6.4 Basic Authenticated Query Flooding
6.4.2 Analysis
The query of a legitimate user will be flooded into the sensor network without any obstacles. However, a query forged by an adversary will only be able to reach a limited part of the network, as some sensor nodes will discard the query. In the following, we analytically determine how many 1-bit MACs should be appended to a query in order to limit the propagation of a fake query to a small constant part of the network.
The variables used in the analysis are summarized in Table 6.1.
meaning of the variable variable typical values number of nodes in the sensor network n 1000 − 10000
number of keys in the key pool l 10000 - 100000
number of keys in the key ring of a node k 50 - 250 node density (average number of neighbors of a
node)
d 5 - 50
number of captured senor nodes n˜ 0 − 50
number of captured keys ˜b Formula 6.1
number of keys in the authenticator which the adversary knows
E˜b Formula 6.2 number of correct bits in the fake authenticator B Formula 6.3 probability that the message will be forwarded pf Formula 6.5
size of the authenticator m 100 - 500 bits
Table 6.1: Variables used in the analysis of bAQF
6.4.2.1 Probability of Accepting a Fake Query by an Arbitrary Node
Using a common model for cryptographic hash functions [12], it is infeasible to first choose some x and then search for an appropriate value q with h(q) = x, or to fix any properties for the desired x and then search for a query q with satisfying h(q). For different queries q, the adversary always receives independent random values x = h(q).
Therefore, we assume that the adversary uses the following strategy:
It computes the seed x = h(q) for its query q, computes the appropriate sequence of key identifiers KIDx using P RG(x), and hopes that it knows enough keys with identifiers from KIDx in order to be able to construct a fake query.
In the following, we compute the probability of a fake query generated as above to propagate successfully through the sensor network assuming that the adversary captured ˜n sensor nodes and guessed the bits of authenticator which it could not compute.
If ˜n sensor nodes are compromised, then the adversary knows on average
˜b keys:
˜b = l(1 − (1 −k
l)n˜) (6.1)
Formula 6.1 assumes that the keys are distributed according to the
uni-6.4 Basic Authenticated Query Flooding 103
form probability distribution. Given that the adversary knows ˜b keys out of l, we can compute the average number of bits in an authenticator of length m that will be correct due to the adversary’s partial knowledge of the key space l:
E˜b = m˜b
l (6.2)
Since the attacker knows nothing about the other keys in the authenti-cator, it has to guess the other bits. There it will have the probability of 50% to guess the correct value. This lets us compute the total number of correct bits in the faked authenticator:
B = E˜b+m − E˜b
2 = m(˜b + l)
2l = m(2 − (1 −kl)˜n)
2 (6.3)
We can finally compute the probability pf that a sensor accepts the query with the fake authenticator: The expression in the parentheses gives the probability that one bit of the authenticator passed the test by a particular sensor node. The first sum-mand expresses the probability that the sensor node does not share any keys with the claimed set of key identifiers P RG(x). The second summand shows the probability that the adversary either could compute the appropriate bit or guessed it.
Substituting B in Formula 6.4 using Formula 6.3 finally yields:
pf = 1 −1
6.4.2.2 Limiting the Propagation of Fake Queries
The last section calculated the probability that each single node forwards a fake query. It is yet open, however, how the network as a total behaves, namely, whether the query reaches a significant number of nodes, or is stopped from doing so.
node decided to forward the query node decided not to forward the query stopped links
working links
Figure 6.1: Query propagation in a branching-process-like network (to the left), and in a wireless sensor network.
To assess the network-wide behavior of our scheme, the propagation of fake queries can be roughly approximated by the development of a variant of a branching process [56]. In this process, entities which can produce entities of the same kind are considered. A single entity starts the process.
Each entity creates d descendants with probability p, and does not create any descendants with probability 1 − p. Thus, the population of entities may extinct after some generations if too little entities are produced. It is well known that if dp < 1, the extinction happens with probability 1. A branching-process-like network is a d-regular tree, see Figure 6.1. The root starts the query propagation. After receiving the query, each node forwards the query with probability p, and remains silent with probability 1 − p.
We can consider the dissemination of a fake query as a branching process with p = pf. However, this is only a rough estimation, because of the higher connectivity of sensor networks. For example, in Figure 6.1, only four nodes of the last depicted generation receive the query, and only two nodes forward the query. However, in the example sensor network, 7 nodes receive the query, and four of them forward the query. Nevertheless, we will see in the following that this estimation gives sufficiently good results which are also confirmed by simulation.
If we see the fake query dissemination as a branching process, we have the following criterion for the propagation of the fake query to be stopped:
pfd < 1 (6.6)
Another justification for Formula 6.6 is as follows. If a node has d neigh-bors, each of them forwarding the fake query with the probability pf, then the average number of nodes which forward the query is pfd. In this case,
6.4 Basic Authenticated Query Flooding 105
the query propagation should be limited if less than one neighbor on average forward the fake query.
From Formulas 6.5 and 6.6 it follows:
1
In Formula 6.8, we have variable parameters d, l, k, ˜n for the length of the authenticator m. The administrators of the network control parameters d, l, k and m, while the adversary controls ˜n.
The next task is to find suitable ranges for d, l, k and m, such that the adversary is unable to send fake queries for reasonable ranges of ˜n. We did so analytically, as well as by simulation (see Section 6.4.4).
Firstly, we comment on the choice of the node density parameter. If the node density is too high, then the capacity of wireless networks decreases.
On the other hand, if the network density is too low, the network may become disconnected. Node density required to ensure connectivity can be estimated as Θ(log n) [149], but the exact number of neighbors remains an open problem. For networks of moderate size, 6 to 8 neighbors may be considered [113].
The size of the key ring k is constrained by the amount of memory available on sensor nodes. In a typical sensor node the RAM size is about 10 kB. Then, if the key size is 80 bits,the nodes would be able to hold up to 200 keys. After choosing k, we can choose l such that kl is sufficiently small.
As the key pool is stored at the base station, we do not have serious limits on the size of l.
Figure 6.2 depicts the necessary authenticator sizes for node density 7, depending on the ratio kl, and the number of compromised nodes ˜n according to Formula 6.8. It can be clearly seen that there is an optimal ratio kl for any particular number of compromised nodes. Below we analytically determine this ratio.
Firstly, we find first derivation of the Expression 6.9, which evolves from