Mobile IP的匿名註冊協定與安全機制

An Anonymous Authentication Protocol and Security Scheme of Mobile IP

黃宗賢(Tsung-Hsien Huang)

指導教授 ： 涂世雄

中原大學/工學院/電機工程研究所/碩士(2004年)

https://doi.org/10.6840/cycu200400243

摘要

摘要

在本論文中,我們針對Mobile IP認證協定提出基於對稱式密碼系統與階層式存取控制之新的匿名認證協定,我們不但應用在最佳換手路徑(handoff)的安全同時也降低整個系統的複雜度以及計算量。
在我們新的匿名認證協定中,此系統中HA與MN擁有共同的秘密金鑰同時透過我們所提出的匿名認證架構,可以使HA快速確認MN的合法性。接著利用PHA與HA擁有共同的秘密金鑰,HA得以使用PHA去確認FA的合法性。最後,FA利用HA和MN擁有共同的秘密金鑰,使得FA可以確認MN和HA的合法性,這樣一來,我們便完成了三方雙向認證及註冊。

我們研究主要貢獻有下列幾點:
(1) 我們結合秘密鑰匙以及互斥或閘運算減少軟硬體設計,整體計算複雜度。
(2) 我們利用匿名認證的方式來降低資料被入侵者竊取的機會
(3) 使用匿名技術和票以及憑證資料來保護資料的機密,再使用隨機數值預防重送攻擊及中間人攻擊法。
(4) 本架構整合密碼學、階層架構以及匿名技術來達到所有成員雙向認證。
我們相信運用本論文所提出的架構,會讓Mobile IP更加的安全以及便利。

關鍵字

行動IP ； 匿名認證協定

並列摘要

Abstract
In this thesis, we propose a new anonymous authentication protocol and security scheme for Mobile IP based on anonymous technique, symmetric key cryptosystem, and hierarchy structure. We will make an application of our scheme on optimized smooth handoff path. We also make the comparison of performance among existent authentication protocols. The proposed new protocol not only improves shortcoming of existent Mobile IP authentication protocols but also reduces the load of authentication.
In the process of designing mechanisms of authentication protocol for Mobile IP, we use anonymous technique to hide the role of the mobile node (MN). At first, according to this quality, we let the cost and complexity of hardware design to be enormously reduced. In addition, we employ hierarchy structure to make mutually authentications among home agent (HA), foreign agent (FA), and MN. It make authentication via the certificate authority (CA), the predecessor of FA (PFA). Using hierarchy structure, the loads of HA, FA and CA can be reduced. Hence, some extra steps will be added. Next, we use symmetric key cryptosystem to make the transport datagram more secure and avoid the invader to steal our information. In contrast, it has a drawback that it will increase capacity of datagram. Then, an example will be given to be an application of our scheme on optimized smooth handoff path. Finally the practical considerations for the application of our scheme will be described.

Our proposed schemes can be separated into three phases that one stated as follows:
In the phase one, the authentication of MN with HA is executed via FA. It employs symmetric key cryptosystem to achieve the identity authentication without even the spirits knowing about it. In the phase two, the legality of FA is checked by HA with hierarchy structure. In the same time, the legality of HA and MN is checked by FA with hierarchy structure in the phase three.

The contributions of our new scheme are as follows:
(1) Making the hardware and software design simpler
The feature of our scheme is that the mechanism of authentication protocol is based on secret key system, bit-wise exclusive and operations are used to make the hardware and software design simpler. Hence, the whole overhead computation complexity and cost of MN are curtailed.
(2) Hiding the identity of MN
Anonymous authentication scheme can avoid expose the identity of MN. It also can reduce the chance for the invader to get the datagram of MN. It gets a batter performance secure communication than the existent authentication protocols of Mobil IP.
(3) Improving confidentiality
Three techniques are adopted to improve the confidentiality of our protocol. They are described as follows.
(i)Anonymity is used to protect the data confidentiality.
(ii)Ticket (T) and Certificated data (Cd) are used to promote the identity confidentiality.
(iii)The random number is used to avoid reply attack and man-in-the-middle attack.
(4) Integrating multi-techniques
The techniques of hierarchical structure, secret key cryptography and anonymity are integrated to reach mutual authentication among all participators.

We trust that the results of our research in this thesis will be much helpful to future research in the category of the authentication protocols of Mobile IP.

並列關鍵字

Anonymous Authentication Protocol ； Mobile IP

參考文獻

〔46〕黃宗驥, 數位化校園文件安全傳送協定之研究, 中原大學電機工程學系碩士論文, 2003.

〔47〕張峻榮, 以混合式存取控制建構數位化校園之文件存取方案, 中原大學電機工程學系碩士論文, 2003.

〔51〕魏瑋志, 基於階層式存取控制之鑰匙交換, 中原大學電機工程學系碩士論文, 2003.

〔2〕Charles E. Perkins, Sun Microsystems "Mobile IP", IEEE Communication Magazine, May 1997

〔3〕Perkins, C.E., “Mobile IP Support”, IETF RFC 2002,Oct. 1996