【作者】 张恒；

【导师】 蔡宏民；

【作者基本信息】 华南理工大学 ， 计算机科学与技术， 2020， 硕士

【摘要】 MQTT通信协议广泛应用于物联网中,但是该协议并未采取任何措施来保证数据在传输及存储处理两方面的安全性,存在着巨大的数据安全风险。而随着用户量的不断增大,这个安全问题亟待解决。近年来关于MQTT协议安全性的研究主要针对数据传输,但数据在代理端的存储处理也同样存在数据安全问题。为了改进这两个方面特别是数据在代理端存储处理时的安全问题,本文提出了一种消息存储处理和安全认证分离式改进方案。在本方案中提出了过程密钥和独占公私钥的概念:通过过程密钥可以解决消息在代理端以明文形式进行存储处理时存在的安全问题及消息最终的可解密性问题;通过独占公私钥可以解决存在大量客户端时的密钥管控问题及密钥的安全问题。基于过程密钥和独占公私钥,本文设计实现了相关的算法,主要包括:1)一种基于混沌理论的希尔加密算法,该算法改进了原始希尔加密容易被已知明文攻击的问题,提高了加密密钥矩阵的随机性,从而保证了数据在传输方面的安全性;2)一种基于希尔加密的过程密钥生成算法,该算法确保了数据仅在订阅者处才具备可解密性,在代理端不具备可解密性,从而保证了数据在存储处理方面的安全性;3)一种基于椭圆曲线加密的独占公私钥对生成算法,该算法使得客户端和认证中心之间生成互为公私钥的密钥对,解决了消息密钥的管控及安全问题。最后,本文基于所提出的改进方案实现了一个消息存储处理和安全认证分离式系统,并对该系统进行了功能和性能两方面的测试。功能测试部分验证了该改进方案能够保证数据在传输和存储处理两方面的安全性。性能测试主要对CPU利用率、内存占用、耗时进行比较。结果表明,基于该改进方案的MQTT协议在整体性能上要优于采用SSL/TLS的方案的MQTT协议,而相对于原始的MQTT协议而言,基于该改进方案的MQTT协议在性能指标与数据安全性两者间取得了较好的折中效果。更多还原

【Abstract】 The MQTT communication protocol is widely used in the Internet of Things(IoT),but the protocol does not take any measures to ensure the security of data both in transmission and processing,and there are significant data security risks.As the number of users continues to grow,this security issue needs to be addressed.Recent research on the security of the MQTT protocol mainly focuses on the security of data transmission,but there are also data security issues associated with the storage and processing of data at the broker side.In order to address the both aspects of security simultaneously,this paper presents a proposal for a message storage processing and security authentication separated improvement scheme.In this scheme,the concepts of process key and exclusive public-private key are proposed: the process key can solve the security problem and the final decryptability of the message when the message is forwarded in explicit form on the broker side;the exclusive public-private key can solve the key control problem and the security problem of the key when there are a large number of clients.Based on the process key and exclusive public-private key,this paper designs and implements related algorithms,which mainly include: 1)a Hill cryptographic algorithm based on chaos theory,which improves the problem that the original Hill cryptography is vulnerable to known explicit attacks and greatly improves the randomness of the cryptographic key matrix,which ensures the security of the data in transmission;2)a process key generation algorithm based on Hill cryptography,which ensures that the data is decryptable only at the subscriber and not at the broker side,thus ensuring the security of the data when storage processing;3)an exclusive public-private key pair generation algorithm based on elliptic curve cryptography,which enables the generation of mutual public-private key pairs between the client and the verification center,solving the key control and security problems.Finally,this paper implements a message storage processing and security authentication split system based on the proposed schemes,and tests the system on both functionality and performance.Functional testing has partially validated this improvement to ensure the security of data during transmission and processing.The performance test mainly compares the three metrics of CPU utilization,memory usage,and time consumption.The results show that the MQTT protocol based on this improved solution has better overall performance than the SSL/TLS-based MQTT protocol,and compared to the original MQTT protocol,it achieves a good compromise between performance and security.更多还原