具有安全性考量的動態路由機制

Abstract

資訊安全已經成為在無線網路及有線網路上傳輸資料的重要議題。過去的研究主要是在加解密演算法的設計以及系統架構上的整合。我們則是針對利用網路上的路由機制，來達到增加資訊安全性的目的。我們提出了一個動態路由機制，能夠隨機的挑選傳送封包的路徑、減少路徑相似度（連續兩個封包傳送路徑的相同連結數）。所提出的機制容易實作，而且可以與目前現存的網路路由機制相容，像是有線網路上的Routing Information Protocol (RIP) 或是無線網路上的 Destination-Sequenced Distance Vector (DSDV) 路由機制，且沒有增加控制封包的數量。我們也在數學分析上做了相關的研究，並使用了相關的實驗方法來驗證所提出的機制。

Security has become one of the major issues for data communication over wired and wireless networks. In the past decades, various security-enhanced measures have been proposed to improve the security of data transmission over public networks. Existing work on security-enhanced data transmission includes the designs of cryptography algorithms and system infrastructures and security-enhanced routing methods. The common objectives of the aforementioned methods are often to defeat various threats over the network, including eavesdropping, spoofing, session hijacking, etc. Different from the past work on the designs of cryptography algorithms and system infrastructures, we aim at the proposing of a dynamic routing algorithm that could randomize delivery paths for data transmission. Based on distance-vector exchanges, the algorithm can be easily implemented over the existing popular routing protocol, such as Routing Information Protocol (RIP) in wired networks and Destination-Sequenced Distance Vector (DSDV) Protocol in wireless networks, without introducing extra control messages. A proper integration of dynamic routing and cryptography-based system designs would further and significantly enhance the security of data transmission over the networks. For example, the security level could be increased when the feedback cipher mode of block ciphering algorithms (e.g., DES and AES), such as Cipher Block Chaining (CBC) and Cipher Feedback (CFB), is adopted. Furthermore, if a key-exchange mechanism (e.g., the Internet Key Exchange (IKE)) is used during data transmission, less packets encrypted by some specific key can be obtained by attackers, which makes it more difficult to derive the original plain text. An analytic study on the proposed algorithm is presented, and a series of performance evaluation is conducted to verify the analytic results and the capability of the proposed algorithm. Analytic and experimental results show that our proposed algorithm introduces a considerably small emph{path similarity} (i.e., the number of common links between two paths) of two consecutive packets transmitted and greatly outperforms the standard shortest-path and equal-cost routing algorithms.