Mobile Adversary Research Articles

Resilient distributed optimization under mobile malicious attacks

This article addresses the distributed optimization problem in the presence of malicious adversaries that can move within the network and induce faulty behaviors in the attacked nodes. We first investigate the vulnerabilities of a consensus-based secure distributed optimization protocol under mobile adversaries. Then, a modified resilient distributed optimization algorithm is proposed. We develop conditions on the network structure for both complete and non-complete directed graph cases, under which the proposed algorithm guarantees that the estimates by regular nodes converge to the convex combination of the minimizers of their local functions. Simulations are carried out to verify the effectiveness of our approach.

Memory Offloading for Remote Attestation of Multi-Service IoT Devices.

Remote attestation (RA) is an effective malware detection mechanism that allows a trusted entity (Verifier) to detect a potentially compromised remote device (Prover). The recent research works are proposing advanced Control-Flow Attestation (CFA) protocols that are able to trace the Prover’s execution flow to detect runtime attacks. Nevertheless, several memory regions remain unattested, leaving the Prover vulnerable to data memory and mobile adversaries. Multi-service devices, whose integrity is also dependent on the integrity of any attached external peripheral devices, are particularly vulnerable to such attacks. This paper extends the state-of-the-art RA schemes by presenting ERAMO, a protocol that attests larger memory regions by adopting the memory offloading approach. We validate and evaluate ERAMO with a hardware proof-of-concept implementation using a TrustZone-capable LPC55S69 running two sensor nodes. We enhance the protocol by providing extensive memory analysis insights for multi-service devices, demonstrating that it is possible to analyze and attest the memory of the attached peripherals. Experiments confirm the feasibility and effectiveness of ERAMO in attesting dynamic memory regions.

Resilient Real-Valued Consensus in Spite of Mobile Malicious Agents on Directed Graphs

This article addresses novel real-valued consensus problems in the presence of malicious adversaries that can move within the network and induce faulty behaviors in the attacked agents. By adopting several mobile adversary models from the computer science literature, we develop protocols which can mitigate the influence of such malicious agents. The algorithms follow the class of mean subsequence reduced (MSR) algorithms, under which agents ignore the suspicious values received from neighbors during their state updates. Different from the static adversary models, even after the adversaries move away, the infected agents may remain faulty in their values, whose effects must be taken into account. We develop conditions on the network structures for both the complete and non-complete directed graph cases, under which the proposed algorithms are guaranteed to attain resilient consensus. The tolerance bound for network conditions becomes more strict as the adversaries are allowed to have more power. Extensive simulations are carried out over random graphs to verify the effectiveness of our approach when the information of the adversarial agents in terms of their models and numbers is unknown to the agents.

A Smart Cryptographic measure for Data Survivability in Unattended Wireless Sensor Networks

An Unattended Wireless Sensor Network (UWSN) wherein a sporadically visiting sink tries to collect data absorbed by the motes. This setup is most suitable in hostile environments where the collected valuable data becomes the target for a mobile adversary. Unattended sensors cannot instantly transmit collected data to some safe external entity. Though there is an intermittent visit by the sink, a powerful mobile adversary can easily compromise the valuable data collected by sensor nodes between the intervals. Therefore, the data needs to be preserved to be handed over to the sink in its next visit. This property of unattended WSN is called as Data Survivability. We propose a symmetric key cryptosystem that tackles sensor collected data erasure, modification, or disclosure as a support for data survivability in UWSNs. The proposed model has been designed using Linear Feedback Shift Registers (LFSRs) embodied with less power dissipation mechanism that operates on mask method. This is critical to any application running in unattended environments. We have compared our design with other standard works and have substantially proved the trustworthiness. Our work has been assessed using NIST test suite and found reliable.

Resilient Consensus against Mobile Malicious Agents

This paper addresses consensus problems in the presence of adversaries that can move within the network and induce faulty behaviors in the attacked agents. By employing mobile adversary models from the computer science literature, we develop three protocols which can mitigate the influence of malicious agents. The algorithms follow the class of mean subsequence reduced (MSR) algorithms, under which agents ignore the suspicious values received from neighbors during their state updates. Different from the static model, even after the adversaries move away, the infected agents may remain faulty in their values for a short while, which must be taken into account. We develop conditions on the network structures for both the complete and non-complete graph cases, under which the proposed algorithms are guaranteed to attain resilient consensus. An illustrative example is provided to verify the effectiveness of our approach.

A hybrid secure routing and monitoring mechanism in IoT-based wireless sensor networks

Internet of Things (IoT) has advanced its pervasiveness across the globe for the development of smart networks. It is aimed to deploy network edge that enables smart services and computation for the IoT devices. In addition, this deployment would not only improve the user experience but also provide service resiliency in case of any catastrophes. In IoT applications, the edge computing exploits distributed architecture and closeness of end-users to provide faster response and better quality of service. However, the security concern is majorly addressed to resist the vulnerability of attacks (VoA). Existing methodologies deal only with static wireless sensor web to deduce the intrusions in which the sensor nodes are deployed in a uniform manner to retain the constancy. Since the sensor nodes are constantly being in question through different transmission regions with several levels of velocities, selection of sensor monitoring nodes or guard nodes has become a challenging job in recent research. In addition, the adversaries are also moving from one location to another to explore its specific chores around the network. Thus, to provide flexible security, we propose a secure routing and monitoring protocol with multi-variant tuples using Two-Fish (TF) symmetric key approach to discover and prevent the adversaries in the global sensor network. The proposed approach is designed on the basis of the Authentication and Encryption Model (ATE). Using Eligibility Weight Function (EWF), the sensor guard nodes are selected and it is hidden with the help of complex symmetric key approach. A secure hybrid routing protocol is chosen to be built by inheriting the properties of both Multipath Optimized Link State Routing (OLSR) and Ad hoc On-Demand Multipath Distance Vector (AOMDV) protocols. The result of the proposed approach is shown that it has a high percentage of monitoring nodes in comparison with the existing routing schemes. Moreover, the proposed routing mechanism is resilient to multiple mobile adversaries; and hence it ensures multipath delivery.

Safe navigation in adversarial environments

This work deals with the problem of navigation while avoiding detection by a mobile adversary, featuring adversarial modeling. In this problem, an evading agent is placed on a graph, where one or more nodes are defined as safehouses. The agent’s goal is to find a path from its current location to a safehouse, while minimizing the probability of meeting a mobile adversarial agent at a node along its path (i.e., being captured). We examine several models of this problem, where each one has different assumptions on what the agents know about their opponent, all using a framework for computing node utility, introduced herein. Using risk attitudes for computing the utility values, their impact on the constructed strategies is analyzed both theoretically and empirically. Furthermore, we allow the agents to use information gained along their movement, in order to efficiently update their motion strategies on-the-fly. Theoretical and empirical analysis shows the importance of using this information and these on-the-fly strategy updates.

A Leakproof Secret Sharing Scheme Based on Environment Sensing

A leakproof secret sharing scheme based on environment sensing is proposed, in which the shadows of participants and the shared secret are leakproof, and can be used repeatedly. The counterfeit shadows of the participants and the authentication information of the shared secret can be changed dynamically basing on environment sensing. So the scheme is secure even against a mobile adversary. Besides, through introducing the concept of adversary structure and the transformation of access structure to adversary structure, the secret sharing on general access structure is realized. Compared to the existing schemes, our scheme is more secure and more flexible in practice. Our scheme is particularly suitable for the system which needs to run long time in the open, such as the wireless sensor network and the multi-robots, the property of leakproof based on environment sensing can improve the efficiency and security of these systems effectively.

Energy Efficient Finite Range Query Scheme for Detecting Mobile Adversary Replica Nodes in Wireless Sensor Networks

the growing demand in wireless sensor network (WSN), adversary attack on sensor node becomes major issue in current WSN deployment. The replica nodes which are generated by attackers receive the valuable information from the network in turn sends to the adversaries and at the same time transmits inappropriate message to the sink in the sensor networks. One of the existing works presented Sequential Probability Ratio Test (SPRT) which reduces the overhead of sensor node transmission on the adversary conditions. However, the sensor node's mobility affected the query range being invoked for detection of replica node location with probability ratio. The energy efficiency of the sensor node also needs to be monitored for effective adversary sensor node detection using SPRT. Our proposed work extends replica detection scheme of probability ratio test with Finite Range Query (FRQ) technique to effectively identify the mobile replica nodes (acting as adversary) and eliminate the varying query ranges of mobile sensor nodes. In addition energy efficiency of the sensor nodes are improved by minimizing the message query transmission on data aggregation.

Exploiting Context-Awareness to Enhance Source-Location Privacy in Wireless Sensor Networks

The source-location privacy problem in Wireless Sensor Networks has been traditionally tackled by the creation of random routes for every packet transmitted from the source nodes to the base station. These schemes provide a considerable protection level at a high cost in terms of message delivery time and energy consumption. This overhead is due to the fact that the data routing process is done in a blind way, without knowledge about the location of the attacker. In this work, we propose the Context-Aware Location Privacy (CALP) approach, which takes advantage of the ability of sensor nodes to perceive the presence of a mobile adversary in their vicinity in order to transmit data packets in a more energy-efficient and privacy-preserving manner. In particular, we apply the concepts of CALP to the development of a shortest-path CALP routing algorithm. A permissive and a strict version of the protocol are studied for different adversarial models and the proposed schemes are evaluated through simulation experiments in terms of privacy protection and energy consumption. Finally, we present the conclusions of the paper as well as possible extensions of this work.

Intrusion-resilient integrity in data-centric unattended WSNs

Unattended Wireless Sensor Networks (UWSNs) operate in autonomous or disconnected mode: sensed data is collected periodically by an itinerant sink. Between successive sink visits, sensor-collected data is subject to some unique vulnerabilities. In particular, while the network is unattended, a mobile adversary (capable of subverting up to a fraction of sensors at a time) can migrate between compromised sets of sensors and inject fraudulent data. In this paper, we provide two collaborative authentication techniques that allow an UWSN to maintain integrity and authenticity of sensor data–in the presence of a mobile adversary–until the next sink visit. Proposed schemes use simple, standard, and inexpensive symmetric cryptographic primitives, coupled with key evolution and few message exchanges. We study their security and effectiveness, both analytically and via simulations. We also assess their robustness and show how to achieve the desired trade-off between performance and security.

Unconditionally secure social secret sharing scheme

The authors introduce the notion of a ‘social secret sharing scheme’, in which shares are allocated based on a player's reputation and the way he/she interacts with other participants. During the social tuning phase, weights of players are adjusted such that participants who cooperate will end up with more shares than those who defect. Alternatively, newcomers are able to be enrolled in the scheme while corrupted players are disenrolled immediately. In other words, this scheme proactively renews shares at each cycle without changing the secret, and allows trusted participants to gain more authority. The motivation is that, in real-world applications, components of a secure scheme may have different levels of importance (i.e. the number of shares a player has) as well as reputation (i.e. cooperation with other players for the share renewal or secret recovery). Therefore a good construction should balance these two factors, respectively. In the proposed schemes, both the passive and active mobile adversaries are considered in an unconditionally secure setting.

Playing hide-and-seek with a focused mobile adversary in unattended wireless sensor networks

Some sensor network settings involve disconnected or unattended operation with periodic visits by a mobile sink. An unattended sensor network operating in a hostile environment can collect data that represents a high-value target for the adversary. Since an unattended sensor can not immediately off-load sensed data to a safe external entity (such as a sink), the adversary can easily mount a focused attack aiming to erase or modify target data. To maximize chances of data survival, sensors must collaboratively attempt to mislead the adversary and hide the location, the origin, and the contents of collected data. In this paper, we focus on applications of well-known security techniques to maximize chances of data survival in unattended sensor networks, where sensed data can not be off-loaded to a sink in real time. Our investigation yields some interesting insights and surprising results. The highlights of our work are: (1) thorough exploration of the data survival challenge, (2) exploration of the design space for possible solutions, (3) construction of several practical and effective techniques, and (4) their evaluation.

New adversary and new threats: security in unattended sensor networks

Some wireless sensor networks preclude the constant presence of a centralized data collection point, that is, a sink. In such a disconnected or unattended setting, nodes must accumulate sensed data until it can be off loaded to an itinerant sink. Furthermore, if the operating environment is hostile, there is a very real danger of node and data compromise. The unattended nature of the network makes it an attractive target for attacks that aim to learn, erase, or modify potentially valuable data collected and held by sensors. We argue that adversarial models and defense techniques in prior WSN literature about security are unsuitable for the unattended WSN setting. We define a new adversarial model by taking into account special features of the UWSN environment. We show that in the presence of a powerful mobile adversary, securing data stored on unattended sensors presents interesting challenges and opens an exciting new line of research.

Perfectly reliable and secure message transmission tolerating mobile adversary

We study the problem of perfectly reliable message transmission (PRMT) and perfectly secure message transmission (PSMT) in an undirected synchronous network tolerating an all powerful threshold mobile Byzantine adversary. Specifically, we show that the mobility of the threshold adversary does not affect the possibility and optimality of PRMT and PSMT protocols. We also characterise PSMT in directed networks tolerating mobile adversary. All existing PRMT and PSMT protocols abstract the paths between the sender and the receiver as wires, neglecting the intermediate nodes in the paths, thus causing significant over estimation in the communication and round complexity of protocols. Here, we consider the underlying paths as a whole instead of abstracting them as wires and derive a tight bound on the number of rounds required to achieve reliable communication tolerating a threshold mobile adversary with arbitrary roaming speed. Finally, we briefly study PRMT and PSMT protocols in the presence of non-threshold mobile Byzantine adversary. Even though the characterisation for PRMT/PSMT is shown to be same against both threshold static and threshold mobile adversary (in this article), we show that the characterisation for PRMT/PSMT against non-threshold static and non-threshold mobile adversary are not same.

Publicly Verifiable Secret Sharing Member-join Protocol For Threshold Signatures

Publicly verifiable secret sharing (PVSS) allows not only shareholders themselves but also everyone verify the shares of a secret distributed by a dealer. It has a lot of electronic applications. In this paper, we propose a publicly verifiable member-join protocol for threshold signatures. In our proposal, a new member can join a PVSS scheme to share the secret only with the help of old shareholders. What’s more, everyone besides the new member can verify the validity of the new member’s share, while only the new member knows his share. Different from previous protocols, our protocol can tolerate a mobile adversary. This proposal adapts to many electronic applications. Finally, we analyze the security of our scheme.

이동 사용자를 위한 분산 보안 메일 시스템

본 논문에서는 매일 사용자의 오버헤드를 최소화하고 TTP(Trusted Third Party)의 기밀성을 분산시킨 새로운 Certified E-mail System을 제안한다. 제안 시스템은 전달 메시지의 공정성 및 기밀성 보장을 위하여 전통적인 암호기법과 함께 서버 지원된 서명 기법을 사용함으로써, 매일 사용자의 공개키 암호 알고리즘 연산에 따른 오버해드를 최소화하는 구조를 가진다. 따라서, 제안 방안은 셀룰러 폰이나 무선 PDA와 같은 컴퓨팅 파워가 취약한 이동 장치를 이용하는 매일 사용자에 적합하다. 또한, 제안된 시스템은 임계 암호시스쳄에 기반하여 설계되었으므로 이동 공격자에 대하여 강겅하며 공모 공격으로부터 안전하다. In this paper, we propose a new certified e-mail system which reduces user's computational overhead and distributes confidentiality of TTP(Trusted Third Partty). Based on the traditional cryptographic schemes and server-supported signiture for fairness and confidentiality of message, we intend to minimize to computation overhead of mobile device on public key algorithm. Therefore, our proposal becomes to be suitable for mail user sho uses mobile devices such as cellular phone and PDA. Moreover, the proposed system is fault-tolerant, secure against mobile adversary and conspiracy attack, since it is based on the threshold cryptography on server-side.

COCA

COCA is a fault-tolerant and secure online certification authority that has been built and deployed both in a local area network and in the Internet. Extremely weak assumptions characterize environments in which COCA's protocols execute correctly: no assumption is made about execution speed and message delivery delays; channels are expected to exhibit only intermittent reliability; and with 3t+ 1 COCA servers up totmay be faulty or compromised. COCA is the first system to integrate a Byzantine quorum system (used to achieve availability) with proactive recovery (used to defend against mobile adversaries which attack, compromise, and control one replica for a limited period of time before moving on to another). In addition to tackling problems associated with combining fault-tolerance and security, new proactive recovery protocols had to be developed. Experimental results give a quantitative evaluation for the cost and effectiveness of the protocols.

Adaptively secure distributed public-key systems

When attacking a distributed protocol, an adaptive adversary is able to determine its actions (e.g., which parties to corrupt) at any time based on its entire view of the protocol including the entire communication history. Proving security of cryptographic protocols against adaptive adversaries is a fundamental problem in cryptography. In this paper, we consider distributed public-key systems which are secure against an adaptive adversary. Specifically, we construct distributed discrete-log-based and RSA-based public-key systems secure against an adaptive adversary. We also extend the discrete-log-based systems to have proactive security, that is, security against an (adaptive) mobile adversary that has an upper bound on the number of servers it may corrupt at any one time, but no upper bound on the number of servers it may corrupt over the lifetime of the system.