一种基于加密哈希的端口地址跳变通信自同步机制

罗跃斌; 王宝生; 王小峰; 张博锋

doi:10.1631/FITEE.1601548

Your Location：

Home >

Browse articles >

一种基于加密哈希的端口地址跳变通信自同步机制

常规文章 | Updated：2022-05-19

- 一种基于加密哈希的端口地址跳变通信自同步机制
- A keyed-hashing based self-synchronization mechanism for port address hopping communication
- 信息与电子工程前沿（英文） 2017年18卷第5期页码：719-728
- Affiliations：
  
  College of Computer, National University of Defense Technology, Changsha 410073, China
- Author bio：
  
  E-mail:luoyuebin@nudt.edu.cn
  E-mail:bswang@nudt.edu.cn
  E-mail:xf_wang@nudt.edu.cn
  E-mail:bfzhang@nudt.edu.cn
- Funds：
  
  Project supported by the National Basic Research Program (973) of China (No. 2012CB315906) and the National Natural Science Foundation of China (No. 61303264)
- DOI：10.1631/FITEE.1601548
  中图分类号： TP393.08
- 收稿：2015-09-16，
  
  录用：2017-4-6，
  
  纸质出版：2017-05
- Accepted：
Scan QR Code
罗跃斌, 王宝生, 王小峰, 等. 一种基于加密哈希的端口地址跳变通信自同步机制[J]. 信息与电子工程前沿（英文）, 2017,18(5):719-728.

Yue-bin LUO, Bao-sheng WANG, Xiao-feng WANG, et al. A keyed-hashing based self-synchronization mechanism for port address hopping communication[J]. Frontiers of Information Technology & Electronic Engineering, 2017, 18(5): 719-728.
罗跃斌, 王宝生, 王小峰, 等. 一种基于加密哈希的端口地址跳变通信自同步机制[J]. 信息与电子工程前沿（英文）, 2017,18(5):719-728. DOI： 10.1631/FITEE.1601548.

Yue-bin LUO, Bao-sheng WANG, Xiao-feng WANG, et al. A keyed-hashing based self-synchronization mechanism for port address hopping communication[J]. Frontiers of Information Technology & Electronic Engineering, 2017, 18(5): 719-728. DOI： 10.1631/FITEE.1601548.

摘要

端口地址跳变（Port address hopping

PAH）通信是一种有用的网络动目标防御（Moving target defense

MTD）机制，它受无线通信领域的跳频通信思想启发发展而来。跳变同步是PAH通信的一个关键和难点问题，已有机制通常为通信会话提供周期为数秒或数分钟的跳变，且容易受到传输延时、流量拥塞、数据包丢包、乱序和重传等网络事件的影响。为了应对这些问题，在本文中我们提出了一种新的自同步机制，叫做基于加密哈希的自同步（Keyed-hashing based self-synchronization

KHSS）。本文方法基于HMAC（Hash message authentication code）机制生成消息认证码（MAC），MAC被进一步用作端口地址编码和解码的同步信息，为端口地址跳变系统提供了一个数据包一次的跳变和隐秘的消息认证功能，使得通过不可靠通信媒介连接的客户端和服务器能够在持续变换它们的通信标识的同时执行消息认证，而且这一过程不需要传输任何同步和认证信息。理论分析、仿真和实验结果表明本文提出的方法能有效防御中间人（man-in-the-middle

MITM）攻击和网络扫描，在安全性和跳变效率方面也明显优于已有方法。

Abstract

Port address hopping (PAH) communication is a powerful network moving target defense (MTD) mechanism. It was inspired by frequency hopping in wireless communications. One of the critical and difficult issues with PAH is synchronization. Existing schemes usually provide hops for each session lasting only a few seconds/minutes

making them easily influenced by network events such as transmission delays

traffic jams

packet dropouts

reordering

and retransmission. To address these problems

in this paper we propose a novel self-synchronization scheme

called `keyed-hashing based self-synchronization (KHSS)'. The proposed method generates the message authentication code (MAC) based on the hash based MAC (HMAC)

which is then further used as the synchronization information for port address encoding and decoding. Providing the PAH communication system with one-packet-one-hopping and invisible message authentication abilities enables both clients and servers to constantly change their identities as well as perform message authentication over unreliable communication mediums without synchronization and authentication information transmissions. Theoretical analysis and simulation and experiment results show that the proposed method is effective in defending against man-in-the-middle (MITM) attacks and network scanning. It significantly outperforms existing schemes in terms of both security and hopping efficiency.

关键词

Keywords

references

S Antonatos , , , P Akritidis , , , EP Markatos , , , 等 . . Defending against hitlist worms using network address space randomization . . Comput. Netw. , , 2007 . . 51 ( ( 12 ): ): 3471 - - 3490 . . DOI: 10.1016/j.comnet.2007.02.006 http://doi.org/10.1016/j.comnet.2007.02.006 . .

M Atighetchi , , , P Pal , , , F Webber , , , 等 . . Adaptive use of network-centric mechanisms in cyber-defense . . 2003 . . Proc. 6th IEEE Int. Symp. on Object-Oriented Real-Time Distributed Computing . . 183 - - 192 . . DOI: 10.1109/ISORC.2003.1199253 http://doi.org/10.1109/ISORC.2003.1199253 . .

G Badishi , , , A Herzberg , , , I Keidar . . Keeping denial of service attackers in the dark . . IEEE Trans. Depend. Sec. Comput. , , 2007 . . 4 ( ( 3 ): ): 191 - - 204 . . DOI: 10.1109/TDSC.2007.70209 http://doi.org/10.1109/TDSC.2007.70209 . .

M Bellare , , , R Canetti , , , H Krawczyk . . Keyed hash functions for message authentication . . LNCS , , 1996 . . 1 - - 15 . . DOI: 10.1007/3-540-68697-5_1 http://doi.org/10.1007/3-540-68697-5_1 . .

F Chong , , , RB Lee , , , A Acquisti , , , 等 . . National Cyber Leap Year Summit 2009 Co-chairs Report . . NITRD Program , , 2009 . . .

D.Ⅲ Eastlake , , , P Jones . . US Secure Hash Algorithm 1 (SHA1) . . 2001 . . Internet Society, Washington DC, USA . . DOI: 10.17487/RFC3174 http://doi.org/10.17487/RFC3174 . .

BA Forouzan . . Cryptography & Network Security . . 2009 . . McGraw-Hill, Inc., New York, USA . . . .

J Gu , , , Z Xue . . An improved efficient secret handshakes scheme with unlinkability . . IEEE Commun. Lett. , , 2011 . . 15 ( ( 2 ): ): 259 - - 261 . . DOI: 10.1109/LCOMM.2011.122810.102229 http://doi.org/10.1109/LCOMM.2011.122810.102229 . .

JH Jafarian , , , E Al-Shaer , , , Q Duan . . Spatio-temporal address mutation for proactive cyber agility against sophisticated attackers . . 2014 . . Proc. MTD Workshop at CCS . . 69 - - 78 . . DOI: 10.1145/2663474.2663483 http://doi.org/10.1145/2663474.2663483 . .

S Karlin , , , L Peterson . . Maximum Packet Rates for Full-Duplex Ethernet . . 2002 . . Technical Report TR-645-02, Department of Computer Science, Princeton University, Princeton, USA . . . .

D Kewley , , , R Fink , , , J Lowry , , , 等 . . Dynamic approach to thwart adversary intelligence gathering . . 2001 . . Proc. DARPA Information Survivability Conf. and Exposition . . 176 - - 185 . . DOI: 10.1109/DISCEX.2001.932214 http://doi.org/10.1109/DISCEX.2001.932214 . .

H Krawczyk , , , M Bellare , , , R Canetti . . HMAC: KeyedHashing for Message Authentication . . 1997 . . IETF Internet Request for Comments 2104 (RFC-2104) . . . .

B Lantz , , , B Heller , , , N McKeown . . A network in a laptop: rapid prototyping for software-defined networks . . 2010 . . Proc. 9th ACM SIGCOMM Workshop on Hot Topics in Networks . . 19:1 - - 19:6 . . DOI: 10.1145/1868447.1868466 http://doi.org/10.1145/1868447.1868466 . .

HCJ Lee , , , VLL Thing . . Port hopping for resilient networks . . 2004 . . Proc. IEEE 60th Vehicular Technology Conf. . . 3291 - - 3295 . . DOI: 10.1109/VETECF.2004.1404672 http://doi.org/10.1109/VETECF.2004.1404672 . .

YB Luo , , , BS Wang , , , XF Wang , , , 等 . . TPAH: a universal and multi-platform deployable port and address hopping mechanism . . 2015a . . Proc. Int. Conf. on Information and Communications Technologies . . 214 - - 219 . . DOI: 10.1049/cp.2015.0230 http://doi.org/10.1049/cp.2015.0230 . .

YB Luo , , , BS Wang , , , XF Wang , , , 等 . . RPAH: random port and address hopping for thwarting internal and external adversaries . . 2015b . . Proc. 14th IEEE Int. Conf. on Trust, Security and Privacy in Computing and Communications . . 263 - - 270 . . DOI: 10.1109/Trustcom.2015.383 http://doi.org/10.1109/Trustcom.2015.383 . .

YB Luo , , , BS Wang , , , XF Wang , , , 等 . . RPAH: a moving target network defense mechanism naturally resists reconnaissances and attacks . . IEICE Trans Inform. Syst , , 2017 . . E100-D ( ( 3 ): ): 469 - - 510 . . DOI: 10.1587/transinf.2016EDP7304 http://doi.org/10.1587/transinf.2016EDP7304 . .

H Modares , , , A Moravejosharieh , , , J Lloret , , , 等 . . A survey of secure protocols in Mobile IPv6 . . J. Netw. Comput. Appl. , , 2014 . . 39 351 - - 368 . . DOI: 10.1016/j.jnca.2013.07.013 http://doi.org/10.1016/j.jnca.2013.07.013 . .

CC Morris , , , LL Burch , , , DT Robinson . . Techniques for Port Hopping . . 2012 . . US Patent 8 301 789 . . . .

RL Rivest . . The MD5 Message Digest Algorithm . . 1992 . . Internet Engineering Task Force, Fremont, USA . . . .

LY Shi , , , CF Jia , , , SW Lü . . Full service hopping for proactive cyber-defense . . 2008 . . Proc. IEEE Int. Conf. on Networking, Networking, Sensing and Control . . 1337 - - 1342 . . DOI: 10.1109/ICNSC.2008.4525425 http://doi.org/10.1109/ICNSC.2008.4525425 . .

M Sifalakis , , , S Schmid , , , D Hutchison . . Network address hopping: a mechanism to enhance data protection for packet communications . . 2005 . . Proc. IEEE Int. Conf. on Communications . . 1518 - - 1523 . . DOI: 10.1109/ICC.2005.1494598 http://doi.org/10.1109/ICC.2005.1494598 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Synchronization transition of a modular neural network containing subnetworks of different scales

Automatic discovery of stateful variables in network protocol software based on replay analysis

EdgeKeeper: a trusted edge computing framework for ubiquitous power Internet of Things

Differential coupling contributes to synchronization via a capacitor connection between chaotic circuits

Networking and communication challenges for post-exascale systems