Authenticating Pervasive Devices with Human Protocols

1
Authenticating Pervasive Devices with Human
Protocols
Ari Juels RSA Laboratories
Stephen A. Weis MIT CSAIL
2
Pervasive Devices

• Pervasive Devices
• Low memory, few gates
• Low power, no clock, little state
• Low computational power
• Billions of pervasive devices are deployed.
• Billions on the way.

Can such feeble devices authenticate themselves?
3
Example Technologies
4
Billions and Billions...

• Supply chain management, inventory control
• Payment systems, building access
• Prescription drug shipments
• Retail checkout
• Luxury goods
• Currency

Authenticating devices is a growing concern.
5
Attacks

• Skimming Reading legitimate tag data to produce
  fraudulent clones.
• Swapping Steal RFID-tagged products then replace
  with counterfeit-tagged decoys.
• Denial of Service Seeding a system with fake,
  but authentic acting tags.

6
Related Work

• Low-Cost Access Control
• SWE02, WSRE03, OSK04
• Pervasive Privacy
• JP03, JRS03, Avoine04, MW04
• Human Authentication HB01

7
Our Contribution

• A new authentication protocol that handles active
  malicious attacks.
• Extremely hardware-efficient
• Secure under same assumption as HB01

8
Hopper-Blum Authentication
Bob(x,?)
Computer(x)
? ?R 0,1
z(ax)?
Repeat for q rounds. Authenticate Bob if he
passes gt (1-?)q rounds.
9
(No Transcript)
10
Security Against Passive Eavesdroppers
Bob(x,?)
Computer(x)
? ?R 0,1
Eavesdropper
(a0,z0), (a1,z1), ..., (aq,zq)
Find an x that allows you to answer a (1-?)
fraction of a challenges
11
Learning Parity with Noise (LPN)

• Crypto and learning problems BFKL93
• LPN algorithm BKW03
• Shortest Vector Problem reduction Regev05

12
Concrete Security
Obligatory grain of salt ??
13
(No Transcript)
14
Our New Protocol HB
Tag(x, y,?)
Reader(x, y)
b ? 0,1k
Blinding Factor
a ? 0,1k
Challenge
? ?R 0,1
z(ax)?(by)??
Response
z(ax)?(by)?
15
Security Against Bad Bob
Adversary
Reader(x, y)
b
Malicious Blinding Factor
a
Challenge
z(a?)?(b?)
Guess Response
16
(No Transcript)
17
Detection Security Model
Adversary
Reader
Alert!
Assume valid readers will detect suspicious
failures No Reader oracles.
18
(No Transcript)
19
Future Work

• Two-round or parallel HB
• Random Number Generation
• Underlying hardness of LPN
• Adapting other HumanAuth protocols

(Rump Session)
20
Questions?

• Ari Juels
• ajuels_at_rsasecurity.com
• www.ari-juels.com

Stephen Weis sweis_at_mit.edu crypto.csail.mit.edu/
sweis