ALPHA: an adaptive and lightweight protocol for hop-by-hop authentication

ABSTRACT

Wireless multi-hop networks are particularly susceptible to attacks based on flooding and the interception, tampering with, and forging of packets. Thus, reliable communication in such networks quintessentially depends on mechanisms to verify the authenticity of network traffic and the identity of communicating peers. A major challenge to achieve this functionality are the tight resource constraints of such devices as smartphones, mesh- and sensor nodes with regard to CPU, memory, and energy. Since existing approaches suffer from significant drawbacks related to functionality and efficiency, we present in this paper ALPHA, an Adaptive and Lightweight Protocol for Hop-by-hop Authentication. ALPHA establishes a verifiable notion of identity for network traffic, based on computationally cheap hash functions, enabling end-to-end as well as hop-by-hop integrity protection for unicast traffic. Our evaluation shows that ALPHA is a generic security mechanism that makes full traffic authentication and secure middlebox signaling viable in resource-constrainted multi-hop networks.

REFERENCES

• 1: Akbani, R., Korkmaz, T., and Raju, G. HEAP: Hop-by-hop Efficient Authentication Protocol For Mobile Ad-hoc Networks. CNS 07 (2007).
• 2: Ross Anderson , Francesco Bergadano , Bruno Crispo , Jong-Hyeon Lee , Charalampos Manifavas , Roger Needham, A new family of authentication protocols, ACM SIGOPS Operating Systems Review, v.32 n.4, p.9-20, Oct. 1998 [doi>10.1145/302350.302353]
• 3: Mihir Bellare , Ran Canetti , Hugo Krawczyk, Keying Hash Functions for Message Authentication, Proceedings of the 16th Annual International Cryptology Conference on Advances in Cryptology, p.1-15, August 18-22, 1996
• 4: Francesco Bergadano , Davide Cavagnino , Bruno Crispo, Chained Stream Authentication, Proceedings of the 7th Annual International Workshop on Selected Areas in Cryptography, p.144-157, August 14-15, 2000
• 5: S. Cheung, An efficient message authentication scheme for link state routing, Proceedings of the 13th Annual Computer Security Applications Conference, p.90, December 08-12, 1997
• 6: Mohamed G. Gouda , E. N. (Mootaz) Elnozahy , Chin-Tser Huang , Tommy M. McGuire, Hop integrity in computer networks, IEEE/ACM Transactions on Networking (TON), v.10 n.3, p.308-319, June 2002 [doi>10.1109/TNET.2002.1012363]
• 7: Gura, N., Patel, A., Wander, A., Eberle, H., and Shantz, S. Comparing Elliptic Curve Cryptography and RSA on 8-Bit CPUs. Cryptographic Hardware and Embedded Systems: 6th International Workshop (2004).
• 8: R. Hauser , T. Przygienda , G. Tsudik, Reducing The Cost Of Security In Link-State Routing, Proceedings of the 1997 Symposium on Network and Distributed System Security, p.93, February 10-11, 1997
• 9: Hu, Y.-C., Perrig, A., and Johnson, D. Packet leashes: a defense against wormhole attacks in wireless networks. INFOCOM (2003).
• 10: Leslie Lamport, Password authentication with insecure communication, Communications of the ACM, v.24 n.11, p.770-772, Nov. 1981 [doi>10.1145/358790.358797]
• 11: Donggang Liu , Peng Ning , Sencun Zhu , Sushil Jajodia, Practical Broadcast Authentication in Sensor Networks, Proceedings of the The Second Annual International Conference on Mobile and Ubiquitous Systems: Networking and Services, p.118-132, July 17-21, 2005 [doi>10.1109/MOBIQUITOUS.2005.49]
• 12: Lu, B., and Pooch, U. W. A Light-weight Hop-by-hop Authentication Protocol for Mobile Ad Hoc Networks. International Journal of Information Technology 11, 2 (2005).
• 13: Matyas, S., Meyer, C., and Oseas, J. Generating strong one-way functions with cryptographic algorithm. IBM Technical Disclosure Bulletin 27, 10A (1985).
• 14: Ralph C. Merkle, A Digital Signature Based on a Conventional Encryption Function, A Conference on the Theory and Applications of Cryptographic Techniques on Advances in Cryptology, p.369-378, August 16-20, 1987
• 15: Ralph C. Merkle, A Certified Digital Signature, Proceedings of the 9th Annual International Cryptology Conference on Advances in Cryptology, p.218-238, August 20-24, 1989
• 16: Moskowitz, R., Nikander, P., Jokela, P., and Henderson, T. Host identity protocol. RFC 5201, IETF, 2008.
• 17: Perrig, A., Canetti, R., Song, D., and Tygar, J. Efficient and Secure Source Authentication for Multicast. NDSS '01 (2001).
• 18: Perrig, A., Canetti, R., Tygar, D., and Song, D. The TESLA broadcast authentication protocol. Cryptobytes 5 (2002).
• 19: Torvinen, V., and Ylitalo, J. Weak Context Establishment Procedure for Mobility Management and Multi-Homing. IFIP Conference on Communications and Multimedia Security (2004).
• 20: Weimerskirch, A., and Westhoff, D. Zero Common-Knowledge Authentication for Pervasive Networks. SAC '03 (2003).
• 21: Yao, T., Fukunaga, S., and Nakai, T. Reliable broadcast message authentication in wireless sensor networks. In EUC Workshops (2006).
• 22: Ye, F., Luo, H., Lu, S., and Zhang, L. Statistical En-Route Filtering of Injected False Data in Sensor Networks. IEEE Journal on Selected Areas in Communications 23 (2005).
• 23: Zhang, K. Efficient protocols for signing routing messages. NDSS '98 (1998).
• 24: Zhang, W., Subramanian, N., and Wang, G. Lightweight and compromise-resilient message authentication in sensor networks. INFOCOM 2008 (2008).
• 25: Zhu, S., Setia, S., Jajodia, S., and Ning, P. An interleaved hop-by-hop authentication scheme for filtering of injected false data in sensor networks. Security and Privacy (2004).
• 26: Sencun Zhu , Shouhuai Xu , Sanjeev Setia , Sushil Jajodia, LHAP: A Lightweight Hop-by-Hop Authentication Protocol for Ad-Hoc Networks, Proceedings of the 23rd International Conference on Distributed Computing Systems, p.749, May 19-22, 2003

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.2 Network Protocols

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls); Data communications

General Terms:
Algorithms, Design, Experimentation, Measurement, Performance, Security

Keywords:
authentication, hash chains, integrity protection