行動IPv6中繞送最佳化機制下之連結更新認證協定

行動IPv6是在網際網路通訊協定第六版通訊協定上，讓行動裝置在不破壞原有的架構下，更換其連結點卻不影響到其它的網路節點或正在執行的應用程式。為了提供這項服務，行動IPv6引入一個新的網路節點：本地代理者 (Home Agent)。本地代理者會記錄行動裝置新取的網路位址，並將送往行動裝置的封包轉送到新的網路位址。然而本地代理者的引進雖然解決了移動的問題，但是新的問題也跟著產生。如果來源端和目的地端相當接近，而本地代理者卻在相當遠的地方，從來源送給目的地端的封包會先送到本地代理者的所在地再轉送到目的地端，因為來源端和目的地端相當接近，所以這種方法增加很多的傳送延遲。解決這問題的方法就是讓來源端和目的地端直接傳輸，這種方法叫做「繞送最佳化」，但卻引發安全性的問題。為了解決上述的安全性問題，許多的協定被提出來。在本論文中，我們分析這些協定抵擋攻擊的能力，並考量執行效能。最後，有三個協定被提出來解決「繞送最佳化」上的安全性問題，其中一個是以現有架構為基礎的協定，另外兩個協定則是以密碼學產生位址(Cryptographically Generated Addresses)技術為基礎。以現有架構為基礎的協定提供最好的安全防護，但是對阻斷式攻擊依然沒有有效的防護。另兩個協定則是將現有利用密碼學產生位址技術協定的安全性漏洞加以填補並改進其執行效率。在本論文的最後，這三個協定的安全性與執行效率將會被完整的分析。

關鍵字

鑰匙交換認證；連結更新安全；安全性分析；行動IPv6

並列摘要

Mobile IPv6 (MIPv6) is a protocol proposed by IETF organization and based on Internet Protocol (IP) version 6 to support mobility. In order to support mobility, MIPv6 uses an additional network node, Home Agent (HA), with a fixed network address. Packets sent to HA first and HA relayed them to the destination. This mechanism introduces another problem: even if the sender and the receiver are close, the sender still has to send packets to the remote HA, which then relay them to the remote receiver. It increases unnecessary routing. This problem is named “Triangle Routing” Problem. IETF proposes “Route Optimization” to solve this problem. The sender sent packets to receivers directly instead of relaying from HA. Although it solves the delay caused by triangle routing problem, it introduces security issue. Several protocols were proposed to solve security problems in Route Optimization. We list all possible attacks to analyze these protocols. In the protocol analysis, some flaws are found in these protocols. Beside the security issues, performance of the protocol is under consideration. Three Protocols was proposed in the paper, one is based on existed infrastructure, and the others are based on Cryptographically Generated Addresses (CGA) technology. The infrastructure-based protocol solves most threats in binding update except the Denial of Service (DoS) attack. The other two protocols fix the loophole in other CGA-based protocols and improve the performance. At last, the three protocols are evaluated in security and performance.

並列關鍵字

Secure Binding Update ； Security Analysis ； Authentication Key-Exchange ； Mobile IPv6

參考文獻

[1] J. Arkko and P. Nikander. “Weak Authentication: How to Authenticate Unknown Trusted Parties”, Proceedings of Security Protocols Workshop 2002, April, 2002

[2] S Deering, R. Hinden, “Internet Protocol Version 6 (IPv6) Specification,” IETF RFC 2460, December 1998

[3] R. H. Deng, J. Zhou, F. Bao, “Defending Against Redirect Attacks in Mobile IP”, CCS’02, November 2002.

[4] R. Droms, J. Bound, B. Volz, T. Lemon, C. Perkins, M, Carney, “Dynamic Host Configuration Protocol for IPv6 (DHCPv6)”,IETF RFC 3315, July 2003

[9] W. Mao, “Modern Cryptography Theory and Practice”, Prentice Hall PTR, 2004

國際替代計量

行動IPv6中繞送最佳化機制下之連結更新認證協定

全文下載

主題瀏覽