具有安全性考量的動態路由機制

Dynamic Routing with Security Considerations

詹勝(Sheng-Kun Chan)

指導教授 ： 逄愛君

國立臺灣大學/電機資訊學院/資訊工程學研究所/碩士(2005年)

https://doi.org/10.6342/NTU.2005.00732

摘要

資訊安全已經成為在無線網路及有線網路上傳輸資料的重要議題。過去的研究主要是在加解密演算法的設計以及系統架構上的整合。我們則是針對利用網路上的路由機制，來達到增加資訊安全性的目的。我們提出了一個動態路由機制，能夠隨機的挑選傳送封包的路徑、減少路徑相似度（連續兩個封包傳送路徑的相同連結數）。所提出的機制容易實作，而且可以與目前現存的網路路由機制相容，像是有線網路上的Routing Information Protocol (RIP) 或是無線網路上的 Destination-Sequenced Distance Vector (DSDV) 路由機制，且沒有增加控制封包的數量。我們也在數學分析上做了相關的研究，並使用了相關的實驗方法來驗證所提出的機制。

關鍵字

路由機制 ； 網路安全

並列摘要

Security has become one of the major issues for data communication
over wired and wireless networks. In the past decades, various
security-enhanced measures have been proposed to improve the
security of data transmission over public networks. Existing work
on security-enhanced data transmission includes the designs of
cryptography algorithms and system infrastructures and
security-enhanced routing methods. The common objectives of the
aforementioned methods are often to defeat various threats over
the network, including eavesdropping, spoofing, session hijacking,
etc.

Different from the past work on the designs of cryptography
algorithms and system infrastructures, we aim at the proposing of
a dynamic routing algorithm that could randomize delivery paths
for data transmission. Based on distance-vector exchanges, the
algorithm can be easily implemented over the existing popular
routing protocol, such as Routing Information Protocol (RIP) in
wired networks and Destination-Sequenced Distance Vector (DSDV)
Protocol in wireless networks, without introducing extra control
messages.

A proper integration of dynamic routing and cryptography-based
system designs would further and significantly enhance the
security of data transmission over the networks. For example, the
security level could be increased when the feedback cipher mode of
block ciphering algorithms (e.g., DES and AES), such as Cipher
Block Chaining (CBC) and Cipher Feedback (CFB), is adopted.
Furthermore, if a key-exchange mechanism (e.g., the Internet Key
Exchange (IKE)) is used during data transmission, less packets
encrypted by some specific key can be obtained by attackers, which
makes it more difficult to derive the original plain text.

An analytic study on the proposed algorithm is presented, and a
series of performance evaluation is conducted to verify the
analytic results and the capability of the proposed algorithm.
Analytic and experimental results show that our proposed algorithm
introduces a considerably small emph{path similarity} (i.e., the
number of common links between two paths) of two consecutive
packets transmitted and greatly outperforms the standard
shortest-path and equal-cost routing algorithms.

並列關鍵字

routing ； security

參考文獻

[1] G. Apostolopoulos, V. Peris, P. Pradhan, and D. Saha. Securing Electronic Commerce: Reducing the SSL Overhead. In IEEE Network, 2000.

[3] D. Collins. Carrier Grade Voice Over IP. McGraw-Hill, 2003.

[5] J. Daemen and V. Rijmen. The design of Rijndael: AES

[8] I. Gojmerac, T. Ziegler, F. Ricciato, and P. Reichl. Adaptive Multipath Routing for Dynamic Tra±c Engineering. In IEEE Global Telecommunications Conference, 2003.

Systems Symposium: Works in Progress Session, 2003.