) problem in G is to compute x.● The (e, t)-DL assumption holds in a group G if no algorithm

running in time at most “t” can solve the DL problem in G with probability at least e.

Online/Offline IBS Scheme (2)● Setup

● This algorithm computes a PKG’s public parameter “param” and a master key “msk”. Note that “param” is given to all parties involved while “msk” is kept secret.

● Extract

● Given an identity ID, this algorithm generates a private key associated with ID using msk, denoted by skID

● Offline Sign

● Given the public parameter, this algorithm generates an offline signature σ''

● Online Sign

● On input the private key skID, the offline signature σ'' and a message m, this algorithm generates a signature σ of the message m

Basic Setting

● Details

● Implementation in single-hop setting● Every WSN node assigned an identity● Signature done in two modes, offline mode at base stations

(prior to knowledge of message, mostly heavy computations), online mode at the sensor nodes (typically less computation overhead, so even a weak processor works)

● Implemented using 160 bit Elliptic Curve Crypto-system

Other Similar Schemes

● Improved online/offline signature schemes – Shamir et al. (ST Scheme)

● Online/offline signatures and multi-signatures for AODV and DSR routing security – Xu et al. (XMS Scheme)

Efficiency Analysis (1)

● Comparison of Computation Cost

● C(θ): the computation cost of operation θ● E: the exponentiation in G● M: the multiplication in G

● m: the modular multiplication in Z*q and

● P: the pairing operation

ST's Scheme XMS's Scheme “this” SchemeOffline (one-time) C(h) + C(σ

g) 2E + m 0

Offline (multi-time) - |q| · 2E 0Online (one-time) m m mOnline (multi-time) - O(|q|).2M + m O(|q|).M + m

Verification C(h) + C(σv) +

C(certv)

2P + 2E + M 2E + M

Efficiency Analysis (2)

● Comparison of Storage Cost and signature size

● |σ| represents the length of a normal digital signature,which is at least 160 bits.

● |cert| represents the length of a digital certificate, which is at least 320 bits

ST's Scheme XMS's Scheme “this” Scheme

Offline Storage (one time)

2|q| + |σ| + |cert| ≥ 800 bits

2|G| + 2|q| ≈ 640 bits |G| + |q| ≈ 320 bits

Offline Storage (multi time)

- 2|q| · |G| ≈ 6.4k bytes |q| · |G| ≈ 3.2k bytes

Size of Signature |q| + |σ| + |cert| ≥ 640 bits

2|G| + |q| ≈ 480 bits 2|G| + |q| ≈ 480 bits

Paper II:

Batch Verification Scheme for Vehicular Sensor Networks – Zhang et al.

(INFOCOM 2008)

Overview of Vehicular Networks

● Major communication nodes

● Vehicles are equipped on-

board unit (OBU)

● Vehicles communicate with

roadside units (RSU)

● RSU can connect with

application servers and trust

authority (TA)Fig. Vehicular networks

Security and Performance Requirements● Conditional privacy preserving

● The identity information of vehicles should be protected

● In case an abuse happens, a trust authority is able to trace

the real identity of the adversary

● Fast verify speed

● Challenging for RSU to verify all messages sent by more

than 200 vehicles every 100-300 ms

● Low communication overhead

● Procedures and overhead for security should be minimized

Challenges in Requirements

● Complicated PKI infrastructure

● Instead of using real ID, vehicles are required to use

different pseudo ID for each communication

● PKI infrastructure manages the pseudo ID and the

associated public key → high overhead due to changing

pseudo ID

● Large number of concurrent verification

● Single RSU should verify up to 2,000 messages per second

The Proposed Solution● IBC is used for conditional privacy

● Batch verification is used for fast verification

<ID1, M1, Sig(M1)> <ID2, M2, Sig(M2)> <ID3, Mn, Sig(Mn)>…

RSU

Batch: Sig(M1)+Sig(M2)+…+Sig(Mn), then verify the summation

Accelerate the speed of verifying multiple

signatures

No public key management required

Key and ID Generation at OBU

● At the time of manufacturing, OBU specific private key is securely stored in the temper-proof device

● At each transmission, tamper-proof device generates pseudo ID and corresponding secret key by using real ID (RID) and private key

Authentication enhancing

Change real ID to pseudo ID

Use pseudo ID to generate private key

ID-based Batch Signature and Verification

● Public parameters {G, GT, q, P, P

pub1, P

pub2}

● where Ppub1

=s1p, P

pub2=s

2p.

● {s1,s

2} is preloaded to a tamper-proof device

● Public key ID={ID1,ID

2}

● Secret key SK={SK1,SK

2}

● Sign: σ = SK1+h(m)SK

2

● Verify: Multiple signatures are summed and verified at once!

Advantages of ID-based Batch Signature Scheme

● Conditional privacy

● An adversary cannot discover the real identity from pseudo identities

● A trust authority can recover the real identity of the vehicle (ElGamal decryption)

● Fast verification of multiple messages

● Verification complexity is independent to the number of concurrent messages

● Less key management overhead

● Since pseudo ID is used for authentication, no PKI infrastructure is required

DiscussionWhat do you think are the limitations for such a Batch Verification

Scheme in Vehicular Networks?

Paper III:

A Mobile Social Network on ESP:an Egocentric Social Platform – Purtell et al.

(PETS 2012)

Slides References:

Presentation at MobiSocial Computing Laboratory at Stanford University - Monica Lam

Egocentric Social Platform - T. J. Purtell, Ian Vo, Monica S. Lam

Motivation● Today’s social networking

● Loss of privacy

Motivation● Today’s social networking

● Loss of privacy ● Monopoly

Motivation● Today’s social networking

● Loss of privacy ● Monopoly● Loss of competition

Zynga D ependency on Facebook w sj, 10-12-11

Zynga D ependency on Facebook w sj, 10-12-11

Motivation● Today’s social networking

TCP/IP

Global Social Graph

Motivation

● Egocentric Social Platform● No single owner of users’

data or app platform● ESP is distributed over all

user devices

● Problem● Secure communication with

all of my friends requires complicated PKI infrastructure!

→ IBC can help this!

EgocentricSocial Platform

IBC with Existing Identities

● User’s identity is verified using public authentication protocol (e.g., Facebook auth)● User obtains appropriate token from public service

ans submit it to IBC server● If token is valid, IBC server sends secret key

IBCserver

ESP Architecture

All data are encrypted outside the mobile device

Wordplay Game on IBC based Platform

Activate an Existing Identity

Alice activates the her existing identity on Musubi

Starting a Game● Alice wants to play WordPlay game now

● Alice chooses Bob's name from her address book

● Bob is not Musubi user

● Alice sends an automated invitation to Bob, presented by Musubi

Joining a Game

● Bob accepts and get the keys from IBC server by simply providing its identity

● Alice and Bob play games securely without a global social network platform! (No ads!)

Private Key Management

● Key update● All secrets have validity time period● Update period is 30 days and update date is the

well-known function of hashed identity

● Key revocation● Necessary in case of lost or infections● User can request a new key before expiration

Discussion

What do you think are the challenges for the Egocentric social

platform?

Summary

● IBC removes the PKI infrastructure, and thus is beneficial for

some applications of wireless networks

● Paper 1: efficient on/offline identity-base signature for sensor

networks

● Paper 2: identity-based batch signature for vehicular

networks

● Paper 3: identity-based encryption for Egocentric social

platform