Time Valid One-Time Signature for Time-Critical Multicast Data Authentication

It is challenging to provide authentication to time-critical multicast data, where low end-to-end delay is of crucial importance. Consequently, it requires not only efficient authentication algorithms to minimize computational cost, but also avoidance of buffering packets so that the data can be immediately processed once being presented. Desirable properties for a multicast authentication scheme also include small communication overhead, tolerance to packet loss, and resistance against malicious attacks. In this paper, we propose a novel signature model - Time Valid One-Time Signature (TV-OTS) - to boost the efficiency of regular one-time signature schemes. Based on the TV-OTS model, we design an efficient multicast authentication scheme "TV-HORS" to meet the above needs. TV-HORS combines one-way hash chains with TV-OTS to avoid frequent public key distribution. It provides fast signing/verification and buffering-free data processing, which make it one of the fastest multicast authentication schemes to date in terms of end-to-end computational latency (on the order of microseconds). In addition, TV-HORS has perfect tolerance to packet loss and strong robustness against malicious attacks. The communication overhead of TV-HORS is much smaller than regular OTS schemes, and even smaller than RSA signature. The only drawback of TV-HORS is a relatively large public key of size 8 KB to 10 KB, depending on parameters.

I. Introduction

Multicast authentication is a security primitive that enables each receiver in the multicast group to verify if received data originates from the claimed sender and was not altered on the way. In this paper, we focus on multicast authentication of time-critical messages. Our work is motivated by the need for authenticating time-critical multicast data in the power grid, which is one of the largest cyber-physical critical infrastructures and is being transformed today with the design and development of advanced real-time control applications [1]. These applications aim to allow timely control of power flow over physical power networks based on data from monitoring and control devices such as PMUs (Phasor Measurement Units) and relays. One of the goals of such systems is to prevent cascading failures that lead to blackouts [3]. For example, in the NASPI (North American SynchroPhasor Initiative) [2], each PMU senses and multicasts system environment data to control centers at a frequency of 30 samples per second. To provide exact control and in-time abnormality detection, such data often needs to be processed fast with low processing delay (several milliseconds at most). Given the nature of critical decisions based on this data, authentication is essential to prevent adversaries from forcing catastrophic decisions by modifying or forging data. Another example is found in current substation communication systems where critical messages related to transient faults (e.g., caused by lightning) need to be shared in a multicast manner across LANs within 4 ms [4]. Hence, efficient multicast authentication of time-critical data is crucially important to the power grid as well as other similar critical infrastructures. We believe time-critical multicast authentication has wide applicability in many delay sensitive applications.