Background. Data hiding Data verification

Transcription

1 Collaborators MIT: Dina Katabi, Minji Kim, Sachin Katti, Jianlong Tang, Fang Zhao Technical University of Munich: Ralf Koetter Caltech: Michelle Effros, Tracey Ho Chinese University of Hong Kong: Sid Jaggi AFRL: Keesook Han HP Labs: Ton Kalker Open University Israel: Michael Langberg University of Porto: Joao Barros, Luisa Lima, Joao Vilela BAE: Jeff Opper

2 Background Network coding provides a new means of conveying information it also changes completely the security aspects of networks Combining symbols in the network may complicate keeping track of information to ensure its integrity or provenance It also affords a new set of techniques for protecting the data Two main aspects: Data hiding Data verification

3 Data hiding The mixture of two messages, appropriately compressed, makes one message a one-time pad to another [CY02] If we want such mixtures, one can derive limits on network capacity [FMSS04] Main scheme: Use other messages for encryption If no other messages are sent: identical to dispersive routing [JM04, LLF04] If other messages are sent: extra security from network coding Security can be added via network coding with lower cost than dispersive routing [TM06]

4 Cost and vulnerability Cost: cost of transmission Vulnerability: probability an attacker can decode p: probability a link is tapped Exodus network, 4 sinks, 4 processes, each with rate 10 [TM06]

5 Wiretapping aspects The mixture of two messages, appropriately compressed, makes one message a one-time pad to another [CY02] If we want such mixtures, one can derive limits on network capacity [FMSS04] In general Difficult to know the maximum number of links that can be tapped by adversary Such secure coding schemes are sometimes impossible Main scheme: Use other messages for encryption If no other messages are sent: identical to dispersive routing [JM04, LLF04] If other messages are sent: extra security from network coding Security can be added via network coding with lower cost than dispersive routing [TM06] Define level of security provided by random linear network coding is measured by the number of symbols that an intermediate node has to guess in order to decode one of the transmitted symbols [LMB07], [LVMB08] 5

6 Random linear coding a free cypher? Overview: Random linear coding (RLC) in effect provides a one-time use pad use of data in combination Level of security provided by RLC: Number of symbols that an intermediate node v has to guess in order to decode one of the transmitted symbols Partial transfer matrix We consider these results under different topologies Model, definitions, approach and results; Two cases w/ relevant information: x P(X lin = 0) " 2 q Partial transfer matrix has full rank F q 2q (a " F q ) # 0 2. Partial transfer matrix has diagonizable parts Linear combination of independent and uniformly distributed values q 2 in Product - Obtain a zero: " K!1 zeros, entries of the multiplicative table Probability p of having zeros in one or more lines P(X lin = 0) q "# = 0 # K & p = % $ K "1' ( # 2 & % $ q ' ( # 1" 2 & % $ q ( ' K"1 6

7 Random linear coding a free cypher? Analysing the different possibilities of combinations for the lines that already have (K-1) zeros and the ones that can be obtained by Gaussian elimination recoverable number of symbols degrees of freedom If L = l " I (v) " I (v) =1 X =1, P(X =1) = p 1 < " I (v) < K K "1 lines with zeros " I (v) = 3 L = " I (v) # l Lines to perform Gaussian elimination (1" p) 3 3p(1" p) 2 3p 2 (1" p) p 3 L = 0 L =1 L = 2 L = 3 (1" p) 3 3p(1" p) 2 3p 2 (1" p) p 3 (1" p) 2 2p(1" p) p 2 (1" p) p L = 0 L =1 L = 2 L = 3 L =1 L = 2 L = 3 L = 2 L = 3 7

8 Is protecting the code enough? The goal is to lighten the overhead of cryptanalysis by making use of network coding A traditional approach will encode packets and operate on those encoded packets We propose to protect the code itself: It is still possible to perform combinations on top of encrypted codes, by keeping the collective effect of the successive encodings upon the encrypted codes We shall model the encryption of the codes as saying that the encoding matrices, based upon variants of random linear network coding, are given only to the source and sinks

9 Main results We provide a characterization of the mutual information between the encoded data and the two elements that can lead to information disclosure: the matrices of random coefficients the original data itself. Our results, some of which hold even with finite block lengths, show that, predicated on uniform distribution of the data to be encoded, information-theoretic security is achievable for any field size without loss in terms of decoding probability The assumption of uniform distribution can be obtained through compression of encryption of even one of the encoded packets

10 Main results We show: A general result for the mutual information between the payload and the encoding matrix, which goes to zero with the size of the field according to the coding scheme used at the source, it is possible to achieve zero mutual information, either between the payload and the encoding matrix or between the payload and the original information. The mutual information between the payload and, respectively, the original information or the encoding matrix tends to zero with the size of the field

11 [1] Ho et al. Statement of results

12 Statement of results We can obtain tighter bounds if we restrict ourselves to invertible matrices

13 Statement of results To obtain further results, consider source encoding of the plaintext where the source symbols exclude the codeword zero We can use traditional source encoding, with random matrices that do not include the coefficient 0

14 Statement of results

15 Statement of results

16 Statement of results What is the effect of reusing the coding matrix?

17 Results Mutual information in function of field size, for several coding strategies for RLNC and n = 4.

18 Conclusions Our results show that it is possible to achieve information theoretic security by performing optimal source coding on the payload information and protecting the code It is also possible to choose between null mutual information on the coefficients or on the payload, which has an impact on practical choices for RLNC protocols, such as the size of the generation to choose for security We are considering the evaluation of the impact of non-uniformities caused by imperfect source coding

19 Byzantine security

20 Byzantine detection with network coding [HLKMEK04]

21 Byzantine modification detection scheme

22 Detection probability

23 Analysis

24 Analysis (cont d)

25

26 Content distribution using network coding a 1 P1+a 2 P2+a 3 P3 A3 Source P1 P2 P3 A1 A2 Peer A D1 d 1 A1+d 2 A2 Peer E E1 E2 Peer B B1 Peer D Peer C A malicious user can send packets with valid linear combination in the header, but garbage in the payload. The pollution of packets spreads quickly. Need a homomorphic signature scheme that allows nodes to verify any linear combination of pieces without contacting the original sender or decoding packets.

27 Verification for content distribution Can use homomorphic hash functions in content distribution systems to detect polluted packets [ADMK05], [GR06]. Can use Secure Random Checksum (SRC) which requires less computation than the homomorphic hash function, but requires a secure channel to transmit the SRCs to all the nodes in the network [KFM04]. A signature scheme without a secure channel for transmitting hash values and associated digital signatures of received and transmitted blocks; Weil pairing on elliptic curves provides authentication of the data in addition to pollution [CJL06]. Use a scheme that relies on the network coding scheme intrinsically [ZKMH07].

28 Problem formulation A source s wishes to send a large file to a group of peers, T. View the data to be transmitted as vectors v, K 1, v m in n n-dimensional vector space F q, where q is a prime. The source node augments these vectors to v 1, K, v m given by v i = ( 0, K,1, K,0, vi 1, K, vin) where the first m elements are zero except the i-th one is 1, and v! ij F q Each packet received by a peer is a linear combination of all the pieces. m w =! " v i i i= 1

29 Signature for network coding The vectors v, K m n 1, v m span a subspace V of F +. p A received packet is a valid linear combination if and only if it belongs to V. Each node verifies the integrity of a received vector w by checking the membership of w in V. Our approach has the following ingredients: q: a large prime such that p is a divisor of q -1. g: a generator of the group G of order p in F q. Private key: K pr = { a i } i= 1, K, m+ n, a random set of elements * in F q. ai Public key:. K pu = { hi = g } i= 1, K, m+ n

30 Signature for network coding The scheme works as follows: The source finds a vector u that is orthogonal to all vectors in V. The source computes vector x = ( u 1 / a1, K, u m + n / am+ n). The source signs x with some standard signature scheme and publishes it. When a node receives a vector w and wants to verify that w is in V, it computes + d =! i= and verifies that d =1. m n 1 h xiw i i

31 Discussion It can be shown that it is as hard as the Discrete Logarithm problem to find new vectors that also satisfy the verification criterion other than those that are in V. Overheads Part of the public key K pu has to be re-generated for each file, otherwise a malicious node can use the information from the previous file; Signature vector, x. If the file sizes are large, after the initial setup, each additional file distributed only incurs a negligible amount of overhead using our signature scheme Our signature scheme has to be applied on the original file, not on hashes.

32 Conclusions Overviewed some of the security capabilities of network coding Robustness to Byzantine attacks. Distributed authentication in peer-to-peer downloads. The implication of network coding for security are not limited to these applications. None of these present in themselves a complete security solution, but network coding has opened up entirely new venues for the operation of networks. We will further develop scalable and secure network coding techniques for multimedia delivery and massive data sharing.

33 References [ADMK05] S. Acedánski, S. Deb, M. Médard, and R. Koetter, How good is random linear coding based distributed network storage?, in Proc. Netcod 05, April [AKLY00] R. Ahlswede, N. Cai, S. Li, and R. Yeung, Network information flow, IEEE Trans. on Information Theory, July [CJL06] D. Charles, K. Jain, and K. Lauter, Signatures for network coding, in Proc. CISS 06, March [GR05] C. Gkantsidis and P. Rodriguez, Network coding for large scale content distribution, in Proc. IEEE INFOCOM 05, March [GR06] C. Gkantsidis and P. Rodriguez, Cooperative security for network coding file distribution, in Proc. of IEEE INFOCOM 06, April [JLKHKM07] S. Jaggi, M. Langberg, S. Katti, T. Ho, D. Katabi, and M. Médard, Resilient network coding in the presence of Byzantine adversaries, in Proc. IEEE INFOCOM 07, May [KFM04] M. N. Krohn, M. J. Freedman, and D. Mazéires, On-the-fly verification of rateless erasure codes for efficient content distribution, in Proc. IEEE Symposium on Security and Privacy, May [KM01] R. Koetter and M. Médard, An algebraic approach to network coding, IEEE/ACM Trans. on Networking, Oct [ZKMH07] F. Zhao, T. Kalker, M. Médard, and K. Han, Signature for content distribution with network coding, in Proc. IEEE ISIT 07, July 2007.

34 Considering overhead What proportion of the outgoing bandwidth of a node is devoted to transmissions that would not occur in the absence of an attack? Consider a node: can detect a bad generation (or sub-generation) and discard can detect a bad packet and discard can forward and rely on error correction at the receiver(s)

35 Comparison [KMB08]

36 Byzantine and pollution attacks Random linear network coding using coding vectors Add polynomial hash A batch of r packets is multicast from a source node s to a set of sink nodes. A packet that is not a linear combination of its input packets is called adversarial. z 0 the maximum number of adversarial packets m the minimum source-sink cut capacity ρ proportion of redundant symbols in each packet An omniscient adversary can observe transmission on the entire network Main results [Jaggi05], [JLHE05], [JKLHDKM07] : If the adversary is omniscient, the information rate of the code approaches m-2z 0 asymptotically as the packet size increases. If the adversary is NOT omniscient, and the source and the sinks share a secret channel not observed by the adversary, a rate of m-z 0 is asymptotically achievable.

37 Byzantine correction Block-length n over finite field F q T 1 D i =T i (1).1+T i (2).r+ +T i (n(1- ε)).rn(1- ε)b r D 1 D E m-z 0 Symbol from F q X 1 X E - Z n(1-ε) Vandermonde matrix... T E n(1-ε) nε m r D 1 D E T 1 r D 1 D E T 1 r D 1 D E... m... T E r z 0 Choose majority (r,d 1,,D E ) D 1 D E T E r T E r D 1 D E D i =T i (1).1+T i (2).r+ +T i (n(1- ε)).r n(1- ε)? If so, accept T i, else reject T i Use accepted T i s to decode [Jaggi05], [JLHE05], [JKLHDKM07]

38 Omniscient adversary case Input matrix, X, whose ith row, x i, corresponds to the ith input packet. The first n-ρn-r entries of x i are independent exogenous data symbols. The next ρn are redundant symbols. The last r symbols form the coding vector. An adversarial packet can be viewed as an additional source packet, and Z is the matrix whose ith row is the ith adversarial packet. The received packets at a terminal node can be represented by Y, given by Y = GX + KZ where G and K are the linear mappings from the source and the adversarial packets respectively to the sink. Let Gʼ be the last r columns of Y. The sink knows Gʼ but not G. 11

39 Omniscient adversary case Lemma 1: With probability at least 1-η/q, the matrix Gʼ has full column rank, where η is the number of links in the network, and q is the size of the finite field. Proposition 1: With probability greater than 1-q nε, the input matrix X can be recovered, and the decoding algorithm has complexity O(n 3 m 3 ). 12

40 Model 1 - Encoding T 1 r 1 D 11 D 1 E D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε)... r i D ij T E r E D E 1 D E E nε T j j

41 Model 1 - Encoding T 1 r 1 D 11 D 1 E D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε)... r i D ij i T E r E D E 1 D E E T j nε

42 Model 1 - Transmission T 1 r 1 D 11 D 1 E T 1 r 1 D 11 D 1 E T E r E D E 1 D E E T E r E D E 1 D E E

43 Model 1 - Decoding T 1 r 1 D 11 D 1 E... T E r E D E 1 D E E D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε)? r i D ij T j Quick consistency check

44 Model 1 - Decoding T 1 r 1 D 11 D 1 E... T E r E D E 1 D E E D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε)? T j D ji =T i (1).1+T i (2).r j + +T i (n(1- ε)).r j n(1- ε)? r i D ij Quick consistency check

45 Model 1 - Decoding T 1 r 1 D 11 D 1 E... Consistency graph T E r E D E 1 D E E D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε) D ji =T i (1).1+T i (2).r j + +T i (n(1- ε)).r j n(1- ε) Edge i consistent with edge j

46 Model 1 - Decoding 1 (Self-loops not important) Consistency graph T T T r,d r,d T 1... T E r 1 r E D 11 D 1 E D E 1 D E E D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε) D ji =T i (1).1+T i (2).r j + +T i (n(1- ε)).r j n(1- ε) Edge i consistent with edge j

47 Model 1 - Decoding Consistency graph T T T r,d r,d T 1... T E r 1 r E D 11 D 1 E D E 1 D E E Detection select vertices connected to at least E /2 other vertices in the consistency graph. Decode using T i s on corresponding edges.

48 Model 1 - Proof Consistency graph T T T r,d r,d T 1... T E r 1 r E D 11 D 1 E D E 1 D E E D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε) D ij =T j (1).1+T j (2).r i + +T j (n(1- ε)).r i n(1- ε) k (T j (k)-t j (k) ).r ik =0 Polynomial in r i of degree n over F q, value of r i unknown to Zorba Probability of error < n/q<<1

49 Network coding and network error correction Random network coding is susceptible to modifications of packets (adversary, jamming, non-hostile, packet erasures) Error correction in combination with network coding was considered by Yeung et al., and Zhang - here the network topology plays a central role Work in the context of Byzantine modifications in arbitrary networks: Ho et al. and Jaggi et al. We consider a network as a modeled by a random linear operator reflecting the Operation of random network coding on a network of unknown topology Operator Channel: Input is a subspace V of ambient n-dimensional space W, H is a random linear operator mapping V to a k-dimensional subspace of V; E is an error space of dimension t(e) Output is a subspace U of W V + U This formulation is very similar to non-coherent detection in the MIMO case: Zheng and Tse E

50 Network coding and network error correction Just as in the MIMO case: Constructing codes is equivalent to packing subspaces of dimension λn in ambient space of dimension n. The metric for defining distance between two spaces A,B is Input: arbitrary basis vector for a chosen space U of dimension L NETWORK Equivalent to finding codes in the Grassmannian graph (q-johnson scheme) Injection of an error space E of dimension t Different modes of operation: ( )" dim( U Y) ñ = dim U! = dim( Y) " dim( Y U ) is the number of errors We can correct any number of errors and erasures as long as 2( ñ+t) < D t! is the number of erasures Output: basis vectors for a space Y