Two-Stage Authentication for Ad Hoc Network Message Authenticity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing ad hoc network security methods, such as PKI encryption, incur high computational costs and bandwidth requirements due to large certificate authority signatures and repetitive authentication processes, especially in networks with numerous vehicles.
Innovation Solution
Implementing a two-stage authentication process using PKI encryption for initial node verification and Timed Efficient Stream Loss-tolerant Authentication (TESLA) encryption for subsequent message exchange, where nodes exchange identification and authentication information, and then use a hash chain for efficient message authentication, reducing computational and bandwidth demands.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PKI encryption is used for message authentication in ad hoc networks, then message authenticity is ensured, but computational cost and bandwidth requirements increase significantly
Solution Approach 1:
The authentication process is segmented into two distinct phases: (1) Initial PKI-based authentication when nodes first join the network, and (2) Subsequent TESLA-based authentication for ongoing message exchange. This segmentation allows the system to use the secure but computationally intensive PKI method only when necessary (initial authentication), while using the more efficient TESLA method for continuous communication, thereby resolving the contradiction between reliability and computational cost
Solution Approach 2:
Nodes perform preliminary PKI authentication and exchange of authentication credentials before entering the main communication phase. This preliminary action establishes trust relationships in advance, allowing nodes to subsequently use lighter-weight TESLA authentication for message verification without repeatedly performing expensive PKI operations, thus reducing overall computational cost while maintaining message authenticity
2Reliability
If certificate authority signatures are included with each message, then message authenticity is verified, but message size and bandwidth consumption increase
Solution Approach 1:
The authentication data is segmented and transmitted at different times: PKI signatures are exchanged during initial node authentication (not with every message), and TESLA uses compact cryptographic keys and signatures for subsequent messages. This segmentation reduces the quantity of authentication data that needs to be transmitted with each message while maintaining authenticity verification capability
Solution Approach 2:
Authentication credentials and certificates are exchanged in advance during node initialization before actual message communication begins. This preliminary exchange of authentication data eliminates the need to attach large certificate authority signatures to every subsequent message, as nodes already possess the necessary credentials for efficient TESLA-based verification, thereby reducing message size and bandwidth consumption
Data Source
AI summary
A method for exchanging messages containing reliable information between nodes in an ad hoc network, such as a vehicle ad hoc network. The method includes the steps of providing a public key for a PKI encrypted certificate authority signature to all nodes known to transmit reliable information. Each node transmits a signal containing node identification information and the PKI encrypted certificate authority signature associated with that node. Each node also receives like signals from other nodes and then decrypts the certificate authority signatures from the received signals by using the certificate authority public key to ascertain the authenticity of the received certificate authority signatures and the reliability of the received message. Thereafter, the nodes receive and accept messages with a TESLA encrypted signature only with nodes identified to have authentic certificate authority signatures until the occurrence of a subsequent predefined event, such as a new node in the network or the elapse of a predetermined time period.