CN104159216A - Distributed certification revocation method under Ad Hoc network environment - Google Patents
Distributed certification revocation method under Ad Hoc network environment Download PDFInfo
- Publication number
- CN104159216A CN104159216A CN201410348052.8A CN201410348052A CN104159216A CN 104159216 A CN104159216 A CN 104159216A CN 201410348052 A CN201410348052 A CN 201410348052A CN 104159216 A CN104159216 A CN 104159216A
- Authority
- CN
- China
- Prior art keywords
- node
- charge
- malicious
- defendant
- certificate
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 36
- 230000008569 process Effects 0.000 claims description 18
- 238000011084 recovery Methods 0.000 claims description 14
- 238000004891 communication Methods 0.000 description 9
- 230000006378 damage Effects 0.000 description 8
- 238000012545 processing Methods 0.000 description 5
- 230000000694 effects Effects 0.000 description 4
- 238000007726 management method Methods 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 238000011160 research Methods 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 230000000737 periodic effect Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 238000011002 quantification Methods 0.000 description 1
- 230000007704 transition Effects 0.000 description 1
Landscapes
- Computer And Data Communications (AREA)
Abstract
The invention discloses a distributed certification revocation method under an Ad Hoc network environment. The method comprises the following steps: if a node finds that a neighbor node of the node cannot normally execute a network routing protocol, charging the neighbor node; using a third node to receive a charged package of the node; using the third node to judge whether content of the charged package is legal or not, if yes, indicating that the charging is successful, and recording the charging into a charging table of the third node; using the third node to calculate the share of revoked certification of the charged node and a threshold value of the revoked certification; revoking the certification of the charged node if the share of the revoked certification of the charged node is not smaller than the revoked threshold value of the node, and identifying the node to be a malicious node; restoring charging functions of the nodes once charged by the malicious node after the judgment result of the malicious node is obtained; updating the record of the nodes which once are used for charging the malicious node in a state table of the third node. By the adoption of the method, the certification of the malicious node can be effectively revoked, and the network security is greatly improved.
Description
Technical field
The invention belongs to mobile Ad Hoc network (MANET) field, relate in particular to a kind of distributed certificate cancelling method of Ad Hoc net environment.
Background technology
Mobile Ad Hoc network is by mobile communication and computer network, to be combined that what produce is the network that a kind of environment self-adaption is stronger, there is no fixing infrastructure, and node is equal in whole system.Node can move freely in network, Dynamic Establishing topological structure.And, network node all has the forwarding capability of common mobile terminal all functions and router bag, realized between node in communication range direct communication or by intermediate node, realized multi-hop route scope and communicate by letter outward, make this network can be good at being applied in the environment such as disaster relief, military communication, interim application scenario, along with appearance and the development of new technology such as car networking, 4G network, SDN, Ad Hoc network has the application of continuous expansion.Yet Ad Hoc network is without features such as center, self-organizing, resource-constraineds, make this network compare and be more vulnerable to attack with conventional wireless network, such as black hole attack, gray holes, Sybil attack etc., so be necessary to propose a kind of effective measures, can reduce efficiently malicious node network is worked the mischief, set up believable network.
The intrinsic characteristic of Ad Hoc network makes any one the node status in network not be better than other nodes, do not have the normal operation that single node can centralized management network, to attempt to research and develop overall analysis optimization algorithm be unpractical or need to pay great cost.Therefore need to adopt distributed algorithm to realize the function that protecting network provides security service.
At present existing a lot of scholars have proposed kinds of schemes and have reduced the attack of malicious node to Ad Hoc network, these schemes can provide effective safety measure to a certain extent, but these schemes are concentrated research, point is to check out the existence of malicious node in network, preventing malicious node is to the destruction of network or avoid malicious node, but the node in network is mobile: node can move with the speed of variation and indefinite motor pattern, and node can add or deviated from network at any time, this has just caused in a certain scope and has slandered malicious node attack, this malicious node again can be at another scope offensive attack, even over time, malicious node can be launched a offensive in identical scope, so above scheme all can not effectively reduce the destruction of malicious node to network.Minimizing because of cause network unpredictability is destroyed of the factors such as node mobility be to need problem demanding prompt solution, this is also starting point of the present invention.
Fortunately, existing some scholars is making great efforts to address this problem, and has also obtained certain achievement simultaneously.In the scheme having proposed, each node should have a legal certificate, only there is the node ability participation network communication of legal certificate, when a certain node generation malicious act, its neighbor node can find that malicious act mode that can be by cancelling this node certificate are to play the effect of the reliability that improves network.These schemes are probably divided into two classes according to obtaining of certificate: online and off-line obtains certificate.Because Ad Hoc network itself is different from the characteristic of legacy network, obtain online certificate mode and be not suitable for Ad Hoc network.For off-line, obtain certificate, according to the network architecture, the present invention further can be divided into certificate revocation mode based on clustering architecture and the certificate revocation based on planar structure.Because bunch head can become network bottleneck, the malicious act of bunch head will be brought larger destruction to network in addition, and therefore the certificate revocation based on clustering architecture can not well be applied in Ad Hoc network.Based on planar structure, can divide the certificate revocation of timely effect and delay effect again, for the former, may produce wrong certificate revocation makes certificate revocation accuracy low, the latter needs the opportunity of long period judgement certificate revocation, in addition, this two schemes all likely exists a large amount of malicious node certificates reversed situation not occur.
In view of above-mentioned research background, need a kind of simple certificate revocation mechanism efficiently can in network, cancel fast and accurately the certificate of malicious node, to reduce malicious node, the destruction of network performance is set up to a believable network.
Summary of the invention
Object of the present invention is exactly in order to address the above problem, a kind of distributed certificate cancelling method of Ad Hoc net environment is provided, its charge weight modification based on node unconditional arbitrarily mutually charge strategy in network, and comprehensive a plurality of charge quantizes to cancel share, adopt dynamic threshold to realize accurately cancelling of malicious node certificate.Meanwhile, the charge by the useful enhancing node of incentive measure affects, and charge function that simultaneously can recovery nodes has guaranteed the rapidity of malicious node certificate revocation.Through NS2.35 emulation experiment, the present invention can efficiently cancel the certificate of malicious node, has significantly improved network security.
To achieve these goals, the present invention adopts following technical scheme:
A distributed certificate cancelling method for Ad Hoc net environment, comprises the steps:
Step (1) a: cycle, its neighbor node of this section point discovery can not normally be carried out network routing protocol, just broadcasts the charge of this node to this neighbor node with the form of charge bag;
Step (2): the charge bag of this node of the 3rd node receiving step (1);
Step (3): it is legal that the 3rd node judges whether the content of charge bag, if just enter step (4); If not, just no longer process this charge;
Step (4): successfully charge, this charge is recorded in the charge table of the 3rd node, meanwhile, in the state table of the 3rd node, upgrade the information of incriminator's node and defendant person's node;
Step (5): this end cycle, the 3rd node calculates the certificate revocation share of this defendant person's node and cancels threshold value;
Step (6): cancel threshold value if the share of the cancellation of doucment of this defendant person's node is not less than it, the certificate of this defendant person's node is cancelled, it is-1 that this certificate status is set, this defendant's node is considered to malicious node;
Obtain after the result of determination of malicious node the charge function of the node that recovery was once charged by this malicious node;
Obtain after the result of determination of malicious node, upgrade the record of node in the state table of the 3rd node once charged this malicious node.
The concrete steps of described step (3) are:
Step (301): the 3rd node judges whether the certificate of incriminator's node and defendant person's node is cancelled; If cancelled, just no longer process this charge; If do not cancel and just enter step (302);
Step (302): the 3rd node judges in the charge table of incriminator's node whether existed this incriminator's node to charge the record of this defendant person's node; If existed, just no longer process this charge; If there is no just enter step (303);
Step (303): check whether the charge weight of this incriminator's node is not less than the charge weight of this defendant person's node; If just enter step (4); If not, just no longer process this charge.
In described step (4), in the state table of the 3rd node, upgrade the information of incriminator's node and defendant person's node: on the charge number of times that incriminator's node sends within the cycle recently, increase 1, defendant's number of times that defendant person's node is total and recently cycle, interior defendant's number of times increased respectively 1, and it is 0 that defendant person's node certificate state is set.
In described step (5):
The charge weight of the 3rd node node of all these defendant persons of charge in accumulative total this cycle of weighting, and the history of the charge weight after weighting and this defendant's node is cancelled to share addition, obtain the certificate revocation share of defendant's node.
Defendant's node cancel half that threshold value equals this node neighbor node sum.
The charge function of the node that in described step (6), recovery was once charged by this malicious node, comprises the steps:
Step (601): for any node of once being charged by this malicious node, if the node in these defendant person's nodes has upgraded the information of the 3rd node at state table early than this malicious node, need to total defendant's number of times, subtract respectively 1 from total defendant's number of times and in next cycle; Otherwise, need to from total defendant's number of times and in this cycle total defendant's number of times subtract 1;
Step (602): after the certificate of all malicious nodes of a certain node of charging is cancelled, the total defendant's number of times of this node is 0, this node recovery nodes charge function.
The record of the node that this malicious node was once charged in renewal in described step (6) in the state table of the 3rd node, comprises the steps:
Step (603): any node of charging this malicious node is increased 1 by cancel respectively malicious node total quantity from the state table of the 3rd node, if some nodes in these incriminator's nodes have upgraded its information at state table early than this malicious node, need within its next cycle, must charge number of times and subtract 1.Otherwise, need within this cycle, must charge number of times and subtract 1.
Beneficial effect of the present invention:
(1) in the present invention, based on node charge weight, be the correct charge that node trusted technology is realized node, by revising unconditional charge mutually arbitrarily between node, the situation of having avoided node charge weight constantly to reduce occurs; Quantize the share of cancelling to a plurality of charges of defendant's node simultaneously, adopt dynamic threshold to determine whether to cancel its certificate plan more, realized the accuracy of certificate revocation.
(2) in the present invention, adopted incentive measure, if a malicious node certificate is cancelled, the node of charging this malicious node will become relatively more credible, and that by these nodes, is sent will accelerate the certificate revocation process to these malicious nodes to the charge of other malicious nodes.A node is charged by a plurality of nodes, after the certificate of all nodes of this node of charge is all undone, by recovering the charge function of this defendant's node, the legal number of nodes with charge function reducing in order to make up the malicious prosecution of network internal cause, has realized the rapidity of certificate revocation.
(3) can be when guaranteeing accurately to cancel fast malicious node certificate in the present invention, by realizing node, be first limited its charge function to the reversed transition of its certificate, i.e. charge can limit the charge function of defendant's node, a plurality of charges are cancelled jointly by the certificate of this node, greatly reduce the generation of malicious prosecution, effectively avoided collusion attack to cancel the incorrect of legal node certificate.For the forfeiture of balance legal node charge function because malicious prosecution causes, for the node that is only limited to charge function, still can there is participation network communication function as ordinary node.
(4) for the ease of charging information management and reducing storage, session expense, in the present invention, adopt periodic node certificate to cancel strategy.Node can be charged at any time the malicious act of malicious node or be accepted the charge to malicious node, but need in end cycle, unify to cancel quantification, for assessment of the certificate of whether cancelling node.
Accompanying drawing explanation
Fig. 1 method flow diagram of the present invention;
The charge table of Fig. 2 nodes records charge relation;
The state table of the charge of Fig. 3 nodes records and defendant's nodal information;
Fig. 4 node certificate is cancelled example schematic;
Fig. 5 node charge functional rehabilitation example schematic;
Fig. 6 integrated stand composition of the present invention.
Embodiment
Below in conjunction with accompanying drawing and embodiment, the invention will be further described.
The present invention make the following assumptions mobile Ad Hoc network: (1) each network node all obtains the PKI certificate and authentication from generally acknowledged authentication center before entering network.(2) half of the total number of nodes of the no more than network of malicious node quantity in network.(3) each node has and for once chance charge another one node.(4) charge between node can occur at any time, but cancelling of node certificate is to occur in end cycle.Based on above hypothesis, the present invention proposes a kind of distributed certificate cancelling method of Ad Hoc net environment, as shown in Figure 1, comprise the steps:
Step (1): in a certain cycle, its neighbor node of this section point discovery can not normally be carried out network routing protocol, just broadcasts the charge of this node to this neighbor node with the form of charge bag;
Step (2): the charge bag of this node of the 3rd node receiving step (1);
Step (3): it is legal that the 3rd node judges whether the content of charge bag, if just enter step (4); Just no longer process if not this charge;
Step (4): successfully charge, this charge is recorded in the charge table of the 3rd node, meanwhile, in the state table of the 3rd node, upgrade the information of incriminator's node and defendant person's node;
Step (5): this end cycle, the 3rd node calculates the certificate revocation share of this defendant person's node and cancels threshold value;
Step (6): cancel threshold value if the share of the cancellation of doucment of this defendant person's node is not less than it, the certificate of this defendant person's node is cancelled, it is-1 that this certificate status is set, this defendant's node is considered to malicious node;
Obtain after the result of determination of malicious node the charge function of the node that recovery was once charged by this malicious node;
Obtain after the result of determination of malicious node, upgrade the record of node in the state table of the 3rd node once charged this malicious node.
The concrete steps of described step (3) are:
Step (301): the 3rd node judges whether the certificate of incriminator's node and defendant person's node is cancelled; If cancelled, just no longer process this charge; If do not cancel and just enter step (302);
Step (302): the 3rd node judges in the charge table of incriminator's node whether existed this incriminator's node to charge the record of this defendant person's node; If existed, just no longer process this charge; If there is no just enter step (303);
Step (303): check whether the charge weight of this incriminator's node is not less than the charge weight of this defendant person's node; If just enter step (4); Just no longer process if not this charge.
In described step (4), in the state table of the 3rd node, upgrade the information of incriminator's node and defendant person's node: on the charge number of times that incriminator's node sends within the cycle recently, increase 1, defendant's number of times that defendant person's node is total and recently cycle, interior defendant's number of times increased respectively 1, and it is 0 that defendant person's node certificate state is set.
The charge weight of the 3rd node node of all these defendant persons of charge in accumulative total this cycle of weighting in described step (5), and the history of the charge weight after weighting and this defendant's node is cancelled to share addition, obtain the share of cancelling of defendant's node.Node certificate cancel half that threshold value equals this node neighbor node sum.
The charge function of the node that in described step (6), recovery was once charged by this malicious node, comprises the steps:
Step (601): for any node of once being charged by this malicious node, if the node in these defendant person's nodes has upgraded the information of the 3rd node at state table early than this malicious node, need to total defendant's number of times, subtract respectively 1 from total defendant's number of times and in next cycle; Otherwise, need to from total defendant's number of times and in this cycle total defendant's number of times subtract 1;
Step (602): after the certificate of all malicious nodes of a certain node of charging is cancelled, the total defendant's number of times of this node is 0, this node recovery nodes charge function.
The record of the node that this malicious node was once charged in renewal in described step (6) in the state table of the 3rd node, comprises the steps:
Step (603): any node of charging this malicious node is increased 1 by cancel respectively malicious node total quantity from the state table of the 3rd node, if some nodes in these incriminator's nodes have upgraded its information at state table early than this malicious node, need within its next cycle, must charge number of times and subtract 1.Otherwise, need within this cycle, must charge number of times and subtract 1.
In the present invention, according to the Routing Protocol of whether correctly carrying out of node, be divided into two large classes: legal node and malicious node.So-called legal node is can correctly carry out Routing Protocol carry out the transmission reception of packet and forward, and malicious node can not correctly be carried out Routing Protocol to cause the destruction of network.The charge the present invention who is sent by legal node is referred to as legal charge, and the charge of being sent by malicious node is referred to as malicious prosecution.
Target of the present invention is the malicious node certificate as much as possible that can cancel in network, and can will no longer be there is the ability of other nodes of charge by the malicious node of cancellation of doucment for not having, can make the certificate of non-malicious node maliciously do not cancelled simultaneously, the normal operation of maintaining network that can be positive, the credibility that improves network, can better be applied in more wide field network.
Each node all can be monitored neighbor node behavior in the present invention, such as opening promiscuous mode, by monitoring the delivery ratio of the bag of neighbor node, once this node discovering neighbor node can not correctly be carried out Routing Protocol, just broadcast and the charge bag of this node is charged to this node with this to other nodes in network have malicious act.Malicious node, in order to reach the object of destroying network performance, can be broadcasted the charge to non-malicious node, and the generation of malicious prosecution can cause the charge to non-malicious node, even causes the malice of certificate to be cancelled.So the present invention has not only considered efficiently the cancelling of malicious node certificate, has also considered the impact of malicious prosecution on network performance simultaneously.Specifically comprise following part:
(1) between node, charge
In the present invention, charge node and defendant's node have been defined: if the charge bag of node A broadcast to Node B, node A is referred to as to charge node so, and Node B is referred to as defendant's node accordingly.In theory, each node should have charge function.Understand intuitively, if there are a plurality of nodes to charge a certain node, this defendant's node is exactly malicious node to a great extent so; Meanwhile, if a node has been charged a plurality of nodes, this charge node may be also malicious node to a certain extent so.Consider simultaneously and in network, have collusion attack, so what node sent need to be quantized the charge of other nodes, with the charge weight that represents that this node is had, other nodes are charged with or have been charged to a node, the charge weight of this node will diminish, if a plurality of nodes are charged or charged to this node by a plurality of nodes, what the charge weight of this node will become so is less.The charge weight of node has reflected the credibility of node: the charge weight of node is larger, and node is more credible; The charge weight of node is less, and node is more insincere.Because internodal charge does not have constraint, this has just caused legal charge and malicious prosecution to be present in network simultaneously, the existence of a large amount of charges, causes the charge weight fast-descending of node, and then causes cancelling accurately fast the certificate of malicious node.
In the present invention, design adopts a kind of rational method to realize internodal charge: only have the node that credibility is larger just can remove the node of the less confidence level of charge, namely charge the node that weighted value is large and could broadcast the charge to the less node of charge weighted value.Based on charging between believable node, the existence of malicious prosecution can be effectively reduced, and then the impact of malicious prosecution on legal node can be reduced, improve the accuracy of malicious node certificate revocation.
(2) restriction of charge function
Although can effectively reduce the generation of malicious prosecution based on believable node charge, but along with the charge of legal node to malicious node, the charge weight of legal node also can diminish, when the charge weight of certain legal node is not more than the charge weight of certain malicious node, and between two nodes, never there is charge, malicious node is just had an opportunity to take advantage of so, can broadcast the charge to legal node.
Existing certificate revocation scheme to the management of the charge function of node is, only has after the certificate of node is undone, and node just can lose charge function, that is to say the having or not of charge function of node is to be simultaneous with whether cancelling of node certificate.Analysis based on above the present invention, in the present invention, require the restriction of the charge function of node to occur early than the certificate revocation of node, a node is only once successfully charged, this node just loses charge ability, it is the coefficient effects of a plurality of charges that but the certificate of this node is cancelled, node charge limit of functions, needs slightly long-time relatively.So-called successfully charge refers to by a node the received record of the charge of another node.Legal charge causes malicious node to lose node charge ability, until the certificate of this node is cancelled, this malicious node can not be charged legal node, further reduce the generation of malicious node.For the impact of balance malicious prosecution on network performance, for being limited to charge function but the unrepealed node of certificate, node still can participation network communication as ordinary node.
(3) node certificate is cancelled
Although the charge function that only limits node can greatly reduce the generation of malicious prosecution, if but a node is charged by a plurality of nodes, should cancel fast the certificate of this node so, make it can not in network, participate in internodal communication, reduce its destruction to network performance.Hence one can see that, to cancelling of malicious node certificate, need to carry out balance consideration from accuracy and rapidity two aspects of certificate revocation.
The certificate of a node is cancelled, to be considered to be a malicious node to this node really so, need recovery nodes because of by this malicious node or charge the charge weight that this malicious node reduces, to promote that in network, more node participates in the supervision to malicious node in network, set up secure and trusted network.Simultaneously, this node of charging this malicious node is considered to more believable node, by these nodes, sent to also will not had the larger dynamics of cancelling by the charge of the malicious node of cancellation of doucment in networking, to effectively improve the rapidity to malicious node certificate revocation.In the present invention, adopt periodic cancellation of doucment mechanism, this mechanism has greatly reduced storage administration and session expense when guarantee information is effectively processed.Cancel the certificate of some nodes and not only should consider the charge to this node in nearest one-period, and should consider the history charge to this node.Certain cycle will finish, by quantizing a plurality of charges of a certain node to obtain the share of cancelling of this node, and the revocation mechanism of employing based on dynamic threshold, especially, in the present invention, charge condition has been carried out strictly and reasonably management, reduce the malicious prosecution of malicious node to legal node, effectively realized the accuracy of certificate revocation.
(4) recovery of node charge function
Malicious node has limited the charge function of legal node to the malicious prosecution of legal node, even can make the certificate of legal node be cancelled.Malicious node can seriously reduce network performance to this destruction of network, this is because a large amount of malicious node can cause a lot of legal nodes to lose the supervision of network node malicious act and charge to the charge of legal node, has created more chance remove attacking network for malicious node.A node is initiated the attack to network, if this node does not have the abundant neighbor node with charge function, needs so to cancel for a long time the certificate of this malicious node, and the destruction that network is caused is inestimable.So network can be operated in believable environment, need to there is the legal node with charge function as much as possible to exist in network.Because the charge of malicious node causes the type number of nodes in network constantly to increase, so for the legal node of being accused by mistake, should recover its charge function.
In the present invention, propose a kind of effective scheme and recovered the charge function of legal node.The number of times that needs each nodes records to be charged with in scheme; if a legal node is charged by n malicious node; this node will be recorded and be charged with n time so; wherein the certificate of any one malicious node is cancelled; to from must charge number of times total amount, subtract one; after the certificate of the malicious node of all this nodes of charge is all cancelled; this node has just recovered its charge function; by this node, will be played an active part in network protection, that by it, is sent will be accepted the charge of other network malicious nodes.Along with constantly being cancelled of malicious node certificate, the malicious node quantity in network will constantly reduce, and meanwhile, the legal number of nodes with charge function in network will constantly increase, and finally sets up a believable MANET network.
In the present invention, the node in network being divided into two large classes, is respectively malicious node and legal node.So-called legal node refers to malicious act that can discovering neighbor node and can correctly charge the node of this malicious node, and on the contrary, so-called malicious node refers to the node of those malicious attack networks the legal node of malicious prosecution.Function according to node in network, can further be divided into three major types by these nodes, is respectively ordinary node, white nodes and dark node.As shown in Figure 6, network is bringing into operation the stage most, and all nodes are all ordinary nodes, these ordinary nodes not only can participation network in transmission, acceptance and the forwarding of packet, and there is the function to neighbor node charge, referred to as charge function.An ordinary node is successfully charged, and this node will become white nodes, and white nodes is compared with ordinary node, still can participation network communication, but no longer there is neighbor node charge function.If the certificate of certain node has been cancelled in a plurality of charges, this node is referred to as dark node so, so dark node is the node that has been undone certificate, this category node not only can not participation network proper communication, also no longer have charge function, dark node is considered to real malicious node simultaneously.By analyzing above, ordinary node comprises malicious node and legal node, charged arbitrarily but certificate does not also have reversed ordinary node to belong to white nodes, by the node of cancellation of doucment, belonged to dark node.When charging the certificate of all nodes of a certain white nodes, cancelled, this white nodes will be resumed as ordinary node.
Each node in network will be safeguarded two tables, be respectively charge table and state table, for recording the charge information receiving, and decide the restriction of node charge function and the restriction of node certificate according to these information.
Fig. 2 has described the charge table of node o, mainly comprises defendant person's information and incriminator's information, and they are recording respectively defendant person and accusatorial certificate serial number and certificate status.ON wherein
o_ ID represents to create the certificate serial number of the node o of this charge table, and TN represents the total nodes in network, DN
iiD and
represent that defendant person puts certificate serial number and the certificate status of i, RN
mid and
be expressed as certificate serial number and certificate status that incriminator puts m.
Fig. 3 has described the state table of node o, is recording equally defendant person and incriminator's information, for each node in state table, such as node i need to record following information: NAA
irecording network from the beginning up to date cycle T finish the charge quantity sum to node i in the whole time,
the charge number of total charge node i in record period T,
the charge number being sent by node i in record period T, NSR
irecording the dark node quantity that causes malicious node certificate revocation in the whole network operation time due to node i participation charge malicious node,
recording the charge weight of node i,
recording the share of cancelling of node i, CS
irecording the certificate status of node i.Wherein
cS
ibe expressed as follows:
Wherein
α and β are two coefficients;
Wherein
be illustrated in nearest cycle T interior nodes j and successfully charged node i
Wherein the certificate of each node i can only have a kind of state in one-period
Suppose that this node of node is node i, when node i is during by the charge of a plurality of nodes, the cancelling weight and will increase of node i, is increased to and is not less than threshold value when cancelling weighted value
time, the certificate of node i will be cancelled.In the present invention, adopt dynamic threshold to determine whether cancelling the certificate of defendant's node, and this threshold value is relevant to the running environment at this place of node own, can accurate evaluation node certificate cancel.The threshold value table of cancelling of node i is shown:
Wherein
represent that node i plays the neighbor node number of nearest cycle T in the end time becoming malicious node from node.
Sometime, malicious node starts attacking network, and in the present invention, the neighbor node of this malicious node plays an active part in the process of this its certificate of nodes withdrawal of charge, so certificate revocation starts from node, finds that its neighbor node exists malicious act.Once node finds have node can not normally carry out network routing protocol around, just with the form of charge bag (AP), broadcast its charge to this node, node is received this charge bag, whether the certificate that first checks incriminator's node and defendant person's node is legal, if the certificate of two nodes is not all cancelled, whether then check in charge table exists this incriminator's node to charge this defendant person's node, in charge table, there is not this charge fortunately, finally check whether the charge weight of this incriminator's node is not less than the charge weight of this defendant person's node, if the former right of complaint is great in the latter's charge weight, this incriminator's node has just successfully been charged this malicious node so.If this charge can not, by wherein any one checks, will no longer be processed this charge.Then this charge is recorded in charge table, simultaneously, in state table, upgrade the information of incriminator's node and defendant person's node: on the charge number of times that incriminator's node sends within the cycle recently, increase 1, in the nearest cycle of defendant person's node, on defendant's number of times, increase respectively 1, it is 0 that defendant person's node certificate state is set.This node all carries out above-mentioned processing to any AP receiving, to can grasp in real time the credibility of network node.In the time of this end cycle, node calculates cancelling share and cancelling threshold value of this defendant person, if the share of cancelling of this defendant's node is not less than it and cancels threshold value, the certificate of this defendant person's node will be cancelled, it is-1 that this certificate status is set, this defendant's node is considered to real malicious node, and the charge bag of any this node of charge will can not accepted.Meanwhile, for any node of once being charged by this malicious node, if some nodes in these defendant person's nodes have upgraded its information at state table early than this malicious node, need within its next cycle, must subtract 1 by defendant's number of times.Otherwise, need within this cycle, must subtract 1 by defendant's number of times.Any node of charging this node is increased 1 by cancelling malicious node total quantity respectively from state table separately, if some nodes in these incriminator's nodes have upgraded its information at state table early than this malicious node, need within its next cycle, must charge number of times and subtract 1.Otherwise, need within this cycle, must charge number of times and subtract 1.Algorithm 1 has provided certificate revocation process in detail.Wherein m n represents that node m charged node n, TU
mrepresent that node m upgrades its variable in state table constantly, symbol > and < represent priority, TU
m>TU
nor TU
n<TU
mall represent that on the node m time, having precedence over node n upgrades its variate-value in state table.
Fig. 4 in conjunction with an example certificate revocation process.Suppose node M
1for malicious node, node M
1neighbor node participate in the charge to it, and node R
1received node M
1to node H
3charge.
Step 1: node H
1, H
2and H
4the charge bag of broadcast to M
Step 2:R
1in cycle T, receive by H
1the charge bag sending, if this charge bag has passed through node H
1inspection to it, arranges
With
Step 3:R
1to receive by H
2and H
4the charge bag of broadcast is done similar processing
Step 4: cycle T finishes, R
1calculate respectively
with
Step 5.1: if
cancel node M
1certificate.If node H
1, H
2, H
4and H
3early than M
1upgraded state table,
With
otherwise
With
In above-mentioned example, provided the basic step that node certificate is cancelled, for each node in state table, before whether assessment cancels this node certificate, need to check node certificate state status, according to different node certificate states, carry out different processing procedures.If node certificate state is 1, only need to calculate the charge weight of next cycle node; If node certificate state is-1, do not do the processing to this node; If the certificate status of node is 0, is divided into two kinds of situations and processes this node: if no longer include node in the whole network operation time, charge this node, the charge state of recovery nodes; Otherwise according to step 4, node is carried out to certificate revocation processing.
The restriction of the legal node charge causing for the malicious prosecution that can recover due to malicious node, designs a variable for recording the number of times of this legal node defendant in whole network time, such as the variable NAA of node i in the present invention
i.In the random time of network, whenever there being node to charge this node, this variable can increase and increase along with charging number of times in the nearest cycle, and each added value is 1, but different from it, this node is when the new cycle starts, not by this variate-value zero clearing.One-period finishes, and whenever the certificate of this node of charge is cancelled, this variable will subtract 1 total amount from charging herein, the certificate of a plurality of nodes is cancelled, must charge number of times will constantly reduce, until no longer include this node of charge charge, the certificate of this node is resumed.Node charge functional rehabilitation algorithm can comparator algorithm 1.
Fig. 5 in conjunction with an example process of node charge functional rehabilitation.Suppose node R
1received node M
1and M
2to node H
3charge, and node H
3there are and only have this two node charges.Afterwards, node M
1by node H
1, H
2and H
4charge, node M
2by node H
4, H
5and H
6charge.
Step 5.2: node H
3within whole network time, must subtract 1 by defendant's number of times,
Step 6: in another end cycle, node R
1cancelled node M
2certificate,
Step 7: if
recovery nodes H
3charge function, arrange
Node H
3charge function owing to having cancelled the certificate of all these nodes of charge, recovered, if node H
3find that its neighbor node exists malicious act, just can as ordinary node, broadcast the charge bag to malicious node.Along with the continuous minimizing of malicious node certificate, the malicious node quantity in network constantly reduces, and the legal number of nodes with charge function constantly increases, and this will make mobile ad-hoc network become more and more credible.
Although above-mentioned, by reference to the accompanying drawings the specific embodiment of the present invention is described; but be not limiting the scope of the invention; one of ordinary skill in the art should be understood that; on the basis of technical scheme of the present invention, those skilled in the art do not need to pay various modifications that creative work can make or distortion still in protection scope of the present invention.
Claims (6)
1. a distributed certificate cancelling method for Ad Hoc net environment, is characterized in that, comprises the steps:
Step (1): in a certain cycle, its neighbor node of this section point discovery can not normally be carried out network routing protocol, just broadcasts the charge of this node to this neighbor node with the form of charge bag;
Step (2): the charge bag of this node of the 3rd node receiving step (1);
Step (3): it is legal that the 3rd node judges whether the content of charge bag, if just enter step (4); Just no longer process if not this charge;
Step (4): successfully charge, this charge is recorded in the charge table of the 3rd node, meanwhile, in the state table of the 3rd node, upgrade the information of incriminator's node and defendant person's node;
Step (5): this end cycle, the 3rd node calculates the certificate revocation share of this defendant person's node and cancels threshold value;
Step (6): cancel threshold value if the share of the cancellation of doucment of this defendant person's node is not less than it, the certificate of this defendant person's node is cancelled, it is-1 that this certificate status is set, this defendant's node is considered to malicious node;
Obtain after the result of determination of malicious node the charge function of the node that recovery was once charged by this malicious node;
Obtain after the result of determination of malicious node, upgrade the record of node in the state table of the 3rd node once charged this malicious node.
2. the distributed certificate cancelling method of a kind of Ad Hoc net environment as claimed in claim 1, is characterized in that, the concrete steps of described step (3) are:
Step (301): the 3rd node judges whether the certificate of incriminator's node and defendant person's node is cancelled; If cancelled, just no longer process this charge; If do not cancel and just enter step (302);
Step (302): the 3rd node judges in the charge table of incriminator's node whether existed this incriminator's node to charge the record of this defendant person's node; If existed, just no longer process this charge; If there is no just enter step (303);
Step (303): check whether the charge weight of this incriminator's node is not less than the charge weight of this defendant person's node; If just enter step (4); If not, just no longer process this charge.
3. the distributed certificate cancelling method of a kind of Ad Hoc net environment as claimed in claim 1, it is characterized in that, in described step (4), in the state table of the 3rd node, upgrade the information of incriminator's node and defendant person's node: on the charge number of times that incriminator's node sends within the cycle recently, increase 1, on interior defendant's number of times of defendant's number of times that defendant person's node is total and recently cycle, increase respectively 1, it is 0 that defendant person's node certificate state is set.
4. the distributed certificate cancelling method of a kind of Ad Hoc net environment as claimed in claim 1, is characterized in that,
The charge weight of the 3rd node node of all these defendant persons of charge in accumulative total this cycle of weighting in described step (5), and the history of the charge weight after weighting and this defendant's node is cancelled to share addition, obtain the share of cancelling of defendant's node; Node certificate cancel half that threshold value equals this node neighbor node sum.
5. the distributed certificate cancelling method of a kind of Ad Hoc net environment as claimed in claim 1, is characterized in that,
The charge function of the node that in described step (6), recovery was once charged by this malicious node, comprises the steps:
Step (601): for any node of once being charged by this malicious node, if the node in these defendant person's nodes has upgraded the information of the 3rd node at state table early than this malicious node, need to total defendant's number of times, subtract respectively 1 from total defendant's number of times and in next cycle; Otherwise, need to from total defendant's number of times and in this cycle total defendant's number of times subtract 1;
Step (602): after all malicious nodes of once charging this node are all cancelled, this node recovery nodes charge function.
6. the distributed certificate cancelling method of a kind of Ad Hoc net environment as claimed in claim 1, is characterized in that,
The record of the node that this malicious node was once charged in renewal in described step (6) in the state table of the 3rd node, comprises the steps:
Step (603): any node of charging this malicious node is increased 1 by cancel respectively malicious node total quantity from the state table of the 3rd node, if some nodes in these incriminator's nodes have upgraded its information at state table early than this malicious node, need within its next cycle, must charge number of times and subtract 1; Otherwise, need within this cycle, must charge number of times and subtract 1.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410348052.8A CN104159216B (en) | 2014-07-21 | 2014-07-21 | A kind of distributed certificate cancelling method under Ad Hoc networks environment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410348052.8A CN104159216B (en) | 2014-07-21 | 2014-07-21 | A kind of distributed certificate cancelling method under Ad Hoc networks environment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104159216A true CN104159216A (en) | 2014-11-19 |
| CN104159216B CN104159216B (en) | 2017-07-07 |
Family
ID=51884602
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410348052.8A Expired - Fee Related CN104159216B (en) | 2014-07-21 | 2014-07-21 | A kind of distributed certificate cancelling method under Ad Hoc networks environment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104159216B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104901798A (en) * | 2014-03-05 | 2015-09-09 | 罗伯特·博世有限公司 | method for revoking a group of certificates |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090249062A1 (en) * | 2008-03-31 | 2009-10-01 | Motorola, Inc. | METHOD AND APPARATUS FOR DISTRIBUTING CERTIFICATE REVOCATION LISTS (CRLs) TO NODES IN AN AD HOC NETWORK |
| CN102263787A (en) * | 2011-07-08 | 2011-11-30 | 西安电子科技大学 | Dynamic distributed certification authority (CA) configuration method |
-
2014
- 2014-07-21 CN CN201410348052.8A patent/CN104159216B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20090249062A1 (en) * | 2008-03-31 | 2009-10-01 | Motorola, Inc. | METHOD AND APPARATUS FOR DISTRIBUTING CERTIFICATE REVOCATION LISTS (CRLs) TO NODES IN AN AD HOC NETWORK |
| CN102263787A (en) * | 2011-07-08 | 2011-11-30 | 西安电子科技大学 | Dynamic distributed certification authority (CA) configuration method |
Non-Patent Citations (4)
| Title |
|---|
| KYUL PARK，ET.AL.: "Certificate Revocation to Cope with False Accusations in Mobile Ad Hoc Networks", 《2010 IEEE 71ST VEHICULAR TECHNOLOGY CONFERENCE》 * |
| WEI LIU，ET.AL.: "A Study on Certificate Revocation in Mobile Ad Hoc Networks", 《2011 IEEE INTERNATIONAL CONFERENCE ON COMMUNICATIONS》 * |
| 石玲玲: "Ad Hoc网络证书撤销机制的分析和研究", 《中国优秀硕士学位论文全文数据库》 * |
| 莫杰等: "Ad Hoc网络的分布式证书撤销方案", 《计算机工程》 * |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104901798A (en) * | 2014-03-05 | 2015-09-09 | 罗伯特·博世有限公司 | method for revoking a group of certificates |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104159216B (en) | 2017-07-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Nguyen et al. | Energy depletion attacks in low power wireless networks | |
| Zhang et al. | Byzantine attack and defense in cognitive radio networks: A survey | |
| Virendra et al. | Quantifying trust in mobile ad-hoc networks | |
| Ye et al. | Statistical en-route filtering of injected false data in sensor networks | |
| Shen et al. | Signaling game based strategy of intrusion detection in wireless sensor networks | |
| Kukreja et al. | Power aware malicious nodes detection for securing MANETs against packet forwarding misbehavior attack | |
| CN111431695A (en) | Software defined tactical network node credit management method based on block chain | |
| Konate et al. | Attacks Analysis in mobile ad hoc networks: Modeling and Simulation | |
| CN103841553A (en) | Method for routing security and privacy protection of mixed wireless Mesh network | |
| CN105611600A (en) | QoE (Quality of Experience) requirement oriented secure routing method for Internet of Things | |
| Zhang et al. | On effective data aggregation techniques in host–based intrusion detection in manet | |
| Alsaedi et al. | Energy trust system for detecting sybil attack in clustered wireless sensor networks | |
| Vassilaras et al. | Security and cooperation in clustered mobile ad hoc networks with centralized supervision | |
| Singh et al. | Survey: black hole attack detection in MANET | |
| CN104159216A (en) | Distributed certification revocation method under Ad Hoc network environment | |
| Abramov et al. | Development of a secure Cluster-based wireless sensor network model | |
| Labraoui et al. | RAHIM: Robust Adaptive Approach Based on Hierarchical Monitoring Providing Trust Aggregation for Wireless... | |
| CN102088741B (en) | Method for coping with malicious interference in wireless sensor network (WSN) | |
| Yang et al. | Dual trust secure protocol for cluster-based wireless sensor networks | |
| Vijayakumar et al. | A novel jamming detection technique for wireless sensor networks | |
| Duan et al. | Issues of trust management for mobile wireless sensor networks | |
| Yuan et al. | KAEF: An en-route scheme of filtering false data in wireless sensor networks | |
| Shinde et al. | Securing wireless sensor network against pollution attack with block chain | |
| Shurman et al. | An Enhanced Cross-Layer Approach Based on Fuzzy-Logic for Securing Wireless Ad-Hoc Networks from Black Hole Attacks | |
| Jain | Security and trust in mobile ad-hoc networks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20170707 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |