線性同餘和鑰匙交換的階層存取控制在行動隨意網路安全之研究

A Study on MANET Security Based on Hierarchy Access Control with Linear Congruence and Key Exchange

陳至睿(Chih-Jui Chen)

指導教授 ： 涂世雄

中原大學/工學院/電機工程研究所/碩士(2005年)

https://doi.org/10.6840/cycu200500104

摘要

摘要

在本論文中,我們針對行動隨意網路認證安全協定提出基於階層式存取控制使用線性同餘和鑰匙交換之新的認證安全協定,我們不但應用在行動隨意網路的安全同時也降低整個系統的複雜度以及計算量。
在我們新的認證安全協定中,我們使用了線性同餘之方法，在安全層級較高使用者可以推算出層級較低使用者的秘密鑰匙，反之則不然，同時透過我們所提出的認證安全架構,即使使用者突然加入、離開原先的使用者並不需要改變其秘密鑰匙。另外我們又有另一個想法那就是再加上鑰匙交換方式,來減少資料傳輸路徑，這樣一來，我們便同時提供了認證和安全機制。

我們研究主要貢獻有下列幾點:
(1)我們結合秘密鑰匙以及互斥或閘運算減少整個系統的複雜度及運算量。
(2)我們設計單向函數的方法來避免群體鑰匙因使用者突然加入、離開而改變。
(3)使用鑰匙交換技術來減少資料傳輸路徑而不需要在透過上面的使用者來幫忙傳送資料。
(4)本架構整合密碼學、階層架構、線性同餘以及鑰匙交換來達到同時認證及安全對於所有使用者。
我們相信運用本論文所提出的架構,會讓行動隨意網路更加的安全以及便利。

關鍵字

階層式存取控制 ； 鑰匙交換 ； 線性同餘 ； 行動隨意網路

並列摘要

Abstract
In this thesis, we propose two authentication protocols and security schemes for MANET based on hierarchy access control, symmetric key cryptosystem, and hierarchy structure. We will make an application of our scheme on MANET security. We also make detailed security analysis about our schemes. The proposed new protocol not only at the same time offer security and authentication on MANET but also reduce systematic complexity and calculating amount.
Our first proposed scheme operational complexity is based on hierarchy access control with linear congruence. In this scheme, via the generated public parameter, the higher level mobile node (predecessor) can derive the secret key of the lower level mobile node (successor). However, the lower level mobile node (successor) can not be able to deduce the secret key of the higher level mobile node (predecessor). There is an another idea proposed by the authors. Except transmitting information form lower level to upper lever, the mobile nodes are also allowed to transmit information to the nodes on the same level with it. For this reason, our second scheme is given based on hierarchy access control with Diffie – Hellman key exchange. In this scheme, through the exchange key scheme, the nodes on the same level can derive the same key for information transmission.
The contributions of our new scheme are as follows:
(1)Reducing complexity and calculating amount of the whole system
The feature of our scheme is that authentication and security protocol is based on secret key system and bit-wise XOR operations to make whole system simpler and reduce calculation amount.
(2)Group key needn't change
Our proposed scheme designs a one-way function with simple linear congruence. By this characteristic, dynamic mobile node such as inserting a group, deleting a group, changing a key etc., can be implemented simply.
(3)Reducing the route
We use Diffie – Hellman key exchange in the same level. Utilizing this method, mobile nodes do not need to take the place of spreading through the node above while transmitting the data. And then jumping one hop directly in the same level can reduce the route.
(4)Integrating multi-techniques
The techniques of hierarchical structure, secret key cryptography and Number Theory are integrated to reach at the same time security and authentication among all participators.
We trust that the results of our research in this thesis will be more helpful to future research in the area of the authentication and security protocols in MANET.

並列關鍵字

Diffie-Hellman Key Exchange ； MANET ； Linear Congruence ； Hierarchy Access Control

參考文獻

[1]C. H. Lin and P. J. Lee, “Several practical protocols for authentication and key exchange,” Information Processing Letters, Vol.53, 1995, pp.92-95.

[2]J. McHung, and A. P. Moore, “A security policy and formal top level specification for a multilevel secure local area network,” Proceedings IEEE Symposium on Security and Privacy, Oakland, CA, April 7-9, 1986, pp. 43-49.

[9]G. I. Davida, D. L. Wells, and J. B. Kam, “A database enctyption system with subkeys,” ACM Transaction Database System, Vol6, No. 2, 1981, pp.312-328.

[11]IETF Working Group： Mobile Ad hoc Networks (MANET). http://www.ietf.org/html.charters/manet-charter.html.

[14]Charles E. Perkins and Pravin Bhagwat, “ Highly Dynamic Destination-Sequenced Distance-Vector routing (DSDV) for Mobile Computers,” In Proceedings of the SIGCOMM ’94 Conference on Communication Architectures, Protocols and Applications, August 1994, pp. 234-244.