Dynamic Security Scheme for Multicast Source ...

Available online at www.sciencedirect.com

Procedia Technology 4 (2012) 515 – 521

C3IT-2012

Dynamic Security Scheme for Multicast Source Authentication Karan Singha Rama Shankar Yadavb a

b

Gautam Buddha University, Greater Noida,U.P., India Motilal Nehru National Institute of Technologfy, Allahabad, U.P., India

Abstract Multicast source authentication is a burning issues in multicast communication because multicast technology provide the better communication than unicast and broadcast. But its design architecture any member can send the data to all joined receivers due to publicly available IP address of group manager. To solve this hottest problems, several schemes have been existed in this category such as simple hash chaining, tree hash chaining where the attacker intensity are unchanged. In this paper, we are going to propose a improved mechanism for multicast source authentication which adapts the security level deployed based on threshold value of attack success rate. The results shows that propose approach dynamic security mechanism in multicast at minimum communication and computation overhead

© 2011 Published by Elsevier Ltd. Selection and/or peer-review under responsibility of C3IT Keywords: Security mechanim, Chaining, Hash, Security level

1. Introduction The growth of video application such as digital TV to PC, youth tube, videoconferencing, multiparty video games, military news feeds, video-audio transmission and IP TV are increasing year by year. There are unicast, broadcast and multicast system to manage the video traffic. In unicast [2] one source send a data copy to only one destination while in broadcast [2] one source send the data copy at a time all destination. Multicast provides [23] the one or many to group communication through IP multicast [7], multicast routing [27] and Internet Group Management Protocol (IGMP) protocol [36]. It is efficient than unicast [2] and utilizes better resource respect to broadcast [2]. The design architecture of multicast such UDP protocols and well known multicast address invite to various shortcomings such as congestion [20], insecurity [19], unreliability [1] etc. The insecurity is major and burning issue of multicast which affect the performance of network system. The security goal [17][18]is best solution for security solution. The group

2212-0173 © 2012 Published by Elsevier Ltd. doi:10.1016/j.protcy.2012.05.082

516

Karan Singh and Rama Shankar Yadav / Procedia Technology 4 (2012) 515 – 521

key management [14][23][35] at receiver end and source authentication [8][13] at source end are proposed solution by researchers [4]5[8][9][13][14][33][34][35][36]. In this paper, we are dealing with source authentication and source authentication. Source authentication provides the genuinity of source and data at receiver end which can be achieved with and without non-repudiation. Non-repudiation allows the recipient to prove the source of the data to a third party. Source authentication without non-repudiation scheme source may deny data sent by him is not the same as received by the receiver can be achieved by A. Perrig et. al. protocol [3][4], RABIN [32], TESLA [5]. In others hand non-repudiation, source authentication with non-repudiation use the digital signature and hashes of data to secure the source genuinity. There are various schemes available in this category such as Simple Offline/Online chaining [28], Periodic Chaining [26], Sara Miner et. al protocol [33], Sencun Zhu et. al [34]. The straight forward solution for source authenticate i.e. make digital signature of each packet is computationally very expensive and create more communication overhead. Then, TMA [8], EMSS [4][5], A2CAST [37] RLH protocol [38], HMA [13] use the amortize concept [38] in the single signature done by source over the multiple packets. These schemes use the hash algorithm to generate hash value (digest) whereas performance of algorithm is inverse proportional to overhead and proportional to protect network. The decision of best algorithm is based on network behaviour and overhead of algorithm. If there is less intensity of attack in network then choose high overhead is create huge communication overhead during transmission while decision to choose less overhead algorithm in more intensity attack create the more packet loss due to un-authenticity. We propose an adaptive security deployment schemes which adapt the security level deployed based on threshold value of attack success rate. The organizations of paper are following: Section 2 deal with related work where as proposed work are given in section 3. Section 4 is providing the result and discussion. Finally section 5 concludes the paper 2. Related Work The related work of our proposed work are simple hash chaining, tree hash chaining and hybrid scheme. The brief details of scheme are following In simple hash chaining [28] scheme is online/offline, if sender store all data before singing called offline otherwise online. Offline simple hash chaining (SHC) illustrated by figure 2 in which sender divide the block into n sub block and generates the hash values corresponding to each sub block. According to figure 1, now sender signed hash of first sub block B1 using RSA [30][31] or DSA [11] approach. The first sends the signed hash value of B1 to receiver. Sender sends B1, B2, B3, B4…Bn-1 with Hash (B2), Hash (B3), Hash (B4), Hash (B5)….. Hash (Bn) respectively. At last send the Bn sub block to receiver. Receiver receives the hash value of first sub bock with signature and after verify signature store it. Receiver receives the B1 sub block with Hash(B2). Receiver compute the hash value of receive sub block B1 and check if store hash value of B1 is identical with computed hash value then first sub block B1 and Hash(B2) is verified. So, Data and hash value of B2 are authentic and source is also authentic. Now similarly B2, B3…Bn are also verified.

Fig. 1: Simple Hash Chaining

Figure 2: Adaptive Hashes and Packet Bundle

In this scheme authentication information is reduced to one hash per block and sender need to sign only once at the first block. The other blocks are authenticated using only a hash computation by receiver

517


Main problem with scheme is that this solution is not fault tolerant, if a block is lost the authentication chain is broken and hence all subsequent blocks can’t be authenticated. Wong and Lam have proposed Tree hash chaining (THC) [8] [9] for reducing the communication and computation overhead. HE Jin et. al. [13] proposed a hybrid approach (HMSA) in make more efficient.. But it has major disadvantage that the redundancy of the hashes, which will cause the high computational and communication overhead. In these schemes there is no decision to choose the hash algorithm according to network condition. Better performance algorithm create the communication overhead in absence of high success rate of attack while less overhead algorithm increase the packet loss ratio. Our contributed work provides the adaptive security level deployed (ASLD) in variation of security level based on threshold of attack success rate i.e. probability of attack. 3. Proposed Work We Before Multicast source authentication provides the genuinity of source as well as message which use signature over hash digest. The use of signature with each packet is very expensive, so, we are also using amortizing concept for sending secure data stream to authentic receivers. The source define the level of deployed security according to performance of hash algorithm and it maintain the security deployed table of security level, performance and overhead of hash algorithm which can be shown by table 1. TABLE 1: LEVEL OF DEPLOYED SECURITY Hash Algorithm Security Performance Level (Bps)

Overhead (Bits)

Hash Algorithm

Security Level

Performan ce (Bps)

Overhead (Bits)

MD4 [40]

0.18

23.90

128

SHA-128 [10]

0.63

6.88

128

MD5 [41]

0.26

17.09

128

RIPEMD160 [42]

0.77

5.69

160

RIPEMD [42]

0.45

9.73

128

TIGER [43]

1.00

4.36

192

We have proposed two algorithm which are modification of Tree Message Authentication (TMA) [8] and Hybrid Message Authentication (HMA) [13] known by adaptive security level deployment without bundle where packet are sending without adaptation with adaptive security level deployed. In this approach, hashes generation, signature generation, packet sending procedure and verification of signature and packets are based on TMA [8][9]. Others one is adaptive security level deployment with bundle which provide the adaptive packet sending procedure with adaptive security deployment. This approach, source divide the message into m block size of B and block is divide into i packets size of P. Now corresponding to packet, source generates the hash value of each packet. Such as tree, source generates the root block. In scheme, source makes the bundle of packet with required hashes and sent to all receivers. Bundle is combination of 2j packet where j is no of bundle and j=0, 1, 2, 3, 4…k. The adaptive size of bundle depends on attack probability. Bundles are verifying individually and increase/decrease the no of packet in bundle according to attack probability in network. If environment is healthy then increase the no of packet in bundle else decrease the no of packet in bundle. Suppose, there is one block which is divided into 8 packets then the computed hashes, root hash, reference hashes (required hashes) and bundle can be shown by figure 2. Proposed approached is discussed in next section.

518


3.1 Adaptive Security Level Deployment The proposed security level deployment algorithm (ASLD) upgrades the security level in case attacker succeeds. The security level is the probability of a deployed scheme with where attacker is unable to succeeds [16][25][44]. It is commutated based on hash computing speed. More the hash computing speed implies less time is required for attacker to know about actual information. Thus, more hash computing speed provide less security level whereas more security can be provided with less hash computing speed. The adaptive security level deployment scheme provides the healthy environment, increase the performance of system and reduce the communication overhead. The next subsection briefs about results discussion followed by experimental setup 4. Result and Discussion In this section simulation has been carried out to evaluate the performance of the proposed adaptive packet grouping and adaptive security level deployed approach with respect to (tree message authentication and hybrid message authentication) [8] [13]. The key parameters for performance measurement are computation overhead, communication overhead, probability of attack success rate and authentic packet ratio. The effect of variation of block size, packet size, bundle size and probability of successful attack, adoption length for security deployed etc. are over these key parameters. The next subsection briefs about experimental setup used. TABLE 2: SIMULATION PARAMETERS Value used Parameter (fixed)(range) Packet Size (Byte) (256)(64, 128, 256,512,1024) Queue Size (No. Packet) Hash Size (Byte) (20)(16, 20,24,32) Threshold (THARS) Signature Size (Byte) (128)(-) Bundle size Block Size (No. Packets) (8)(2, 4, 8, 16,32) Network bandwidth( MB)

Value used (fixed)(range) (100)(-) 5 (8)(1,2, 4, 8, 16,1) (10-100)(-)

Rate (Packet/Sec)

(10-50)(-)

Parameter

(10)(-)

Link delay (ms)

4.1 Experiment setup The simulation experiment has been carried out on Intel Core 2 dual processor 2.0 GHz, 3.0 GB RAM, 80 GB HDD machine support with network simulation version 3.0 under Linux operating system. In this simulation topology the key component are sender (where message has been originated) and end router where multiple receivers are connected multicast. The roll of intermediate router is more perform routing decision. Beside this routing decision, end router maintain multicast group where as receivers computes hashes and verify the genuinity. On the others hand source compute hashes, make a bundle from packet and send it it end router, from it is delivered to the multicast receivers. The simplest topology shown in figure 3, gives only end router, source (sender) and multicast receivers. The intermediate routers are not given here. The network is heterogeneous in term bandwidth uniformly distributed in range (10-100) MBPS. The buffer used at each receiver is 100KB. The other simulation parameters are listed in table 2. These values are same used in [8][13][3]][28] The next subsection deals with simulation results and it analysis. 4.2 Results and Discussion The effect of variation in packet size, number of packet in block, security adaptation parameters over communication overhead, computation overhead and verification overhead. First we analysis the effect of variation in packet size followed by number of in block.

519


4.2.1 Effect of Variation in Threshold

The variations in threshold value of succeed attack effect the adaptive decision which increase or decrease the authentic packet ratio and communication overhead. The increment in threshold increase the authentic packet ration but increase the communication overhead because late decision for changing security level. The proposed approach has improved performance in term of authentic packet ratio and communication overhead as summarize below On Authentic Packet Ratio

The effect of variation in threshold value on the authentic packet ratio can be illustrated by figure 4. We have maintain 4 block history and starts hash generation from level 0 while packet size and block size consider 128, 8 respectively.

APR (Authentic Packet Ratio)

0.86

ASDL-I TMA

0.84

0.82

0.80

0.78

0.76

0.74 0

2

4

6

8

10

Thresold Value (No of Sucess Attack)

Fig. 3: Simplified Form of Topology Used

Fig. 4: Authentic Packet Ratio w.r.t Threshold Value 0.25

400

P ack et S ize B lock S ize T hre sold V alue H is tory B lock (k ) S ecurity L evel

= 128 = 8 = 5 = 4 = 3

At Bundle size = 8 0.20

Avrage Pr (SA)

Communication overhead (Byte)

500

300

200

0.15

0.10

0.05

100

0

0.00

A S LD -I

A S LD -II

TMA

HMA

A u th en ticatio n S ch e m e

Fig. 5: Communication Overhead w.r.t Authentication Scheme

1

2

3

4

5

6

7

8

9

10

11

12

13

History of k block

Fig. 6: Probability of Attack Success Rate w.r.t History of block

On Communication Overhead

Figure 5 is between communication overhead and authentication scheme at threshold values 5. We can observe from figure that ASDLs communication overhead is less than TMA or HAM algorithm because in these approach, duplicity of hashes and fix security level increase the communication overhead. 4.2.2 Effect of variation in history

520


The variation in history of k block which effect the succeed attack. More block history help more for taking decision for changing security level or bundle size. The effect of variation in history of k block on probability of success attack describe below On Probability of Success Attack

The effect of variation in history of k block in important phenomena for adapts the situation for changing bundle size and security deployed algorithm. It affects the probability of success attack which can be illustrated by figure 6. This graph shows that if we increase the value of k than probability of success attack success is decrease because adaptation for changing security level and group size can be taken careful. 5. Conclusion We have proposed the adaptive security level deployment approach which increase or decrease the level of security according to network behaviour. It provide the improve security and reduce the communication and computation overhead in adversary environment. The scheme provides the source authentication as well as message authentication with non-repudiation. Results show that communication overhead is less than HMA and TMA while authentic ration also better in proposed improved mechanism (ASLD). We can observe from results and discussion that adaptive security deployed approach performs better while communication overheads are less in adversary environment.

References 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13.

14. 15.

16.

Koifman and S. Zabele, “RAMP: A reliable adaptive multicast protocol,” IEEE INFOCOM ’96, Mar. 1996, pp. 1442–1451. A. Legout, J. Nonnenmacher, and E. W. Biersack, "Bandwidth-allocation Policies for Unicast and Multicast Flows", IEEE/ACM Transactions on Networking, 9(4):464-478, August 2001. A. Perrig et al, “Efficient and Secure Source Authentication for Multicast”, 8th Annual Internet Society Symp. Network and Distributed System Security, 2001. A. Perrig et al., “Efficient Authentication and Signing of Multicast Streams over Lossy Channels” IEEE Symp. Security and privacy 2000. A. Perrig et al., “The TESLA Broadcast Authenticationic Protocol”, RSA CryptoBytes, vol. 5, Summer 2002. B. Kaliski, The MD2 Message-Digest Algorithm, RFC 1319, 1992. C. Diot, B. N. Levine, B. Lyles, H. Kassem, and D. Balensiefen, "Deployment Issues for the IP Multicast Service and Architecture", IEEE Network Magazine Special Issue on Multicasting, 14(1):78-88, January/February 2000. C. K. Wong and S. S. Lam, “Digital Signatures for Flows and Multicasts”, IEEE ICNP 98, Oct. 1998. C. K. Wong and S. S. Lam, Digital Signatures for Flows and Multicasts,Ó IEEE/ACM Trans. Net., vol. 7, no. 4, Aug. 1999. D. Eastlake, P. Jones, US Secure Hash Algorithm 1 (SHA1), September RFC 3174, 2001. Federal Information Processing Standards Publication, Digital Signature Standard (DSS), FIPS PUB 186, 1994. Book: design of hashing algorithms "Methods of attack on hash functions" vol Volume 756. pp-48-55, 1993, Springer Berlin / Heidelberg. HE Jin-xin, XU Gao-chao, FU Xiao-dong, ZHOU Zhi-guo “A Hybrid and Efficient Scheme of Multicast Source Authentication” Eighth ACIS International Conference on Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed Computing IEEE, 2007. Hoyoung Lee, Boyoung Rhee, Euijun Kim and Sunyoung Han “User-Oriented Batch Processing Of Individual Rekeying” IEEE, 2008. Karan Singh and Rama Shankar Yadav “Efficient and Secure Multicast Communications” International Conference on Computer Networks and Security (ICCNS 08), September 27-28, 2008, pp 97-102, published by VIT, Pune, ISBN 978-81906198-1-3. Qin, Tao Xie and Xiao. “Sheduling Security Aware Real Time Applications on Clusters”. IEEE transactions on computers. Vol. 55, no 7, Page(s): 864-879, July 2006

Karan Singh and Rama Shankar Yadav / Procedia Technology 4 (2012) 515 – 521 17. Karan Singh with Rama Shankar Yadav, Ranvijai “A REVIEW PAPER ON ADHOC NETWORK SECURITY” International Journal of Computer Science and Security (IJCSS) vol. 1, no. 1, July 2007, ISSN: 1985-1533. 18. Karan Singh, R. S. Yadav “Overview of Secure Network System” International Journal of Computer Sciences and Engineering Systems (IJCSES) Vol. 1, No. 4, Nov, 2007, China, PP 259-265, ISSN:0973-4406 19. Karan Singh, Rama Shankar Yadav, and Amit Kumar Sharma “Adaptive Approach: Hash Redundancy Conquest For Multicast Source Authentication” International Conference on Emerging Trends in Computing, at Kamaraj College of Engineering & Technology Virudhunagar, Tamil Nadu, India during 8-10 January, 2009. 20. Karan Singh, Rama Shankar Yadav, Manisha Manjul and Renu Dhir “Bandwidth Delay Quality Parameter Based Multicast Congestion Control” International Conference on Advanced Computing and Communication (ADCOM 08) at Department of Information Technology, MIT, Anna University, Chennai, during 14th -17th December 2008. 21. Ulrich Schmidta and Alexander Zimper"Security and potential level preferences with thresholds"Journal of Mathematical Psychology, Vol 51, Issue 5, October 2007, PP 279-289 22. Luby, M., Micisano, L., Gemmell,J., Rizzo, L.,Handley, M., and Crowcroft, J. 2002. The use of forward error correction in reliable multicast. IETF Internet Draft draft-ietf-rmt-info-fec-03.txt, available at http://www.ietf.org/internet-drafts/draft-ietfrmt-info-fec-03.txt. 23. M. Baugher, R. Canetti, L. Dondeti, F. Lindholm “Multicast Security (MSEC) Group Key Management Architecture” RFC 4046, April 2005. 24. M. Baugher, R. Canetti, P. Cheng, P. Rohatgi, "MESP: A Multicast Framework for the IPsec ESP", Work in Progress, October 2002. 25. M. Yajnik, S. Moon, J. Kurose, D. Towsley, Measurement and modeling of the temporal dependence in packet loss, INFOCOM’99, 1999, pp. 345–352. 26. P. Golle et. al., “Authenticating Streamed Data in the Presence of Random Packet Loss” NDSS’01 : The Network and Distributed System Security Symp., 2001 27. R. Braudes,S. Zabele"Requirements for Multicast Protocols" Request for Comments: 1458, May 1993. 28. R. Gennaro and P. Rohatgi, “How to Sign Digital Streams,” Information and Computation, vol. 165, no. 1, Feb. 2001, pp. 10016 29. R. Rivest, The MD5 Message-Digest Algorithm, RFC 1321, 1992. 30. R. Stewart, M. Tuexen, G.C. Ericsson” Security Attacks Found Against the Stream Control Transmission Protocol (SCTP) and Current countermeasures” RFC- 5062 September 2007. 31. R.L. Rivest, A. Shamir, L.M. Adelman, A method for obtaining digital signatures and public-key cryptosystems, Communications of the ACM 21 1978, 120–126. 32. RABIN,M. 1989. Efficient dispersal of information for security, load balancing, and fault tolerance. J. ACM 36, 2, 335–348. 33. Sara Miner and Jessica Staddon, “Graph-Based Authentication of Digital Streams,” IEEE Symp. Security and Privacy, 2001. 34. Sencun Zhu, Chao Yao , Donggang Liu , Sanjeev Setia , Sushil Jajodia “Efficient Security Mechanisms For Overlay Multicast Based Content Delivery” IEEE, 2007 35. T. Hardjono , B. Weis “The Multicast Group Security Architecture” RFC-3740 , March 2004. 36. W. Fenner, Xerox PARC “Internet Group Management Protocol” Request for Comments: 2236, November 1997 37. Y. Challal, H. Bettahar, and A. Bouabdallah, “A2Cast: An Adaptive Source Authentication Protocol for MultiCast Stream”, IEEE-ISCC”, June 2004. 38. Hidema Tanaka, Toshinobu Kaneko "A linear attack on the random generator by a nonlinear combiner" Vol 82, Issue 5, Pages 72 - 79,1999 39. Ulrich Schmidta and Alexander Zimper "Security and potential level preferences with thresholds"Journal of Mathematical Psychology, Vol 51, Issue 5, October 2007, PP 279-289 40. R. Rivest "The MD4 Message-Digest Algorithm" Request for Comments: 1320, 1992. 41. Ronald L. Rivest"Message Digest 5" available at http://userpages.umbc.edu/~mabzug1/cs/md5/md5.html. 42. Hans Dobbertin, Antoon Bosselaers, and Bart Preneel "RIPEMD-160" available at http://homes.esat.kuleuven.be/~bosselae/ripemd160.html. 43. Ross Anderson and Eli Biham, Tiger "A Fast New Hash Function, proceedings of Fast Software" Encryption 3, Cambridge, 1996 44. Chia-Mu Yu; Cheng-Chung Li; Chun-Shien Lu; Der-Tsai Lee; Sy-Yen Kuo "Attack Probability Based Deterministic Key Predistribution Mechanism for Non-Uniform Sensor Deployment"; Distributed Computing Systems Workshops, International Conference on 22-29 June 2007 PP:18 – 18.

521