Secure Communications for Ad Hoc Networking

Ad Hoc 网络的安全通信

• 批准号: 9980521
• 负责人: Zygmunt Haas
• 金额: $ 30.06万
• 依托单位: Cornell University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2000
• 资助国家: 美国
• 起止时间: 2000-06-15 至 2005-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=9980521&HistoricalAwards=false
• 关键词: Secure; Communications; Ad; Hoc; Networking

An ad hoc network is communication paradigm that does not rely on a pre-existing communication infrastructure. Rather, the network is established on-demand. Thus, the network needs to be deployed without prior planning and needs to operate in a variety of different and differing network propagation conditions, traffic demands, and user mobility patterns. Nodes in an ad hoc network frequently join and leave the network, without prior notice. Furthermore, the nodes are mobile and communicate by accessing a shared wireless channel. Consequently, the topology of the network is constantly changing i.e., connections between neighbor nodes (nodes that can communication directly) are established and torn down all the time. Since the diameter of the network may be significantly larger than the transmission range of a single node, communication between non-neighbor nodes is by multi-hop routing. Probably the most characteristic feature of ad hoc networks is that there is no central entity in the network. This is radically different than most other wireless networks, especially the cellular networks. Thus, nodes in an ad hoc network rely on peer-to-peer communications. Consequently, all network protocols need to be implemented in a distributed manner and need to be extremely efficient, as to ensure that the overhead caused by the frequent reconfiguration of the network is not prohibitively large. Application of ad hoc networks has been for a long time limited to the military communication environment only. However, recently, the commercial sector is increasingly interested in this technology, evidence of which is the establishment of the Intenet Engineering Task Force, MANET Working Group. ALthough it is still not clear what the main application of the commercial ad hoc network will be, applications for LAN, sensor networks, and virtual classrooms have been proposed. One of the main difficulties in promoting the concept of ad hoc networks is that, inherently, ad hoc networks are extremely vulnerable to security attacks. Not only do these networks rely nearly exclusively on unreliable and insecure wireless communication, but also the nodes in the network do not, in general, belong to the same administrative domain. Thus the standard security measure may not be readily applicable to ad hoc networks. But above all, the lack of centralized entity makes design of security protocols that much more difficult. In particular, due to possibly low availability of any network node, no one node can serve as a trustful entity in the network. Moreover, as an ad hoc network may consist of thousands to tens of thousands of nodes, it is essential that any solution be highly scaleable. Furthermore, it is imperative that the security protocols address the highly dynamic communication environment, for example, by frequent rekeying of the system. Finally, because of the nature of the nature of these networks and their intended application, high degree of reliability and survivability to node and link failures is necessary. Fortunately, many protocols that protect against intentional security attacks also guard the system again (unintentional) system failures. As part of the proposed research, the researchers plan on investigating a number of central schemes that will allow secure communication in the ad hoc networking environment. Secure communication needs to address the following attributes: availability, confidentiality, integrity, authenticity, and non-repudiation. Some of these attributes can be addressed through conventional security protocols, such as ensuring privacy of information through encryption. However, for other attributes, the standard security measures do not suffice. For example, authentication in an ad hoc network cannot rely on a signle central trustful entity. The researchers propose to use two main principles in securing the communication in an ad hoc network: use of redundancies in the network topology and distribution of trust. The main idea is that availability can be improved by relying on multiple routing paths in the network. So, if compromised paths can be eliminated, other paths can be used reliably. The second principle - the distribution of trust - is based on the assumption that as no single node is worth unlimited trust of other network nodes. However, a large enough quorum of nodes can be trusted, as the probability of compromising large number of nodes simultaneously is rather small. This research proposes to investigate the above mentioned issues of supporting secure communications in the ad hoc network by proposing and designing fundamental framework for such a communications. The researchers will use both analysis and simulation to evaluate our protocol and we intend to implement these protocols to demonstrate their behavior in a practical network.

自组织网络是不依赖于预先存在的通信基础设施的通信范例。相反，网络是按需建立的。因此，网络需要在没有事先规划的情况下部署，并且需要在各种不同和不同的网络传播条件、流量需求和用户移动性模式下运行。自组织网络中的节点在没有事先通知的情况下频繁地加入和离开网络。此外，节点是移动的，并且通过访问共享的无线信道进行通信。因此，网络的拓扑不断变化，即邻居节点(可以直接通信的节点)之间的连接一直在建立和拆除。由于网络的直径可能比单个节点的传输范围大得多，因此非邻居节点之间的通信是通过多跳路由进行的。自组织网络的最大特点可能是在网络中没有中心实体。这与大多数其他无线网络，特别是蜂窝网络有着根本的不同。因此，自组织网络中的节点依赖于对等通信。因此，所有网络协议都需要以分布式方式实现，并且需要非常高效，以确保网络的频繁重新配置造成的开销不会大得令人望而却步。长期以来，自组网的应用一直局限于军事通信环境。然而，最近，商界对这项技术越来越感兴趣，其证据是成立了互联网工程任务组，即MANET工作组。虽然目前还不清楚商业自组织网络的主要应用是什么，但已经提出了局域网、传感器网络和虚拟教室的应用。推广自组织网络概念的主要困难之一是，自组织网络本身就极易受到安全攻击。这些网络不仅几乎完全依赖不可靠和不安全的无线通信，而且网络中的节点通常不属于同一管理域。因此，标准安全措施可能不容易应用于自组织网络。但最重要的是，缺乏集中的实体使得安全协议的设计变得更加困难。具体地说，由于任何网络节点的可用性可能较低，因此没有一个节点可以充当网络中的可信实体。此外，由于自组织网络可能由数千到数万个节点组成，因此任何解决方案都必须具有高度的可扩展性。此外，安全协议必须解决高度动态的通信环境，例如通过频繁地更新系统密钥。最后，由于这些网络的性质及其预期的应用，对节点和链路故障具有高度的可靠性和生存性是必要的。幸运的是，许多防止故意安全攻击的协议也会再次保护系统出现(无意的)系统故障。作为拟议研究的一部分，研究人员计划调查一些中央方案，这些方案将允许在临时网络环境中进行安全通信。安全通信需要满足以下属性：可用性、机密性、完整性、真实性和不可否认性。这些属性中的一些可以通过传统的安全协议来解决，例如通过加密确保信息的隐私。然而，对于其他属性，标准的安全措施是不够的。例如，自组织网络中的身份验证不能依赖于单点中心可信实体。研究人员提出了在自组织网络中保护通信的两个主要原则：在网络拓扑中使用冗余和信任分配。其主要思想是，可以通过依赖网络中的多条路由路径来提高可用性。因此，如果可以消除受危害的路径，则可以可靠地使用其他路径。第二个原则--信任分配--是基于这样的假设，即没有任何单个节点值得其他网络节点无限信任。然而，可以信任足够大的法定数量的节点，因为同时危及大量节点的概率相当小。本研究提出并设计了无线自组织网络安全通信的基本框架，对上述问题进行了研究。研究人员将使用分析和模拟来评估我们的协议，我们打算实施这些协议，以演示它们在实际网络中的行为。