基于环签名的SIP云呼叫方案研究与设计

发布时间：2018-05-02 19:35

本文选题：SIP + 环签名　；参考：《西安电子科技大学》2015年硕士论文

【摘要】：SIP(会话初始化协议)作为完整的IP会话协议,以其简单灵活、扩展性好、易于移植等特点成为下一代网络NGN的核心控制协议,而为了满足随时随地的通信和防止DDOS(分布式拒绝服务)攻击,将SIP服务器部署在云端是接下来各大公司发展的一个热门方向,随着虚拟化的发展,云计算也已经成为当前各类应用搭建平台的主要方式。然而SIP本身的一些安全问题还需要完善的同时,云计算也带来了新的安全隐患。SIP存在注册攻击,伪造服务器以及会话干扰等攻击形式,而云计算则带来了用户数据的不安全,存在丢失用户配置数据和泄露用户通话记录的危险。因此,本文就新的网络环境下的挑战,提出了一种基于环签名的安全匿名认证方案,用于用户隐藏自己在云服务器上的痕迹。环签名是基于群签名提出的一种匿名认证方案,与群签名不同的是不需要签名管理中心和用户之间的协调,具有便捷的无条件匿名性。将环签名应用到SIP云服务器上,一方面可以对用户进行安全认证,另一方面用户在云端是匿名的,保护了用户信息。根据环签名的算法,本文提出了三种方案:1.将环签名应用于注册过程,根据共享密钥和消息标识生成环签名参数,然后用户根据私钥产生环签名,服务器对其进行验证,确保用户属于信任域内。2.将环签名应用于会话邀请,由对方相互决定参数生成环签名,做到相互认证,保证通话双方的合法性。3.注册过程中通过服务器与用户的共享密钥来协商环签名参数,并在会话邀请中利用参数生成环签名来相互认证。本文在提出方案的同时,分别对各个方案的安全性和实现方式进行了研究与设计,并且与其他安全方案比较,总结各自的优缺点。与其他安全认证相比,本文方案首先保留了SIP协议的完整性,没有添加或者删除信令,其次不需要管理中心参与认证,保持了SIP原有的灵活性,最后环签名的无条件匿名相比于其他认证,更适用于身份泄露严重的云环境,从理论上表明了方案的可行性。为了实验测试方案的效率,本文采用对称加密算法SM4和OpenSSL库中的RSA算法进行环签名生成实验,通过实验数据证明了环签名的效率满足需求;然后通过参加互联网安全大会以及实际搭建云服务器,对云计算进行了调研,分析了当前云计算的安全环境;最后将环签名与Osip协议栈结合,应用于SIP协议流程中,证明了在实验环境中,基于环签名的SIP认证方案的可行性。
[Abstract]:As a complete IP session protocol, SIP (session initialization Protocol) has become the core control protocol of next generation network (NGN) because of its simple and flexible, good expansibility and easy to transplant. In order to meet the requirements of communication and prevent DDOS (distributed denial of Service) attacks, deploying SIP servers in the cloud is a hot trend for the next major companies, and with the development of virtualization, Cloud computing has also become the main way to build platforms for all kinds of applications. However, while some security problems of SIP still need to be improved, cloud computing also brings some new security risks. Sip exists registration attacks, forgery servers and session interference, and cloud computing brings user data insecurity. There is a risk of loss of user configuration data and disclosure of user call records. Therefore, this paper proposes a secure anonymous authentication scheme based on ring signature for users to hide their traces on the cloud server in view of the challenges in the new network environment. Ring signature is an anonymous authentication scheme based on group signature. Unlike group signature, it does not need the coordination between signature management center and user, so it has convenient and unconditional anonymity. The ring signature is applied to the SIP cloud server, on the one hand, it can authenticate the user safely, and on the other hand, the user is anonymous in the cloud, which protects the user information. According to the algorithm of ring signature, this paper proposes three schemes: 1. The ring signature is applied to the registration process and the ring signature parameter is generated according to the shared key and message identification. Then the user generates the ring signature according to the private key and the server verifies it to ensure that the user belongs to the trust domain. The ring signature is applied to the session invitation, and the ring signature is generated by the other party deciding the parameters mutually, so that the mutual authentication can be achieved, and the legitimacy of the two parties can be guaranteed. 3. In the registration process, the ring signature parameters are negotiated by the shared key between the server and the user, and the ring signatures are generated by the parameters in the session invitation to authenticate each other. In this paper, the security and implementation of each scheme are studied and designed respectively, and compared with other security schemes, the advantages and disadvantages of each scheme are summarized. Compared with other security authentication, this scheme firstly retains the integrity of SIP protocol, and does not add or remove signaling. Secondly, it does not need management center to participate in authentication, so it maintains the original flexibility of SIP. Finally, the unconditional anonymity of ring signature is more suitable for the cloud environment where identity disclosure is serious than other authentication, which shows the feasibility of the scheme theoretically. In order to test the efficiency of the scheme, the symmetric encryption algorithm SM4 and the RSA algorithm in the OpenSSL library are used in the ring signature generation experiment. The experimental data show that the efficiency of the ring signature meets the requirements. Then through participating in the Internet security conference and building a cloud server, the cloud computing is investigated, and the current cloud computing security environment is analyzed. Finally, the ring signature is combined with the Osip protocol stack and applied to the SIP protocol process. The feasibility of SIP authentication scheme based on ring signature in experimental environment is proved.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TN918.91

【相似文献】