CN103702382A - Internet of Things DAI(Direct Access Information)security routing protocol based on voting method - Google Patents

Abstract

The invention discloses an Internet of Things DAI(Direct Access Information)security routing protocol based on a voting method. According to the invention, the security routing protocol which can effectively detect a denial of service attack is designed by aiming at how to detect the problem of accurately detecting the denial of service attack in the Internet of Things on the basis of local monitoring theories through using a detection voting mechanism, and in order to improve the detection accuracy of the scheme, an alarm assessment mechanism is provided to reduce false alarms caused by forecast errors. The new scheme can be used for detecting various DoS (Denial of Service) attacks initiated by a forwarding node through a local monitoring mechanism, and the detection voting mechanism judges whether the forwarding node is a malicious attack node according to voting information of a monitoring node, if the forwarding node is a malicious attack node, the malicious attack node is deleted from a network topology, and isolating information is sent to a neighbor node of a malicious node simultaneously to thoroughly isolate the malicious node.

Description

A kind of safe Routing Protocol of Internet of Things DAI based on voting method

Technical field

The present invention be a kind of for information network, particularly designed a kind of can defence, detect and the Internet of Things Routing Protocol of isolation malicious node, belong to Internet of Things safety applications technical field.

Background technology

Internet of Things is by various information sensing equipment, the information of the various needs such as Real-time Collection is any needs monitoring, connect, interactive object or process, a kind of can structure under the environment of network infrastructure in advance, peer to peer network temporarily that formed by sensing node, sensing layer is a kind of self-organizing, the network of management certainly, and is combined the huge network forming with the Internet.In network, each node can add at any time and exit, topological structure frequent variations, and because the communication overlay face of each node is little, inter-node communication usually will forward through the multi-hop of other node, Internet of things node resource-constrained.The multiple threats such as information leakage, the information that general wireless network faces is distorted, Replay Attack that these features make Internet of Things except having, Internet of Things also faces denial of service (DoS) and attacks.In the practical application of Internet of Things, the availability that maintains network is particularly important, and common DoS attack is not simply to destroy Internet of Things or is only to obtain security information, but will reduce the function of even destroying whole network, makes network thoroughly unavailable.The major way of DoS attack is as follows: Rushing attack, false routing attack, Wormhole attack, Sybil attack, Sinkhole attack, HELLO flood attack, Blackhole attack and select forwarding attack etc.

Summary of the invention

Object of the present invention will overcome the above problems exactly, a kind of safe Routing Protocol of Internet of Things DAI based on voting method is provided, on the basis of area monitoring's theory, by employing, detect voting mechanism, a kind ofly can detect various different attacks, and can isolate in time malicious attack nodes, improve the DAI agreement of Internet of Things routing safety performance.

Technical scheme of the present invention is achieved in that a kind of safe Routing Protocol of Internet of Things DAI based on voting method, be characterized in: on the basis of local monitoring theory, propose a kind of theoretical model that detects ballot, and on the basis of voting in part monitoring and detection, designed a kind of energy defence, detect and isolated the Routing Protocol DAI that malicious node sends DoS attack;

A) nested MAC code; Neighbours find the stage, guarantee the fail safe of transmission information of neighbor nodes; In forwarding vote information process, for confirming the correctness of transmission path; Malicious node isolation stage, for the authentication between transmission node;

B) One-way Hash function numeral authenticates between the node of data transfer phae, has avoided the complexity of symmetric cryptography;

C) local monitoring module monitors the various DoS attacks that forward node is initiated, and detects vote module and judges according to the vote information of monitor node whether forward node is to attack node; DAI agreement utilizes whether base station decision node is malicious node, if it is from network topology structure, deletes malicious node, sends isolation information to the neighbours of malice point, the thorough like this malicious node of having isolated simultaneously;

D) multirouting; Agreement adopt main road by with standby reason, when living after route damages, start alternate routing, thereby strengthened the fault-tolerant ability of network.

The present invention is on the basis of area monitoring's theory, by employing, detect voting mechanism, design a kind of safe Routing Protocol that can effectively detect Denial of Service attack, in order to improve the accuracy in detection of scheme, propose a kind of warning evaluation mechanism, reduced the wrong report that predicated error is brought.New departure detects by area monitoring's mechanism the various DoS attacks that forward node is initiated, detect voting mechanism and judge according to the vote information of monitoring node whether forward node is malicious attack nodes, if it is from network topology structure, delete malicious attack nodes, send isolation information to the neighbor node of malicious node, thorough like this this malicious node of having isolated simultaneously.

Accompanying drawing explanation

Fig. 1 is neighbor node monitoring turnover flow schematic diagram.

Embodiment

As seen from Figure 1, the present invention is on the basis of local monitoring theory, propose a kind of theoretical model that detects ballot, and on the basis of voting in part monitoring and detection, designed a kind of energy defence, detect and isolated the Routing Protocol DAI that malicious node sends DoS attack;

A) nested MAC code; Neighbours find the stage, guarantee the fail safe of transmission information of neighbor nodes; In forwarding vote information process, for confirming the correctness of transmission path; Malicious node isolation stage, for the authentication between transmission node;

B) One-way Hash function numeral authenticates between the node of data transfer phae, has avoided the complexity of symmetric cryptography;

C) local monitoring module monitors the various DoS attacks that forward node is initiated, and detects vote module and judges according to the vote information of monitor node whether forward node is to attack node; DAI agreement utilizes whether base station decision node is malicious node, if it is from network topology structure, deletes malicious node, sends isolation information to the neighbours of malice point, the thorough like this malicious node of having isolated simultaneously;

D) multirouting; Agreement adopt main road by with standby reason, when living after route damages, start alternate routing, thereby strengthened the fault-tolerant ability of network.

(1) system model and supposition

Challenge model: Internet of Things malicious node can be the internal node of not knowing the external node of encryption key or having key.An external node can be forged by capturing a legal node, becomes a malicious node.Malicious node can carry out the DoS attack of all kinds, and it has a kind of high-octane transmittability.

System supposition: each Internet of things node has a little buffering area to be used for preserving local routing iinformation and monitor node information.Inter-node communication is two-way communication.Between node, the deployment of Traffic encryption key(TEK) distributes by random key distribution scheme, and base station and each node have a unique shared key.

(2) neighbours find

Internet of things node was deployed to behind target area within the section time of a restriction, by base station, initiated neighbor node request message.This message of base station broadcast, form is as follows:

NBR is type of message, and BS is base station IDs, and OHC is the unidirectional Hash chain numeral being arranged in advance in each Internet of things node, || represent that data connect, MAC is the message authentication code obtaining after the key K BS with base station, this MAC value of base station stored.Receive for the first time the node change message of request message, record the MAC value of self simultaneously, then broadcast again.The ID that supposes to receive the nodes X of message is IDx, and the message format after change is:

Each Internet of things node is safeguarded a neighbor node collection, selects to receive that for the first time the node of REQ message is its father node.For example, when nodes X is received request message for the first time, using sender's ID as its father node and the neighbours that this ID puts oneself into, concentrate, then the MAC value calculating is stored in the internal memory of oneself, abandon the MAC value of father node; Subsequently the requesting node ID with identical OHC receiving is put into neighbor node and concentrate, but no longer broadcast this request message.

It is to make a malicious node by interference neighbors node signal, the request that abandons, wrap or to initiate Rushing in this stage to attack that the institute of these security mechanisms produces effect.

Neighbours find after a period of time, and node sends neighbor request and replys message and upwards prolong father node and be sent to base station.Reply message

with the MAC of an encryption, protect.Father node ID is that the reply message format of X node of Y is as follows:

NBRX is wherein the neighbor information of node, if nodes X has k neighbours, ID is n1 ... nk, its neighbor information is:

Base station is received after neighbor request reply message, can be calculated the integrality that MACs confirms NBRX.This mechanism can defend Wormhole to attack, and final base station generates whole topology of networks.

(3) local monitoring: detect and analyze

The dissimilar DoS attack that in network, malicious node is initiated can be detected.Each monitoring nodes neighbour's turnover flow.In Fig. 1, for node M, energy monitor node A, needs two conditions: 1. each forwards the direct object of the necessary clear and definite declaration forwarding bag of bag.2. M must be the neighbor node of the previous dive X of A and A.Node N is also the monitor node of node A as seen from Figure 1.

(4) polling response: ballot and isolation

Detect the first step that analysis is the whole network of protection, polling response module is used for the malicious node information detecting to send to base station.Whether base station is malicious node according to ballot judgment mechanism decision node, is that malicious node sends isolation information to all neighbor nodes of malicious node.

1) criminal manipulation that neighbor node detected when monitor node surpasses after certain thresholding, sends and detects vote information to base station.

2), when receive after ballot base station, first how many authenticities of checking ballot, then come whether concrete decision node is malicious node according to the monitor node number of forward node, if forward node has N monitor node.

1. in a period of time, receive the detection vote information of M node to a forward node, if M exists

within the scope of <=M<=N, be judged as malicious node;

2. only receive that one or two monitor node constantly votes to certain node, first check whether this node only has one or two monitor node.If as long as 3. a monitor node turns to; If forward node has a lot of monitor nodes (nodes N>=5), can judge that monitor node is malicious node;

3. as forward node only has a monitor node, base station sends checking request message to be divided and is clipped to monitor node and forward node is verified, and then judges which node is malicious node.

3), after judgement, base station sends isolation information to all neighbours of malicious node.After isolation, all neighbours of malicious node do not accept the information of malicious node.

One, route discovery

Internet of Things source node is by sending route requests (RREQ) initialization route finding process to base station.Receive after the request message of source node base station, utilizes topology of networks to calculate the route that arrives source node, and then base station produces a routing reply RREP and arrives source node along main routed path and alternate routing path.

1) route requests

Internet of Things source node S need to be found to the route of D, produces a routing request packet REQ, comprises type of data packet FREQ, sender IDs, destination address IDd and a unique sequence number SN.The every broadcast of SN once, increases once, is used for preventing the reply of REQ bag.Then node S uses the MAC of the shared key calculated data bag of S and D.Finally, S produces and the next value of trust key is joined in REQ bag, broadcast REQ bag.

If Kcommit (s) is correct, the neighbours Z of S accepts REQ bag.Then Z removes Kcommit (S) from REQ, adds IDz, forwards REQ.The REQ bag that the direct intermediate node B storage of non-S is received for the first time.

2) multipath route is calculated

After neighbours find, base station has obtained whole topology of networks.For Internet of Things source node S, article one arrives the path of S and calculates and produce with Dijkstra shortest path first, and this path is as main routed path.For determining and disjoint second path, article one path, need node set N1, N1 is the set of node that belongs to article one path.Second path configuration is as follows: from network, remove the node in all N1, then search the shortest path that arrives source node S.If found path, finish to calculate.Second path is as alternate routing path.Because search path algorithm depends on topology of networks, likely can not find second path, alternate routing path is now set for empty.

3) monitor node initialization

Base station calculates after two routed paths, calculates the corresponding monitor node of each node on every paths, as only have a paths according to network topology structure, only calculates the monitor node on a paths.

4) routing reply: more new routing information and monitor node information

Base station calculate behind path with monitor node information after, select a SEED at random from the OHC kind subpool of oneself, with an One-way Hash function, calculate a series of OHC digital: S0, S1 ... Sn, Sn=SEED, Si=F (Si+1), 0<=i<n.Make OHC=S0, structure return information, form is as follows:

RTREPLY is type of message, and R & M-NODES is the ID of all nodes in the route calculating and monitor node separately, and concrete form is:

Wherein BS is base station IDs, and IDS is source node ID, and ID1--IDn is the node ID on path,

for the monitor node of node n, monitor node number can be zero; The ID form of the ID of monitor node and forward node can be distinguished mutually; OHC is One-way Hash function numeral, and RT-TYPE is route-type (main road is by P or alternate routing S), and SEED is that Hash chain numeral generates seed,

be with KBS to SEED symmetric cryptography, MAC is message authentication code.After construction complete, base station broadcast packet.

Receive the node of base station broadcast, check R & M-NODES table, if node, on routed path, is accepted packet.OHC is in the OHC list of self in storage, then upgrades the routing table of self: storage BS, IDS and RTTYPE, be made as BS next-hop node, then broadcast data packet.Other nodes of receiving base station broadcast are not done any reflection.

Intermediate node on routed path is received after message, after storage OHC, the routing table of itself is set: storage BS, IDS and RTTYPE, down hop is set to the ID of previous node, Next-Next-Hop is arranged to the previous dive of previous node, after forward node before the front double bounce of deletion and monitor node ID, upgrade and reply message, continuation is broadcasted it.

Other node receives after message check in R & M-NODES whether contain the ID of self, if had, the forward node ID that will monitor is put in the watch-list of self, preserves OHC simultaneously; The message with identical OHC of later receiving does not respond.

After waiting for a period of time, Internet of Things source node is received reply, with KBS, authenticates MAC, after authentication success, with KBS, deciphers

, obtain SEED, preserve.Then the node ID of down hop and Next-Next-Hop is set.Routing reply finishes, and routing node has upgraded routing table, and monitor node has upgraded monitoring form.Two sheet formats are as follows:

Table 1 forward node routing table

Table 2 monitor node monitoring form

Source node	Destination node	OHC	Monitor node
				S1	BS	Number1	ID1
…	…	…	…
				Sn	BS	NumberN	IDn

Two, data retransmission

1) construction data bag

Internet of Things source node utilizes an One-way Hash function F identical with base station to produce a series of OHC numerals: S0 according to SEED, S1 ..., Sn, Si=F (Si+1), 0<=i<n, Sn=SEED.After source node sensed data, search routing table, after construction data bag, broadcast.Data packet format is as follows:

dATA is type of message, and IDnext is next-hop node, and IDnnext is Next-Next-Hop node, and data is sensed data.When source node sends packet for the first time, make OHC=S1, S1 is included.In the middle of each, the node of forwarding data comes specified data bag whether to come from source node S by authentication S0=F (S1).After forwarding data, intermediate node is replaced the old OHC numeral in routing table by new OHC numeral.Source node S is used Si to carry out i secondary data and is forwarded.Because only have the next OHC numeral of generation that source node S could be correct, so this mechanism can confirm the packet that centre forward node is received, really come from source node S, thereby can prevent assailant's source node that disguises oneself as to carry out the propagation of false data bag.

2) forward node data retransmission

Intermediate node is received after data, check that whether IDnext is identical with the ID of self, the identical OHC utilizing in One-way Hash function verification msg bag, routing table is correctly searched in checking, change packet, step is as follows: IDnext and IDnnext replacement in self corresponding routing table for the IDnext in packet and IDnnext.By the new OHC numeral in packet, upgrade the old OHC numeral in corresponding routing table, send the packet after change.

3) monitor node monitoring forward node

Other non-routing node is searched for the monitoring form of self according to the BS in packet, IDS and IDnext after receiving packet, if there is the item of coupling, monitors the behavior of forward node IDnext after storage packet.

Data arrive behind base station, and first base station by the correctness of KBS checking MAC, is proved to be successful and deciphers with KBS thereby, obtain sensed data data.

Three, detecting ballot message forwards

Monitor node detects after the malicious act of node, upwards sends and detects ballot message to father node.If monitor node X

send the detection ballot to forward node Y, the message format of voting is:

Wherein POLL is type of message, the father node that IDparent is nodes X, and KBX is the shared key of base station and X.RTINFO is the routing iinformation on transmit path, comprises node ID on path and their MAC generating in neighbor discovery process, and form is:

IDn1 ... Idnk is the node ID on path, MACn1 ... MACn2 is the MAC value generating in its each comfortable neighbours' discovery stage.

The father node of X is received after ballot message, the IDparent in packet is changed to the father node ID of self, the ID of oneself and MAC is joined in RTINFO simultaneously.The like, message finally arrives base station.First base station authenticates MAC, after the integrality of acknowledge message, then authenticates the MAC in RTINFO, determines that message is the arrival base station, path along the father node of each node really, rather than in the middle of other, malicious node is forged message.Finally with KBS, decipher

, obtain the ballot of monitor node X to forward node Y.

Four, malicious node isolation

Receive after the ballot of control point base station, according to rule, judges whether forward node is malicious node.If so, this node is put in the isolation node of oneself, sends isolation message to all neighbor nodes of malicious node simultaneously.Transmission data packet format is as follows:

RT-NODES by destination node all node ID of process, ISO is type of message, ID _iSOfor the node ID that will isolate, ID _dESfor destination node ID, MACver finds the authentication code that stage base station generates for neighbours.This packet of base station broadcast after construction complete, receives the node of message checks whether first ID of RT-NODES is the ID of self, is the MAC whether MAC in packet of computational methods checkings that finds stage MAC according to neighbours can derive self.Checking correctly re-constructs packet: from RT-NODES, remove the ID of itself, MACver is changed into the MAC of oneself.Again broadcast.

Destination node is received after packet, after checking MACver and MAC success, with KBD deciphering, obtains the node ID ISO that will isolate, and this ID is removed from the neighbor node of itself.

Five, route maintenance

Detect after malicious attack nodes, base station informs that source node adopts alternate routing to transmit data, thereby has strengthened the fault-tolerance of network.Main road was by after losing efficacy with alternate routing simultaneously, and source node is applied for new route again to base station.

Claims (1)

1. the safe Routing Protocol of Internet of Things DAI based on voting method, it is characterized in that: on the basis of local monitoring theory, propose a kind of theoretical model that detects ballot, and on the basis of voting in part monitoring and detection, designed a kind of energy defence, detect and isolated the Routing Protocol DAI that malicious node sends DoS attack;

A) nested MAC code; Neighbours find the stage, guarantee the fail safe of transmission information of neighbor nodes; In forwarding vote information process, for confirming the correctness of transmission path; Malicious node isolation stage, for the authentication between transmission node;

B) One-way Hash function numeral authenticates between the node of data transfer phae, has avoided the complexity of symmetric cryptography;

C) local monitoring module monitors the various DoS attacks that forward node is initiated, and detects vote module and judges according to the vote information of monitor node whether forward node is to attack node; DAI agreement utilizes whether base station decision node is malicious node, if it is from network topology structure, deletes malicious node, sends isolation information to the neighbours of malice point, the thorough like this malicious node of having isolated simultaneously;

D) multirouting; Agreement adopt main road by with standby reason, when living after route damages, start alternate routing, thereby strengthened the fault-tolerant ability of network.

Images