# Efficient Key Exchange Using Identity-Based Encryption in Multipath TCP Environment
## 2 Background Study
### Multipath TCP (MPTCP) and Its Security Threats
Various packet sniffing tools, such as scapy, wirshark, etc., can be used to sniff and forge the packet to initiate the various attacks. The prerequisite information such as packet sequence number, IP address, port, etc., to initiate the attack can be captured through these sniffing tools. After obtaining the IP-port pair and sequence number, one can initiate the ADD_ADDR attack by using the steps shown in Figure 7 [2]. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Attack** & **Category * & **Active/ Passive** & **References** & **Security Goals** **Impacted * & **Remarks** \\ \hline DoS attack on MP\_JOIN & F & Active & [34] & A & The legitimate users will not be able to create new subflows by sending fake SYN+MP\_JOIN requests, which will make the server busy; thus, the server will not be able to handle the requests of legitimate users. \\ \hline SYN Flooding attack & F & Active & [34] & A & By using the SYN packet, the server will be exhausted; thus, the client will not be served. \\ \hline Traffic diversion attack & F & Active & [36] & C, A & By cross-path inference, an attacker can monitor one of the subflows, and by using a forged MP\_PRIO packet, all the traffic can be redirected to the compromised subflow. \\ \hline Cross path inferences attack & F & Active & [37] & C, A & Attackers can infer the properties and sensitive information of an unmonitored path through side channels to create a negative impact on the design goals of MPTCP. \\ \hline SYN/JOIN attack & P & Active & [34] & C, I, A & If the attacker is on the path during the initial SYN/JOIN message exchange, the attacker will be able to add any of the addresses to establish a new subflow over the connection. \\ \hline Data Sequence signal manipulation & F & Active & [38] & A & The connection level ACK is manipulated on the top of the TCP optimistic ACKing, which will lead to a powerful attack scenario such as DoS, flood, etc. \\ \hline \end{tabular}  
* Category: O, on-path; F, off-path; P, partial-time-on-path.
* Security Goals: C, confidentiality; I, integrity; A, availability.  
\end{table} 
Table 2: _Cont._Here, [PERSON] and [PERSON] are the legitimate users who are communicating with each other through the connection established on IP-A and IP-B. [PERSON], an attacker, tries to add his address IP-C by impersonating the identity of [PERSON] using the ADD_ADDR packet. Now, [PERSON] will have the illusion that IP-C is the IP address, which is advertised by [PERSON]; thus, he sends a request using MP_JOIN to add another subflow on the connection. [PERSON] sends the forged packet to [PERSON] by changing the source IP, and [PERSON] has the illusion that the request is coming from [PERSON]; thus, she replies with her HMAC, which will be used by [PERSON] to authenticate herself as [PERSON], and again this packet is forged by [PERSON] and sent to [PERSON] and so on. After the four-way handshake, the new subflow will be established between [PERSON] and [PERSON]. Now, the actual situation and illusionary scenario is represented in Figure 8. [PERSON] can change the priority of the subflow by sending the MP_PRIO packet to hijack the whole session.