行動IPv6網路路由最佳化安全性之研究

Security of Route Optimization in Mobile IPv6 Networks

楊富丞(Fu-Chen Yang)

指導教授 ： 陳彥錚

國立暨南國際大學/管理學院/資訊管理學系/碩士(2009年)

https://doi.org/10.6837/NCNU.2009.00048

摘要

現今許多無線應用程式和行動通訊多是透過IP網路所提供服務，因而增加廣大的行動使用者數量，但IP位址的短缺與行動支援等問題隨之而來。因此IETF組織在IPv6網路中詳細定義行動支援的部份，稱為行動IPv6 (Mobile IPv6)，它允許行動使用者在IPv6網路中隨意移動並仍保持連線。當行動使用者移動到不同的網路，它仍然可以就由原屬網路所轉送的封包來保持通訊。然而，溝通對象並未得知行動使用者的移動，故持續將封包傳送至使用者的原屬網路，再由原屬網路透過tunnel方式傳送至行動使用者目前的位址，而此非直接封包傳送方式稱為三角路由。三角路由雖可提供行動性，但卻大幅增加節點中通訊延遲，為了避免三角路由所帶來的問題，IETF組織利用連結更新訊息使得節點間能夠直接通訊，該方式稱為路由最佳化。
為了確保連結更新訊息的完整性，返回路由程序則被採用來防範連結更新過程中所可能遇到的威脅。然而，返回路由程序卻遭受許多攻擊。故在此論文中，我們介紹兩個不同的IPv6驗證環境並分別提出兩個確保連接更新訊息的機制。環境一是無基礎式架構，在該環境中並無任何信認第三方或是驗證中心，我們利用無狀態式、輕量運算與CGA等特點分別依據Diffie Hellman金鑰協議與幾何計算為基礎提出兩個協定。環境二是基礎式架構，在該環境中存有信任第三方與AAA伺服器於各網路領域中，我們依據不同的隱私需求分別提出以pairing為基礎之多PKG身分識別多簽章與加密機制來確保連結更新訊息的不可否認性與機密性。

關鍵字

行動IPv6 ； 連結更新 ； 路由最佳化 ； 返回路由程序 ； 無狀態式 ； 幾何計算

並列摘要

Many wireless applications and mobile communication services are provided through IP networks. This brings the increased popularity of mobile users, but also introduces the problems of IP address shortage and demands for mobility support in IP networks. Therefore, IETF defines mobility support in IPv6, i.e. MIPv6, to allow nodes to remain reachable while moving around in the IPv6 internet. When a node moves and visits a foreign network, it is still reachable through the indirect packet forwarding from its home network. This triangular routing feature provides node mobility but increases the communication latency between nodes. In order to further eliminate triangular routing, IETF proposes a binding update (BU) scheme, which enables nodes communicate directly. This process of enabling direct packet delivering is called Route Optimization.
To protect the security of BU message, a Return Routability (RR) procedure was proposed. However, it was found that RR is vulnerable to many attacks. In this thesis, we consider two different mobile IPv6 authentication architectures and propose two securing Binding Update message schemes for each architecture. In the infrastructureless environment, neither trusted third party nor certificate authority exists. We adopt CGA (Cryptographic Generated Address) scheme to propose two solutions based on Diffie Hellman key agreement and geometric computation respectively. In the infrastructure environment, there exists a third-party trusted Certificate Authority (CA) and different AAA servers, which also behave as PKGs (private key generators), distributed in different network domains. According to distinct privacy requirements, we present two secure BU schemes, adopting ID-based multi-signature and encryption respectively across multi-PKGs.

並列關鍵字

Mobile IPv6 ； Binding Update ； Route Optimization ； Return Routability Procedure ； Stateless ； Geometric Computation

參考文獻

1. D. Johnson, C. Perkins, J. Arkko, “Mobility Support in IPv6,” Request for comments 3775, IETF, June 2004

2. Feng Yong, Wu Zhongfu, Zhong Jiang, Ye Chunxiao, Wu Kaigui, “A Novel Authentication Mechanism Based on CGA for BU Message Disposal in Mobile IPv6,” International Conference on Networking, Architecture, and Storage

3. Fu-Chen Yang, Yen-Cheng Chen, “A stateless Return Routability Scheme in Mobile IPv6,” International Conference on E-Business and Information System Security 2009, IEEE, Wuhan, China.

4. Yen-Cheng Chen, Fu-Chen Yang, “An Efficient MIPv6 Return Routability Scheme Based on Geometric Computations,” Inter. Conf. on Computer Network and System Security, Proceedings of WASET, Vol. 39, 2009, HK

5. M. Roe, T. Aura, G.O’Shea, J. Arkko, “Authentication of Mobile IPv6 Binding Updates and Acknowledgements”, IETF internet draft, February 2002