MABS: Multicast Authentication Based on Batch Signature

Conventional block-based multicast authentication schemes overlook the heterogeneity of receivers by letting the sender choose the block size, divide a multicast stream into blocks, associate each block with a signature, and spread the effect of the signature across all the packets in the block through hash graphs or coding algorithms. The correlation among packets makes them vulnerable to packet loss, which is inherent in the Internet and wireless networks. Moreover, the lack of Denial of Service (DoS) resilience renders most of them vulnerable to packet injection in hostile environments. In this paper, we propose a novel multicast authentication protocol, namely MABS, including two schemes. The basic scheme (MABS-B) eliminates the correlation among packets and thus provides the perfect resilience to packet loss, and it is also efficient in terms of latency, computation, and communication overhead due to an efficient cryptographic primitive called batch signature, which supports the authentication of any number of packets simultaneously. We also present an enhanced scheme MABS-E, which combines the basic scheme with a packet filtering mechanism to alleviate the DoS impact while preserving the perfect resilience to packet loss.

传统的基于块的组播认证方案通过让发送方选择块大小、将组播流划分为块、为每个块关联一个签名，并通过哈希图或编码算法将签名的影响扩展到块中的所有数据包，从而忽视了接收方的异构性。数据包之间的相关性使它们容易受到数据包丢失的影响，而数据包丢失在互联网和无线网络中是固有的。此外，缺乏拒绝服务（DoS）弹性使得它们中的大多数在恶劣环境中容易受到数据包注入的攻击。在本文中，我们提出了一种新颖的组播认证协议，即MABS，包括两种方案。基本方案（MABS - B）消除了数据包之间的相关性，从而对数据包丢失具有完美的弹性，并且由于一种称为批量签名的高效密码原语，它在延迟、计算和通信开销方面也是高效的，该原语支持同时对任意数量的数据包进行认证。我们还提出了一种增强方案MABS - E，它将基本方案与数据包过滤机制相结合，以减轻DoS影响，同时保持对数据包丢失的完美弹性。