CN101060480A - HORSEI2-based mobile self-organized network safety QoS multicast route creating method - Google Patents

Abstract

The related HORSEI2 based building method for self-organizing network security QoS multicast route comprises: every transmitter and receiver can add the multicast security group only being checked by visits control mechanism to obtain the private and public key of HORSEI2; every node requiring for creating/receiving new security multicast dialogue data creates/adds safe QoS multicast tree, wherein the transmitter applies signature on the message generated by HORSEI2, and the receiver uses the public key for verification.

Description

Method for building up based on the mobile self-organized network safety QoS multicast route of HORSEI2

Technical field

The invention belongs to the network security technology field, is the method for building up of a kind of mobile self-organized network safety QoS multicast route based on HORSEI2 of belonging to mobile ad hoc network.

Background technology

Mobile communications network can be divided into two big classes: the base station support is arranged and do not have the base station to support. and the former comprises existing GSM, CDMA, networks such as CDPD; The latter is exactly a mobile ad hoc network.Mobile ad hoc network is the provisional autonomous system of a multi-hop forming of one group of mobile node that has a wireless transmitter. in this environment, because the finiteness of node radio communication coverage area need be carried out packet forward by intermediate node and be arrived the stay of two nights.It can provide a kind of available communication supporting environment under the situation that does not have available network infrastructure.

Mobile ad hoc network is a kind of wireless mobile network who does not have center infrastructure to support, the node in the network constitutes by mobile host.Mobile ad hoc network is applied to military field at first, its research originates from Packet Radio Network data communication project under the battlefield surroundings, this project is subsidized by DARPA, again nineteen eighty-three and 1994 year carried out anti-the ruin research that can adapt to network SURAN (SurvivableAdaptive Network) and Globle Mobile Information Systems Glomo (Global InformationSystem) project thereafter.Because the continuous development of radio communication and terminal technology, mobile ad hoc network also is developed under commercial environment, as need carry out provisional communication in the area that does not have wired infrastructure the time, can realize by making up mobile ad hoc network easily.In mobile ad hoc network, when two mobile hosts were in communication coverage each other, they can direct communication.But,, then need to realize by the forwarding of the mobile host between them if the main frame of two apart from each others will communicate because the communication coverage of mobile host is limited.Therefore in mobile ad hoc network, main frame is still router simultaneously, undertaking and is finding route and the work that E-Packets, and route generally all is made up of multi-hop, and packet could arrive the destination by the forwarding of a plurality of main frames.So mobile ad hoc network is also referred to as multi-hop wireless network.

Mobile ad hoc network can be regarded as the intersection of mobile communication and computer network.In mobile ad hoc network, the grouping of network that uses a computer exchanging mechanism.The main frame of communication generally is mobile terminal devices such as portable computer, PDA(Personal Digital Assistant).Mobile ad hoc network is different from the mobile IP network in the present internet environment.In mobile IP network, mobile host can be by being fixed with mode access networks such as spider lines, Radio Link and dial line, and only have a kind of connected mode of Radio Link in mobile ad hoc network.In mobile IP network, mobile host could be communicated by letter by the support of adjacent wired facilities such as base station, is cable network between base station and base station (agency and agency), still uses traditional Routing Protocol of internet.And mobile ad hoc network does not have the support of these facilities.In addition, mobile host does not possess routing function in mobile IP network, just a common communication terminal.When moving to another district from a district, mobile host do not change network topology structure, and the mobile change that will cause topological structure of mobile host in the mobile ad hoc network.

Multicast be a kind of be one group of transmission that main frame is the datagram of destination node of sign with single destination address.The multicast service is very useful for the application of those one-to-many transmission.The multicast routing policy can be optimized the use of resource, particularly in the mobile ad hoc network of bandwidth and limited energy.But because the mobility of main frame and the interference of wireless signal, the multicast in the mobile ad hoc network is more more complex than the multicast in the cable network.

QoS (Quality of Service) route is to find and safeguard the path [48] of satisfying under the given resource QoS constraint.The QoS binding target generally has: time delay, delay variation, bandwidth, packet loss and network cost or the like.

In mobile ad hoc network, the topological structure dynamic change, wireless signal-path band width is narrower, and congestion phenomenon often appears in network, is unfavorable for the normal operation of some real-time web application.Routing Protocol based on QoS relatively is suitable for moving in mobile ad hoc network.Usually be used with certain resource reservation mechanism (for example RSV P agreement) based on the Routing Protocol of QoS under the cable environment, satisfied have a QoS demand of different information flows.But in the mobile ad hoc network environment, because its characteristic is difficult to realize this comparatively exquisite control strategy, the target that reach also is different.At first, the Routing Protocol based on QoS under the cable environment needs the communication network resource information, carries out the resource reservation operation, keeps the state information and the available network resources information of information flow.These expenses can occupy a large amount of channel width, CPU disposal ability and memory headroom in MANET.Secondly, moving arbitrarily of network node may make relevant Internet resources have greatly changed in the mobile ad hoc network, the resource reservation of preserving have off status invalid, thereby cause the route that forms with big protocol overhead invalid, and may trigger more routing update information.At last, target under the cable environment is to select corresponding route to have the transmission of the information flow of QoS demand with guarantee, and the target in the mobile ad hoc network is under the prerequisite that selected route exists, and the route of the transmission of the information flow that most possibly satisfies the specific QoS demand is provided.

QoS route in the mobile ad hoc network is with respect to the QoS route of cable network, because narrow bandwidth, disposal ability are weak, the energy is limited, wireless signal disturbs and the influence of factor such as node motion, the QoS route of mobile ad hoc network more needs to consider the fast algorithm of the little variation of expense.

Because the bandwidth of mobile ad hoc network is narrower, disposal ability a little less than, so more and more grow with each passing day based on the multimedia application of mobile ad hoc network demand for multicast and specified services quality, in the hope of efficiently utilizing limited bandwidth and satisfying quality of service requirement, therefore need set up QoS multicast route selects correct path.

What existing a lot of scholars had proposed to have very much achievement is applicable to mobile ad hoc network QoS multicast route protocol.The design of traditional multicast route protocol is constructed multicast tree based on the data-transmission mode of " doing one's best " based on connectedness.Such multicast tree is not satisfy demands of applications in shortage of resources and when quality of service requirement is arranged.Safety is relevant to be provided with and the QoS multicast route protocol at mobile ad hoc network that these have proposed does not all have, believe that impliedly all participate in nodes in communication, malicious node is forged, is distorted even disintegrates the exchange of packet or the behavior of the normal route of bypass has then greatly threatened this trusting relationship.Therefore structure is applicable to that the safety QoS multicast route of mobile ad hoc network is very necessary as can be known.

Summary of the invention

The objective of the invention is to adopt the HORSEI2 cipher mechanism is that the QoS multicast route of mobile ad hoc network is provided with authentication mechanism, thereby make during QoS multicast route is set up, route requests message and route back message using can not revised, pretend to be and deny by unwarranted node, reach the purpose of safe route and propose a kind of method for building up based on the mobile self-organized network safety QoS multicast route of HORSEI2 that accounts for the little safety of the few processing expenditure of bandwidth.

To achieve these goals, technical scheme of the present invention is: be made up of three phases: the one, add safety QoS multicast group; The 2nd, create the safety QoS multicast tree; The 3rd, add the safety QoS multicast tree,

(1) needs to have had in the network suitable distributed access control and cipher key authority, be responsible for the granting and the renewal of the HORSEI2 PKI of multicast security group membership's room entry/exit management and each group membership's node by these access control and key management mechanism, each node of wanting to send/receives the multicast conversation data is adding multicast security group in advance all;

(2) foundation of safety QoS multicast router tree is triggered by data transmitting node, everyly thinks with the predetermined quality of service requirement data to be sent to the node of multicast group safely, if send for the first time, all must create the safety QoS multicast router tree earlier;

(3) everyly want to add the QoS multicast conversation and all must add the safety QoS multicast tree with the node that the predetermined quality of service requirement receives data safely;

Non-tree root node and the internodal data path of tree root on this safety QoS multicast tree just are called safety QoS multicast route.

Be to use the very little class PKI mechanism of the processing expenditure of certifying signature-HORSEI2 cryptographic algorithm to realize among the present invention.Simulation result shows, the present invention can reduce processing expenditure of being brought and the network bandwidth consumption that the digital signature to the route message authenticates effectively, and the reliable assurance of efficient higher data integrality and source authenticity is provided for the QoS multicast route of safety.

Description of drawings

Fig. 1 creates safety QoS multicast tree flow chart for sending node of the present invention.

Fig. 2 adds safety QoS multicast tree flow chart for the present invention.

Embodiment

The invention will be further described below in conjunction with accompanying drawing.

1) related network model and QoS multicast routing issue is defined as follows among the present invention:

Define 1 one networks can be expressed as a weighted graph G=(V, E), wherein V represents set of node, E represents the communication link collection of connected node.| V| and | E| represents node number and the number of links in this network respectively.For being without loss of generality, only consider such class figure, promptly in such network, have only a link between a pair of node at most, the parameter in chain roadside can be used for describing the current state of this link.

P (s, the t) path of expression from source node s to end node t, T (s, M) expression multicast tree are established in definition 2.S ∈ V is the source node of a multicast tree, and { V-{s}} is the end node or the leaf segment point set of this multicast tree to M .

It is the arithmetic number collection that R is established in definition 3, R ^*Be the nonnegative real number collection.For any link e ∈ E, some QoS characteristic value (metrics) of definable:

Delay function delay (e): E → R,

Cost function cost (e): E → R,

Bandwidth function bandwidth (e): E → R,

Delay jitter function d elay-jitter (e): E → R.

Define 4 for arbitrary node n ∈ V, also some QoS characteristic value (metrics) of definable:

Delay function delay (n): V → R,

Cost function cost (n): V → R,

Delay jitter function d elay-jitter (n): E → R ^*,

Letter packet loss function packet_loss (n): V → R ^*.

The definition 5 establish T (s, M) expression multicast tree, following relationship is then arranged:

$\mathrm{delay}\left(p(s,t)\right)=\underset{e\∈p(s,t)}{\mathrm{\Σ}}\mathrm{delay}\left(e\right)+\underset{n\∈p(s,t)}{\mathrm{\Σ}}\mathrm{delay}\left(n\right).$

$\cos t\left(T(s,M)\right)=\underset{e\∈T(s,M)}{\mathrm{\Σ}}\cos t\left(e\right)+\underset{n\∈T(s,M)}{\mathrm{\Σ}}\cos t\left(n\right).$

bandwidth(p(s，t))＝min{bandwidth(e)，e∈p(s，t)}

$\mathrm{delay}-\mathrm{jitter}\left(p(s,t)\right)=\underset{e\∈p(s,t)}{\mathrm{\Σ}}\mathrm{delay}\_\mathrm{jitter}\left(e\right)\underset{n\∈p(s,t)}{\mathrm{\Σ}}\mathrm{delay}\_\mathrm{jitter}\left(n\right).$

$\mathrm{packet}\_\mathrm{loss}\left(p(s,t)\right)=1-\underset{n\∈p(s,t)}{\mathrm{\Π}}(1-\mathrm{packet}\_\mathrm{loss}\left(n\right))$

Definition 6QoS multicast routing issue relates generally to following element:

Network G=(V, E);

Multicast source node s ∈ V;

Multicast end node collection M  { V-{s}};

delay(·)∈R ^*；

cost(·)∈R；

bandwidth(·)∈R；

packet_loss(·)∈R ^*.

Definition 7QoS multicast routing issue is that (s, M), it satisfies following QoS constraint to multicast tree T of searching, and makes cost (T (s, M)) minimum.

(1) deferred constraint: delay (p (s, t))≤D;

(2) bandwidth constraint: bandwidth (p (s, t)) 〉=B;

(3) delay jitter constraint: delay_jitter (p (s, t))≤J;

(4) packet loss constraint: packet_loss (p (s, t))≤L.

Wherein D is deferred constraint, and J is the delay jitter constraint, and B is a bandwidth constraint, and L is the packet loss constraint.Wherein contact is comparatively tight between delay and the delay jitter, and the latter can be reflected the former stationarity to a certain extent.Delay and jitter is an additive property, and bandwidth is an extremum property, and loss rate is a product.

Because node and link have equivalence, so only consider the QoS constraint of link among the present invention.

2) add safety QoS multicast group

No matter be which node request adds the security multicast group in the net, sender and recipient must examine its membership qualification via access control mechanism (establishing in addition) in the net.

After passing, requesting node just can obtain the initial privacy key SK of the good HORSEI2 of the prior calculated off-line of cipher key authority ₀Be stored to this node internal memory with the hash chain of HORSEI2 correspondence and with it, its PKI PK ₀And hash intermediate link all is distributed to all secure group members.

The process that cipher key authority is carried out the generation of HORSEI2 key is as follows:

(1) argument of type integer l is set, k, t,

Satisfy klog ₂T≤H (),

k＜t，

l≤|H(·)|/2；

Wherein, H () is a unidirectional hash function of safety.

(2) produce the random number s of t l bit long again ₁, s ₂..., s _t, with them as seed (also being the private key pair set) s _{(d, 1)}, s _{(d, 2)}..., s _{(d, t)}Construct length and be t the hash chain of d, as follows:

{s _(d，1)→s _(d-1，1)→s _(d-2，1)→...→s _(0，1)}

＝{h ⁰(s _(d，1))→h ¹(s _(d，1))→h ²(s _(d，1))→...→h ^d(s _(d，1))}；

{s _(d，2)→s _(d-1，2)→s _(d-2，2)→...→s _(0，2)}

＝{h ⁰(s _(d，2))→h ¹(s _(d，2))→h ²(s _(d，2))→...→h ^d(s _(d，2))}；

...

{s _(d，t)→s _(d-1，t)→s _(d-2，t)→...→s _(0，t)}

＝{h ⁰(s _(d，t))→h ¹(s _(d，t))→h ²(s _(d，t))→...→h ^d(s _(d，t))}；

S wherein _{(d-i, j)}=H ⁱ(s _{(d, j)}),

Be s _{(i, j)}=H ^D-i(s _{(d, j)}), (0≤i≤d, 1≤j≤t)

(3) above each hash chain is divided into

Individual length is

Subchain, and in the middle of link place of per two subchains is provided with one hash link (Intermediate HashJoint), wherein the value of r centre hash link is in the j bar hash chain

$J_{(r,j)}=H\left(s_{(r*d^{,},j)}\right|\left|{\mathrm{PK}}_{(0,j))}\right),$

Wherein be provided with $d^{,}=\mathrm{int}\left(\sqrt{d}\right),$

r＝0，1，2，...，int(i/d’)，...，(d’-1)，

Work as r=0, then J _{(0, j)}=PK _{(0, j)}.

Wherein, PK _{(0, j)}Be and s _{(i, j)}The PKI of corresponding j bar hash chain.

(4) store this t hash chain and middle hash link (abbreviating IHJ as) and be used as a series of transmit leg keys.Therefore the private key that produces is to SK ₀Be respectively with middle hash link

SK ₀＝(s ₁，s ₂，...，s _t)

＝(s _(d-1，1)，s _(d-1，2)，...s _(d-1，t))；

IHJ＝(J _(1，j)，J _(2，j)，...，J _(d’-1，j))，(1≤j≤t).

(5) PKI PK ₀Set

PK＝(v ₁，v ₂，...，v _t)

＝(s _(0，1)，s _(0，2)，...s _(0，t))

＝(H(s _(1，1))，H(s _(1，2))，...，H(s _(1，t)))；

3) create the safety QoS multicast tree

Consider fail safe, suppose to have only the secure group member could add multicast tree, its flow process is as described below:

If group membership t _sThink to send safely information to the multicast group membership, can be at safety QoS multicast conversation of when beginning initialization, (s M), and makes up through authentic other members that are routed to session promptly to create the multicast tree T to the service quality sensitivity of a safety.For this reason, t _sBroadcast a statement of creating the QoS multicast tree and give its neighbours t _vAs follows:

Be provided with

(1)m _s，i＝[CTreq，IDt _s，T(s，M)，i，Bandwidth，B，Delay，D，Delay-jitter，J，...]； (3-1)

(2) make h=Hash (m _{S, i}); (3-2)

Wherein, i represents that this is t _sI the packets of information of sending, B, D and J are respectively QoS binding occurrence-bandwidth, delay and the delay jitters of requirement.

(3) h being divided into a series of each length is log ₂The substring h of t position ₁, h ₂..., h _j..., h _k

(4) make i _j=h ₁ h ₂ ...  h _j ... h _k,

With i _jAs subscript from SK _iIn select an element as signature, promptly

$\mathrm{\σ}=s_{i_j};---(3-3)$

(5)t _s→*：{m _s，i‖σ _s，i}. (3-4)

Work as t _sAfter having broadcasted above-mentioned information, (s, M) this multicast tree was created, then t as if T _sNeighbours can send the information " Ctnak " that refusal creates and give t _s, then this form build the statement be cancelled.Otherwise if t _sNot receiving after through one specific period in echo message that any refusal creates is with regard to the explanation group does not have other people to create this security multicast group, and then this security multicast is formed and built up merit.Each group membership is to signature sigma _{S, i}Verify.If checking is passed through, then neighbours just with the sign T of this security multicast tree (s, M) and t _sSign IDt _sBe recorded in the internal memory together.T subsequently _sJust begin to broadcast " Group Hello " packets of information to all group memberships with group leader's identity.

4) add the safety QoS multicast tree

If a group membership also is recipient's t simultaneously _uWish to add the safety QoS multicast conversation, (s M) arrives the member t of other conversation group with the safe route of setting up through authentication just to want to add multicast tree T _v, then broadcast a request that adds the QoS multicast tree, its operation following (wherein having omitted processing) to the route jumping figure:

(1)t _u：m _u，i＝[JTreq，IDt _u，T(s，M)，，Bandwidth，B，Delay，D，Delay-jitter，J，...]

(2) other operate the same joint Chinese style (3-2) (3-3), then t _uSend broadcast packet to neighbours:

t _u→*：{m _u，i‖σ _u，i}.

2) when the relaying node and also be the t that tree goes up node _vReceive after this solicited message that it is as follows just packets of information to be carried out integrity checking:

(1)t _v：h’＝H(m _u，i)；

(2) division h ', obtaining k length is log ₂The substring h of t position ₁', h ₂' ..., h _j' ..., h _k' conversion h _jBecome integer and count i _j(1≤j≤k);

With i _jBe subscript, if for each j, (1≤j≤k)

Have $H\left({s^{\text{'}}}_{i_j}\right)=s_{{(i+1)}_j},$ (when the front has been received s _{(i+1) j})

Or have $J_{(r,j)}=H\left(H^{\left(i\mathrm{mod}{d}^{,}\right)}\left({s^{\text{'}}}_{i_j}\right)\right)\left|\right|P{K}_{(0,j)})$ Set up.

Then checking is passed through, otherwise refuses this packets of information and signature thereof.

Wherein, $J_{(r,j)}=H\left(S_{(r*d^{,},j)}\right|\left|\mathrm{PK}(0,j)\right),---(3-5)$

$d^{,}=\mathrm{int}\left(\sqrt{d}\right),$

r＝0，1，2，...，int(i/d’)，...，(d’-1)， (3-6)

Work as r=0, then J _{(0, j)}=PK _{(0, j)}.

(3) follow t _vTo check t _uQos requirement security multicast tree can satisfy.This is checked with reference to document ^[133]Relevant flow process, we have added authentication measures at this.

If (d (t _s, ^*)+d (t _u, t _vThe ∧ of)≤D) (dj (t _s, ^*)+dj (t _u, t _vThe ∧ of)≤J) (bw (tu tv) 〉=B) sets up,

Wherein, d (t _s, ^*) and dj (t _s, ^*) be respectively from source node t _sTo all along the delay of road downstream node and delay jitter and.And bw (tu, tv), d (t _u, t _v) and dj (t _u, t _v) be respectively t _uAnd t _vBetween two nodes along bandwidth, the delay and jitter on road.

T then _vSend an echo message JTack and give t _uAs follows:

t _v→t _u：{[JTack，IDt _v，T(s，M)，]‖σ _v，i}；

Otherwise, survey again:

If bw (t _u, t _v)＜B

Then (s removes t on M) from T _u

Otherwise, if (d (t _s, ^*)+d (t _u, t _vThe ∨ of)＞D) (dj (t _s, ^*)+dj (t _u, t _v)＞J)

T then _vTransmit t _uRequest give its local neighbours and be t _uThe new path that following condition is satisfied in search and calculating.

Otherwise, if (d (t _s, t _u))=min[d (s, ^*), D-d (t _v, t _u)]) ∧ (dj (s, t _v))=min[dj (s, ^*), J-dj (t _v, t _u)]);

T so _vAccept the request of this adding QoS multicast tree, and this JTack message is transmitted to t _u.

Otherwise, t _vSend refusal message JTnak and give t _u:

t _v→t _u：{[JTnak，IDt _v，T(s，M)，i]‖σ _v，i}.

(4) work as t _uCan check t after receiving _vSignature sigma _{V, i}, by leading to upstream node t under the postscript _vPort, the multicast route set up to finish.

Obviously, message " JTack " or " JTnak " are by the via node t that wants route to some extent _vSend and to reduce the network cost effectively.

The content that is not described in detail in this specification belongs to this area professional and technical personnel's known prior art.

Claims (2)

1, a kind of method for building up of the mobile self-organized network safety QoS multicast route based on HORSEI2, its method is:

Each multicast conversation sender and recipient must check that through access control mechanism the back adds the multicast security group earlier, and obtain HORSEI2 private key and PKI;

Each wants to send multi-case data under the condition that possesses the QoS guarantee, creates the node of a new security multicast session and then creates the safety QoS multicast tree;

Each wants to add the security multicast session under the condition that possesses the QoS guarantee, and the node that receives multi-case data then adds the safety QoS multicast tree.

2, the method for building up of the mobile self-organized network safety QoS multicast route based on HORSEI2 as claimed in claim 1, it is characterized in that: in all data transmission procedures, sending data person needs the message that desire sends is applied the signature that produces with the HORSEI2 cipher mechanism, and receiving data person needs the message that receives is verified with sender's PKI.

Images