Estrategia 1

Before diving into the mechanisms of malice and selfishness prevention, which will be the topic of the rest of this book, we will now focus on the notion of trust and we will refine the definition of the adversary model.

3.1 About trust

As we have already hinted in the previous chapter, building and maintaining trust will be much more difficult in upcoming wireless networks than in existing ones. Yet, trust is absolutely fundamental for the future of (wireless) communications. Once computing has become ubiquitous, it will probably be de facto mandatory, as are al- ready today mobile phones and personal computers; but what if it is not trustworthy? What if it is as unsafe as today’s Internet? Moreover, no business is possible without trust, and wireless networks are essentially driven by business considerations.

Trust can be defined as the belief that another party (a person, an organization, but also a device) will behave according to a set of well-established rules and will thus meet one’s expectations. This notion is fundamental in all human societies (and also in many animal groups); generally, a breach of trust is considered to be a major offense.

But trust is a fuzzy notion, be it considered across persons or across areas of competence: no matter how close they are to each other, different people may trust very different things, even in front of the same evidence. Likewise, a person A may trust a person B for the accomplishment of a certain task, but not another: most people trust their mother in general, but rarely for piloting a helicopter; similarly, a subscriber trusts a cellular operator to provide her with connectivity over a given territory, but not necessarily for striking the most advantageous roaming deals (from the subscriber’s point of view) with other operators. To make things worse, even in a given area of competence, trust is neither symmetric nor transitive.

It is important at this stage to position trust with respect to security and to coop- eration.

Trust preexists security. As mentioned, trust is a “natural” phenomenon, and it has existed for millennia, before any concept of security was invented. Security is simply a technique to infer trust: if I trust something, security can help me trusting something else. For example, if I trust that my personal computer is not compromised, that the security protocol I use is not flawed, and that the cryptographic algorithm running on both sides is not (yet) broken, then I can trust that what I see on my screen is indeed a Web page corresponding to my bank and I can carry out my e- banking transactions with the legitimate belief that I will not be defrauded. It should be clear from this simple example that any security mechanism requires some level of trust in its underlying components.

Cooperation reinforces trust. In the definition that we have provided, trust is about the ability to predict the behavior of another party. People being what they are, a reasonable assumption is to assume selfishness of the other parties. Therefore, if a system is designed in such a way that the socially desirable behavior coincides with a party’s vested interest, then it is likely that that party will indeed behave as desired.1 _{Hence the possible emergence of a virtuous cycle: I observe the other party’s}

cooperative behavior. This lets me believe that she will continue to be cooperative in the future, and hence my trust in her. It also encourages me to be cooperative, which will reinforce the trust that she has in me, etc.

Because of the complex characteristics of trust, and as it is very deeply rooted in our human nature, trust is difficult to quantify and to model, in the same way as the “quality of service” of a communication application is difficult to assess in a fully objective way. It is in fact easier to describe the reasons to trust someone or something, which are the following.

Moral values As mentioned, any society has its rules, and in many cases we will consider that other parties obey these rules, typically because of their educa- tion or because they fear bad publicity, should their misbehavior be disclosed. So for example, we trust a large cellular operator to protect our privacy as long as there is no strong reason (e.g., a legal enquiry) to depart from that attitude.

Experience about a given party Previous interactions are of course revealing about the trustworthiness of a given party; these interactions can be either first hand or be reported by other parties, meaning that reputation is a fun- damental component of trust. Of course, the frequency of the interactions as

1 _{As explained in Appendix B, this situation corresponds to the case in which Pareto-optimality}

well as the durability of the other parties (and of their identifiers) are very important to make experience relevant.

Rule enforcement organization If the stakes are high (e.g., the risk of accident when driving a car), the obedience to the rules is further “encouraged” by a specialized agency. For example, the way cellular operators use the radio spectrum is usually regulated by a governmental agency; the way mobile users make use of the radio spectrum is usually controlled by the operator. Rule enforcement mechanism As it is not possible to “put a cop behind each

wireless device”, technical mechanisms must be deployed to either make at- tacks more difficult or to encourage the desired behavior.2

As an example of the former case, it is much more efficient to encrypt radio communications rather than to deploy police force everywhere to check that no one is eavesdropping. Several examples of the latter case are described in Part III of this book.

Usual behavior Although malicious behavior refers to poorly understood psycho- logical mechanisms, it is possible to consider that one behavior is much more frequent than another. For example, usually a driver chooses an itinerary to reach her destination by taking into account exclusively her own benefit and not the implications of this decision on the other drivers; but it is (for- tunately) very unusual that a driver throws a box of nails on a highway, just for the dubious pleasure to generate an accident. Likewise, network users will often keep trying to set up a communication in spite of the fact that the network is congested; but very few will make the effort to jam a given area simply to “enjoy” complicating other people’s life.

3.2 Trust in the era of ubiquitous computing

In the previous chapter, we have explained the major characteristics of upcoming wireless networks. Our discussion of trust building will now be useful to explain why this evolution has profound implications in terms of trust.

We have seen that the number and diversity of operators will increase, that the wireless communication chain between the end device and the operated devices will become longer, that the mobility of the devices will increase, and that the overall number of devices will explode. Consequently, the two first items of the previous list (moral values and experience about a given party) will lose relevance: the compliance to the first becomes more difficult to observe and the increasing mobility of the devices

2 _{This encouragement can be realized by either providing rewards in case of good behavior (e.g., by}

means of micropayments) or by punishing misbehavior (e.g., by reducing the provided quality of service).

and the shorter lifetime of organizations makes the second more difficult. Rule en- forcement organizations will have to evolve, because some of the techniques they use are not scalable (this is the case for example when sending engineers in various parts of the country to make measurements about the power used by base stations). Hence these organizations will have to rely more and more on rule enforcement mechanisms. Rule enforcement mechanisms are indeed the way of the future. Whenever neces- sary, they will take into account the knowledge about usual behavior. These mecha- nisms can be classified in two categories. The first category aims at preventing bad things from happening and is typically based on security and cryptographic tech- niques. The second category aims at encouraging desirable behavior (or discouraging undesirable behavior). It usually quantifies the benefit to the user and leverages on game theory and mechanism design. Both categories can be complemented by anomaly detection mechanisms.

3.3 Adversary

Considering the diversity of upcoming wireless networks, it would be foolish to try to define a common adversary model: A threat on a vehicular network is not the same as one on a sensor network, for example. In the previous chapters, we have already described some possible misdeeds (hence giving some information about the attacker); in each of the following chapters of this book, we will define what the specific adversary is. Yet at this stage we will make several comments of general interest.

Malice and selfishness

As mentioned in the first chapter, an intuitive distinction between malice and selfish- ness consists in stating that the former refers to the willingness to do harm (which includes the access to personal data), whereas the second corresponds to the overuse of common resources such as a network or a radio spectrum.

In the classical security view, only the former is considered: for some reason there is an attacker, and it is willing to perpetrate its attack no matter what. This makes a lot of sense in the original application area, namely warfare: “we” are right, and we must make all possible efforts to fight our enemy and defeat it (breaking its cryptographic codes can be tremendously helpful to achieve that goal, as History has shown). But as we move from military to commercial settings, the motivation to deploy security mechanisms becomes weaker, leading to the unpleasant situation of today’s Internet, because (i) the attacker is much more difficult to identify, (ii) those who deploy the security mechanisms are not necessarily those who benefit from them (we will come back to this issue shortly), and (iii) the attempts to overuse the network resources (as is the case with spam) can be very difficult to thwart.

This shows that malice and selfishness must be considered jointly, if we want to seriously protect the wireless networks of the future. For this reason, we believe that the specialists in charge of these tasks must have an appropriate understanding of both security and game theory. Indeed, security techniques are useful to thwart malice, whereas game theory can help modeling (and therefore preventing) selfishness. But this segregation in two camps is a bit artificial, as we will see towards the end of this book. Yet the distinction between malice and selfishness is useful, and we will make use of the following definitions.

Definition 3.1

A misbehavior is the action of a party or group of parties consisting in deliberately departing from the standardized or otherwise prescribed behavior in order to reach a specific goal.

It is thus assumed that the standardized or prescribed behavior is of public knowl- edge.

Definition 3.2

A misbehavior is selfish (or greedy, or strategic) if it aims at obtaining an advantage that can be quantitatively expressed in the units (bitrate, joules, or coverage) of wireless networking or in a related incentive system (e.g., micropayments); any other misbehavior is considered to be malicious.

From this last definition, we see that a technique aiming at increasing one’s share of the bandwidth (in general at the expense of other users) is selfish. Likewise, an operator who increases the power of its base stations (thus leading to an overall degradation of the communication quality of the mobile users connected to the base stations of other operators) is selfish as well. A Denial-of-Service attack is malicious, but it can obviously rely on techniques borrowed from selfish attacks. Finally, an attack aiming at obtaining information about or from another user of the network (hence an attack against privacy) is malicious.

The distinction between Part II and Part III of this book is based on this defini- tion; as we will see, Part II corresponds to what is usually considered to be security concerns, whereas Part III focuses on cooperation issues. The last chapter of Part III shows how mechanisms to enforce cooperation can be designed based on security techniques.

An additional reason to consider both security and cooperation is that one of the explanations for the lack of deployment of security mechanisms is the lack of incentives to do so, especially when the failure to deploy a security mechanism falls on other people. This topic is considered to be important enough to have triggered the creation

of a workshop devoted to it: the Workshop on the Economics of Information Security (WEIS).

Yet another reason why malice and selfishness should be jointly studied is that, in a number of cases, the techniques to thwart them can (and in some instances, should) be combined. Here are a few examples.

• A mechanism aiming at enforcing a given behavior (designed for example with the help of game theory) needs to be secured in order to be effective. For example, reputation-based systems make sense exclusively if the involved parties can verify each others’ identities.

• A security mechanism can be modeled and studied as a game: the attacker is modeled as being one of the players while the other players represent the defendants; applications to intrusion detection in wired and in ad hoc networks can be found in [247] and in [262], respectively. In another example, players are peers running a protocol in which they progressively unveil information; see [76] for an application to the modelling of a rational exchange protocol.

• More generally, there is always a trade-off between security and usability, meaning that security should be properly calibrated with respect to the objective threat. Game theory, as it allows to express the preferences of the various parties, offers the perspective of substantial progress on that front.

Adversary models

A popular adversary model used in security is defined by Dolev and Yao [119]. This model notably assumes that the attacker can (i) be a legitimate party (e.g., a regis- tered network user), (ii) send and receive messages to any party in the network, and (iii) be a potential “man-in-the-middle” everywhere in the network (meaning that she is able to read, modify, block, replay, or insert any message anywhere in the network). Finally, the model assumes that the cryptographic primitives are unbreakable.

Nevertheless, in order to properly protect upcoming wireless networks, we need to modify this model.

• First, we need to include selfish opponents, as we have just explained.

• The Dolev-Yao attacker model may be too strong for our purpose, in the sense that the attacker of a wireless network does not necessarily have access to all com- munication links between all devices: for example, the attacker’s pervasiveness is a reasonable assumption against a specific mesh network, but not against a continent- wide vehicular network.

• The notion of physical location of the (wireless) parties becomes very important, as we will see in several of the following chapters.

• Likewise, the topology and the communication primitives of the network become very relevant. For example, as we will see, an attacker can try to disrupt the communication between legitimate parties by jamming a communication link or by fiddling with the route establishment protocols.

• The risk of capture and cloning must be taken into account, as we have already seen for the case of mesh networks.

• The huge number of parties (e.g., several thousand sensors per human being; a total of one billion road vehicles) makes key management a challenge per se. • Finally, specific attention must be devoted to the assumption of unbreakability of

the cryptographic primitives: no matter how much progress is made in technology, there will always be business opportunities for low tier devices, whose computing and communication capabilities will be very limited, thus calling for the design of ad hoc cryptographic primitives; in this case, the system model must take this issue into account.

Considering all these peculiarities as well as the diversity of the wireless networks that we have described in the previous chapter, it is clear that any attempt to define a single attacker model in wireless networks is doomed to fail. Consequently, in the following chapters we will describe the attacher’s model that we assume for each considered problem.

Note: It would be naive to believe that, just because the opponent needs to be in power range of the victim to perpetrate an attack, these attacks will be less frequent or less harmful than against wired networks. Indeed, the wireless attack can be carried out over the Internet, from a compromised device; or the attack can be perpetrated by devices that the opponent has previously installed in a given area of interest, and which she can monitor from a remote distance. Progress in technology will make this easier and easier to accomplish, unfortunately.

3.4 Summary

In this chapter, we have seen that some level of trust is needed for the proper func- tioning of a wireless communication system. We have also explained that the current trends in wireless networks require a thorough re-examination of how trust can be built and maintained in those networks. We have explained that malice and selfishness must be considered jointly, and that this can lead to solutions based on security and game theory considerations. Finally, we have refined the notion of adversary model in a wireless setting.

3.5 To probe further

Trust has been investigated by a number of computer scientists. When checking the literature, it is very important to bear in mind that different authors may have different definitions or interpretations of the notion of trust.

Trust for inter-realm authentication in large distributed systems is discussed in the contribution by Gligor, Luan, and Pato [153]. Blaze, Feigenbaum, and Lacy have proposed “PolicyMaker” [55], a decentralized trust management language and system supporting the specification of trusted actions and trust relationships. This work inspired a subsequent trust management system called KeyNote, described in an IETF RFC [54]. These ideas were further explored by Yu, Winslett, and Seamons [389], notably for automated trust negotiation. Kohlas and Maurer provide a solution for confidence valuation in a public-key infrastructure based on uncertain evidence [226]. Trust in decentralized systems can be based on reputation. A general reflection on reputation in future communication systems can be found in the work by Mundinger and Le Boudec [283].