Efficient and Secure Source Authentication for Multicast.

TLDR

Source authentication in multicast is challenging, especially when receivers are untrusted and packet loss is unretransmitted, and existing schemes lack satisfactory efficiency across key parameters. The paper proposes substantial modifications and improvements to the TESLA multicast authentication scheme. The proposed scheme, TESLA, relies on loose time synchronization and delayed key release from the sender. The modifications enable near‑instant packet authentication, improve scalability, reduce space overhead, and strengthen resistance to denial‑of‑service attacks.

Abstract

One of the main challenges of securing multicast communicationis source authentication,or enabling receivers of multicast data to verify that the received data originated with the claimed source and was not modified enroute. The problem becomes more complex in common settings where other receivers of the data are not trusted, and where lost packets are not retransmitted. Several source authentication schemes for multicast have been suggested in the past, but none of these schemes is satisfactorily efficient in all prominent parameters. We recently proposed a very efficient scheme, TESLA, that is based on initial loose time synchronization between the sender and the receivers, followed by delayed release of keys by the sender. This paper proposes several substantial modifications and improvements to TESLA. One modification allows receivers to authenticate most packets as soon as they arrive (whereas TESLArequires buffering packets at the receiver side, and provides delayed authentication only). Other modifications improve the scalability of the scheme, reduce the space overhead for multiple instances, increase its resistance to denial-of-service attacks, and more.