Distillation Codes for DoS-Resistant Multicast Authentication

1. CSC 774 Advanced Network Security Distillation Codes and Applications to DoS Resistant Multicast Authentication Presented by: Divya Gupta 3rd Nov, 2005

2. Roadmap • Background & Preliminaries • Erasure Codes • Distillation Codes • PRABS (Pollution Resistant Authenticated Block Stream) • Conclusion

3. Background r r r S r r r r • Single sender • Continuous data flow • Many receivers • Lossy Channels • Malicious nodes

4. Possible Authentication Techniques • Sign every packet • Large overheads • TESLA • Time synchronization is an overhead • Signature amortization • Single signature for multiple packets • Hash graphs • Wong-Lam scheme • Erasure codes • Finally, distillation codes • How to reliably transmit the signature?

5. Erasure Codes (n, t) Erasure code: (5, 1) shown as example Encoder Decoder Data Transmit r3 r1 r4 r2 s3 s1 s4 s5 s2 (1 symbol lost) Redundant encoding (n symbols) Data Loss-tolerant Decoding & Validation (from n-t symbols)

6. Problems • Symbols might get lost in transit • Symbols might get corrupted in transit • Attacker can introduce invalid symbols in the stream (Polluted Erasure Channel) • Recovery would involve removing known duplicates that are not required • Try all possible combinations of the symbols • There can be too many to try!

7. Problems (cont) Example: Received Symbols: {r1, r2, b2, b3, r4, b4, r5} Combinations to decode and validate: {r1, r2, b3, b4} {r1, b2, b3, r4} {r1, r2, b4, r5} {r1, b2, r4, r5} … Worst case: 2n-t candidates!

8. Distillation Codes • Erasure code, with ability to handle pollution • Solution • Partition received symbols into different sets • Validate all symbols belonging to a single set • Avoids trying out all the combinations • Accumulator functions for set membership Accumulate (S) → a Witness (s, S) → w Verify (s, w, a) → b (b is a boolean) Recover (s, w) → a

9. Distillation Codes (cont) • Distillation Encode • Construct an (n,t) erasure encoding • Add witness information to each symbol • Partition Symbols • Use Recover() function to partition the received symbols based on the accumulator value • Distillation Decode • Invoke Partition Symbols function • Throw away all partitions with < (n-t) symbols • Erasure decode each remaining partition Sender Reciever

10. m 07 m m 03 47 m m m m 01 23 45 67 m m m m m m m m 0 1 2 4 5 6 7 3 Merkle Hash Tree as an Accumulator Accumulator • Witness(m2, S) = {m3, m01, m47,m07} • Recovery involves recalculating the root based on the verification sequence

11. Security of Distillation Codes • The most computation that an adversary can cause with pollution attack with attack factor f: Hash operations Erasure decoding and validations

12. PRABS • Pollution Resistant Authenticated Block Streams • Builds on SAIDA (Signature Amortization using Information Dispersal Algorithm) • Uses distillation codes to authenticate data streams

13. PRABS Sender

14. PRABS Receiver

15. Security of PRABS • The most computation that an adversary can cause PRABS with bandwidth b through pollution attack with attack factor f: Hash operations Erasure decoding and validations

16. Conclusion and Possible Future Work • Distillation codes can handle “real” channels and provide authentication • Can possibly be used for any information that needs to be stored across multiple unreliable storage devices and reconstructed when needed.