KR20080040393A - Secure data forwarding based on source routing in mobile ad hoc network - Google Patents

Abstract

A secure data transmission method based on a source routing in a mobile ad hoc network is provided to guarantee the integrity of data by generating a value using a hash key chain and transmitting data and an ACK(Acknowledgement) signal. A secure data transmission method based on a source routing in a mobile ad hoc network includes the steps of: adjusting a hash key selection window as much as the number of nodes which are included in path information received from a destination(D); and selecting a hash key chain at a predetermined position of a generated hash key chain. Each node receives a couple of hash keys having a selected reliable node T in an inverse direction of a key chain which is generated in a sequence of a node to which data and ACK are transmitted.

Description

Secure data transmission in mobile ad hoc networks based on source routing {SECURE DATA FORWARDING BASED ON SOURCE ROUTING IN MOBILE AD HOC NETWORK}

1 is a view showing a basic structure for the present invention,

2 is a diagram in which route D delivers route information to trusted node T after routing by source routing;

3 is a hash key selection window adjusted by the number of nodes included in the route information received from the destination D in the bidirectional hash key chain previously generated by the trusted node T, and then the hash key pair is selected at a random position and shared with each node. Drawing to encrypt with a secret key,

4 is a diagram in which a trusted node T distributes an encrypted hash key pair to each mobile node;

5 is a diagram in which the source S receives a hash key pair and generates a value using the data and the hash key to safely deliver the value to the destination D.

6 is a diagram in which the destination D generates an ACK in response to the data received from the source S, and then generates a value with the hash key received from the trusted node T to the source S, and securely delivers it to the source S.

The present invention relates to a method of protecting a route established in a source routing based mobile ad hoc network from being arbitrarily modified by an attacker, and allowing data to be safely delivered to a destination along the route established. Mobile ad hoc network is a network environment that can be configured and communicated with only mobile nodes without any fixed base such as AP or BS (Base Station) used for communication in existing wireless network environment. In addition, since mobile nodes are free to join and leave mobile ad hoc network environments, and all mobile nodes communicate using wireless channels, malicious attackers can easily be included in normal communication, and it is not easy to detect such malicious nodes.

In a mobile ad hoc network environment, there are a number of safe ways to prevent malicious attackers from being involved in the normal routing and data forwarding process to prevent attacks that interfere with routing, tampering with data, or disrupting normal communication. Proposed. The proposed methods can be largely classified into public key based method and symmetric key method. Among several methods that use public key based method, ARAN uses all mobile nodes received certificate from authentication server. Every mobile node that enters the ad hoc network environment sends a certificate request message to the authentication server, which includes unique information that can prove itself to the authentication server. The authentication server signs the mobile node's public and authentication information with its private key. Pass the certificate to the mobile node. Afterwards, in the routing process for secure data transmission, the mobile nodes sign the routing message using their private key and deliver the same along with their certificate to the neighbor node. The neighbor node verifies that the node sending the message is a normal node and verifies the signed message using the public key included in the certificate. After that, the source node signs the message signed by the private key and the message generated by the private key with the private key, and then passes the source certificate and its own certificate to the neighbor node. These messages are delivered with integrity and nonrepudiation. Ariadne has been proposed to secure routing in the DSR, an on-demand ad hoc network routing protocol. Ariadne shares a secret key between nodes in advance and uses the TESLA broadcast authentication protocol to protect the routing message. Ariadne defines eight fields: Route Request, Initiator, Target, Id, Time Interval, Hash Chain, Node List, and MAC List to protect routing messages. When a node sends an RREQ, it broadcasts to its neighbors, including its own address for the initiator, a destination address for the target, an id for the current RREQ's identification number, a TESLA time interval for the time interval, and a hash chain that it creates. If a node receives a broadcasted RREQ message, it generates a hash chain by hashing its identifier and the hash chain value of the previous node if it is not the destination, and broadcasts it to the neighbor node including the MAC value using the TESLA key. When delivered to the destination node, the destination node creates an RREP and sends it to the source node along the path set in the message it received. In the transmitted RREP, MAC values generated by each node and the node list are delivered together during the RREQ message transfer process, and each node that receives the RREP transmits its TESLA key to the neighboring node. When the source node receives the RREP, it gets the authenticated node information.

After routing securely using routing protocols such as ARAN and Ariadne described above, data is delivered along a route set as a destination node. Even after the path is established in a secure manner, there are various attacks that prevent the normal transmission by modifying or arbitrarily discarding the path or data by a malicious attacker. Therefore, there is a need for a safe way to ensure that the path or data does not change in the course of data transfer. Among the existing methods, the Watchdog, which is proposed to check for malicious or abnormal behavior, checks for anomalous nodes in the process of transferring data, or scans for malicious nodes that intentionally discard data packets. It can be applied when using the source routing protocol as a technology. In this way, when a malicious node is found, the other node removes the node from the network or modifies the node's reputation so that data packets are not sent to nodes with low reputation.

However, although the conventional methods described above can safely transmit data in a mobile ad hoc network, there are some disadvantages when applied to an actual ad hoc network environment. In the case of using a public key-based certificate, each time a mobile node receives a message, it must calculate the source's certificate and the neighbor's certificate and verify the re-signed message using the public key included in the certificate. . In general, public key calculation requires about 1000 times the encryption and decryption calculation time than the symmetric key based method, which results in a slower processing speed than other methods, and increases the amount of computation required by the node. have. On the other hand, the symmetric key has a much faster processing speed than the public key based method, but there is a problem of sharing a secret key with all nodes in the key distribution process. Assuming n nodes, each node should share and keep as many keys as there are keys. In addition, when a mobile node moves, there is a disadvantage in that a key exchange operation for sharing a secret key with neighboring nodes continues.

As a result, there is a need for a method of efficiently using the limited resources of the mobile terminal in the process of delivering data through the established path by improving the disadvantages of applying the conventional methods to the actual mobile ad hoc network and transmitting the data safely.

The present invention has been made to solve the above problems, and prevents the path set by the source routing protocol from being changed by any attacker in the mobile ad hoc network, and the reliability of the established path and We want to provide a way to support integrity.

In addition, the present invention is to provide a path authentication, message integrity support, secure data transmission method and the like provided by the existing public key or symmetric key based on applying the bidirectional hash key chain.

1 is an overall structural diagram of the present invention. In the present invention, trusted node T 101 is used to distribute the hash key to each node. Mobile nodes 102-106 share secret keys 107-111 in a secure manner with trusted node T 101 when they enter the first ad hoc network environment. At this time, the shared secret keys 107 to 111 are used to encrypt the distributed key in the process of distributing the key to each of the nodes 102 to 106 by the trusted node T 101. In addition, the trusted node T 101 generates and stores a bidirectional hash key chain as in Equation 1 using its secret value and an arbitrary number. This hash key chain is then used to select a hash key pair distributed to each node included in the established route information. The present invention presupposes that the path has already been securely set up by source routing in a mobile ad hoc network environment.

2, the source routing causes the destination D 106 to know the route information through the RREQ sent by the source S 102. In response to the RREQ, destination D 106 sends an RREP message 201 to source S 102. At this time, the destination D 106 encrypts the route information with the secret key 111 sharing the route information that it knows with the trusted node T 101, and transmits the encrypted route information to the trusted node T 101.

3 is a hash key selection window 303 corresponding to the number of nodes included in the hash key chain 301 and 302 previously generated by the trusted node T 101 and the path information 202 received from the destination D 106 in the 302. 305), and then select hash key pairs 401 to 405 at arbitrary positions. The hash key selection windows 303 and 305 vary as many as the number of nodes included in the set path. It also moves 304 and 306 to any position of the pre-generated hash key chains 301 and 302 and selects the hash keys so that they do not overlap. The selected hash key pairs 401-405 are encrypted with the trusted nodes T 101 and the secret keys 107-111 of each node 102-106, respectively, and receive the hash key pairs 401-405. IPs 307 to 311 are forwarded to the encrypted hash key pairs 401 to 405 to each node at once.

4 shows each node 102 ˜ after selecting the hash key pairs 401 ˜ 405 corresponding to the number of nodes included in the path with reference to the route information 202 received from the destination D 106 by the trusted node T 101. To 106). Each node that receives the encrypted hash key pair is identified with its own IP and then decrypted using its secret key. Table 1 below summarizes the hash key pair and the secret key used to encrypt the hash key pair delivered to each node.

Data protection key K _Di (301) K ₆ K ₅ K ₄ K ₃ K ₂ ACK protection key K _Sj (302) K ₉ K ₁₀ K ₁₁ K ₁₂ K ₁₃ Secret key SK SK _TS (107) SK _TN1 (108) SK _TN2 (109) SK _TN3 (110) SK _TD (111) Node Source (102) N1 (103) N2 (104) N3 (105) N4 (106)

5 transmits data 501 along the determined path after source S 102 receives RREP 201. At this time, the source S 102 generates a raw value 502 used to securely transfer data among the hash key pairs received from the trusted node T 101, attaches it to the data, and delivers it to the N1 node 103. Equation 2 below shows the values of the chains 502 to 505 generated by each node when data is transferred from the source S 102 to the destination D 106.

When destination D 106 receives the data and the value 505, it verifies the value 505 using the distribution distributed by trusted node T 101. The hash key distributed by the destination D 106 is the first generated key among the hash keys of the nodes included in the path. Therefore, hashing the hash key of the destination D 106 may generate a hash key distributed by previous nodes, and the received key 505 may be verified using this key.

6 informs the source S with an ACK that the destination D has received data securely. At this time, the destination D generates a by using the key distributed from the new node T and delivers it to the node N3. The N3 node generates ACK using the received ACK and the distributed key and delivers it to the neighbor node. The generated value is generated in the same manner as in Equation 2. When the source S receives the delivered ACK message, it validates by using the distributed.

The effects of the present invention described above are as follows.

First, it guarantees the reliability of the established route in source routing based mobile ad hoc network environment. In the case of a hash keychain, it is not possible to find out the old key using the generated key. When the data is passed to S N1 N2 N3 D, the distributed hash key chain is distributed with the key generated last by the source S and by the destination D with the first generated key. When the data is passed along the set path, each node calculates and passes the including the of the previous node with the distributed hash key. Therefore, if the path is changed by the malicious attacker, the normal value cannot be generated. The path can be changed to prevent data from being passed.

Second, data integrity is ensured by generating data using hash key chains in both directions and then passing data and ACKs.

Third, because the data is delivered using the value calculated using the hash key, it is calculated relatively quickly and simply compared to the method of protecting the data using the public key base and authenticating each node. It can be applied effectively without waste. In addition, since hash key pairs are distributed through the trust node T, a key sharing problem that is a problem in symmetric keys can be solved.

Claims (3)

How to select the hash key chain at any position of the hash key chain generated by adjusting the hash key selection window by the number of nodes included in the route information received from the destination D. The method of claim 1, Trust node T passes the hash key pair selected so that each node can receive the selected hash key pair in the reverse order of generating the hash key chain in the order of the data and ACK node. The method of claim 2, In the process of transmitting data and ACK, each node calculates and transmits the value in chain form through the hash key chain received from the trusted node T, and then hashes its hash key at the final destination to generate the hash key of the previous node. How to verify the value

Images