【作者】 周曜；

【导师】 刘凤玉；

【作者基本信息】 南京理工大学 ， 计算机应用技术， 2010， 博士

【摘要】 随着移动自组网(Mobile Ad Hoc Networks,MANET)应用范围的逐渐推广,MANET的性能优化和安全防护也受到了更多的关注。本文针对这一领域中的若干关键和热点问题,从自适应性、扩展性、匿名性、可认证性等方面开展研究,主要贡献与创新性成果如下：(1)在分析目前路径压缩算法原理和特点的基础上,提出了一个Ad Hoc网络路径压缩的动态分析模型。该模型充分考虑了Ad Hoc网络的动态性与扩展性,从分析节点的t-时间相对移动向量入手,在路径压缩事件发生概率与网络关键参数之间建立起定量关系,为压缩算法的设计与分析提供了必要的理论支持。通过对典型路径压缩算法SHORT和PCA的实验,验证了该模型可有效描述与路径压缩有关的现实环境。最后进一步讨论了该模型的典型应用及进一步改进思路。(2)针对现有Ad Hoc路径压缩技术存在的压缩盲目、路径不稳定、短暂缩减和多次缩减现象频繁等不足,提出一种基于节点停留概率的路径压缩算法NSP-PCA。NSP-PCA通过计算造成路径变化的节点相对于另一节点传输区域的停留概率,动态预测压缩路径的稳定性,并以此为依据决定压缩操作的优先级。通过与PCA和SHORT的性能对比,表明NSP-PCA能有效控制非正常压缩事件的发生,提高优化路径的稳定性与持久性。(3)针对已有Ad Hoc网络匿名路由协议在对抗伪造报文方面存在的不足,提出了一种可认证安全匿名路由协议ANAR。ANAR利用双线性对的性质,在邻居间实现双向匿名认证,在路由发现过程中利用邻居认证密钥对路由控制消息进行逐跳的验证与处理,使得伪造路由分组的影响被控制在一跳范围中。理论分析和仿真实验表明,ANAR能有效对抗基于伪造匿名报文的各类攻击,提高匿名路由协议的安全性与可靠性。(4)针对现有基于洋葱路由的Ad Hoc网络匿名通信方案在前向机密方面存在的不足,提出了一种安全增强的洋葱路由方案FSAR。在FSAR中,引入了前向安全的密钥协商机制,使得节点长期私钥的泄漏不会导致以往会话密钥也连带泄露,从而保证了洋葱数据包的前向机密性。分析和实验表明,FSAR在有限增加开销的前提下,可有效消除由于节点被侵蚀而导致的前向机密隐患。(5)提出一种流量自适应的传感器网络DDoS攻击源追踪方案WETS,方案中每个节点以一定概率随机抽取数据包并进行标记,被攻击者通过收集标记包重构出一条攻击路径。方案可动态适应DDoS流量分布特性,使标记包到达终点的概率随距离递增,在流量较小处有较大的采样概率,从而获得最佳的追踪效果。通过与现有追踪方案对比,表明WETS在路径收敛时间,标记包收集数目,误报率方面有明显改善。更多还原

【Abstract】 With the gradual promotion of the scope of MANET applications, performance optimization and security issues of MANET are more and more concerned. This paper focuses on some key problems in this field and proposes some solutions from the point of adaptability, expansibility, anonymity and authentication.The main achievements of this paper are listed below:(1) We proposed a dynamic model for analyzing path compression algorithm in MANET. Based on the analysis to the probability distribution of time-t relevant movement vector of two MANET nodes, this model constructs the quantitative relationship between network parameters and path compression probability. The model takes the mobility and expansibility of MANET into account and provides the theoretic basis for developing and analyzing path compression algorithm. The simulation results of SHORT and PCA show that it is a correct and efficient dynamic model for path compression.(2) To overcome the shortcomings of traditional path compression techniques, a node staying probability based path compression algorithm (NSP-PCA) is proposed. In NSP-PCA, the stability of new path is predicted by computing the probability that one node keeps staying in another node’s transmission range and the compressing operation is performed based on the prediction to reduce the blindness of compression. Simulation results show that NSP-PCA lessens the ephemeral and multiple short-cuts observably and achieves lower end-to-end delay, lower routing overhead and higher packet delivery rate compared with both SHORT and PCA.(3) Existing anonymous routing protocols for MANET are vulnerable to attacks based on forged packets. We present an anonymous and authenticated routing protocols (ANAR) to solve this problem. By anonymous neighborhood authentications using bilinear paring, shared keys are established between legal neighboring nodes in ANAR. In route discovery procedure, control packets are hop-by-hop authenticated and processed. ANAR ensures the forged packets are correctly distinguished and the nodes en route process control packets by symmetric key which decrease computing overhead. Analysis and simulation show that ANAR can resist attacks based on forged packets and has lower route construction delay than traditional protocols.(4) To solve the security problem of traditional onion routing protocol in MANET, we propose an onion routing schemes with forward secrecy (FSAR).In FSAR, the communicating nodes construct the anonymous route through an forward secure key agreement scheme, which ensure the forward secrecy of the onion packets. Compared with traditional onion routing protocol, FSAR can efficiently eliminate the security shortage and also has lower route construction overhead.(5) We present an efficient traceback scheme (WETS) to locate DDoS attack sources in WSN. In WETS, every node in attack paths marks packets probabilistically and the victim reconstructs attack paths by collecting those marked packets. WETS is adaptive to DDoS traffic distribution, which means the sampling probability of the marking nodes keeps increasing along with the distance to the victim. Thus, the farer node where the DDoS traffic is lower can be sampled more easily. Simulation results show that WETS is much more efficient than other traditional schemes.更多还原