【作者】 张沛；

【导师】 马严；

【作者基本信息】 北京邮电大学 ， 计算机科学与技术， 2012， 博士

【摘要】 随着互联网的快速发展和普及,人们对网络服务的性能和质量有着越来越高的要求,而建立和维护一个健壮、可靠、稳定的互联网络,需要网络管理者与网络研究者以及网络管理者之间通过协作的方式来发现问题,解决问题。一方面,网络研究者需要现网的测量数据来建立、优化模型,进而为网络建设和优化提供科学的指导意见,另一方面,由于安全性等因素,网络研究者很难获得权限在网络管理者运营的网络中部署测量设施来采集网络数据,或者访问网络管理者已经采集的数据。因此,共享网络测量数据对网络的研究有非常重要的意义。然而,网络测量数据中包含了大量的敏感信息,如主机标识、用户个人信息(Email、身份ID、金融账号)、网络拓扑结构等,这些信息在一定程度上可以反映用户使用网络的习惯和行为特征,揭示网络运营者的竞争策略和商业秘密等,更进一步,这些敏感信息可以被恶意用户用来发动网络攻击,进而影响网络性能。网络数据的敏感性和隐私性阻碍了网络管理者共享测量数据的积极性,进而影响了网络研究的开展。因此,研究可靠、安全的网络测量数据隐私保护技术是迫切需要解决的问题。本文重点研究了网络测量数据隐私保护若干关键技术,包括网络测量数据净化技术和安全多方计算技术。网络测量数据净化技术是指对网络测量数据中敏感属性字段进行特殊处理从而达到隐私保护的目的,而安全多方计算技术是指两个或两个以上的数据共享者根据各自的秘密输入而执行安全的计算协议,使得各方在得到正确结果的同时又保护自身信息的秘密性。本文主要贡献和创新点包含以下几个方面：(1)研究了相关的网络测量数据净化技术尤其是网络测量数据中的IP地址净化技术,对分层IPv4净化算法进行了安全性评估,并针对IPv6寻址结构的特点、IPv6地址分配的特点提出了IPv6地址净化策略。对净化算法的可恢复性进行了深入的研究,在此基础上了提出了基于可逆树的IP地址净化恢复算法,增强了净化技术的溯源性,进一步完善了网络测量数据净化技术体系的完整性。(2)研究了针对网络测量数据净化技术的相关攻击方法和攻击模型,提出了在多方参与共享网络测量数据的情况下,对净化后数据的安全性的评估方法。该方法从实体对象的角度对共享的数据集进行聚类分析,通过对比数据净化前后实体对象在特征属性上分布的相似程度,使用相似度分布的统计学方法来评估每个实体对象经过净化处理后被破解的不确定性,从而为参与共享数据的数据提供者提供定量的安全性评估标准。(3)研究了基于安全多方计算的网络测量数据隐私保护技术,并针对网络测量数据的特点,对安全多方计算的原子操作进行了优化,并在此基础上提出了基于安全多方计算的分布式网络测量数据汇聚查询算法和跨域网络流量异常检测算法。基于安全多方计算的分布式测量数据汇聚查询算法,采用了阀值门限技术和Shamir安全多方求和协议,对分布在不同地理位置的网络测量数据进行安全的协同计算,可以使参与查询计算的参与方在不暴露自身流量数据隐私的前提下正确的计算出全局汇聚值最大的前K个项及汇聚值。而基于安全多方计算的跨域异常检测算法是通过对传统集中式的PCA异常检测算法的计算过程进行分解,并使用安全两方矩阵计算协议和Shamir安全多方求和协议来保证计算过程各方测量数据的安全性,从而使跨多个域的分布式网络流量异常检测成为可能。(4)基于上述的网络测量数据隐私保护技术的研究基础,设计并实现了针对基于可信第三方的数据共享模型和基于安全多方计算的数据共享模型。数据提供者可以根据不同的应用场景和不同的应用需求,选择不同的数据发布模型,最大限度的保护网络测量数据的安全性。更多还原

【Abstract】 With the fast development and popularization of Internet, people have a increasing demand for higher performance and quality of network services. To build a strong, reliable and stable network, network manager and researcher should work together through collaboration to find and solve network problems. On the one hand, network researchers require shared traffic traces to build and optimize network model for network construction. On the other hand, due to factors such as security, it’s very hard for network researcher to get permission to collect traffic traces from the target network or access existed network traffic traces. Therefore, network data sharing has important implications for network research.Unfortunately, these traffic traces often contain highly sensitive information about the network being monitored and their users, such as host identities, user private information (Emai address, identification number and financial account), network architecture and so on. The sensitive information in some extent could reflect user’s behavior characteristics as well as reveal the network operator’s competition strategy and business secret. Furthermore, this information can be exploited by malicious users to launch network attack, which will affect the performance of the network. Therefore, it is necessary to study reliable and secure privacy-preserving mechanism for network data sharing.This dissertation focuses on two key techniques for protecting sensitive and private information in the traffic traces. One is sanitation technology which refers to using secure methods to process sensitive attributes in traffic data formats. The other one is Secure Multiparty Computation (SMC) technology that enable a set of parties to compute a public function over their private data in a way that the computation only reveals the final value of the public function and nothing more about the private data. The main contributions of our work include:(1). This dissertation researches on network trace sanitation technologies especially for IP address sanitation mechanism. We introduce a evaluation metric to evaluate the security of different dividing strategies for IPv4sanitation as well as give dividing suggestions for IPv6address sanitation, according to the characteristics of IPv6address structure and IPv6address allocation policy. We also propose a reversible tree based mechanism for recovery. Experimental results show that our mechanism performs better for both IPv4and IPv6anonymization and the recovery process has the same computation complexity with the anonymization process.(2). This dissertation researches on some attack methods and models employed by an adversary for de-sanitation. We introduce a evaluation metric to assess security of the santized traffic traces in the context that multi-participants joint together to share network traces. We analysis the shared data sets in a clustering way from the point of view of entity object. We compare the feature distribution’s similarity between a santized object and all unsantized object and use the statistic method to evaluate its decomposed uncertainty. In this way, we can provide a metric for each participant to evaluate the security of its sanitized dataset.(3). This dissertation researches on Secure Multiparty Computation (SMC) based mechanism for traffic traces privacy protection. We optimize the SMC’s atomic operations and propose secure algorithms for distributed traffic traces aggregation and multi-domain traffic anomaly detection. For the secure distributed traffic traces aggregation algorithm, we leverage secure multiparty computation to design a privacy-preserving top-k queries based on threshold algorithm (TA). We use Oblivious Pseudorandom Functions (OPRF) and Shamir’s secret sharing scheme to keep the input key-value pairs privacy-preserving. With the TA-style algorithm, we can guarantee the results of distributed privacy-preserving top-k queries accuracy without errors. For the secure multi-domain traffic anomaly detection algorithm, we propose a privacy-preserving mechanism that allows ISPs to cooperatively detect anomalies without requiring them to reveal private traffic information. We design a "semi-centralized" architecture and use secure multiparty computation (SMC) protocol to make the Principal Component Analysis (PCA) based detection method privacy-preserving and at same time keep its scalability and accuracy.(4). Based on the above research, we design and implement two traffc traces sharing model:Trusted Third Party model and SMC-based sharing model. The data publisher can choose appropriate data sharing model according to different application requirements.更多还原