Keywords

1 Introduction

The large-scale development of Internet and use of electronics meant for communication resulted the new digital era of communication. The data or information can be sent to various network like unicast, broadcast, multicast, etc. In the case of unicast, there is one-to-one communication, while in case of broadcast one-to-all communication and in case of multicast the communication is between one source to a group of destinations. The demand of multipoint communications (multicast) among various parties is increasing. Unicast communications are overheaded and underutilized. Multicasting is increasing day by day for various applications such as video on demand (VoD), IPTv, broadcasting, and stock quotes. The multicast IP address is well known as class D. That is why, there are many security obstacles present in multicast. There is a need to maintain security goals to provide security at source and group ends. In multicast network, the source is not necessarily member of the group, so untrusted source may cause the rescuer deployment of the multicast services. Hash and digital signatures are the used for integrity [1], authentication, and non-repudiation. However, these mechanisms is used to design for point-to-point [2] transmission, and embedded in multicasting.

Multicast communication suffers from various challenges such as congestion, security threats, and addressing and the security threat is a biggest challenge in the multicast. This challenge is handled by source authentication and group authentication. Source authentication is main objective of proposed work. The researchers [3,4,5,6,7,8,9] have provided the mechanism for source authentication. The authors have used RSA [10, 11] for digital signature to achieve the source authentication [12], but existing mechanisms suffered from computation overhead and communication overhead. To solve these problems, we are proposing source authentication mechanism which is based on Elliptic Curve Cryptography Digital Signature Algorithm (ECDSA) [13, 14] for multicasting. The proposed approach is known as Elliptic Curve Cryptography Source Authentication (ECCSA).

2 Related Works

The literature possess several approaches and models for providing source authentication in multicast communication. The issues and challenges in the area of multicast security are described in this section existing multicast source authentication protocol such as simple off-line chaining, tree chaining, EMSS, and HMSA are described with their advantages and disadvantages.

In Hash chaining [9] scheme, the working of sender and receiver are described below into the blocks [15] then the hash of the first block is computed and signs the hash of the first block. The technique of the hash chaining scheme, sender first divides message M into 4 blocks {B1, B2, B3, B4} then computes the hash of the first block, signs it, and transmit to each receiver.

In tree chaining [16, 17] scheme each packet carries the required authentication information so that each can be individually verifiable. In other words, even if n − 1 out of n packets are lost the authenticity of the single received packet can be verified. The stream is signed block by block.

Efficient Multi-chained Stream Signature (EMSS) [18, 19] scheme each packet of the stream is hash linked [20, 21] to many target packets. Even if some packets are lost; a received packet is verifiable if it remains a hash-link path that relates the packet to a signature packet. For a given packet, the EMSS chooses target packets randomly.

Jin et al. [22] proposed a hybrid approach (HMSA) in which hash tree and hash chaining scheme are combined. In this approach, the author has targeted on the main disadvantage that occurs with both the scheme.

This section explained the existing multicast source authentication protocol with non-repudiation [11] and their advantages and disadvantages. There is no scheme which will satisfy all the requirements for multicast source authentication. In the next section, a novel multicast source authentication with non-repudiation protocol hash redundancy mitigation scheme for multicast source authentication [23] is proposed which makes a tradeoff between communications overhead [24] and robustness [25] against the packet loss.

3 Proposed Method

Multicast communication suffers from various attacks such as distributed denial of service (DDoS) [26, 27], Message modification [25], replay attacks [28], and eavesdropping [29]. The attacker uses the source as data transmitter or it works as a source of data because multicast IP address [30] are well known to everyone. There is a need to provide a mechanism which protects the source of multicast communication and mechanism is known as multicast source authentication (MSA). This subsection is providing the procedure for packet generation procedure [31] and packet verification [32] procedure as follows:

Sender Side

Packet Generation Procedure: M is a message of any size and message is divided into blocks. The block size may be 2, 4, 8, 16, 32, 64, and 128(packets) (Fig. 1).

Fig. 1
figure 1

a Hash generation process for block 1. b Hash generation process for block 2

Full size image

Hash Generation: The main arguments of the proposed work are based on following procedure.

  • Sender generates H ij (i = 1 and j = 1to 8) of first block root hash [H118] by using packet hashes H11, H12, H18 and hashes of the internal node. Similarly for others blocks.

  • Sender signed over root hash of the first block.

  • Sender sends signed hash of first block root to each receiver

  • Sender sends first packets P11 of block one with packet ID, sibling hashes of current packet path to root (H12, H134, and H158) and second block root hash [H118].

  • Sender sends the second packet with only first packet hash value h11. Because it uses to generate root hash of the value H11. Because it is used to generate root hash of the sender side.

  • Now, Sender sends the P13 with H14 and H12 only and uses the stored values to generate the root of the first block.

  • Sender sends the P14 with only H13.

  • Now, sender sends packets P15, P16, P17, and P18 according to step 4, 5, 6 and 7. So sender sends P15 with a sibling (H16, H178, H118) with second block root [H118], P16 with H15 and P17 with H18+H156.

  • Repeat all steps for n − 1 block and with last block no need to send the signature root packet.

Signature Generation & Distribution: Associate the root hash (H) of packet Pi with signature and does the following:

  • Choose a random number k (integer) between 1 to N − 1.

  • Generate Hash (P)

  • Generate the curve point k ·G = (a, b)

  • Generate e = a mod N. If e = 0 then go back to step 1

  • Generate \( d = (k^{ - 1} )\left( {h_{l} + ed_{a} } \right)\bmod \,N \). if \( d = 0, \) then go to step 1.

  • Sender’s signature for the root hash of packet Pi is the pair of integers (e, d).

Receiver Side

To verify Sender signature (e, d) on H: Receiver associated with public key C a does the following:

  • Verify that e and d are integers between 1 to (N − 1)

  • Generate h = H(m)

  • Generate \( t = (d^{ - 1} ) \, \text{mod}\, N \)

  • Generate \( v1 = h_{l} t\, \text{mod}\, N \) and \( v2 = et\, \text{mod}\, N \)

  • Generate curve point x \( v1G + v2 \) C a

  • If a = 0, then reject the signature, \( v = a\, \text{mod}\, N \)

  • Accept the signature if v = e.

Digest Regeneration and Verification of Root Hash

  • Receivers first receive the signed hash root of the first block.

  • Receivers unsigned the root hash and store it.

  • Receivers receive packet P11 and compute H11.

  • Now regenerate the hash root of the first block with help of H12, H134, H158 and computed first block root hash [H118].

Receivers verify the authentication of P11, H12, H134, H58 and second block hash of root, if stored root hash of block one is identical with the computed root hash of block one (Fig. 2).

Fig. 2
figure 2

a Hash verification process of block 1. b Hash verification process of block 2

Full size image

  • Receivers store the value H12, H134, H156; second block root hash [H118].

  • Receivers get P12 along with previous packet hash, i.e., H11 then it computes the hash [33] of packet P11 and generates first block root hash with the help of store hashes. If computed first block root hash H118 is identical with stored first block root H118, so source is authentic along with packet P2.

  • Same way receiver received packet P3, P4 and with the help of stored value of hash to generate the first block root hash H118. The proposed work flow chart is given in Fig. 3.

Fig. 3
figure 3

Flowchart of the proposed work

Full size image

4 Result Analysis and Discussion

We use QualNet simulator version 5.0 to simulate our work. QualNet simulator provides wide a variety of simulations

A platform that can predict wireless wired and mixed platform network and networking device performance.

4.1 Parameters Used

There are following parameters used for implementation of the work are shown in Table 1.

Table 1 List of implementation parameters
Full size table

4.2 Experimental Topology

The general scenario of multicast is shown in Fig. 4. In this topology, there is one source and there are eight receivers. Source needs to send packet only once then in the network cloud there are many numbers of routers which makes a copy of the packet and send to its neighbor routers. Finally, packet is reached to the end router which makes many copies of packet as the number of receivers in a particular multicast group then transmit the packet to that entire receiver.

Fig. 4
figure 4

Experimental topology

Full size image

4.3 Result Analysis

There are many schemes [34, 35] discussed in literature survey and they used the RSA for source authentication for multicasting. According to NIST recommendation, achieving 128-bit security means that the RSA key should be at least 3072 bits although the same security can be provided using Elliptic Curve Cryptography Digital Signature Algorithm (ECDSA) [36] with the key of 256 bits. Hence the key size has been reduced.

Effect of Packet Size on Computation Time

It can be observed from the Fig. 5 that the computation time in case of HTS is highest and computation time SHS and HTSS are approximately equal and greater than ECCSA scheme.

Fig. 5
figure 5

Block size versus commutation time

Full size image

Effect of Packet Size on Computation Time

It can be observed from the Fig. 6 that the computation time in case of HTS is highest and computation time SHS and HTSS are approximately equal and greater than ECCSA scheme.

Fig. 6
figure 6

Block size versus communication overhead

Full size image

Effect of Packet Size on Communication Overhead

It can be observed from the Fig. 7 that the communication overhead is less than SHS, HTS, and HTSS.

Fig. 7
figure 7

Block size versus verification rate

Full size image

Effect of Packet Size on Verification Rate

It can be observed from the Fig. 8 that the verification rate of ECCSA is greater than the HTS [37] but less than HTSS and SHS. The verification rate is a little bit less but the other advantage of ECCSA schemes is less communication overhead because the ECCSA scheme did not send the redundant data through the channel.

Fig. 8
figure 8

Schemes versus communication overhead

Full size image

Effect of Packet Size on Communication Overhead

Figure 8 shows the comparative result of existing schemes and purposed scheme. The base of comparison is communication overhead on block size 16 (packets). It can be observed from the graph that the communication overhead is less than the SHS, HTS and HTSS.

5 Conclusions

The multicast source authentication technique known as Elliptic Curve Cryptography Source Authentication is proposed. This approach is a combination of two different algorithms which perform its operation according to network conditions. This scheme is used to reduce the computation overhead and communication overhead and the scheme have less communication overhead as compared to SHS, HTS, and HTSS.

The proposed work is for wired multicast communication model but rapid growth of wireless communication and wireless-based application like military application, software updates, audio, video conferencing, intelligent houses etc. force us to deploy the techniques for multicast source authentication with non-repudiation which can efficiently work on wired as well as wireless (heterogeneous) environment.