TWI418177B - Random network security routing method - Google Patents

Description

Free network security routing method

The invention relates to a routing method, in particular to an arbitrary network security routing method.

In the initial stages of the development of the Internet, the way users use the Internet is to connect to the network through a wired connection. Until the 1999 IEEE proposed the 802.11 Wireless Local Area Networks (WLAN), WLAN came into being. After this standard is set, various equipment manufacturers have produced many products according to this standard. At this stage, the development speed of wireless networks has taken a big step forward. The main vision of wireless networks is to make tables. A host computer, laptop, or other mobile device capable of using a wireless network can wirelessly log into the network, transforming the transmission medium from a tangible network route to invisible air, thereby enabling it to reach any time and any Locations, users can connect to the Internet via wireless network.

In addition, the wireless network is mainly divided into two types: an infrastructure network that requires an access point (Infrastructure Network) and a mobile network that does not require a base station (MANETs). Among them, the mobile wireless network has a peer-to-peer nature, that is, the connection mode can be a corresponding Peer to Peer Mode, so it can also be called a peer-to-peer network (Peer). To Peer Network).

Since the mobile network can organize itself dynamically and allow the mobile nodes to communicate with each other via wireless network-related technologies without any infrastructure, they can establish connections at any time (also known as built-in). With considerable convenience and mobility, mobile networks are gradually gaining attention from wireless networks and industry.

Although the mobile network can organize itself dynamically, and the mobile nodes can establish and communicate with each other via wireless technology without infrastructure, it seems convenient and mobile. However, due to the broadcast characteristics of radio waves, the defects of routing protocol design and the action node itself, many problems or security vulnerabilities are caused. The most important and significant security problems are mainly the following:

(1) Node information is easily obtained:

Since the mobile network is communicating in an open environment, if the routing protocol used is not designed with security in mind, it is used in the actual environment as long as it is covered by radio waves. Node information is easily obtained by an attacker. In the case of eavesdropping, any eavesdropper can smoothly perform eavesdropping by adjusting the receiving frequency of the network card to the transmission frequency. Therefore, if the information is to be transmitted over the wireless network, It is necessary to protect the data to improve the security of data transmission.

(2) Routing information is easily modified:

Extending from the above, the attacker can obtain the content of the node and obtain the content of the packet, for example, the source node address, the destination node address, the serial number, etc., and then resend to the network. , causing other nodes in the network to get the wrong message.

(3) Black hole attack:

This attack method, as in the general relativity proposed by Einstein, refers to the special celestial features of the black hole. The gravitational attraction in the black hole is very powerful. No matter can escape from this area, even the light is strongly attracted by it. Pull back; therefore, in the random network, there is a black hole attack, the malicious node in the route search phase, using the characteristics of the routing protocol to declare that it has the shortest path to the specified destination node, so that the packets of some nodes flow through this A malicious node, after receiving a packet, the malicious node discards the packet, thereby achieving the purpose of intercepting the packet.

Therefore, how to propose a security method to improve the general potential vulnerabilities of random network routing protocols has become a goal that related schools and the industry are trying to achieve.

Accordingly, it is an object of the present invention to provide an arbitrary network secure routing method that utilizes the transmission of a fictitious packet to detect whether a malicious host is hidden in a transmission path.

Therefore, the random network security routing method of the present invention comprises the following steps:

(a) Before the source host wants to transmit a data packet to a destination host, it determines whether there is a path information to the destination host in a routing table, and if not, proceeds to the next step.

(b) The source host sends a path query packet with a fictitious destination address to the plurality of relay hosts.

(c) the source host determines whether there is a path response packet backhaul corresponding to the path query packet, and if yes, indicating that the relay host includes at least one malicious host, analyzing the source of the path response packet, and The source of the malicious host is included in a blacklist.

Further, another object of the present invention is to provide an arbitrary network secure routing method for encrypting data using a communication key.

Therefore, the random network security routing method of the present invention comprises the following steps:

(a) A transmitting host performs a verification operation before transmitting a path inquiry packet including a constant field and a variable field, that is, the transmitting host generates a verification value, and then uses a hash operation function to verify the packet. The value performs a hash operation of the first hop count number, generates a verification hash value, and places the verification hash value and the verification value into the constant field, and places the first hop value into the variable column Within the bit.

(b) Reusing the private key to transmit the private key to encrypt the unchanged field and send the path inquiry packet.

(c) upon receiving the path query packet encrypted by the transport private key, the receiving host uses one of the transmitting host to transmit the public key to decrypt the unchanged field, and obtains the verification value and the verification hash. The value is used, and the hash value is used to perform a hash operation of the second hop number of times on the verification value to generate a hash value to be tested.

(d) The receiving host compares the verification hash value with the to-be-tested hash value. If they are the same, it indicates that the verification operation works correctly.

(e) when the transmitting host is a source host for transmitting a data, the source host generates a first value and performs a public key with one of the destination hosts before performing the verification operation and transmitting the data. The first value is encrypted and placed in the path query packet, and the path inquiry packet is sent.

(f) When the receiving host is the destination host, after the verification operation is correct and the path inquiry packet is received, the first value is solved by using a private key of the destination host.

(g) the destination host generates a second value before sending a path response packet, and encrypts the second value with a public key of the source host, and places the path response packet, and sends the path response. Packet.

(h) When the source host receives the path response packet, the second value is solved by using a private key of the source host.

(i) the source host uses an operation mechanism to calculate the first value and the solved second value to obtain a communication key, and the destination host uses the operation mechanism to solve the second value and the solution The first value is calculated to obtain the communication key.

(j) The source host encrypts the data using the communication key and transmits it to the destination host.

The effect of the present invention is that the source host sends a path query packet with the fictitious destination address to the relay hosts, and observes the return status of the relevant path response packet to remove the malicious host; The public and private key encryption and decryption mechanisms of the host, as well as the assistance of digital signatures and hash function operations, prevent the risk of tampering with the transmitted data.

The above and other technical contents, features and advantages of the present invention will be apparent from the following detailed description of the preferred embodiments of the invention.

Before the present invention is described in detail, it is noted that in the following description, similar elements are denoted by the same reference numerals.

Referring to FIG. 1 and FIG. 2, a first preferred embodiment of the network security routing method of the present invention includes the following steps. First, as shown in step 61, a source host 1 wants to transmit a data packet 10 to a destination host 2 As shown in step 62, it is determined whether there is a path information 111 to the destination host 2 in a routing table 11: if yes, that is, when the source host 1 determines that there is path information 111 to the destination host 2, As shown in step 63, the data packet 10 is directly transmitted to the destination host 2 according to the path information 111.

If not, then as shown in step 64, the source host 1 sends a path query packet 12 having a fictitious destination address to the plurality of relay hosts 3.

Then, as shown in step 65, the source host 1 determines whether there is a path response packet 311 corresponding to the path query packet 12: if yes, as shown in step 66, it indicates that the relay host 3 includes at least one The malicious host 31 analyzes the source of the path response packet 311 as shown in step 67, and lists the source of the malicious host 31 in a blacklist 13.

If not, that is, when the source host 1 determines that there is no backhaul response packet 311 backhaul, as shown in step 68, a path finding mechanism is used to cooperate with the ones not listed in the blacklist 13. After the host 3 establishes a packet transmission path, the data packet 10 is transmitted to the destination host 2.

It is worth mentioning that the path finding mechanism adopts the Ad Hoc On-demand Distance Vector Routing protocol in the preferred embodiment. However, in practice, it can be a secure and random network requirement. The Secure Ad Hoc On-demand Distance Vector Routing protocol or the Adaptive-Securing Ad Hoc On-demand Distance Vector Routing protocol, which is easy for those with relevant backgrounds. And variations are employed and should not be limited to the specific examples of the preferred embodiments.

Finally, as shown in step 69, after the step 67 is performed, if any of the relay hosts 3 not listed in the blacklist 13 receives the path response packet 311, the path response packet 311 is discarded.

Therefore, the malicious host 31 is reversed by the manner in which the path of the destination address with the fictitious non-existent destination is sent to the network by the first preferred embodiment of the network secure routing method of the present invention. Free network black hole attack mode.

In addition, in order to further prevent risks such as "node information is easily obtained" and "route information is easily modified" in the above-mentioned general random network, the related transmission data is sneaked or tampered with. Next, please refer to FIG. 3 to A second preferred embodiment of the network security routing method of the present invention is provided. The preferred embodiment includes the following steps. First, referring to FIG. 3A and FIG. 4, as shown in step 701, a transmitting host 8 transmits one. Before the path query packet 14 including the invariant field 141 and the variable field 142, a verification operation is performed, that is, as shown in step 702, the transfer host 8 generates a verification value 81, and then applies a hash operation function ( Hash Function 82 performs a hash operation on the verification value for a first hop value of 83 (here, a maximum hop value) to generate a verification hash value 84. In the preferred embodiment, the verification value 81 is in the form of a random random number, and the hash operation function 82 is a One Way Hash Function.

Next, as shown in step 703, the verification hash value 84 and the verification value 81 are placed in the constant field 141, and the first hop value 83 (ie, the maximum hop value) is placed in the variable field. Within 142.

Next, as shown in step 704, the invariant field 141 is encrypted by transmitting the private key 85 by one of the transmitting hosts 8, and the path inquiry packet 14 is sent. In the preferred embodiment, in step 704, the step 704 is performed on the digital signature. However, the foregoing digital signature method of the present invention differs from the prior art in that it is added to the present invention. The verification value 81 is a random random number, so that the verification value 81 is a time-varying value having a time-varying parameter property, thereby effectively preventing the digital signature from being intercepted, stored and reused by the malicious host 31.

Next, referring to FIG. 3A and FIG. 5, as shown in step 705, a receiving host 9 transmits a public key 86 using one of the transmitting hosts 8 upon receiving the path query packet 14 encrypted by the transmitting private key 85. The invariant field 141 is decrypted to obtain the verification value 81 and the verification hash value 84.

Then, as shown in step 706, the hash function is performed by the hash operation function 82, and a hash operation of the second hop value 91 (here, the maximum hop count number minus one receive hop value) is generated. A waiting hash value of 92.

Then, as shown in step 707, the receiving host 9 compares the verification hash value 84 with the to-be-tested hash value 92.

If the comparison result is the same, as shown in step 708, the verification operation is correct.

If the comparison result is different, as shown in step 709, the verification operation fails, and the receiving host 9 discards the path inquiry packet 14.

Next, referring to FIG. 3A, FIG. 3B and FIG. 6, as shown in step 710, when the transfer host 8 is a source host 1 for transmitting a data 5, the verification operation proposed in steps 701 to 709 is performed. The source host 1 generates a first value of 15 before transmitting the data 5.

And as shown in step 711, the source host 1 encrypts the first value 15 with the public key 21 of the destination host 2, and places the encrypted first data 151 into the path query packet 14, and then sends it out. The path asks for packet 14. In the preferred embodiment, the first value 15 is in the form of a random random number.

Then, as shown in step 712, when the receiving host 9 is the destination host, after the verification operation is correct and the path inquiry packet 14 is received, the private key 22 of the destination host 2 is used to solve the number. A value of 15.

Then, as shown in step 713, the destination host 2 generates a second value 24 before sending a path response packet 23, and as shown in step 714, the primary key 1 is used to disclose the key 16 to the first The second value 24 is encrypted, and the encrypted second value 241 is placed in the path response packet 23, and the path response packet 23 is sent. In the preferred embodiment, the second value 24 is in the form of a random random number.

Next, as shown in step 715, when the source host 1 receives the path response packet 23, the second value 24 is solved by using the private key 17 of the source host 1.

Next, as shown in step 716, the source host 1 uses a computing mechanism to calculate the first value 15 and the second value 24 that is solved to obtain a communication key 4, and the destination host 2 utilizes the The arithmetic mechanism operates the second value 24 and the first value 15 that is solved to obtain the same communication key 4. In the preferred embodiment, the operation mechanism is to perform a mutually exclusive operation on the first value 15 and the second value 24. However, in practice, other people in the related fields may also adopt other A value of 15 and the input of the second value 24 result in various ways in which the communication key 4 is contemplated.

Then, as shown in step 717, the source host 1 encrypts the data 5 by using the communication key 4, and then transmits the encrypted data 51 to the destination host 2.

It is worth mentioning that the source host 1 uses the communication key 4 to encrypt the data 5 by using the AES encryption method. However, in practice, DES or other types of encryption methods may also be used. Those skilled in the relevant art will readily appreciate the use of the present invention and should not be limited to those disclosed in the preferred embodiments.

Finally, as shown in step 718, after the destination host 2 receives the encrypted data 51 transmitted by the source host 1, the encrypted data 51 is decrypted by the communication key 4 to obtain the data. 5.

In summary, the mechanism provided by the first preferred embodiment of the network security routing method of the present invention, that is, the source host 1 sends a path query packet 12 having the fictitious destination address to the relay hosts. 3, and observe the return status of the relevant path response packet 311, to determine whether there is a malicious host 31 in the relay host 3, and further find the malicious host 31 and blacklist 13 In order to ensure that the data packet 10 is transmitted, it can avoid the "black hole attack" and smoothly reach the destination host 2.

Furthermore, the mechanism provided by the second preferred embodiment of the network secure routing method of the present invention is to add a verification value 81 having a time-varying property and to utilize the operation of the digital signature and the hash operation function 82 to effectively Avoid the digital signature being intercepted, stored and reused by the malicious host 31; in addition, the public and private keys of the two hosts (source host 1 and destination host 2) are used together with the first and second values 15, 24 The encryption of the random random number type increases the security protection of the data 5; therefore, by the second preferred embodiment of the present invention, the "node information is easily obtained" and the "routing data is easily modified" is prevented. The risk of tampering with the transmission of data 5 caused by the situation.

Therefore, the methods described in the first and second preferred embodiments of the present invention can achieve the object of the present invention.

However, the above is only the preferred embodiment of the present invention, and the scope of the present invention is not limited thereto, that is, the simple equivalent changes and modifications made in accordance with the scope of the present invention and the description of the invention. All remain within the scope of the invention patent.

1. . . Source host

10. . . Data packet

11. . . Routing table

111. . . Path information

12. . . Path query packet for fictitious destination address

13. . . blacklist

14. . . Path inquiry packet

141. . . Invariant field

142. . . Variable field

15. . . First value

151. . . First value of encryption

16. . . Source host public key

17. . . Source host private key

2. . . Destination host

twenty one. . . Destination host public key

twenty two. . . Destination host private key

twenty three. . . Path response packet

twenty four. . . Second value

241. . . Second value of encryption

3. . . Relay host

31. . . Malicious host

311. . . Path response packet for fictitious destination address

4. . . Communication key

5. . . data

51. . . Encrypted data

61~69. . . step

701~718. . . step

8. . . Transfer host

81. . . Verification value

82. . . Hash function

83. . . First hop value

84. . . Verify the hash value

85. . . Transfer private key

86. . . Send public key

9. . . Receiving host

91. . . Second hop value

92. . . Hundred value

1 is a flow chart showing the steps of a first preferred embodiment of the network security routing method of the present invention;

Figure 2 is a block diagram showing the configuration and operation of the relevant components of the first preferred embodiment;

3A and 3B are flowcharts showing related steps of a second preferred embodiment of the network security routing method of the present invention;

4 is a block diagram showing the aspects of the digital signature and hash operation of the related components of the second preferred embodiment;

Figure 5 is a block diagram showing the aspects of the verification of the digital signature and the hash value of the relevant components of the second preferred embodiment; and

Figure 6 is a block diagram showing the manner in which the various components of the second preferred embodiment establish a communication key.

61~69. . . step

Claims (5)

An arbitrary network security routing method includes the following steps: (a) a source host wants to transmit a data packet to a destination host, and determines whether there is a path information to the destination host in a routing table, and if not, proceed a next step; (b) the source host sends a path query packet having a fictitious destination address to the plurality of relay hosts; and (c) the source host determines whether there is a path response packet return corresponding to the path query packet If yes, it indicates that the relay host includes at least one malicious host, analyzes the source of the path response packet, and lists the source of the malicious host in a blacklist. The random network security routing method according to claim 1, wherein in the step (c), when any of the relay hosts not listed in the blacklist receives the path response packet, Discard the path response packet. According to the random network security routing method described in claim 1 or 2, in the step (c), when the source host determines that there is no path response packet backhaul, a path searching mechanism is used. And establishing a packet transmission path with the relay hosts not listed in the blacklist, and transmitting the data packet to the destination host. The random network security routing method according to claim 3, wherein in the step (c), the path searching mechanism is selected from a random network demand distance vector routing protocol, and a secure random network requirement Distance vector routing protocol, and a group of adaptive secure random network demand distance vector routing protocols. According to the method of claim 4, the method of claim 4, wherein, in the step (a), when the source host determines that there is path information to the destination host, directly transmitting the path information according to the path information. The data is encapsulated to the destination host.