路由交换行为信任度与互联网可信路由协议研究

发布时间：2018-01-08 22:04

本文关键词：路由交换行为信任度与互联网可信路由协议研究　出处：《清华大学》2016年博士论文　论文类型：学位论文

【摘要】：作为网络数据处理与传输枢纽的路由交换设备可能存在安全漏洞,导致其服务行为不符合用户预期,严重威胁网络安全。为保障用户数据传输的保密性和完整性以及网络自身的可用性,本文设计了路由交换行为安全策略及基于策略的检测设备,并为进一步提高安全网络工作效率,基于策略检测给出路由交换设备信任度的定义和动态量化方法,以及互联网可信路由协议,具体包括路由交换设备数据窃听攻击行为检测策略设计与实现,分组源地址篡改攻击行为检测策略设计与实现,路由交换行为信任度量化与可信路由协议研究。本文的主要贡献包括:1、数据窃听攻击行为检测策略设计与实现。针对利用路由交换设备漏洞窃听和获取用户数据的攻击行为,提出路由交换行为安全检测策略,以及基于策略的窃听行为检测算法和检测设备模型;为提高检测效率,对策略检测算法进行优化。理论分析和系统仿真实验结果显示,优化后本文设计的检测设备可放行全部正常分组,同时识别和约束99.92%以上的窃听分组,被检测路由交换设备吞吐率可达Gbps级。2、分组源地址篡改攻击行为检测策略设计与实现。针对发送主机和路由交换设备篡改分组源地址的攻击行为,提出路由交换行为安全检测策略,以及基于策略的窃听行为检测算法和检测设备模型。对比其它安全机制,本检测算法和设备可即时检测攻击、通用于TCP/IP网络,并容易部署,理论分析及仿真实验结果显示,该机制性能优于当前具备相同功能的分组源地址篡改攻击防御机制。3、路由交换行为信任度量化与互联网可信路由协议。上述策略可全面满足用户对核心网络保密性、完整性和可用性的总体服务需求,但其检测效率难以满足用户对汇聚层网络的性能需求,为此设计了一种高速可信的路由协议,具体包括路由交换行为信任度的定义与动态量化方法,以及指导分组沿最优信任度路径传输的路由协议。仿真实验及理论分析结果显示,本路由协议可保障核心网络任意设备之间的信任度不低于给定阈值,同时路由交换设备吞吐率可达10Gbps级。
[Abstract]:As a network data processing and transmission hub, routing switching equipment may have security vulnerabilities, resulting in its service behavior does not meet user expectations. In order to protect the confidentiality and integrity of user data transmission and the usability of the network, this paper designs a routing exchange behavior security policy and policy-based detection equipment. In order to further improve the work efficiency of secure network, the definition and dynamic quantization method of routing switching equipment trust and the Internet trusted routing protocol are given based on policy detection. It includes the design and implementation of the detection strategy of data eavesdropping attack behavior of routing switching equipment and the design and implementation of the detection strategy of packet source address tampering attack behavior. Research on trust quantization of routing switching behavior and trusted routing protocol. The main contributions of this paper include: 1. Design and implementation of data eavesdropping attack detection strategy. Aiming at the eavesdropping and user data acquisition attacks using routing switching device vulnerabilities, a routing switching behavior security detection strategy is proposed. And policy-based eavesdropping detection algorithm and detection equipment model; In order to improve the detection efficiency, the strategy detection algorithm is optimized. Theoretical analysis and system simulation results show that the optimized detection equipment can release all normal groups. At the same time, over 99.92% eavesdropping packets are identified and constrained, and the throughput of the detected routing switching device can reach Gbps level 2. 2. Design and implementation of packet source address tampering attack detection strategy. Aiming at the attack behavior of sending host and routing switching equipment tampering with packet source address, a routing switching behavior security detection strategy is proposed. Compared with other security mechanisms, this detection algorithm and equipment can detect attacks instantly, which can be used in TCP/IP network and easy to deploy. Theoretical analysis and simulation results show that the performance of this mechanism is superior to that of the current packet source address tampering defense mechanism with the same function. 3. Routing behavior trust quantization and Internet trusted routing protocol. The above strategy can fully meet the users' overall service requirements for the confidentiality integrity and availability of the core network. However, its detection efficiency is difficult to meet the performance requirements of the convergent layer network. Therefore, a high speed trusted routing protocol is designed, including the definition of routing switching behavior trust and dynamic quantization method. The simulation results and theoretical analysis show that the routing protocol can ensure that the trust between arbitrary devices in the core network is not lower than the given threshold. At the same time, the throughput of the routing equipment can reach 10 Gbps.
【学位授予单位】：清华大学
【学位级别】：博士
【学位授予年份】：2016
【分类号】：TP393.08

【相似文献】