• 沒有找到結果。

End-to-end Security Mechanisms for SMS

N/A
N/A
Protected

Academic year: 2022

Share "End-to-end Security Mechanisms for SMS"

Copied!
19
0
0

加載中.... (立即查看全文)

全文

(1)

End-to-end Security Mechanisms for SMS

Jing-Shyang Hwu, Shih-Feng Hsu, Yi-Bing Lin, and Rong-Jaye Chen

Department of Computer Science & Information Engineering National Chiao Tung University

{jshwu, hsusf, liny, rjchen}@csie.nctu.edu.tw

Abstract

In the mobile communication systems, security (encryption) offered by the network operator only applies on the wireless link. Data delivered through the mobile core network may not be protected. Existing end-to-end security mechanisms are provided at application level and typically based on public key cryptosystem. This paper introduces two encryption mechanisms based on the RSA scheme and the ID-based scheme to provide end-to-end security for SMS. We implement these two mechanisms over the standard SMS network architecture and estimate the encryption overhead. Our study indicates that the ID-based mechanism has advantages over the RSA mechanism in key distribution and scalability of increasing security level for mobile service.

Keywords: End-to-end Security, Identity-based Cryptography, Public Key.

1. Introduction

In today’s mobile communication systems, the symmetric key technology is used to authenticate the mobile station (MS). The authentication method is based on the pre-shared secret key Ki (created at the service subscription) between the user and the mobile operator [6]. The symmetric session key Kc derived during the authentication phase (by using Ki)

(2)

only applies on the wireless link, i.e., from the MS to the base station. End-to-end security or confidentiality and integrity over the whole path between two parties (e.g., an MS to another MS) is not provided by mobile systems (such as GSM and UMTS) and therefore has to be provided at application level. Asymmetric cryptography is typically used in mobile systems to provide end-to-end security.

Asymmetric cryptography or public key cryptography (PKC) involves two distinct keys, KU and KR. The public key, KU, can be widely distributed without compromising its corresponding private key, KR. In some systems, KR remains only known to the user that generated it, while in other systems, KR is given to a user by another trusted entity. To generate the key pair, one first chooses a private key KR and applies some trapdoor one- way function to KR to obtain a random and uncontrollable public key KU. The main concern in a public key setting is the authenticity of the public key. If an attacker convinces a sender that the receiver’s public key is some key of the attacker’s choice instead of the correct public key, he/she can eavesdrop and decrypt messages intended for the receiver. This is the well known man-in-the-middle attack [10]. This authentication problem is typically resolved by the use of verifiable information called certificate, which is issued by a trusted third party and consists of the user name and his/her public key.

In 1984, Shamir [9] introduced the concept of identity-based (ID-based) cryptography where the public key of a user can be derived from public information that uniquely identifies the user. For example, the public key of a user can be simply his/her email address or telephone number, and hence implicitly known to all other users. A major advantage of ID-based cryptosystem is that no certificate is needed to bind user names with their public keys.

(3)

applications without requiring the users to memorize extra public keys. For example, sending an ID-based encrypted short message is exactly the same as sending a normal short message [3] if the mobile phone number of the short message recipient is used as the public key. Therefore, the mobile user (the sender) does not need to memorize an extra public key for the receiver. This feature is especially desirable for transaction-type mobile applications such as bank or stock transactions [7].

In this paper, we implement two encryption systems for Short Message Service (SMS) and estimate the encryption overheads compared with the original non-ciphered message transmissions. We first introduce the certificate-based and the ID-based public key cryptosystems which provide authentic solutions for public key distribution. Then we propose two applicable end-to-end encryption mechanisms for SMS based on the certificate-based public key cryptosystem and the ID-based public key cryptosystem, respectively. Finally, we also evaluate and compare the transmission overheads between these two mechanisms.

2. Public Key Cryptography

Public key techniques utilize the asymmetric key pairs. In an asymmetric key pair, one key is made publicly available, while the other is kept private. Because one of the keys is available publicly, there is no need for a secure key exchange. However, it is required to distribute the public key authentically. Because there is no need for pre-shared secrets prior to a communication, public key techniques are ideal for supporting security between previously unknown parties. Authentication is achieved by proving possession of the private key. One mechanism for doing this is digital signature. A digital signature is

(4)

generated with the private key and verified using the corresponding public key. Since the public key of a key pair is usually published in a directory, the overhead associated with distributing keys is reduced significantly in comparison with secret key techniques.

A main concern in public key distribution is the authenticity of the public key. Fig. 1 illustrates how an adversary between a sender B and a receiver A can impersonate the receiver A in the public key encryption scheme. The adversary achieves this by replacing A’s public key KUA with a false public key KUA' which is then received by B (Fig. 1 (1) and (2)). User B uses the false public key KUA' to encrypt the message M (Fig. 1 (3)). The adversary obtains the secret message M (Fig. 1 (4)) and delivers the re-encrypted cipher to user A (Fig. 1 (5)). In this way, the secret message M is acquired by both user A (Fig. 1 (6)) and the adversary. Similar impersonation settings exist between the signer and verifier in the signature schemes. This is the well known man-in-the-middle attack. The following issue arises from the need to prevent these kinds of attacks: how does B know (or authenticate) which particular public key is A’s? To answer this question, authentication of public key distribution is required. Authenticating public keys provides assurance to the entity that the received public key corresponds to the sender’s identity.

Figure 1. The man-in-the-middle attack

(5)

2.1. Certificate-based Public Key Cryptosystem

A typical approach to guarantee the authentication of the public key holder relies on a trusted agent named Certificate Authority (CA). The CA’s digital signature binds entity A’s identity IDA to the corresponding public key KUA. The CA’s signature, when sent along with the identity (e.g., name or telephone number) and public key, forms a digital certificate which can be verified by any entity in possession of the CA’s public key.

This certificate provides a binding between the identity and the public key. Digital certificates can contain extra information, such as cryptographic algorithms to be used in conjunction with the public key in the certificate. The most widely adopted certificate format is based on the X.509 standard [5]. A basic certificate issued by a CA for entity A is of the form:

CertA = (IDA, KUA, SignKR_CA(IDA, KUA)),

where SignKR_CA(.) denotes the signing algorithm with the CA’s private key as the signing key.

The certificate-based public-key distribution works as follows. User A first chooses a public key cryptosystem, and generates his/her own key pair (KUA, KRA), where KUA

denotes the public key and KRA is the private key. To attain the authenticity of public-key distribution, user A has to subscribe to the trusted Certificate Authority (CA; see Fig. 2 (1)), and requests a certificate CertA for his/her public-key from CA (Fig. 2 (2)). The CA signs the certificate with its private key. Then user A can send his/her certificate directly to another user B (Fig. 2 (3)) or put it on the public key directory. Once user B is in possession of A’s certificate, B verifies the certificate with the CA’s public key and has

(6)

confidence that the messages he/she encrypts with A’s public key will be secure from eavesdropping and that messages signed with A’s private key are unforgeable.

Figure 2. The certificate-based public-key distribution 2.2. ID-based Public Key Cryptosystem

Shamir [9] proposed the identity-based (ID-based) public key approach to support public key cryptography without the use of certification. In ID-based public key cryptosystem, user A’s public key KUA is not delivered to user B, and therefore eliminates the attack presented in Fig. 1. User B encrypts a message for user A or verifies a signature from user A using a public key which is derived from user A’s identifier IDA (e.g., email address or telephone number; see Fig. 3 (3)). The trusted agent has a new role in ID-based public key cryptosystem, and is renamed as the Private Key Generator (PKG). The PKG issues the private key corresponding to the public key (derived from the identifier IDA) to user A over a secure channel (Fig. 3 (2)). This issuing action takes place after user A is authenticated by the PKG (Fig. 3 (1)). To generate private keys, the PKG makes use of a master key which must be kept in secret. The requirement to have an authentic CA’s public key for verifying certificates in certificate-based cryptosystem is replaced by the requirement to

(7)

have authentic PKG’s system parameters in ID-based cryptosystem. Notice that both the PKG and the user A know the private key KRA.

Figure 3. The ID-based public-key distribution

3. End-to-end Security for Short Message Service

This section first introduces the short message service (SMS) for GSM [6][7]. Then we describe the RSA and the ID-based encryption mechanisms for SMS.

3.1. Short Message Service Architecture

The network architecture of short message service in GSM is illustrated in Fig. 4. In this architecture, the short message is first delivered from the mobile station (MS) A to a short message service center (SM-SC) through the base station system (BSS), the mobile switching center (MSC), and then the interworking MSC (IWMSC). The SM-SC then forwards the message to the GSM network through a specific GSM MSC called the short message service gateway MSC (SMS GMSC). The SM-SC may connect to several GSM networks and to several SMS GMSCs in a GSM network. Following the GSM roaming

(8)

protocol, the SMS GMSC locates the current MSC of the message receiver and forwards the message to that MSC. The MSC then broadcasts the message through the BSS to the destination MS B. In the next subsections, we will describe two encryption mechanisms for end-to-end secure SMS based on certificate-based and ID-based cryptosystems.

Figure 4. GSM short message service network architecture

3.2. RSA Mechanism

The most widely implemented approach to public key encryption is the Rivest-Shamir- Adleman (RSA) scheme [8]. The RSA scheme is a block cipher in which the original non- ciphered text and cipher text are integers between 0 and n-1 for some n. That is, the block size kRSA is determined by the bit length of the integer n and regarded as the key size of the RSA scheme. This scheme consists of the following three functions:

(9)

Key generation: A user first selects two prime numbers p and q, randomly chooses e with gcd(e, (p-1)(q-1)) = 1, and calculates d  e-1 mod (p-1)(q-1). Then the public key is KU = (e, n) and the private key is KR = (d, n), where n = pq.

Encryption: For a given message represented as an integer M < n, the cipher text is computed by C = M e mod n.

Decryption: For a given cipher text C, the original non-ciphered text is computed by M = C d mod n.

A RSA mechanism for end-to-end secure SMS is introduced as follows. The end-to-end security service provider (ESSP) plays a role as the CA in the certificate-based public key cryptosystem. To access the end-to-end security service, a user first chooses his/her own key pair (KU, KR) and subscribes to the ESSP for requesting a certificate of his/her public key KU. The ESSP signs the certificate with its private key and publishes the certificate in the public key directory for public access. When a mobile user A (the sender) wants to encrypt a short message to user B, he/she first sends a public key request (Fig. 5 (1)) to the public key directory in short message format. The public key directory retrieves user B’s certificate. If it succeeds, user B’s certificate is sent to user A as the public key response (Fig. 5 (2)). Once user A is in possession of B’s certificate, he/she verifies the certificate with the ESSP’s public key and uses the user B’s public key to encrypt short message for B (Fig. 5 (3)). If the request fails (due to unavailability of user B’s certificate), the ESSP will inform user B to subscribe to end-to-end security service if he/she wants to securely communicate with user A.

(10)

Figure 5. The RSA procedure for sending an encrypted short message 3.3. ID-based Mechanism

In the above RSA approach, the sender needs to communicate with the public key directory for requesting the public key. If the request fails (e.g., the directory server is down or there is no certificate exist for the receiver), the sender can not encrypt short message for the receiver. On the other hand, in an ID-based encryption scheme, the sender simply uses the receiver’s ID (i.e., the telephone number) as his public key without any request and verification. Thus, the sender does not need to access any public key directory before sending an encrypted short message.

The first complete and efficient ID-based encryption scheme was proposed by Boneh and Franklin [1] which uses a bilinear map called Weil pairing over elliptic curves. The bilinear map transforms a pair of elements in group G1 and sends it to an element in group G2 in a way that satisfies some properties. The most important property is the bilinearity that it should be linear in each entry of the pair. Assume that P and Q are two elements (e.g., points on elliptic curves) of an additive group G1. Let e(P, Q) be the element of a

(11)

multiplicative group G2, which is the pairing applied to P and Q. Then the pairing must have the following property:

e(rP, Q) = e(P, Q)r = e(P, rQ),

where r is an integer and rP denotes the element generated by r times of additions on P, e.g., 2P=P+P, 3P=P+P+P and so on. Weil pairing on elliptic curves is selected as the bilinear map. That is, the elliptic curve group (the set of point collection on elliptic curves) is used as G1 and the multiplicative group of a finite field is used as G2.

The ID-based scheme consists of four algorithms: Setup, Extraction, Encryption, and Decryption. Setup is run by the PKG to generate the master key and the system

parameters. This is done on input of a security parameter kID, which specifies the bit length of the group order and is regarded as the key size of the ID-based scheme. The Extraction algorithm is carried out by the PKG to generate a private key corresponding to the identity of a user. As with regular public key cryptography, the Encryption algorithm takes a message and a public key as inputs to produce a cipher text. Similarly, the Decryption algorithm is executed by the owner of the corresponding private key to decrypt the cipher text. These four functions are described as follows.

Setup: With the parameter kID, the algorithm works as follows:

1. Generate a random kID-bit prime p, two groups (G1; +); (G2; *) of order p, and the Weil pairing e: G1  G1  G2. Choose an arbitrary generator P  G1.

2. Pick a random number s  Zp* and set Ppub = sP .

3. Choose cryptographic hash functions h1:{0, 1}*G1* and h2:G2 {0, 1}n for some n.

(12)

The public system parameters are {p, G1, G2, e, n, P, Ppub, h1, h2} and the master key s is kept in secret by the PKG.

Extraction: For a given string ID{0, 1}* as the public key, the algorithm works as follows:

1. Compute QID = h1(ID)  G1.

2. Set the private key KR = sQID, where s is the master key held by PKG.

Encryption: To encrypt a message M under the public key KU = ID, the algorithm works as follows:

1. Compute QID = h1(ID)  G1. 2. Choose a random r  Zp*.

3. Set the cipher text to be C = (U, V) = (rP, M  h2(e(QID, sP)r))

Decryption: To decrypt a cipher C = (U, V) encrypted using the public key KU = ID, the algorithm uses the private key KR = sQID to compute M = V  h2(e(sQID, U)).

This decryption procedure yields the correct message due to the bilinearity of the Weil pairing (i.e., e(sQID, U) = e(sQID, rP) = e(QID, sP)r).

Details of Weil pairing for ID-based cryptosystem can be found in [4], and will not be elaborated further in this paper.

Based on an improved algorithm we proposed [4], an efficient ID-based end-to-end encryption mechanism for mobile services is illustrated in Fig. 6. The PKG (Fig. 6 (1)) constructs the ID-based cryptosystem and uses, for example, the phone number as the ID (Fig. 6 (2)). Every mobile user involved in the ID-based cryptosystem is given a

(13)

subscriber identity module (SIM) card (Fig. 6 (3)) at the subscription time. The ID (phone number; e.g., 0912345678 in Fig. 6) and its corresponding private key KR are loaded in the SIM card by the end-to-end security service provider. Note that for standard GSM/UMTS service, SIM card is always given to a mobile user at the subscription time and the proposed ID-based encryption scheme can be pre-loaded into the SIM card without incurring any extra overhead. The mobile station contains two security modules: ID-based encryption module (Fig. 6 (4)) and ID-based decryption module (Fig. 6 (5)). When a mobile user A (the sender; (Fig. 6 (6))) wants to encrypt a short message to user B (the receiver), A uses B’s phone number 0912345678 (Fig. 6 (7)) as the public key and encrypts the message through the ID-based encryption module. Once user B receives the cipher (the encrypted message), he/she uses the private key KR (Fig. 6 (8)) stored in the SIM card to decrypt the cipher through the ID-based decryption module and obtain the original non- ciphered message.

(14)

Figure 6. ID-based end-to-end encryption mechanism

To estimate the encryption overheads between the RSA and the ID-based mechanisms, we implement these two encryption schemes and give the evaluation in the next section.

4. Performance Comparison

This section compares the transmission (encryption, decryption, and message delivery [3]) delay of ciphered short messages based on the RSA and the ID-based approaches. The experimental environment is illustrated in Fig. 7. Both the sender and the receiver are notebooks (Fig. 7 (1) and (3)) configured with a Pentium-III 500 MHz CPU, 256MB main memory, and 20GB disk space, and are running on the Windows XP Professional operating system. To deliver short messages, every notebook is plugged in a NOKIA Card Phone

(15)

version 2.0 and the short message is sent via the ChungHwa GSM network (Fig. 7 (2)) from the sender to the receiver.

Figure 7. Encrypted short message experimental environment

We first note that to support the same security level, the key length for the ID-based and the RSA approaches are different. The ID-based cryptosystem using Weil pairing is over elliptic curves, thus its security level depends on the key length of Elliptic Curve Cryptosystem (ECC). As listed in Table 1 [2], a 108-bit ECC key provides the same security level as a 512-bit RSA key, a 160-bit ECC key provides the security level equivalent to a 1024-bit RSA key, and a 224-bit ECC key is equivalent to a 2048-bit RSA key. For a fair comparison, we measure the transmission delays of ID-based system and RSA system over the same security level, and the results are shown in Fig. 8.

Table 1 Key length for equivalent security levels (in bits) ECC (ID-based) RSA

108 512

160 1024

224 2048

This figure plots transmission delays of the RSA and ID-based approaches for the same non-ciphered length (in bytes), where the ◆ curves represent the RSA transmission

(16)

delays, the ▓ curves represent the ID-based transmission delays, and the ▲ curves represent the non-ciphered message delays.

Based on the RSA encryption algorithm described in Section 3.2, for a non-ciphered message of length i, the RSA ciphered message length is

 

RSA RSA

RSA k

k i i L

where kRSA is the key length of RSA approach. For kRSA 512,

 

1024 i

512 1024

512 2

51 i

i

LRSA .

Therefore, in Fig. 8 (a), we observe a step curve for the RSA ciphered message transmission. For kRSA 1024 and kRSA 2048, if i1024, LRSA

 

i is 1024 and 2048 respectively. Therefore, in Fig. 8 (b) and (c), we observe horizontal lines for the RSA ciphered message transmission.

Based on step 3 of ID-based encryption algorithm described in Section 3.3, the ID- based ciphered message length is

 

4

ID ID

i k i

L   ,

where kID is the key length of ID-based approach. For a fixed kID, LID

 

i increases as i increases. Therefore, in Fig. 8 (a), (b), and (c), we observe linear lines for ID-based ciphered message transmission.

(17)

(a) 512 bits RSA key and 120 bits ID-based key cipher

(b) 1024 bits RSA key and 160 bits ID-based key cipher

(c) 2048 bits RSA key and 224 bits ID-based key cipher Figure 8. Transmission delays of short message service

(18)

Based on the above transmission delay analysis, Fig. 8 (a) shows that the ID-based approach outperforms the RSA approach when the non-ciphered message length is less than 30 bytes or is between 65 and 90 bytes. Fig. 8 (b) shows that the ID-based approach outperforms the RSA approach when the non-ciphered message length is less than 79 bytes. Fig. 8 (c) shows that the ID-based approach outperforms the RSA approach up to 140-byte message limit of short message service. These figures indicate that as the security level increases, it is more likely that the ID-based approach outperforms the RSA approach for the SMS applications.

5. Conclusion

In this paper, two applicable end-to-end security mechanisms for SMS based on the RSA scheme and the ID-based scheme are introduced and implemented. The ID-based scheme provides a great simplification of key distribution. That is, all public keys can be derived from the identities of the users. Therefore obtaining someone’s public key, for encryption or verification, becomes a simple and transparent procedure. This is in contrast to the RSA scheme, where one has to look up the corresponding certificate and verify the CA’s signature. Another advantage of the ID-based scheme is the linear scalability of increasing security level. When the security level increases, the key size of the RSA scheme increases faster than that of the ID-based scheme and may not be practical for the SMS applications. Our study concludes that the ID-based scheme offers a convenient end- to-end security mechanism for mobile service such as SMS.

(19)

Reference

[1] D. Boneh and M. Franklin, “Identity-based Encryption from the Weil Pairing”, Advances in Cryptology-CRYPTO’01, pp. 213–239.

[2] D. Hankerson, A. Menezes, and S. Vanstone, Guide to Elliptic Curves Cryptography, Springer-Verlag, 2003.

[3] H.-N. Hung, Y.-B. Lin, M.-K. Lu, and N.-F. Peng, “A Statistic Approach for Deriving the Short Message Transmission Delay Distributions”, IEEE Trans. on Wireless Communications, vol. 3, No. 6, 2004.

[4] J.-S. Hwu, R.-J. Chen, and Y.-B. Lin, “An Efficient Identity-based Cryptosystem for End-to-end Mobile Security”, Accepted and to appear in IEEE Transactions on Wireless Communications.

[5] ITU-T Recommendation X.509, “Information technology - open systems interconnection - the directory: Public-key and attribute certificate frameworks”, 2000.

[6] Y.-B. Lin and I. Chlamtac, Wireless and Mobile Network Architectures, John Wiley and Sons, 2001.

[7] Y.-B. Lin and A.-C. Pang, Wireless and Mobile All-IP Networks, John Wiley and Sons, 2005.

[8] R. Revest, A. Shamir, and L. Aldeman, “A Method for Obtaining Digital Signature and Public Key Cryptosystems”, Communication of the ACM, February 1978

[9] A. Shamir, “Identity-based Cryptosystems and Signature Schemes”, Advances in Cryptology–CRYPTO’84, pp. 47-53.

[10] W. Stallings, Cryptography and Network Security, Prentice Hall, 1999.

數據

Figure 1. The man-in-the-middle attack
Figure 2.  The certificate-based public-key distribution 2.2. ID-based Public Key Cryptosystem
Figure 3. The ID-based public-key distribution
Figure 4. GSM short message service network architecture
+4

參考文獻

相關文件

To proceed, we construct a t-motive M S for this purpose, so that it has the GP property and its “periods”Ψ S (θ) from rigid analytic trivialization generate also the field K S ,

Reading Task 6: Genre Structure and Language Features. • Now let’s look at how language features (e.g. sentence patterns) are connected to the structure

If a contributor is actively seeking an appointment in the aided school sector but has not yet obtained an appointment as a regular teacher in a grant/subsidized school, or he

Hence, we have shown the S-duality at the Poisson level for a D3-brane in R-R and NS-NS backgrounds.... Hence, we have shown the S-duality at the Poisson level for a D3-brane in R-R

John studies hard and in 1911 he left the city of Melbourne and went to work in South Australia for the Presbyterian Church.. The church wanted to help the sheep farmer s who

Continue to serve as statements of curriculum intentions setting out more precisely student achievement as a result of the curriculum.

Light rays start from pixels B(s, t) in the background image, interact with the foreground object and finally reach pixel C(x, y) in the recorded image plane. The goal of environment

a) Describe the changing trend of daily patronage of different types of public transport modes in Hong Kong from 2000 to 2015.. b) Discuss the possible reasons leading to