A keyed-hashing based self-synchronization mechanism for port address hopping communication

Yue-bin LUO; Bao-sheng WANG; Xiao-feng WANG; Bo-feng ZHANG

doi:10.1631/FITEE.1601548

Your Location：

Home >

Browse articles >

A keyed-hashing based self-synchronization mechanism for port address hopping communication

Regular Papers | Updated：2022-05-19

- A keyed-hashing based self-synchronization mechanism for port address hopping communication
- 一种基于加密哈希的端口地址跳变通信自同步机制
- Frontiers of Information Technology & Electronic Engineering Vol. 18, Issue 5, Pages: 719-728(2017)
- Affiliations：
  
  College of Computer, National University of Defense Technology, Changsha 410073, China
- Author bio：
  
  E-mail:luoyuebin@nudt.edu.cn
  E-mail:bswang@nudt.edu.cn
  E-mail:xf_wang@nudt.edu.cn
  E-mail:bfzhang@nudt.edu.cn
- Funds：
- DOI：10.1631/FITEE.1601548
  CLC： TP393.08
- Received：16 September 2015，
  
  Accepted：06 April 2017，
  
  Published：2017-05
- Accepted：
Scan QR Code
Yue-bin LUO, Bao-sheng WANG, Xiao-feng WANG, et al. A keyed-hashing based self-synchronization mechanism for port address hopping communication[J]. Frontiers of Information Technology & Electronic Engineering, 2017, 18(5): 719-728.
DOI：

Yue-bin LUO, Bao-sheng WANG, Xiao-feng WANG, et al. A keyed-hashing based self-synchronization mechanism for port address hopping communication[J]. Frontiers of Information Technology & Electronic Engineering, 2017, 18(5): 719-728. DOI： 10.1631/FITEE.1601548.

摘要

端口地址跳变（Port address hopping

PAH）通信是一种有用的网络动目标防御（Moving target defense

MTD）机制，它受无线通信领域的跳频通信思想启发发展而来。跳变同步是PAH通信的一个关键和难点问题，已有机制通常为通信会话提供周期为数秒或数分钟的跳变，且容易受到传输延时、流量拥塞、数据包丢包、乱序和重传等网络事件的影响。为了应对这些问题，在本文中我们提出了一种新的自同步机制，叫做基于加密哈希的自同步（Keyed-hashing based self-synchronization

KHSS）。本文方法基于HMAC（Hash message authentication code）机制生成消息认证码（MAC），MAC被进一步用作端口地址编码和解码的同步信息，为端口地址跳变系统提供了一个数据包一次的跳变和隐秘的消息认证功能，使得通过不可靠通信媒介连接的客户端和服务器能够在持续变换它们的通信标识的同时执行消息认证，而且这一过程不需要传输任何同步和认证信息。理论分析、仿真和实验结果表明本文提出的方法能有效防御中间人（man-in-the-middle

MITM）攻击和网络扫描，在安全性和跳变效率方面也明显优于已有方法。

Abstract

Port address hopping (PAH) communication is a powerful network moving target defense (MTD) mechanism. It was inspired by frequency hopping in wireless communications. One of the critical and difficult issues with PAH is synchronization. Existing schemes usually provide hops for each session lasting only a few seconds/minutes

making them easily influenced by network events such as transmission delays

traffic jams

packet dropouts

reordering

and retransmission. To address these problems

in this paper we propose a novel self-synchronization scheme

called `keyed-hashing based self-synchronization (KHSS)'. The proposed method generates the message authentication code (MAC) based on the hash based MAC (HMAC)

which is then further used as the synchronization information for port address encoding and decoding. Providing the PAH communication system with one-packet-one-hopping and invisible message authentication abilities enables both clients and servers to constantly change their identities as well as perform message authentication over unreliable communication mediums without synchronization and authentication information transmissions. Theoretical analysis and simulation and experiment results show that the proposed method is effective in defending against man-in-the-middle (MITM) attacks and network scanning. It significantly outperforms existing schemes in terms of both security and hopping efficiency.

关键词

Keywords

references

S Antonatos , , , P Akritidis , , , EP Markatos , , , 等 . . Defending against hitlist worms using network address space randomization . . Comput. Netw. , , 2007 . . 51 ( ( 12 ): ): 3471 - - 3490 . . DOI: 10.1016/j.comnet.2007.02.006 http://doi.org/10.1016/j.comnet.2007.02.006 . .

M Atighetchi , , , P Pal , , , F Webber , , , 等 . . Adaptive use of network-centric mechanisms in cyber-defense . . 2003 . . Proc. 6th IEEE Int. Symp. on Object-Oriented Real-Time Distributed Computing . . 183 - - 192 . . DOI: 10.1109/ISORC.2003.1199253 http://doi.org/10.1109/ISORC.2003.1199253 . .

G Badishi , , , A Herzberg , , , I Keidar . . Keeping denial of service attackers in the dark . . IEEE Trans. Depend. Sec. Comput. , , 2007 . . 4 ( ( 3 ): ): 191 - - 204 . . DOI: 10.1109/TDSC.2007.70209 http://doi.org/10.1109/TDSC.2007.70209 . .

M Bellare , , , R Canetti , , , H Krawczyk . . Keyed hash functions for message authentication . . LNCS , , 1996 . . 1 - - 15 . . DOI: 10.1007/3-540-68697-5_1 http://doi.org/10.1007/3-540-68697-5_1 . .

F Chong , , , RB Lee , , , A Acquisti , , , 等 . . National Cyber Leap Year Summit 2009 Co-chairs Report . . NITRD Program , , 2009 . . .

D.Ⅲ Eastlake , , , P Jones . . US Secure Hash Algorithm 1 (SHA1) . . 2001 . . Internet Society, Washington DC, USA . . DOI: 10.17487/RFC3174 http://doi.org/10.17487/RFC3174 . .

BA Forouzan . . Cryptography & Network Security . . 2009 . . McGraw-Hill, Inc., New York, USA . . . .

J Gu , , , Z Xue . . An improved efficient secret handshakes scheme with unlinkability . . IEEE Commun. Lett. , , 2011 . . 15 ( ( 2 ): ): 259 - - 261 . . DOI: 10.1109/LCOMM.2011.122810.102229 http://doi.org/10.1109/LCOMM.2011.122810.102229 . .

JH Jafarian , , , E Al-Shaer , , , Q Duan . . Spatio-temporal address mutation for proactive cyber agility against sophisticated attackers . . 2014 . . Proc. MTD Workshop at CCS . . 69 - - 78 . . DOI: 10.1145/2663474.2663483 http://doi.org/10.1145/2663474.2663483 . .

S Karlin , , , L Peterson . . Maximum Packet Rates for Full-Duplex Ethernet . . 2002 . . Technical Report TR-645-02, Department of Computer Science, Princeton University, Princeton, USA . . . .

D Kewley , , , R Fink , , , J Lowry , , , 等 . . Dynamic approach to thwart adversary intelligence gathering . . 2001 . . Proc. DARPA Information Survivability Conf. and Exposition . . 176 - - 185 . . DOI: 10.1109/DISCEX.2001.932214 http://doi.org/10.1109/DISCEX.2001.932214 . .

H Krawczyk , , , M Bellare , , , R Canetti . . HMAC: KeyedHashing for Message Authentication . . 1997 . . IETF Internet Request for Comments 2104 (RFC-2104) . . . .

B Lantz , , , B Heller , , , N McKeown . . A network in a laptop: rapid prototyping for software-defined networks . . 2010 . . Proc. 9th ACM SIGCOMM Workshop on Hot Topics in Networks . . 19:1 - - 19:6 . . DOI: 10.1145/1868447.1868466 http://doi.org/10.1145/1868447.1868466 . .

HCJ Lee , , , VLL Thing . . Port hopping for resilient networks . . 2004 . . Proc. IEEE 60th Vehicular Technology Conf. . . 3291 - - 3295 . . DOI: 10.1109/VETECF.2004.1404672 http://doi.org/10.1109/VETECF.2004.1404672 . .

YB Luo , , , BS Wang , , , XF Wang , , , 等 . . TPAH: a universal and multi-platform deployable port and address hopping mechanism . . 2015a . . Proc. Int. Conf. on Information and Communications Technologies . . 214 - - 219 . . DOI: 10.1049/cp.2015.0230 http://doi.org/10.1049/cp.2015.0230 . .

YB Luo , , , BS Wang , , , XF Wang , , , 等 . . RPAH: random port and address hopping for thwarting internal and external adversaries . . 2015b . . Proc. 14th IEEE Int. Conf. on Trust, Security and Privacy in Computing and Communications . . 263 - - 270 . . DOI: 10.1109/Trustcom.2015.383 http://doi.org/10.1109/Trustcom.2015.383 . .

YB Luo , , , BS Wang , , , XF Wang , , , 等 . . RPAH: a moving target network defense mechanism naturally resists reconnaissances and attacks . . IEICE Trans Inform. Syst , , 2017 . . E100-D ( ( 3 ): ): 469 - - 510 . . DOI: 10.1587/transinf.2016EDP7304 http://doi.org/10.1587/transinf.2016EDP7304 . .

H Modares , , , A Moravejosharieh , , , J Lloret , , , 等 . . A survey of secure protocols in Mobile IPv6 . . J. Netw. Comput. Appl. , , 2014 . . 39 351 - - 368 . . DOI: 10.1016/j.jnca.2013.07.013 http://doi.org/10.1016/j.jnca.2013.07.013 . .

CC Morris , , , LL Burch , , , DT Robinson . . Techniques for Port Hopping . . 2012 . . US Patent 8 301 789 . . . .

RL Rivest . . The MD5 Message Digest Algorithm . . 1992 . . Internet Engineering Task Force, Fremont, USA . . . .

LY Shi , , , CF Jia , , , SW Lü . . Full service hopping for proactive cyber-defense . . 2008 . . Proc. IEEE Int. Conf. on Networking, Networking, Sensing and Control . . 1337 - - 1342 . . DOI: 10.1109/ICNSC.2008.4525425 http://doi.org/10.1109/ICNSC.2008.4525425 . .

M Sifalakis , , , S Schmid , , , D Hutchison . . Network address hopping: a mechanism to enhance data protection for packet communications . . 2005 . . Proc. IEEE Int. Conf. on Communications . . 1518 - - 1523 . . DOI: 10.1109/ICC.2005.1494598 http://doi.org/10.1109/ICC.2005.1494598 . .

Views

Downloads

CSCD

Alert me when the article has been cited

Submit

Tools

Publicity Resources

Synchronization transition of a modular neural network containing subnetworks of different scales

Automatic discovery of stateful variables in network protocol software based on replay analysis

EdgeKeeper: a trusted edge computing framework for ubiquitous power Internet of Things

Differential coupling contributes to synchronization via a capacitor connection between chaotic circuits

Networking and communication challenges for post-exascale systems

Related Author

Ya JIA

Ziying FU

Xuan ZHAN

Lijian YANG

Weifang HUANG

Jinshu SU

Runhao LIU

Bo YU

Related Institution

College of Physics Science and Technology, Central China Normal University

School of Life Sciences, Central China Normal University

College of Computer Science and Technology, National University of Defense Technology

Academy of Military Science

Department of Computer Science and Technology, Nanjing University

Chat

Address：Zhejiang University Press, 148 Tianmushan Road, Hangzhou, China Postal code：310028
Tel：+86-571-88273162 Email：fitee@zju.edu.cn
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰