Body Sensor Network Security.ppt

bodysensornetworksecurity anidentity basedcryptographyapproach chiuc tan haodongwang shengzhong qunlimarch31 april2 2008 alexandria virginia usa outlines introduction 1 oursolution 2 securityanalysis 3 conclusion 4 1 introduction applyingwirelesssensorstowardhealthcaremonitoringallowsfornewwaystoprovidequalityhealthcaretopatients abodysensornetwork orbsn isanetworkofsensorsdeployedonaperson sbodytocollectphysiologicalinformation inthispaper wefocusonabsndeployedformedicalmonitoring thedatacollectedbythebsniseitherstoredonthesensors orforwardedandarchivedonpubliclyaccessiblesiteknownasthestoragesite 1 1motivatingexampleprivacyandsecurityforabsnisimportantsincethedatacollectedisdirectlyassociatedwithaparticularpatient atthesametime thedatamustbeeasilyaccessibletorelevantpersonalintheeventofanemergency 1 2bsnsecurityrequirementswhileacompletebsnsystemwillhavemanydifferentcomponents acrucialfactoristhatanysecuritydesignmustbelightweightenoughtobeexecutedbyasensorinabsnsinceasensorcanbelostorstolen leavingthedatastoredwithinthesensorexposed thefollowingaresecurityandprivacyrequirementsforabsn protectpatientprivacyfromthestoragesite toleratecompromisedbsnsensors preventunauthorizedaccesstoinformation flexibilityingrantingpermissions protectpatientprivacyfromthestoragesite weassumeanhonest but curiousstoragesitethatwillnotmaliciouslydeletethedata butmayattempttolearnthecontentsofapatient sdata toleratecompromisedbsnsensors thebsnsensorsmaybemisplacedorstolen andacompromisedbsnsensorshouldnotallowanadversaryfromobtainingthepatient sdata preventunauthorizedaccesstoinformation weassumethatadoctormayattempttoobtainadditionaldataaboutapatientbeyondwhatwasauthorized sincestoragesiteisnottrusted accesscontrolcanonlybeperformedbytheca flexibilityingrantingpermissions thepatientmaydecidetoallowdifferentpeopletoaccessthebsndata andthebsnshouldbeabletogeneratekeyson the flywithoutadditionalinteractionwiththeca 1 3identity basedencryptionoursolutionsarebasedonatypeofcryptographicprimitiveknownasidentity basedencryption ibe afteraninitialsetupphase ibeallowsapublickeytobegeneratedfromanarbitrarystring thecorrespondingsecretkeycanbederivedseparatelybyatrustedparty 1 4ourcontributionsinthispaper wedesignprotocolsbasedonidentity basedencryption ibe thatprovidesecurityandprivacyprotectionstoabodysensornetwork whileallowingflexibleaccesstostoreddata weproposeibe lite alightweightibeschemethatissuitableforsensors whileibeschemeshavebeensuggestedbypreviousresearcherstoprotectmedicaldata wearethefirsttopresentalightweightibesuitableforbodysensornetworks 2 oursolution ibe liesharestwopropertieswithconventionalibe namelytheabilitytouseanarbitrarystringtogenerateapublickey andtheabilitytogenerateapublickeyseparatelyfromthecorrespondingsecretkey webeginbyfirstreviewingellipticcurvecryptography ecc apublickeyprimitivesuitableforbsn 17 followedbythemodificationsmadetoderiveibe lite finally wepresentourprotocolsbasedonibe lite 2 1basiceccprimitivestosetupecc wefirstselectaparticularellipticcurveeovergf p wherepisabigprimenumber wealsodenotepasthebasepointofeandqastheorderofp whereqisalsoabigprime wethenpickasecretkeyx andthecorrespondingpublickeyy wherey x p andacryptographichashfunctionh finally wehavethesecretkeyxandpublicparameters y p p q h wedenoteencryptingamessagemusingpublickeyyaseccencrypt m y theresultingciphertextisdenotedbyc thedecryptionofciphertextcusingthesecretkeyxisgivenaseccdecrypt c x 2 2ibe litefromthebasiceccprimitives wederivethefollowingibe liteprimitives setup keygen encryptanddecrypt theintuitionbehindistoletasensorindependentlygenerateapublickeyon the flyusinganarbitrarystring forexample asensorcollectingekgreadingsonmonday1pmwillfirstcreateastringstr monday 1pm ekg usingthisstring thesensorcanderiveapublickey ystrtoencryptthedataandsendittothestoragesite thereisnocorrespondingsecretkeycreated infact thesensorcannotcreatethesecretkeyneededtodecryptthemessage whenthepatientwishestoreleasethisinformationtoadoctor thepatientcanderivethecorrespondingsecretkey xstr byusingthesamestringstr monday 1pm ekg thissecretkeyonlyallowsthedoctortodecryptmessagesencryptedbyasensorusingthesamestring thissimplifiesthekeymanagement sincethepatientcangeneratethesecretkeyon demandwithoutkeepingtrackofwhichkeyswereusedtoencryptwhichdata theonlyrequirementisthatthestringusedtodescribetheeventisthesame setup weselectanellipticcurveeovergf p wherepisabigprimenumber wealsodenotepasthebasepointofeandqastheorderofp whereqisalsoabigprime asetofnsecretkeysx1 xn gf q ischosentogeneratethemastersecretkey x x1 xn thenpublickeysarethengeneratedtomakeupthemasterpublickey y y1 yn whereyi xi p 1 i n finally acollisionresistantone wayhashfunctionischosen theparameters y p p q h arereleasedasthesystempublicparameters keygen toderiveasecretkeyxstrcorrespondingtoapublickeygeneratedbyastringstr thepatientexecuteskeygen str xstr wherehi str isthei thbitofh str encrypt toencryptamessagemusingapublickeyderivedfromstringstr thesensordoesencrypt m str todeterminetheciphertextc alg 3showstheprocess notethatalg 3lines1and2needonlyberunoncetoderivethepublickeyystr decrypt thedoctorexecutesdecrypt c xstr toobtaintheoriginalmessagemwhichwasencryptedusingasecretkeyderivedfromstr theprocessisshowninalg 4 2 3bsnsecurityprotocolswedescribetheinitializationphasewherethepatientconfiguresthebsndatacollectionphasewhichoutlineshowasensorencryptsthecollecteddata datatransferphasedescribeshowabsntransfersdatatoastoragesite queryphasewhichoccurswhenadoctorneedstoobtaindatafromthestoragesite thepatientdecidingtocollectdataonahourlybasiswillsetthesensorsinthebsntoaffixatimestamproundedtothenearesthourwhencreatingstr ex twoekgreadingscollectedonmondayat1 05pmand1 20pmwillbothbedescribedusingthesamestringstr monday 1pm ekg initialization thepatientfirstexecutessetuptoobtainthemastersecretkeyx x1 xn andpublicparameters y p p q h thepatientloadstheparameters y p p q h intoeverysensorinthebsn thepatientthenregistersthemastersecretkeytogetherwithadditionalinstructionswiththeca datacollection letthesensorcollectdatadateventstr thesensorexecutesalg 5toencryptitsdata thetuple c1 c2 isthenstoredinsensormemory theflagisacommonlyknownbitstringseveralbitslong datatransfer periodically eachsensorinthebsnwilltransferitsdatatothestoragesite thisisdonebyfirstaggregatingallthedataintoacellphonelikedevice 27 thecellphonethenforwardstheaggregateddatatothestoragesite assumingthattherearektuplesgeneratedbythebsn thecellphonewillforwardtheset alternatively asensorwithenoughstoragecapacitycanopttostorethedatawithinthesensoritself inthiscase thereisnodatatransferprocess querying adoctorwishingtoobtaindatacollectedundersomestrwillfirstcontactthecaforpermission afterthecaagrees thecawillrunkeygen str toderivethecorrespondingsecretkeyxstrneededtodecryptdata thedoctorthencontactsthestoragesiteandretrievesthedataasshowninalg 6 whenthedataisstoredwithinthesensor theroleofthestoragesitewillbeexecutedbythesensor sinceallthedataisencrypted thestoragesitecannotreturnaspecificencryptedtupletothedoctor instead thestoragesitesimplyletsthedoctortrytodecrypteachtuple c1 c2 belongingtothepatient thereasonforreturningc1tothedoctorfirstinsteadofreturningc2directlyistoimproveefficiency sincethelengthofc1ismuchshorterthanc2 lettingthedoctorfirstattempttodecryptc1beforesendingthemuchlongerc2reducestransmissiontime thedoctorcancheckifthedataobtainedfromthestoragesitebelongstohispatientbycheckingwhetherthesamerandomnumbernisusedinbothc1andc2 sincethisrandomnisknownonlytothesensorencryptingthedata onlythatsensorcanembedthesameninbothc1andc2 3 securityanalysis webeginbyexaminingthebasicprimitives followedbyananalysisoftheprotocolsthemselves 3 1analysisofbasicprimitivesoursetupissimilartothatofthebasiceccsetupscheme exceptthatinsteadofpickingasinglesecretx oursetuppicksnsecretsandncorrespondingpublickeys knowingonlyonexstrandh str thedoctorcannotdeterminethepatient smastersecretxsincetherearenunknownxi theuseofxstrandystrastheprivatekeyandpublickeyderivedfromstringstrdoesnotviolatethediscretelogarithmpropertyofeccwhere givenay x p itisinfeasibletodeterminexgivenyandp sincebotharesimplytheresultofadditionofpoints also bothencryptanddecryptaresecuresincebothrelyonwellestablishedeccencryptionanddecryptionmethods 3 2analysisofprotocolsourprotocolsprotectstheprivacyofthepatient sdatabyencryptingalltheinformationbeforeforwardingthedatatothestoragesite afterasensorcollectsthedata thesensorencryptsthedatausingencrypt resultinginthetuple c1 c2 thestoragesitereceivesanaggregatedsetoftuples theprotocolsalsopreventunauthorizedaccesstothepatient sdata eachpieceofdatacollectedbyasensorisencryptedwithaystr thepublickeyderivedfromthestringstr whenthedoctorreceivespermissionstoaccessdataencryptedunderstr thedoctorreceivesthesecretkeyxstr whichcannotbeusedtodecryptanyotherciphertextnotencryptedusingystr acompromisedsensordoesnotallowtheadversarytoobtainanyusefuldataaboutapatientfromthestoragesitesincethesensoronlystoresthepubliclyknownparameters atmosttheadversaryobtainstheciphertextpair c1 c2 theadversarycantrytolaunchamatchingattackbyfirstcreatingmanypublickeysusingdifferentstringsstr theadversarythenencryptsallpossiblevaluesusingthedifferentpublickeystodeterminewhetherthereisamatchforthetuple c1 c2 thisispossiblesincethenumberofpotentialekgreadingsforexamplearebounded however bothc1andc2containsarandomnumberngeneratedbythesensor sincetheadversarycannotpredictthevalueofn thematchingattackfails finally ourprotocolsprovideflexibility thestringstrcanbeusedtospecifyaccesstothedata withoutusingadditionalcertificates forinstance considerthestringstr date er d