Towards Privacy Aware Pseudonymless Strategy for Avoiding Profile Generation in Vehicular Ad Hoc Networks
1 like704 views
This document proposes a pseudonymless strategy for avoiding profile generation in VANETs. It suggests that vehicles send beacons without identities to preserve anonymity. Vehicles are organized into random groups by a trusted third party (TTP) and each vehicle has an individual secret key. The keys and group assignments are periodically updated by the TTP to limit information disclosure if keys are compromised. This approach reduces the cost of revocation to O(g) where g is the group size, provides conditional anonymity, and has better efficiency than alternative pseudonymous schemes.
![Motivation[1/2]
Application requirement in VANET: vehicle sends beacons
every 100-300 ms
Due to security requirements, beacons are normally
digitally signed
Signing cost is high
Verification cost is high
Scheuer et al. suggested using symmetric key for noncritical messages (beacons) and necessary security
through TRH (Tamper-resistant Hardware)
For fast revocation, pseudonyms were used
© Information Security & Privacy Laboratory
-3-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-3-320.jpg)
![Motivation[2/2]
Side effects of pseudonyms (specially single pseudonym
for each vehicle)
Profile generation
Remedy: mix zone, silent periods, GTTP
Multiple pseudonyms: (pseudonym, key) pairs
Extension of the framework outlined in *
* “A privacy aware and efficient security infrastructure for vehicular ad hoc networks,” by K. Plobi and
H. Federrath, Computer Standards & Interfaces, 2008
© Information Security & Privacy Laboratory
-4-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-4-320.jpg)
![Multiple Pseudonyms[1/2]
Remedy within frame of pseudonymity
How about Multiple Pseudonyms?
Timestamp
Speed &
Position
PAi
HMAC1 with
Encrypted with
K MACPA
i
HMAC2 with
K all
Kc
Using Multiple Pseudonyms overcome some of the
deficiencies of using single pseudonym
Downside!
Bad effects on space requirement
Inefficient Bootstrapping
Requires periodically refill strategy
© Information Security & Privacy Laboratory
-7-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-7-320.jpg)
![Multiple Pseudonyms[2/2]
GTTP (Geographically distributed Trusted Third Party):
responsible for revocation of a VRI if it is required but
with CA(GTA (Government Transportation Authority))
The main threat for Profiling is the ‘identities’
Do we have certain mechanism in which we don’t need
to use identities, anonymously send beacons and the
functionality of the entities is still maintained?
We should think of a ‘Pseudonymless’ strategy
© Information Security & Privacy Laboratory
-8-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-8-320.jpg)
![Grouping[1/2]
Group secret key:
Group Secret key (Kg) is used for calculating HMAC1
Where Gid is group ID and we included VRI in HMAC1
Kg is the group secret key used for HMAC1
Compromise of group key effects the whole group!
© Information Security & Privacy Laboratory
-13-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-13-320.jpg)
![Grouping[2/2]
Individual secret key:
Individual Secret key ( K v ) is used for calculating HMAC1
i
K vi is the individual secret key used for HMAC1
Inclusion of VRI in HMAC1 is not needed
Revocation cost is still O(g)
Compromise of secret key effects only single vehicle!
© Information Security & Privacy Laboratory
-14-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-14-320.jpg)
![Key and Group Updation[1/2]
The amount of information disclosed in case of a key
compromise is reduced by changing the keys periodically
Vehicles switch between groups
Requirements
Mutual Authentication between TTP and TRH
Confidentiality
Integrity of updated Key ( K'Vi )
Availability of TTP
Tamper Resistance of TRH
Both the group ID and individual secret keys keep
changing according to the counter maintained in TRH
© Information Security & Privacy Laboratory
-16-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-16-320.jpg)
![Key and Group Updation[2/2]
KTRH-TTP is assumed to be established securely (may be by using
secure Diffie-Hellman method)
K'Vi is the updated individual secret key for vehicle (TRH)
Gid is the new group id and Rn is the random number
We assume that the encrypted message provides integrity of inner
content of the message
TTP updates the database only if the acknowledgment is received
© Information Security & Privacy Laboratory
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-17-320.jpg)
![Evaluation[1/2]
Security (beacon message and key updating protocol)
Beacon require integrity, privacy and revocation
We do not consider the confidentiality
No need for strong authentication
Integrity is provided by calculating HMAC2
Integrity and confidentiality of updated key K'Vi depends upon the
security of session key protocol
Compromise of Kall and K vi !
Severe problem will arise if compromised Kall is used for
injecting bogus information (e.g. false position) to the beacon
Assumptions on TRH take care of that!
© Information Security & Privacy Laboratory
-18-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-18-320.jpg)
![Evaluation[2/2]
Privacy
HMAC1 provides privacy
No other party can revoke the message until K v is obtained
i
if we remove the possibility of identifying vehicles using HMAC1,
there is no information in beacon by which vehicle can be identified
Our scheme provides conditional anonymity
Efficiency
With SHA-256 (192bit key) for HMAC and AES (192bit key)
Security overhead in terms of size is ( 2 x 256 + 16 ) = 66 bytes
Beacon size is 366* bytes and security overhead is 18%
TRH calculates only 2 HMACs for beaconing
* Supposing that 300 bytes are reasonable for beacon, alarm and warning
© Information Security & Privacy Laboratory
-19-
Hanyang University](https://image.slidesharecdn.com/towardsprivacyawarepseudonymlessstrategyforavoidingprofilegenerationinvehicularadhocnetworks-131225192743-phpapp02/85/Towards-Privacy-Aware-Pseudonymless-Strategy-for-Avoiding-Profile-Generation-in-Vehicular-Ad-Hoc-Networks-19-320.jpg)
Towards Privacy Aware Pseudonymless Strategy for Avoiding Profile Generation in Vehicular Ad Hoc Networks
- 1. Towards Privacy Aware Pseudonymless Strategy for Avoiding Profile Generation in VANET 1Rasheed Hussain, 2Sangjin Kim, and 1Heekuck Oh 1Hanyang University, Department of Computer Science and Engineering 2Korea University of Technology and Education, School of Information and Media Engineering, Republic of Korea 26-08-2009 © Information Security & Privacy Laboratory Hanyang University
- 2. Agenda Motivation Profile Generations and Pseudonyms Multiple Pseudonyms Proposed Pseudonymless Scheme Grouping Updating keys and groups Evaluation © Information Security & Privacy Laboratory -2- Hanyang University
- 3. Motivation[1/2] Application requirement in VANET: vehicle sends beacons every 100-300 ms Due to security requirements, beacons are normally digitally signed Signing cost is high Verification cost is high Scheuer et al. suggested using symmetric key for noncritical messages (beacons) and necessary security through TRH (Tamper-resistant Hardware) For fast revocation, pseudonyms were used © Information Security & Privacy Laboratory -3- Hanyang University
- 4. Motivation[2/2] Side effects of pseudonyms (specially single pseudonym for each vehicle) Profile generation Remedy: mix zone, silent periods, GTTP Multiple pseudonyms: (pseudonym, key) pairs Extension of the framework outlined in * * “A privacy aware and efficient security infrastructure for vehicular ad hoc networks,” by K. Plobi and H. Federrath, Computer Standards & Interfaces, 2008 © Information Security & Privacy Laboratory -4- Hanyang University
- 5. Framework * Figure from Plobi et al.’s Scheme © Information Security & Privacy Laboratory -5- Hanyang University
- 6. TRH We assume that every vehicle is equipped with TRH Stored information Root CA’s certificate, TRH’s certificate(CertTRH), vehicle’s individual symmetric key K vi ), vehicle’s VRI (Vehicle-related ( Identitiy), common symmetric key (Kall) and group ID (Gid) Part of operations of TRH, keys may be updated inside TRH by requesting TTP and using “key and group ID updating protocol” Only authentic configuration is possible for the owner of the car at initialization or when the car is sold All messages are assembled inside TRH Keys are kept secure inside TRH (at least until TRH is removed or replaced by new one) © Information Security & Privacy Laboratory -6- Hanyang University
- 7. Multiple Pseudonyms[1/2] Remedy within frame of pseudonymity How about Multiple Pseudonyms? Timestamp Speed & Position PAi HMAC1 with Encrypted with K MACPA i HMAC2 with K all Kc Using Multiple Pseudonyms overcome some of the deficiencies of using single pseudonym Downside! Bad effects on space requirement Inefficient Bootstrapping Requires periodically refill strategy © Information Security & Privacy Laboratory -7- Hanyang University
- 8. Multiple Pseudonyms[2/2] GTTP (Geographically distributed Trusted Third Party): responsible for revocation of a VRI if it is required but with CA(GTA (Government Transportation Authority)) The main threat for Profiling is the ‘identities’ Do we have certain mechanism in which we don’t need to use identities, anonymously send beacons and the functionality of the entities is still maintained? We should think of a ‘Pseudonymless’ strategy © Information Security & Privacy Laboratory -8- Hanyang University
- 9. Proposed Pseudonymless Scheme We don’t use any identity in beacons ‘GTTP’ will brute-forcely search the node if it needs to be revoked Cost will be O(n) where n is the number of users that are currently entertained by GTTP Beacon Format Timestamp is for Freshness K viis vehicle’s individual secret key that keeps on changing after a specified amount of time (how?) and Kall is the common key This beacon has no identity © Information Security & Privacy Laboratory -9- Hanyang University
- 10. Is ‘No identity beacon’ practical? Pseudonyms used for Privacy and anonymity But they cause Profilation Notion of insiders and outsiders Encryption may be essential Need of Mixed Zones and Silent Period and their effect on services provided by VANET Message size and Security overhead is increased with Pseudonymous strategy How often GTTP will need to revoke the VRI? No-Pseudonym strategy may be practical © Information Security & Privacy Laboratory -10- Hanyang University
- 11. Why not single TTP? Till now we used the term ‘GTTP’ With Pseudonymous strategy, GTTP were used which covered relatively small area Handled pseudonym operations and encryption functions Reduces search space in case of revocation A compromise if any, is localized In our scheme By Grouping, no need of GTTP to reduce revocation cost To limit the amount of disclosed information in case of compromise, we update the keys Use of single TTP for key distribution, management and revocation Replication for ‘easy to access’, efficiency and interconnect through RSUs © Information Security & Privacy Laboratory -11- Hanyang University
- 12. Reducing the cost! With ‘No Pseudonym’ the cost for search was O(n) What if TTP organize the vehicles to groups somehow? There must be limitation on group size! Cost will be reduced to O(g) instead of O(n) Group size should be trade-off between efficiency of TTP and privacy of vehicle © Information Security & Privacy Laboratory -12- Hanyang University
- 13. Grouping[1/2] Group secret key: Group Secret key (Kg) is used for calculating HMAC1 Where Gid is group ID and we included VRI in HMAC1 Kg is the group secret key used for HMAC1 Compromise of group key effects the whole group! © Information Security & Privacy Laboratory -13- Hanyang University
- 14. Grouping[2/2] Individual secret key: Individual Secret key ( K v ) is used for calculating HMAC1 i K vi is the individual secret key used for HMAC1 Inclusion of VRI in HMAC1 is not needed Revocation cost is still O(g) Compromise of secret key effects only single vehicle! © Information Security & Privacy Laboratory -14- Hanyang University
- 15. Grouping strategy Sequential Method TTP assigns the entering vehicles, same group id up to certain amount of time At an instant of time, only one group will be growing Threat for privacy in long term depending upon traffic density! Random Method TTP assigns the group ids to entering vehicles randomly At an instant of time, every group will be populating equally Random fashion preserves privacy and anonymity! Our scheme uses individual secret key with random grouping © Information Security & Privacy Laboratory -15- Hanyang University
- 16. Key and Group Updation[1/2] The amount of information disclosed in case of a key compromise is reduced by changing the keys periodically Vehicles switch between groups Requirements Mutual Authentication between TTP and TRH Confidentiality Integrity of updated Key ( K'Vi ) Availability of TTP Tamper Resistance of TRH Both the group ID and individual secret keys keep changing according to the counter maintained in TRH © Information Security & Privacy Laboratory -16- Hanyang University
- 17. Key and Group Updation[2/2] KTRH-TTP is assumed to be established securely (may be by using secure Diffie-Hellman method) K'Vi is the updated individual secret key for vehicle (TRH) Gid is the new group id and Rn is the random number We assume that the encrypted message provides integrity of inner content of the message TTP updates the database only if the acknowledgment is received © Information Security & Privacy Laboratory Hanyang University
- 18. Evaluation[1/2] Security (beacon message and key updating protocol) Beacon require integrity, privacy and revocation We do not consider the confidentiality No need for strong authentication Integrity is provided by calculating HMAC2 Integrity and confidentiality of updated key K'Vi depends upon the security of session key protocol Compromise of Kall and K vi ! Severe problem will arise if compromised Kall is used for injecting bogus information (e.g. false position) to the beacon Assumptions on TRH take care of that! © Information Security & Privacy Laboratory -18- Hanyang University
- 19. Evaluation[2/2] Privacy HMAC1 provides privacy No other party can revoke the message until K v is obtained i if we remove the possibility of identifying vehicles using HMAC1, there is no information in beacon by which vehicle can be identified Our scheme provides conditional anonymity Efficiency With SHA-256 (192bit key) for HMAC and AES (192bit key) Security overhead in terms of size is ( 2 x 256 + 16 ) = 66 bytes Beacon size is 366* bytes and security overhead is 18% TRH calculates only 2 HMACs for beaconing * Supposing that 300 bytes are reasonable for beacon, alarm and warning © Information Security & Privacy Laboratory -19- Hanyang University
- 20. Comparison with other schemes Comparison with other schemes H means HMAC calculation and E means Symmetric encryption © Information Security & Privacy Laboratory -20- Hanyang University
- 21. Merits of our system Profile generation is avoided GTTP, Mix Zones or silent period is NOT required Better efficiency with respect to Computational and Bandwidth cost Space requirements are less than that of Scheuer et al.’s scheme © Information Security & Privacy Laboratory -21- Hanyang University
- 22. © Information Security & Privacy Laboratory -22- Hanyang University