Leap-Frog Packet Linking and Diverse Key Distributions for Improved Integrity in Network Broadcasts

Authors:
Michael T. Goodrich
Affiliations:
University of California, Irvine
Venue:
SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Year:
2005

Citing 0
Cited 4

On identifying malicious nodes in ad hoc networks

IWCMC '07 Proceedings of the 2007 international conference on Wireless communications and mobile computing
Using Identity-Based Privacy-Protected Access Control Filter (IPACF) to against denial of service attacks and protect user privacy

SpringSim '07 Proceedings of the 2007 spring simulation multiconference - Volume 3
Modelling and simulations for Identity-Based Privacy-Protected Access Control Filter (IPACF) capability to resist massive denial of service attacks

International Journal of Information and Computer Security
Routing with Byzantine robustness

Routing with Byzantine robustness

Quantified Score

Hi-index	0.03

Visualization

Abstract

We present two new approaches to improving the integrity of network broadcasts and multicasts with low storage and computation overhead. The first approach is a leapfrog linking protocol for securing the integrity of packets as they traverse a network during a broadcast, such as in the setup phase for link-state routing. This technique allows each router to gain confidence about the integrity of a packet before passing it on to the next router; hence, allows many integrity violations to be stopped immediately in their tracks. The second approach is a novel key predistribution scheme that we use in conjunction with a small number of hashed message authentication codes (HMACs), which allows end-to-end integrity checking as well as improved hop-by-hop integrity checking. Our schemes are suited to environments, such as in ad hoc and overlay networks, where routers can share only a small number of symmetric keys. Moreover, our protocols do not use encryption (which, of course, can be added as an optional security enhancement). Instead, security is based strictly on the use of one-way hash functions; hence, our algorithms are considerably faster than those based on traditional public-key signature schemes. This improvement in speed comes with only modest reductions in the security for broadcasting, as our schemes can tolerate small numbers of malicious routers, provided they donýt form significant cooperating coalitions.