利用公鑰系統以及雜湊函數保護M2M網絡的控制層和數據層

Securing M2M control plane and data plane with a public key architecture and hash functions

路易斯(Louis Fauchet)

指導教授 ： 林盈達

國立交通大學/電機學院/電機資訊國際學位學程/碩士(2018年)

摘要

機器到機器(Machine to Machine,M2M)通信是一種特定類型的通信方式,此種通信中設備之間直接相互通信而無需人為干預。M2M設備中所遭受到的攻擊主要針對其機密性,完整性及可用性。由於M2M通信不需仰賴網路,所以依賴信任方的機制不完全有效。此外,不同的M2M網絡的設備具有不同的需求,例如通信延遲, 消息大小,功耗。在本文中,我們提出了一個通用的安全解決方案,可以保護M2M網絡的控制層和數據層。這種安全解決方案於硬體中實做加密演算法。此加密演算法基於單向雜湊函數的認證交握,且不需要第三方認證。我們還提出了一種特定路由算法,可以在每個設備上計算網絡內部的可信以及不可信賴之設備。我們的解決方案提供安全性,防止對設備之間交換的消息(如消息偽造和消息竄改)的攻擊。然而,其通信性能取決於網絡的大小。對於少於50個節點的網絡,我們可以達到類似的端到端延遲,以達到最短路徑路由。至於較大的網絡,網路延遲將會是兩倍以上。

關鍵字

機器溝通 ； 網絡安全 ； 路由

並列摘要

Machine to Machine (M2M) communication is a specific type of communication in which devices are communicating directly with each other without any human interaction. These devices in M2M are targeted by attacks on their confidentiality, their integrity or their availability. Since the networks in M2M communication can be disconnected of the internet, a mechanism that relies on trust party cannot be completely efficient. Moreover, the devices used in M2M networks
have different requirements, as an example for communication delay, message size, power consumption. In this paper we propose a general security solution that protects both control and data plane of M2M networks. This security solution relies on cryptographic functions implemented and protected in hardware. We provide an authentication handshake based on one-way hash functions and that doesn’t need third party attestation. We also propose a specific routing algorithm that can compute at each entity the set of trusted and untrusted entities inside the network. Our solution provides security against attacks on the messages exchanged between the entities such as message fabrication and message alteration. However, its communication performance depends on the size of the network. We reach similar end to end delay performance to shortest path routing algorithm for networks of less than 50 nodes, whereas for larger network, the security solution introduces a higher delay by multiplying it by two.

並列關鍵字

M2M communication ； network security ； routing

參考文獻

[1] Sumra, Irshad & Bin Hasbullah, Halabi & Bin AbManan, Jamalul-lail. (2014). Attacks on Security Goals (Confidentiality, Integrity, Availability) in VANET: A Survey. Advances in Intelligent Systems and Computing. 306. . 10.1007/978-981-287-158-9_5.

[2] Website: https://www.theguardian.com/world/2013/oct/19/dick-cheney-heart-assassination-fear, accessed on 2018, May.

[3] Shwartz, O., Cohen, A., Shabtai, A., & Oren, Y. (2017, August). Shattered Trust: When Replacement Smartphone Components Attack. In 11th {USENIX} Workshop on Offensive Technologies ({WOOT} 17). USENIX} Association}.

[4] ARM, A. (2009). Security technology building a secure system using trustzone technology (white paper). ARM Limited.

[5] Zhao, S., Zhang, Q., Hu, G., Qin, Y., & Feng, D. (2014, November). Providing root of trust for arm trustzone using on-chip sram. In Proceedings of the 4th International Workshop on Trustworthy Embedded Devices (pp. 25-36). ACM.