Service Assurance in Insecure Networks with Byzantine Adversaries

SERVICE ASSURANCE IN INSECURE NETWORKS WITH BYZANTINE ADVERSARIES Paul Rabinovich, PhD George Mason University, 2008 Dissertation Director: Dr. Robert Simon This dissertation describes research into security threats in new communication environments and methods to counter them. More specifically, we consider networks where some nodes perform an important application function such as routing, filtering, aggregation, etc., and may become compromised while doing so. We consider three types of networks: Internet-scale publish/subscribe networks, aggregating sensor networks, and peer-to-peer massively multiplayer online games (MMOG) and virtual environments. These environments are complementary to each other in many respects. A publish/subscribe network is responsible for disseminating data objects produced by one set of nodes (publishers) to another set of nodes (subscribers). Subscribers want to receive those and only those objects that satisfy their interests. A large-scale publish/subscribe network using many network providers, each under its own administrative control, presents numerous opportunities for mischief. In many cases the network providers will not trust one another and will not be fully trusted by the end users. A malicious network provider may insert, delete, modify, reorder, misdirect, or delay messages, and remain undetected. The first topic of our research is how to assure service integrity in such networks if some of the intermediate nodes may attack the system in an arbitrary fashion. We solve the problem by creating filtering agents corresponding to user subscriptions, and mapping these agents to either hosts from trusted providers or to clusters of hosts taken from multiple non-trusted providers. As a whole, each cluster can be trusted since only a relatively small number of providers are assumed to be malicious. A sensor network is a network connecting hundreds or thousands of sensors, tiny batterypowered computers equipped with units measuring some physical phenomena (e.g., light intensity, temperature, humidity, ambient chemical composition, etc.) and wireless radio transceivers. We study aggregating sensor networks that do not fully propagate raw measurements to their users but rather perform in-network aggregation with the intent of lowering the total amount of transmitted data thus preserving bandwidth and energy. As sensor networks are frequently placed in hostile environments (for instance, in military applications) it is important to devise mechanisms guaranteeing integrity of their service under attack, and their survivability. In this dissertation we discuss CoDeX, a collect-detectexclude framework for secure aggregation in sensor networks. Our approach to solving the problem is based on the fact that many physical phenomena exhibit strong spatial correlation. Sensor nodes can take advantage of the broadcast nature of radio transmissions, receive measurements from their neighbors, and compare them with their own results. If the values significantly differ, the fact can be reported to the user (the ”collect” phase). If a node is a subject of many such reports, it is, probably, compromised (the ”detect” phase) and should be removed from the network (the ”exclude” phase). We complement this approach with the use of randomized delivery (aggregation) trees, cryptography, and repeated aggregation of the same data in different configurations. Peer-to-peer massively multiplayer online games and virtual environments pose challenges similar to those in the other two types of networks: all three lack centralized control and run autonomously. Like pub-sub networks, P2P-based MMOGs may span the Internet and contain thousands and, potentially, hunderds of thousands of nodes. Like sensor networks, these systems almost completely rely on end nodes for providing infrastructure services. Unfortunately, most games do not provide sufficient safeguards against cheating and fraud perpetrated by the players. We developed FRAPPE, an architecture that significantly reduces this vulnerability by forming trusted ”supernodes” out of non-trusted peer machines, employing authentication, confidentiality and pseudonymity services, using secret sharing and other secure multiparty computation techniques, and constructing anonymizing tunnels to hide identities of communicating parties. We also introduce a useful primitive, called local broadcast with verification (LBV), used to solicit services of peers in a particular neighborhood and subsequently verify that the peers properly executed the protocol. Using a combination of analysis and experimental results we demonstrate that all three approaches provide strong service assurance guarantees for their respective types of networks. Chapter 1: Introduction Rudimentary computer networks appeared in the 1950s; they connected remote terminals, printers and remote job entry points to shared central computers [1]. As peripheral devices became widespread and varied, connecting each individual device to the central machine ceased to be economical: specialized networking hardware, such as concentrators (to batch traffic from and to a set of related units) and front-end processors (to offload the task of managing the network), was introduced. Creation of the Arpanet, the first packet-switched network (1969), invention and implementation of TCP/IP (1977), adoption of TCP/IP as the Arpanet’s protocol stack (1982), and introduction of links to other parts of the world and other North American networks led to the creation of the Internet, a world-wide network of millions of computers that supports e-mail, instant messaging, file and news transfer, the Web, voice communications, and other applications [2]. Concurrent advances in design and manufacturing of microprocessors resulted in many new ever more compact computer-like devices (personal computers, laptops, tablet PCs, personal digital assistants, cellular phones, smart phones, sensors, etc.) capable of simultaneously processing data and communicating. Communication networks can be categorized into many taxonomies. One categorization may be based on the communication medium, whether it is wired or wireless. Networks may also be characterized by scale: there are wide-area networks, metropolitan-area networks, short range networks, and local area networks. Networks may provide varied quality of service, for example, in terms of reliability. Most modern networks can provide both reliable and unreliable service and only differ in how such services are implemented and made