Self-healing key distribution schemes enable a group user to recover session keys from two broadcast messages he received before and after those sessions, even if the broadcast messages for the middle sessions are lost due to network failure. These schemes are quite suitable in supporting secure communication over unreliable networks such as sensor networks and ad hoc networks. An efficient self-healing key distribution scheme is proposed in this paper. The scheme bases on the concept of access polynomial and self-healing key distribution model constructed by Hong et al. The new scheme reduces communication and computation overheads greatly yet still keeps the constant storageoverhead

Dillon, Tharam S.

Han, Song

Tian, Biming

English

Crossref

An Efficient Self-Healing Key Distribution Scheme

Copyright © 2008 IEEE This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author&apos;s copyright. In most cases, these works may not be reposted without the explicit permission of the copyright holder. If you wish to contact a Curtin researcher associated with this document, you may obtain an email address fro

Biming Tian

Song Han

Tharam S. Dillon

CiteSeerX

An efficient self-healing key distribution scheme

espace@Curtin

©2008 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. An Efficient Self-Healing Key Distribution SchemeBiming Tian, Song Han, and Tharam S. DillonDEBI Institute, Curtin University of Technology, AustraliaEmail: Biming.Tian@cbs.curtin.edu.auAbstract—Self-healing key distribution schemes enable a groupuser to recover session keys from two broadcast messages itreceived before and after those sessions, even if broadcast mes-sages for middle sessions are lost due to network failure. Theseschemes are quite suitable for supporting secure communicationover unreliable networks such as sensor networks and ad hocnetworks. An efficient self-healing key distribution scheme isproposed in this paper. The scheme based on the concept of accesspolynomial and self-healing key distribution model constructedby Hong et al. The new scheme reduces communication overheadand computation overhead greatly yet still keeps the constantstorage overhead. In addition, we consider the possibility ofmutual-healing between neighbor users in wireless networks.I. INTRODUCTIONSelf-healing key distribution schemes realize an attractiveproperty: even if during certain sessions some broadcastmessages get lost, users are still capable of recovering thesession keys simply by using one of broadcast message theyhave received during previous sessions and one of broadcastmessages they will receive in subsequent sessions, withoutrequesting additional transmissions from the group manager.The mechanism enables a large and dynamic group of usersto establish session keys for secure communications over anunreliable channel in the manner that is resistant to packet lossand collusion attacks.Self-healing key distribution scheme appears to be quiteuseful in several settings where session key is used for a shorttime-period, due to frequent changes in the group structure.Military-oriented applications as well as Internet application,such as broadcast transmissions and pay-per-view TV, areimportant examples which can benefit from such approaches.In addition, the self-healing mechanism is quite useful in com-mercial content distribution applications or electronic servicesin which communication contents are highly sensitive.In this paper, we propose an efficient self-healing key dis-tribution scheme for secure group communication in wirelesssensor networks. The scheme based on the notion of accesspolynomial which is introduced in [1] and the security modeldeveloped by Hong et al. in [2]. We point out the incorrectnessof efficiency analysis in [1]. We show that our scheme reducescommunication and computation overheads greatly withoutweakening the advantage in the storage overhead. In addition,we discuss the possibility of mutual-healing between neighborusers in wireless communications.The rest of the paper is organized as follows: in Section II,we present an overview of earlier works in the area of self-healing key distribution. In Section III, we introduce concreteconstruction. In Section IV, we prove the security and analyzethe efficiency of the proposed scheme. In Section V, wediscuss the possibility of mutual-healing between neighborusers in wireless communications. We conclude the paper inthe last section.II. RELATED WORKSThe first pioneering work of self-healing key distributionwas introduced by Staddon et al. in [3]. Formal definitions,lower bounds on the resources as well as some constructionsof self-healing key distribution scheme were proposed in it.Liu et al. generalized the definitions in [3] and gave someconstructions in [4]. The schemes reduced communicationoverhead and storage overheads by introducing a novel per-sonal key distribution technique. In addition, two techniquesthat allow trade-off between the broadcast length and therecoverability of lost session keys were proposed. The twomethods further reduced the length of broadcast message insituations where there are frequent but short-term disruptionsof communication and where there are long-time but infre-quent disruptions of communication, respectively.Blundo et al. in [5] showed an attack that can be appliedto the first construction in [3], presented a new mechanismfor implementing the self-healing approach, extended the self-healing approach to key distribution, and proposed anotherkey-recovery scheme which enables a user to recover all lostsession keys (for sessions in which he belongs to the group)by using only the current broadcast message.More et al. in [6] introduced sliding window to self-healingkey distribution scheme. They addressed the three problemsin [3]. The three problems were inconsistent robustness, highoverhead and expensive maintenance costs.Different from the revocation polynomial introduced in [4],Zou et al introduced the notion of access polynomial in [1].The scheme overcame some shortcomings existing in previousschemes yet still possessed all the advantages of them.The constructions in [1], [3], [4], [5], and [6] based onShamir’s secret sharing technique and are unconditionallysecure.By introducing an improved secret sharing scheme, Tian etal. proposed a self-healing key scheme with novel propertiesin [7]. Firstly, the scheme reduced storage overhead of per-sonal key to a constant. Secondly, the scheme concealed therequirement of secure channel in setup phase. In addition, thelong-lived scheme was much more efficient than those in [3]and [5]. However, the efficiency improvements are obtained by978-2-9532443-0-4 © 2008 ESRGroups France 1relaxing the security slightly. The scheme is a computationallysecure scheme.To sum up, Shamir’s secret sharing is the most commontechnique used to realize self-healing key distribution. It isperforms easily. However, the schemes suffer from high stor-age and computation overhead. In this paper, we propose anefficient self-healing key distribution scheme for secure groupcommunications in wireless sensor networks. We use accesspolynomial to substitute common used revocation polynomial.The underlying model is similar to the one given in [2] whichis optimized in terms of storage and communication overheads.Our scheme further reduces communication and computationoverheads. Fortunately, the storage overhead in our scheme isstill a constant.III. CONCRETE CONSTRUCTIONLet U = {U1, . . . , Un} be the finite universe of users. Abroadcast unreliable channel is available, and time is definedby a global clock. The group manager sets up and manages, bymeans of joining and revoking operations, a communicationgroup which is a dynamic subset of users of U . All of ouroperations take place in Fq, where q is a large prime. mdenotes the number of sessions and t denotes the degree ofpersonal key polynomial. Let Gj ⊆ U be the communicationgroup established by the group manager in session j. Eachuser Ui ∈ Gj holds a personal key Si, which is used torecover the session keys as long as Ui is not removed by thegroup manager from the group. Let Rj ⊆ Gj−1 denote theset of revoked group users in session j and Jj ⊂ U \ Gj−1denote the set of users who join the group in session j withRj ∩Jj = φ. Hence, Gj = (Gj−1∪Jj)\Rj for j ≥ 2 and bydefinition G1 = U . Moreover, for j ∈ {1, . . . , m}, the sessionkeys Kj(j = 1, . . . ,m) are randomly chosen by the groupmanager and according to uniform distribution. For each non-revoked user Ui ∈ Gj , the j-th session key Kj is determinedby broadcast information Bj and personal key Si.The self-healing key distribution scheme is composed ofseveral procedures. We will introduce them one by one.1) Setup: The group manager randomly chooses a t degreepolynomial S(x) from Fq[x] and keeps it secret. Furthermore,it chooses a private unique identity IDi ∈ Fq and computesS(IDi) for each user Ui. The tuple (IDi, S(IDi)) as personalkey Si is transferred to user Ui by the group manager over asecure channel. The group manager chooses m session keysK1, · · · ,Km from Fq. The session keys are independent toeach other and according to uniform distribution.2) Broadcast: For any session 1 ≤ j ≤ m, the groupmanager constructs the access polynomialAj(x) = (x − V ID)|Gj |∏i=1(x − IDi) + 1using private identities of users in session group Gj . V IDis a virtual identity which is randomly chosen by the groupmanager for each session and different from all users’ privateidentities. |Gj | denotes the number of users in session j. Then,the group manager computesPj(x) = Aj(x) · Kj + S(x)for session j. The broadcast message Bj for session j is inthe following form:Bj = {P1(x), . . . , Pj(x)}.3) Key Recovery: When a user Ui ∈ Gj receives the broad-cast message Bj , it computes Pj(IDi). Note that Aj(IDi) =1 for any user Ui ∈ Gj . Ui recovers the session key for sessionj:Kj = Pj(IDi) − S(IDi).One should note that Ui can recover the session key if andonly if he belongs to the Gj . For any user Ul 	∈ Gj , Aj(IDl)is a value other than 1. Ul gets a valueK′j =Pj(IDl) − S(IDl)Aj(IDl),which is different from the session key Kj .4) Self-healing: Without loss of generality, suppose Uimissed a broadcast message for session r < j. As far as itbelongs to the session group Gr, it picks up the polynomialPr(x) from broadcast message Bj , then computesKr = Pr(IDi) − S(IDi).If more than one broadcast messages get lost, the operation ofself-healing is the same as aforementioned.5) Add and Revoke user: If a new user Unew applies forjoining the session j, the group manager checks its legitimacyfirstly. If Unew is entitled to the session j, the group managerchooses a secret and unique identity IDnew and computespersonal key S(IDnew)), then the group manager sendspersonal key Si = (IDnew, S(IDnew)) to Unew over thesecure channel between them. In the procedure of broadcast,the group manager constructs new Aj(x) which should include(x − IDnew).If a user Urov is revoked in session j, what the groupmanager should do is excludes (x − IDrov) from Aj(x)when it constructs the polynomial Aj(x) in the procedure ofBroadcast. The group manager makes sure that Ui cannot getthe session key Kj by using the broadcast Bj and it privatepersonal key Si. Because of the special construction of accesspolynomial Aj(x), for any user Urov who is revoked from Gj ,Aj(IDrov) is a value other than 1. If Urov performs the opera-tion of key recovery, it gets a value K′j =Pj(IDrov)−S(IDrov)Aj(IDrov)which is different from the session key Kj . For a coalition ofless than t+1 revoked users, they can collect at most t pointson S(x). S(x) is a t-degree polynomial so they cannot recoverit from t or less point on it. Even they get the unique identityof an authorized user, they cannot recover any personal keysof authorized users. Thus, Kj is completely safe.The operations of adding and revoking are very efficient inour scheme due to the application of access polynomial. Forthe condition that more than one user joining or revoking, theoperations are the same as aforementioned.2IV. PERFORMANCE ANALYSISIn this section, we first prove the security and then analyzethe efficiency of the proposed scheme.A. Security AnalysisIn this section we show that our construction realizes aself-healing key distribution scheme with revocation capability.More precisely, we can prove the following theorem accordingto the security model in [2].Theorem 1. The construction is a self-healing key distribu-tion scheme with t-revocation capability.Proof: (Sketch)1) The scheme is a session key distribution scheme:(a) As described in the procedure of Key Recovery,an authorized user can recover session key from thebroadcast message by using its personal key.(b) On the one hand, since session keys are chosenaccording to the uniform distribution and independentto the personal keys, it is straightforward to see that thepersonal keys alone do not give any information aboutsession keys. On the other hand, it is not difficult to seethat each Pj(j = 1, . . . , m) perfectly hides keys Kj bymeans of Aj(x) and S(x) since Pj = Aj(x)·Kj +S(x).The set of session keys can not be determined bybroadcast messages alone.2) The scheme has t-revocation capability:Suppose that a coalition R of t revoked group userscollude in session j. The coalition of R can collect atmost t points on S(x). They cannot recover personal keyS(x). In addition, the unique identity is kept secret. Forthe collusion user R cannot construct access polynomialAj(x). For any guess of user unique identity they canconstruct a different polynomial Aj(x). Thus, Kj iscompletely safe.3) The scheme has self-healing capability:(a) For any Ui who is a user in session r and s (1 ≤r < s ≤ m), the results Aj(IDi) = 1(j = r, . . . , s)hold. Ui has personal key S(IDi). By the methodintroduced in the procedure of Key Computation, Uican subsequently recover the whole sequences of sessionkeys Kr, . . . ,Ks. In fact, in our construction, a qualifieduser can recover the all the session keys before thesession s. This is a stronger self-healing scheme.(b) Suppose C ⊆ Rr ∪ . . . ∪ R1 be a colation of usersremoved before session r and let D ⊆ Js ∪ . . .∪ Jm bea colation of users who joins the group from session sand satisfies C ∪D ≤ t. Because the coalition of C ∪Dcan collect at most t points on S(x)(for any r < j ≤ s).Hence, session keys Kj are completely safe with respectto joint coalition of size at most t of new and revokedusers.B. Efficiency AnalysisWe take advantage of access polynomial which was in-troduced by Zou et al. in [1] to design self-healing keydistribution scheme. Our scheme reduces communication andcomputation overheads greatly meanwhile constant storageoverhead is kept. Table 1 in [1] shows quantitative compar-ison of different self-healing schemes in terms of storage,communication and computation overheads. The advantagesof [1] can be seen easily from the table. We point out thatthe communication overhead in [1] comes from broadcastBj which is composed by 2m polynomial. As far as thepolynomial Pj(x) is concerned, Pj(x) = Aj(x)·Sj(x)+H(x).Both Sj(x) and H(x) are t degree polynomials, and the degreeof Aj(x) amounts to (|Gj | + 1). Generally speaking, |Gj |was larger than t. Therefore, the claim that communicationoverhead is O(mt) is incorrect. A performance comparisonbetween our scheme and the scheme [1] and [2] is showed intable I.TABLE IPERFORMANCE COMPARISONSchemes User storage Communication ComputationHong (m − j + 1)logq (tj + j + t)logq (3t + 1)logqZou 2logq (t + |Gj | + 3)logq (t + |Gj | + 1)logqNew one 2logq (|Gj | + 2)logq (|Gj | + 1)logqAlthough the proposed scheme reduces the communicationoverhead greatly, the communication overhead increases withthe number of users in a group. It is meaningful to explorenew way to further reduce the communication overhead dueto limited communication capability of wireless nodes.V. THE POSSIBILITY OF MUTUAL-HEALINGWe consider the possibility of mutual-healing betweenneighbor users in wireless networks. It is meaningful to detectcounterpart measures. In this section, we just discuss thenotions of it without exploring technical details.More et al. in [6] pointed out that the protocol in [3] sufferedfrom inconsistent robustness. Subsequently, they used a slidingwindow to make error recovery consistently robust: after aninitial Setup procedure, any lost key can be recovered as longas two sufficiently close broadcast messages–one before it andone after it–are received. Similar technique was taken in [1].The minimum size of the window can be dynamic adjustedaccording to network condition. Both [6] and [1] guaranteedthat user can recover window size session keys for previoussessions if it receive a broadcast message. However, theproblem of how to recover the session key if the last broadcastmessage gets lost has never been taken into consideration. Inaddition, some applications, such as live and pay-per-view TV,have strictly requirement of freshness. They would better lostonly a limit number of broadcast messages.It is virtually impossible to make users completely self-healing. We considerate the idea of mutual-healing, which wasalso discussed in [8]. That is, if a user has missed more than afixed number broadcast message or the last broadcast message,it can get assistance from its neighboring nodes. The users inthe same session group cooperate with each other forwardingbroadcast messages which its neighbor users missed. Thusrobust performance is achieved.3Bohio et al. in [8] claimed that there are two requirementsfor multi-healing: the authentication on requesting user andthe authentication on requested session key. If a user doesnot receive the broadcast message from the group manager, itwill contact its neighboring user to get the missed session key.The neighboring node needs to perform authenticate operation.They suggested using an identity-based pair-wise shared secretproposed in [9], as which requires less communication and isnon-interactive if identities are public.As messages are broadcasted in the form of plain-text,anyone can receive them. We argue that the authentication ofrequested session key is needless. Instead, user only needs toforward the broadcast message corresponding to the requestedsession key. If the requesting user is entitled for the session,it will be able to recover the session key, otherwise not. Nev-ertheless, in order to avoid attacks on their limited resource,effective countermeasures must be developed.VI. CONCLUSIONWe proposed an efficient self-healing key distributionscheme for secure group communications in wireless sensornetworks. The scheme was based on the notion of accesspolynomial introduced in [1] and self-healing key distributionmodel developed in [2]. We analyzed the performance of thescheme proposed in [1] and [2]. We pointed out the incor-rectness in the analysis of communication overheads in [1]and showed that communication and computation overheadsin our scheme reduces to the half of the ones in [1] withoutweakening the advantage in storage overhead.REFERENCES[1] X. Zou and Y. Dai, A Robust and Stateless Self-Healing Group KeyManagement Scheme, Communication Technology, 2006. ICCT ’06.International Conference on, pp.1-4, Nov 2006.[2] D. Hong and J. S. Kang, An Efficient Key Distribution Scheme with Self-healing Property, IEEE Communication Letters, Vol.9, No.8, August,2005.[3] J. Staddon, S. Miner, M. Franklin, D. Balfanz, M. Malkin and D. Dean,Self-healing Key Distribution with Revocation, proceedings of IEEESymposium on Security and Privacy, pp. 224-240, 2002.[4] D. Liu, P. Ning and K. Sun, Efficient Self-healing Group Key Distributionwith Revocation Capability, Proceeding of the 10th ACM CCS, 2003.[5] C. Blundo, P. D’Arco, A. Santis and M. Listo, Design of Self-healing KeyDistribution Schemes, Design Codes and Cryptography, No.32, pp.15-44,2004.[6] S. M. More, M. Malkin, J. Staddon and D. Balfanz, Sliding Window Self-healing Key Distribution with Revocation, ACM Workshop on Survivableand Self-Regenerative Systems, pp.82-90, 2003.[7] B. Tian and M. He, Self-Healing Key Distribution Scheme with NovelProperties, International Journal of Network Security, Vol.7, No.2,pp.147-152, 2008.[8] M. J. Bohio and A. Miri, Self-Healing Group Key Distribution, Interna-tional Journal of Network Security, Vol.1, No 2, pp.110-117, 2005.[9] B. Pinkas, Efficient State Updates for Key Management, Proceedings ofthe IEEE, Special Issue on Enabling Technologies for Digital RightsManagement, Vol.92, No.6, pp. 910-917, 2004.4

http://espace.library.curtin.edu.au/cgi-bin/espace.pdf?file%3D/2009/02/18/file_1/116129

An efficient self-healing key distribution scheme

Abstract

Similar works

Full text

Available Versions

Crossref

CiteSeerX

espace@Curtin