An Authentication Service Based on Trust and Clustering in Wireless Ad Hoc Networks: Description and Security Evaluation Edith C. H. Ngai and Michael R. Lyu Department of Computer Science and Engineering The Chinese University of Hong Kong 5 Jun 2006 The IEEE International Conference on Sensor Networks, Dept. of Computer Science & Ubiquitous, and Trustworthy Computing (SUTC 2006) Engineering, CUHK
Outline n Introduction n Related Work n Architecture and Models n Trust- and Clustering-Based Authentication Service n Simulation Results n Conclusion Dept. of Computer Science & Engineering, CUHK 2
Mobile Ad Hoc Network An ad-hoc network (of wireless nodes) is a temporarily formed network, created, operated and managed by the nodes themselves. n It is also often termed an infrastructureless, self-organized, or spontaneous network. n Dept. of Computer Science & Engineering, CUHK 3
Mobile Ad Hoc Network n Connected with wireless communication n Dynamic Topology n Nodes are often mobile n Vulnerable to security attacks n Applications – Military: for tactical communications – Rescue missions : in times of natural disaster – Commercial use: for sales presentations or meetings Dept. of Computer Science & Engineering, CUHK 4
Vulnerabilities Security in wireless ad hoc network is hard to achieve due to the vulnerabilities of its links, limited physical protection, and the absence of centralized management point n Unlike conventional networks, nodes of ad hoc networks cannot be secured in locked cabinets n Risk in being captured and compromised n Wireless communications are vulnerable to eavesdropping and active interference n Dept. of Computer Science & Engineering, CUHK 5
Security Mechanisms n n n Popular network authentication architecture include X. 509 standard and Kerberos systems Pretty Good Privacy (PGP) functions by following a web-of-trust model and using digital signatures Authentication service establishes the valid identities of communicating nodes In reality, a node may turn from trustworthy to malicious under a sudden attack We provide a secure authentication service that can defend against malicious nodes Dept. of Computer Science & Engineering, CUHK 6
Related Work Partially-distributed certificate authority by Zhou and Hass n Mobile Certificate Authority (MOCA) by Yi and Kravets n Fully-distributed certificate authority by Kong et. al. n Dept. of Computer Science & Engineering, CUHK 7
Related Work n Pretty Good Privacy (PGP) – following a web-of-trust authentication model n Self-issued certificates by Hubaux et. al. – distribute certificates by users themselves without the involvement of any certificate authority Dept. of Computer Science & Engineering, CUHK 8
Our Work Propose a secure public key authentication service in mobile ad hoc networks with malicious nodes n Prevent nodes from obtaining false public keys of the others n Engage a network model and a trust model n Design security operations including public key certification, identification of malicious nodes, and trust value update n Dept. of Computer Science & Engineering, CUHK 9
Trust- and Clustering-Based Authentication Service Architecture Dept. of Computer Science & Engineering, CUHK 10
The Network Model Clustering-based network model obtains a hierarchical organization of a network n Limit direct monitoring capability to neighboring nodes n Allow monitoring work to proceed more naturally n Improve network security n Dept. of Computer Science & Engineering, CUHK 11
The Trust Model This model uses digital signatures as its form of introduction. Any node signs another's public key with its own private key to establish a web of trust n Define the authentication metric as a continuous value between 0. 0 and 1. 0 n Define a direct trust relationship as the trust relationship between two nodes in the same group and a recommendation trust as the trust relationship between nodes of different groups. n Dept. of Computer Science & Engineering, CUHK 12
Clustering Structure Maintenance n n n Maintain a balanced clustering structure for supporting our trust model and security operations Adapt to the mobility of nodes Handle leave and join of nodes from one cluster to another Each node requests for the cluster ID of its neighboring nodes periodically In each cycle, a node collects this information and updates its cluster ID Dept. of Computer Science & Engineering, CUHK 13
Clustering Structure Maintenance A node joins the neighbouring cluster with minimum size only if it leaves the original cluster or the sizes of the neighbouring clusters are not within a certain range Dept. of Computer Science & Engineering, CUHK 14
Evolution of Cluster Size It keeps balance cluster sizes Dept. of Computer Science & Engineering, CUHK 15
Authentication Service Public key certification 2. Identification of malicious nodes 3. Trust value update 1. Selects a number of trustable nodes as introducers Sends out request messages to introducers Collects and compares all the public key certificates received Selects the public key of t with majority votes Discovers malicious Isolates malicious introducer? introducer Calculates trust value of t Updates trust table Dept. of Computer Science & Engineering, CUHK 16
Public Key Certification Authentication in our network relies on the public key certificates signed by some trustworthy nodes n Nodes in the same group always know each other better by means of their monitoring components and their short distances n Every node is able to request for the public key certificates of other new nodes n Nodes in the same cluster are assumed to know each other by means of their mutual monitoring components n Dept. of Computer Science & Engineering, CUHK 17
Public Key Certification We focus on public key certification, where s and t belong to different groups n Nodes, which are in the same cluster as t and have already built up a trust relationship with s, can be introducers n Dept. of Computer Science & Engineering, CUHK 18
Public Key Certification Send request to neighbors if target node in same cluster Send request to introducers if target node in different cluster Dept. of Computer Science & Engineering, CUHK 19
Identification of Malicious Nodes n Identify malicious neighboring nodes by monitoring their behaviors n Identify introducers who provide public key certificates different from the others n Identify a target node as malicious if the trust values provided from the introducers indicate that Dept. of Computer Science & Engineering, CUHK 20
Trust Value Update Dept. of Computer Science & Engineering, CUHK 21
Parameters Setting Network simulator Glomosim n Evaluate the effectiveness in providing secure public key authentication in the presence of malicious nodes n Dept. of Computer Science & Engineering, CUHK 22
Simulation Metrics n n n Successful Possible Cases with 3 Introducers rate Fail rate Unreachable rate False-positive error rate False-negative error rate Dept. of Computer Science & Engineering, CUHK 23
Effectiveness of Neighbor Monitoring Rates to No. of Cycles with n=40, r=100, (left) m=0. 3 (right) m=0. 7 Dept. of Computer Science & Engineering, CUHK 24
Isolation of Malicious Nodes ID 0 1 2 3 4 5 6 7 8 9 10 Cases Not enough Introducers OOO OOX OXX XXX OO OX XX O X No Reply Rates to No. of Cycles with n=40, r=100, and Isolation of Suspicious Nodes in Cases 2, 3, 4, 6, 7 (left) m=0. 3 (right) m=0. 7 Dept. of Computer Science & Engineering, CUHK 25
Isolation of Malicious Nodes ID 0 1 2 3 4 5 6 7 8 9 10 Cases Not enough Introducers OOO OOX OXX XXX OO OX XX O X No Reply Rates to No. of Cycles with n=40, r=100, and Isolation of Suspicious Nodes in Cases 2, 4, 7 (left) m=0. 3 (right) m=0. 7 Dept. of Computer Science & Engineering, CUHK 26
Conclusions We developed a trust- and clustering-based public key authentication mechanism n We defined a clustering-based network model with a balanced structure and a trust model that allows nodes to monitor and rate each other with quantitative trust values n The authentication protocol proposed involves new security operations on public key certification, update of trust table, discovery and isolation of malicious nodes n We conducted security evaluation to demonstrate the effectiveness of our solution n Dept. of Computer Science & Engineering, CUHK 27
Скачать презентацию An Authentication Service Based on Trust and Clustering
330c7e2db64332d2316d65661429fe53.ppt