基于安全组播的端系统的设计与实现

【作者】 刘洁；

【导师】 吴跃；

【作者基本信息】 电子科技大学 ， 计算机软件与理论， 2011， 硕士

【摘要】 由于组播通信和IP组播模型的特点,组播网络比单播网络有更大的安全隐患,在安全性方面的存在很多不足,安全组播成为当下组播研究领域的一个热点问题。安全组播的研究主要涉及两个方面:组成员的控制和组播数据的传输。现有IP组播模型采用IGMP(Internet Group Management Protocol)对组成员进行管理,主流版本为IGMPv2。IGMPv2没有对组成员的加入和退出进行任何限制,任何用户都可以加入组播组发送或接收组播数据。在组播数据的传输方面,现有组播模型也没有采取任何安全措施。因此,IP组播通信在接入和传输两个阶段都很容易遭到攻击。本文在863项目“基于端到端虚电路架构的网络安全计算模型及其关键技术的研究”背景下,针对现有IP组播模型存在的缺点,借鉴一些安全组播模型的思路,提出了一种新的安全组播模型,并且采用Linux内核模块编程技术实现了该模型。新型安全组播模型主要设计了带安全的组管理协议(Group management protocol with security,缩写为GMPWS)和基于端到端虚电路的传输协议(End-to-End virtual circuit-based transport protocol,缩写为VCTP)。GMPWS借鉴了IGMPV2的框架,对加入和退出组播组进行了重新设计。在加入组播组时,用户必须经过组管理服务器的认证之后,才可以加入组播组,并获取一个组密钥。如果是发送方,该密钥用来对发送数据进行加密,如果是接收方,用该密钥解密接收到的组数据。在退出组播组时,用户必须主动向组管理服务器发送退出请求。同时该协议还要负责组密钥的动态更新,保证组播数据的前向安全和后向安全。VCTP设计为组播数据的传输协议,采用端到端虚电路来传输组播数据。该协议中,节点的识别主要依靠端口号和虚电路号,使用虚电路号代替了组播地址,隐藏组播地址,保证组播组的安全。采用虚电路结构可以有效的保证QOS方面的需求,提高组播传输的可靠性和稳定性。基于安全组播的端系统是新型安全组播模型原型系统的重要组成部分。根据基于安全组播的端系统的需求分析,该系统实现了GMPWS和VCTP,实现了资源管理机制,可以对成员安全接入和组播数据安全传输提供保障,有效地减轻核心网络的压力,保证网络的稳定性和可靠性。端系统和组管理服务器(Group management server)和核心网络共同完成了组播的安全传输,在源端和传输链路上同时保证了组播的安全。基于安全组播的端系统的目标就是使组播网络安全、可靠、可控,最终使组播技术满足互联网快速发展的需要。更多还原

【Abstract】 Because of the characteristics of multicast communication and IP multicast model, multicast network have greater security risk and have more deficiencies than unicast, security multicast becomes to be a hot issue of current research. Research of security multicast mainly involves in two aspects, one is the control of multicast group membership and the other is the transmission of data. The existing IP multicast model use IGMP for group membership management, the major version is IGMPv2, it has not carried on any limit to joining and leaving. Each user can join in a multicast group to send or receive multicast data. In the process of data communication, IP multicast model did not take any security measures. Therefore, IP multicast communication is easy to suffer attack in stages of access and transmission. Based on the 863 project“end-to-end virtual circuit-based network security architecture and its key technology research”and the deficiencies of IP multicast, learned from some of the idea of secure multicast model, this thesis proposed a new secure multicast model, meanwhile we use the linux kernel module programming technology to realize this model.The new security multicast model mainly design GMPWS(Group management protocol with security) and VCTP(End-to-End virtual circuit-based transport protocol). GMPWS learned from IGMPv2 and designed a new operation of joining and leaving. Before joining the group, user must be certified in group management server, then it join group and get a group key. If it is a sender, the group key is used to encrypt the sent data. If it is a receiver, the group key is used to decrypt the received data. When leaving the multicast group, user must actively send leave request to group management server. Meanwhile, group management server needs to be responsible for the group key’s dynamic updating in order to ensure the forward security and backward security. VCTP designed for multicast data transmission protocol, it use end-to-end virtual circuit to transmit data。In the protocol, the identification of node mainly rely on the port number and virtual circuit number, that virtual circuit number instead of multicast address can hidden multicast address and can ensure the security of multicast group. Virtual circuit structure can effectively guarantee QOS demand and improve reliability and stability of the multicast communication.End system which is based on security multicast is an important part of new secure multicast model’s prototype system. According to demand analysis of the end-system based on security multicast, this system realizes GMPWS and VCTP and resource management mechanism for secure access and secure transmission,meanwhile, effectively alleviate the pressure on the core network to ensure network stability. End system and group management server and core network have completed the multicast secure transmission, and have simultaneously assured the multicast security in the source end and transmission link. The end-system based on security multicast is to make the multicast safe, reliable, controllable, and ultimately enable multicast technology to meet the demands of the internet.更多还原