Mutual Distance Bounding Protocol with Its Implementability Over a Noisy Channel and Its Utilization for Key Agreement in Peer-to-Peer Wireless Networks

Abstract

In order to protect a wireless sensor network and an RFID system against wormhole and relay attacks respectively, distance bounding protocols are suggested for the past decade. In these protocols, a verifier authenticates a user as well as estimating an upper bound for the physical distance between the user and itself. Recently, distance bounding protocols, each with a mutual authentication, are proposed to increase the security level for such systems. They are also suggested to be deployed for key agreement protocols in a short-range wireless communication system to prevent Man-in-the-Middle attack. In this paper, a new mutual distance bounding protocol called NMDB is proposed with two security parameters ($n$ and $t$). The parameter $n$ denotes the number of iterations in an execution of the protocol and the parameter $t$ presents the number of errors acceptable by the verifier during $n$ iterations. This novel protocol is implementable in a noisy wireless environment without requiring final confirmation message. Moreover, it is shown that, how this protocol can be employed for the key agreement procedures to resist against Man-in-the-Middle attack. NMDB is also analyzed in a noisy environment to compute the success probability of attackers and the rejection probability of a valid user due to channel errors. The analytically obtained results show that, with the proper selection of the security parameters ($n$ and $t$) in a known noisy environment, NMDB provides an appropriate security level with a reliable performance.

Appendix: Man-in-the-Middle Attack Over DH–IR Key Agreement Protocol

Čapkun et al. [29] improved Diffie–Hellman key agreement scheme using a DB protocol, named DH–IR protocol. In this protocol, both user $A$ and user $B$ compute the commitment/opening pairs $(c_A,o_A)$ and $(c_B,o_B)$ by applying a commitment scheme to messages $m_A=ID_A\Vert g^{x_A}\Vert N_A$ and $m_B=ID_B\Vert g^{x_B}\Vert N_B$, respectively (here $N_A$ and $N_B$ are two $n$-bit random sequences and $ID_A$ and $ID_B$ are two public identifiers for users $A$ and $B$, respectively). In the first four messages of the protocol, user $A$ and user $B$ exchange $c_A$, $c_B$, $o_A$ and $o_B$ as shown in Fig. 10. Then, user $A$ and user $B$ open the commitments and verify the correctness of $ID_B$ and $ID_A$, respectively. If the verification is correct, each user computes the $n$-bit sequence as $N_A\oplus {N_B}$. Next, as shown in Fig. 10, a DB protocol is started by user $A$ and user $B$ for $n$ rounds. At each round of the rapid bit exchange, e.g., $i$th round, user $A$ sends a random bit $C_i$ as the challenge bit to user $B$. User $B$ also sends back $R_i=C_i\oplus {(s_B)_i}$ as the response bit. Hence, in addition to user $B'$s authentication, user $A$ estimates an upper bound for the physical distance between the user $B$ and itself. However, if this DB protocol successfully ends, then user $A$ and user $B$ accept $K_{AB}=g^{x_Ax_B}$ as the shared secret key.

Fig. 10

DH–IR key agreement protocol [29]

Now, suppose that the attacker $A_M$ want to perform the MITM attack on DH–IR protocol. It is assumed that the attacker $A_M$ locates outside of two spherical spaces centred around user $A$ and user $B$ with radius $d$ while it is able to modify and transmit signals between $A$ and $B$ (the attacker $A_M$ is a powerful attacker that can perform the signal jamming attack).

In this attack, when DH–IR protocol is started by user $A$ and user $B$, the attacker $A_M$ interrupts the first four messages exchanged between $A$ and $B$ at the beginning of the protocol (i.e., $c_A$, $c_B$, $o_A$ and $o_B$) and then it transmits $\widehat{c}_A$, $\widehat{c}_B$, $\widehat{o}_A$ and $\widehat{o}_B$ instead of them as shown in Fig. 11. Hence, when user $A$ opens the commitment, it obtains $\widehat{N}_B$ and $g^{x_R}$ instead of $N_B$ and $g^{x_B}$, respectively. User $B$ also obtains $\widehat{N}_A$ and $g^{x_R}$ instead of $N_A$ and $g^{x_A}$, respectively.

Fig. 11

Man-in-the-Middle attack over DH–IR key agreement protocol

Next, for the correct execution of the DB protocol, at each round of the rapid bit exchange, e.g., $i$th round, the attacker $A_M$ must adopt the response bit computed with ${(\widehat{s}_B)_i}={(\widehat{N}_A)_i}\oplus {(N_B)_i}$ to the response bit computed with ${(\widehat{s}_A)_i}={({N_A})_i}\oplus {(\widehat{N}_B)_i}$. Although the attacker $A_M$ is farther than the allowable distance, but since $A_M$ knows $\widehat{N}_A$, $\widehat{N}_B$, $N_A$ and $N_B$ at start of the rapid bit exchange step, it can adopt the response bit computed by user $B$, i.e., $R_i={C_i}\oplus {(\widehat{s}_B)_i}$, to its desirable response bit, i.e., $\widehat{R}_i={C_i}\oplus {(\widehat{s}_A)_i}$. Hence, at each round, the attacker $A_M$ transmits a suitable signal between $A$ and $B$ at a particular time to change $R_i$ to $\widehat{R}_i$. When ${({N_A})_i}\oplus {(\widehat{N}_B)_i}$ is equal to ${(\widehat{N}_A)_i}\oplus {({N_B})_i}$, then $\widehat{R}_i=R_i$; so in this case $A_M$ sends no signal between $A$ and $B$. But if they are not equal, then $\widehat{R}_i=R_i\oplus {1}$; so in this case $A_M$ must modify the response bit $R_i$. Therefore, user $A$ and user $B$ cannot detect the attack and accept the secret keys $g^{x_Ax_R}$ and $g^{x_Bx_R}$, respectively. It is notable that the attacker $A_M$ have an access to both secret keys $g^{x_Ax_R}$ and $g^{x_Bx_R}$. Consequently, $A_M$ succeeds to perform Man-in-the-Middle attack.