Multicast Security

1. Multicast Security Cryptographic Protocols InKwan Yu

2. Multicast Security Issues • Multicast • What is it? • An efficient way to communicate between 1-to-n or m-to-n hosts • Applications • Audio/video streaming, conferencing, multi-player gaming, stock quotes distribution, command and control communication, and much more. • Features • Open access to receive data • Open membership • Open access to send data in a multicast group

3. Multicast Security Issues • Multicast Security Issues • Receiver Access Control • Group policy specification functions • Authentication & authorization /w public key cryptography • Source Authentication • Digital signature, MAC

4. Multicast Security Issues • Multicast Security Issues (Cont) • Multicast Fingerprint • Watermarking is embedding copyright information in the contents • Fingerprint is a watermarking for a specific user • Desirable features of fingerprint • non-removable, collusion resistance, asymmetric fingerprinting, protection granularity, efficiency

5. Multicast Security Issues • Multicast Security Issues (Cont) • Multicast Fingerprint (Cont) • Methods • Intermediate routers can cooperate with the sender to create a unique stream to each member • Sender may multicast the most of data and unicast some of unique data to each member • Two different streams can uniquely arbitrate for a different user

6. Multicast Security Issues • Multicast Security Issues (Cont) • Group Key Management • Shared group key to encrypt the multicast data • Rekey • Core functionality for the multicast security • Group Key Management Issues • Member identification and authentication between GCKS (Group Controller/Key Server) and members • Access control to validate the join operation • Generation, distribution and installation of key materials. Keys should be regularly changed and key generation should be independent of past and future keys

7. Multicast Security Issues • Group Key Management Issues(Cont) • Forward secrecy to prevent a leaving group member to access the group communication. • Backward secrecy to prevent a joining group member to decipher previous messages before its join. • Storage requirements. The number of keys necessary to operate the system • Size of messages. The message size needed to rekey. • Collusion. Members of the group can cooperate to compromise the system security • Key independence, decentralized controller, local rekey, number of rounds, number of messages

8. Multicast Security Issues • Issues & Solutions multicast All receive data Open group Membership Outside member sends data Properties Open access to distributed content No individualization of received data Open access to send data to group Security issues Denial of service Eavesdropping No theft deterrence Denial of service Masquerading Security vulnerabilities Multicast receiver access control Group key management Multicast fingerprinting Multicast source access control Multicast source authentication Security solutions

9. Multicast Security Architecture • Reference • RFC 3740 • What’s in it • Overview and rationale of multicast security architecture • Reference frameworks of secure multicast protocols

10. Multicast Security Architecture • GSA (Group Security Association) • SA (Security Association) • Necessary shared information between two parties for a secure comm. • Selectors (destination transport address) • Properties (algorithms, modes, key lifetimes, key lengths) • Keys for authentication, encryption and signing

11. Multicast Security Architecture • GSA (Cont) • Def. of GSA • Aggregate of Sas • REG SA • Unicast SA that a group member uses to pull GSA information from Group Controller/Key Server (GCKS) • REKEY SA • SA used for rekeying • DATA SA • Shared by among the group members • Superset of SAs • Includes Attributes of SA

12. Multicast Security Architecture • GSA (Cont) GCKS REG REKEY REG REG REKEY Sender DATA REG REKEY Receiver DATA

13. Multicast Security Architecture • Centralized Multicast Security Reference Framework Multicast Security Policies Policy Sever Group Key Management Group Controller/ Key Server Receiver Multicast Data Handling Sender

14. Multicast Security Architecture • Distributed Multicast Security Reference Framework Policy Sever Policy Sever Multicast Security Policies Group Controller/ Key Server Group Controller/ Key Server Group Key Management Receiver Sender Receiver Multicast Data Handling

15. Multicast Security Architecture • Hierarchically-organized Decentralized Key Distribution GCKS Member Member Member . . . . Sub GCKS Sub GCKS Sub GCKS . . . . Member Member Member . . . .

16. Group Key Management Protocol • Reference • RFC 2093 and RFC 2094 • Features • Public key algorithm for authentication certificates • Pairwise key exchange • Member compromise can be solved only by creating a new group • GTEK(Group Traffic Encryption Key) for data • GKEK(Group Key Encryption Key) for the group key

17. Group Key Management Protocol • Group Key Generation C O N T R O L L E R M E M B E R Create Group Keys 1 (rand #) Create Group Keys 2 (# for GTEK, GKEK) Negotiate Group Keys 1 (GTEK, GKEK, permission,group id, group member, rekey interval,CRL (compromise recovery list) Negotiate Group Keys 2

18. Group Key Management Protocol • Group Key Distribution C O N T R O L L E R M E M B E R Create Session Keys 1 (rand #) Create Session Keys 2 (# for SKEK) Negotiate Session Keys 1 (SKEK, permission, group id, members) Negotiate Session Keys 2 Download Group Keys(GTEK, GKEK, group id, group permission, rekey interval) Key Download Acknowledge

19. Group Key Management Protocol • Rekey C O N T R O L L E R M E M B E R Create Group Keys 1 Create Group Keys 2 Negotiate Session Keys 1 Negotiate Session Keys 2 Rekey_Multicast

20. Group Key Management Protocol • Join C O N T R O L L E R M E M B E R Request Group Join Create Session Keys 1 Create Session Keys 2 Negotiate Session Keys 1 Negotiate Session Keys 2 Download Group Keys Key Download Acknowledge

21. Tree Based Multicast Group Key Management • Reference • RFC 2627 • Features • The secure removal of a compromised user from the multicast group • Transmission efficiency • Storage efficiency • Net key is a root key used as DEK

22. Tree Based Multicast Group Key Management • Initialization • Pair wise KEKs with each user by the public key exchange protocol • Key for each node is generated • From the parents of leaf nodes up to the root, the server transmits the key for each node encrypted with the keys of each of the node’s children • Each leaf has all keys on the path to the root

23. Tree Based Multicast Group Key Management • Member Deletion • Ex) When the user 11 is deleted • New key for F is encrypted with the user 12’s KEK and sent • New key for K is encrypted with the new key for F and sent. New key for K is encrypted with the new key for E and sent for the users 9 and 10 • New key for N is encrypted with keys of K and L, etc. until a new root key(DEK) is distributed.

24. Tree Based Multicast Group Key Management • Logical Key Distribution Architecture net key Key O intermediate keys Key M Key N Key I Key J Key K Key L Key A Key B Key C Key D Key E Key F Key G Key H 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 users

25. Centralized Flat Key Distribution • Architecture • Each member has a fixed length id • Each bit of id is assigned to a different KEK. • Each member is assigned a set of unique KEKs according to the id bit values

26. Centralized Flat Key Distribution • Flat ID Assignment (e.g 0110) Bit 0 Bit 1 Bit 2 Bit 3 Bit value 0 Bit value 1

27. Centralized Flat Key Distribution • Join • Assign KEKs from the KEK space • Leave • KEKs related to the deleted member’s id bits are assigned new KEKs. And new TEK is generated • New KEKs are encrypted with the new TEK and the old KEK of that bit. KEKs related to bits not used by the deleted member is used to encrypt the new TEK

28. Centralized Flat Key Distribution • KEK for Member 0110 Deletion

29. Scalable Multicast Key Distribution • Reference • RFC 1949 • CBT (Core Based Tree Multicast Routing) • RFC 2201 • IP layer protocol • CBT protocol creates a hard state routing tree among a multicast group. The multicast data follow the fixed multicast tree structure • Tree branch is formed when there is at least one member join from a subtree • In SMKD, the primary core of CBT establishes the security parameters used in the multicast

30. Scalable Multicast Key Distribution • Scalability • With enough information including keys and ACL (group access control list), each router can distribute the group key (DEK) and KEK • This operation is dependent on the structure of CBT tree

31. Scalable Multicast Key Distribution • Multicast Key Distribution using CBT router router router router router router router router router Core B router router A A, B, router are non-core routers Host h

32. Scalable Multicast Key Distribution • Example Protocol

33. Dual Encryption Protocol • Architecture • Top level nodes may have different KEKs • Using several KEKs may extend the key lifetime • Each subgroup has a subgroup key • Participating group manager will not be given a KEK. Only members have KEK. • CC (Capability Certificates) are issued by a higher authority • AC (Access Capability) is used to prevent multiple join • DEK is encrypted with the KEK and the subgroup key

34. Dual Encryption Protocol • Key Distribution Tree S Top level sender Key group 1 p1 g1 h1 p2 g2 h2 h3 h4 h5 h6 h7 h5 h6 h7 gi pi hi member participant host

35. Dual Encryption Protocol • Join

36. Dual Encryption Protocol • Leave • The group manager multicast a message containing a new subgroup key encrypted with the rest of group member’s public keys • To decrypt the DEK, KEK and subgroup key are necessary. Since the leaving member just has KEK and the old subgroup key, it cannot access the multicast data afterwards ensuring the forward secrecy.

37. Diffie-Hellman Group Key Distribution • 3 Protocols are proposed • No group controller. All members should cooperate to generate a group key

38. Diffie-Hellman Group Key Distribution • Version 1

39. Diffie-Hellman • Version 1 Example

40. Diffie-Hellman Group Key Distribution • Version 2

41. Diffie-Hellman • Version 2 Example

42. Diffie-Hellman Group Key Distribution • Version 3

43. Diffie-Hellman Group Key Distribution • Join for version 2

44. Diffie-Hellman Group Key Distribution • Delete for version 2

45. Reference • [1] Paul Judge and Mostafa Ammar, Security Issues and Solutions in Multicast Content Distribution: A Survey, IEEE Network, Jan/Feb 2003. • [2] T. Hardjono and B Weis, RFC 3740, IETF, 2004 • [3] SanFord Rafaeli and David Hutchison, A Survey of Key Management for Secure Group Communication, ACM Computing Survey, Vol 35, No. 3, Sept., 2003. • [4] Lakshminath R. Dondeti, Sarit Mukherjee and Ashok Samal, Survey and Comparison of Secure Group Communication Protocols, Technical Report, University of Nebraska-Lincoln, June 1999. • [5] Thoams Hardjono and Gene Tsudik, IP Multicast Security: Issues and Directions, Annales de Telecom, 2000.

46. Reference • [6] R. Canetti, J. Garay, G. Itkis, D. Micciancio, M. Naor, and B. Pinkas, Multicast Security: A Taxonomy and Efficient Constructions. IEEE Infocom, NY, USA, March 1999. • [7] A. Eskicioglu, Multimedia security in group communications: recent progress in key management, authentication, and watermarking. ACM Multimedia Systems Journal, Special Issue on Multimedia Security, September 2003. • [8] H. Harney, C. Muckenhirn, Group Key Management Protocol (GKMP) Specification, RFC 2093, 1997. • [9] H. Harney, C. Muckenhirn, Group Key Management Protocol (GKMP) Architecture, 2094, 1997. • [10] A. Ballardie, Scalable Multicast Key Distribution, RFC 1949, 1996

47. Reference • [11] D. Wallner, E. Harder and R. Agee, Key Management for Multicast: Isssues and Architectures, RFC 2627, 1999. • [12] Lakshminath R. Dondeti and Sarit Mukherjee, A Dual Encryption Protocol for Scalable Secure Multicasting, IEEE ISCC, 1999 • [13] Michael Steiner, Gene Tsudik and Michael Waidner, Diffie-Hellman Key Distribution Extended to Group Communication, ACM CCS, 1996. • [14]Marcel Waldvogel, GErmano Caronni, Dan Sun, Nathalie Weiler and Berhard Plattner, The VersaKey FrameWork: Versatile Group Key Management, IEEE Journal on Selected Areas in Communications, 1999.