Secure and Dynamic Publish/Subscribe: LCMsec: Attacker Model and Security Goals

Table of Links

Abstract and Introduction

Related Work

Description of LCM

Attacker Model and Security Goals

LCMSec: The Proposed Protocol

Implementation and Evaluation

Conclusion

Appendix and References

IV. ATTACKER MODEL AND SECURITY GOALS

We consider active and modifying attackers in the system. Security is provided only against outsiders: we do not consider an attacker who has the permission to send on the multicast group in question (please refer to the discussion on permission management in Section V-B1). The attacker has considerable, but limited resources and cannot break common cryptographic primitives.

Since channelnames in LCM are usually domain-specific topics, they should remain confidential. LCMsec aims to provide confidentiality and integrity of not only the messages in transit, but also the channelname associated with them. We also provide a notion of authenticity: messages are guaranteed to have originated from a trusted entity within the LCMDomain, but cannot be attributed to a specific entity.

We provide a reduced form of security against an attacker, who has no permission to send on a specific channel, but can send on some other channel within the group. Against this type of attacker, the integrity and accountability guarantees remain unchanged, however, confidentiality is provided only for the contents of messages, not for the channelname (or topic) associated with messages. We elaborate on the reason for this trade-off in Section V-A.