Affiliations: [a] Department of Computer Science and Engineering and College of Information Systems and Technology, The Pennsylvania State University, USA | [b] Department of Computer Science, George Mason University, USA | [c] Department of Computer Science, University of Texas at San Antonio, USA | [d] Center for Secure Information Systems, George Mason University, USA. E-mail: szhu@cse.psu.edu, setia@gmu.edu, jajodia@gmu.edu, shxu@cs.utsa.edu
Note: [*] A preliminary version of this work appeared in: Proceedings of the 1st International Conference on Mobile and Ubiquitous Systems (Mobiquitous’04), 2004.
Abstract: We present GKMPAN, an efficient and scalable group rekeying protocol for secure multicast in ad hoc networks. Our protocol exploits the property of ad hoc networks that each member of a group is both a host and a router, and distributes the group key to member nodes via a secure hop-by-hop propagation scheme. A probabilistic scheme based on pre-deployed symmetric keys is used for implementing secure channels between members for group key distribution. GKMPAN also includes a novel distributed scheme for efficiently updating the pre-deployed keys. GKMPAN has three attractive properties. First, it is significantly more efficient than group rekeying schemes that were adapted from those proposed for wired networks. Second, GKMPAN has the property of partial statelessness; that is, a node can decode the current group key even if it has missed a certain number of previous group rekeying operations. This makes it very attractive for ad hoc networks where nodes may lose packets due to transmission link errors or temporary network partitions. Third, in GKMPAN the key server does not need any information about the topology of the ad hoc network or the geographic location of the members of the group. We study the security and performance of GKMPAN through detailed analysis and simulation; we have also implemented GKMPAN in a sensor network testbed.
Keywords: Group key management, ad hoc networks, probabilistic key sharing, key updating, stateless
