Secure Network Coding over the Integers

Abstract

Network coding has received significant attention in the networking community for its potential to increase throughput and improve robustness without any centralized control. Unfortunately, network coding is highly susceptible to "pollution attacks" in which malicious nodes modify packets in a way that prevents the reconstruction of information at recipients; such attacks cannot be prevented using standard end-to-end cryptographic authentication because network coding requires that intermediate nodes modify data packets in transit. Specialized solutions to the problem have been developed in recent years based on homomorphic hashing and homomorphic signatures. The latter are more bandwidth-efficient but require more computation; in particular, the only known construction uses bilinear maps.We contribute to this area in several ways. We present the first homomorphic signature scheme based solely on the RSA assumption (in the random oracle model), and present a homomorphic hashing scheme based on composite moduli that is computationally more efficient than existing schemes (and which leads to secure network coding signatures based solely on the hardness of factoring in the standard model). Both schemes use shorter public keys than previous schemes. In addition, we show variants of existing schemes that reduce the communication overhead significantly for moderate-size networks, and which improve computational efficiency in some cases quite dramatically (e.g., we achieve a 20-fold speedup in the computation of intermediate nodes). At the core of our techniques is a modified approach to network coding where instead of working in a vector space over a field, we work directly over the integers (with small coefficients).

Linearly Homomorphic Signatures over Binary Fields and New Tools for Lattice-Based Signatures

“…vectors) of elements of R. This definition encompasses the homomorphic signatures over finite fields defined by Boneh et al [4] as well as the signatures over Z and Z N defined by Gennaro et al [13]. While we describe the system in terms of a fixed ring R, it may be that R is determined by the Setup algorithm, as in the case where the size of R depends on the system's security parameter.…”

“…The original motivation for linearly homomorphic signatures comes from the network coding routing mechanism [12,11,25,4,13]. In a computer network that uses network coding, a message sender signs a number of "augmented" message vectors and transmits the resulting vector-signature pairs through the network to a recipient.…”

“…Previous results on linearly homomorphic signatures make use of groups in which the discrete logarithm problem is hard [18,11,25,4] or the RSA assumption holds [13]. In the former case, signatures are linearly homomorphic over F p for some large p, while in the latter case, signatures are homomorphic over the integers (with some bound on the size of the coefficients allowed in linear combinations).…”

Computing on Authenticated Data

“…, v k . Signature schemes for this predicate P are presented in [14,13,12,15,2] while schemes over Z (rather than F p ) are presented in [27]. These schemes were originally designed to secure network coding where context hiding is not needed since there are no privacy requirements for the sender (in fact, the sender is explicitly transmitting all his data to the recipient).…”

A Full Homomorphic Message Authenticator with Improved Efficiency

“…The first linear homomorphic signature scheme is proposed by Johnson et al in [13]. Since then, many linear homomorphic signatures and message authentication in the context of network coding are developed [14]- [20]. Linear homomophic signature and message authentication schemes can be used to construct proofs of storage and retrievability [21]- [24].…”