CN101286838A

CN101286838A - Design of large-scale dynamic multicasting security system framework

Info

Publication number: CN101286838A
Application number: CNA2007100488477A
Authority: CN
Inventors: 秦志光; 何兴高; 靳京; 叶李
Original assignee: University of Electronic Science and Technology of China
Current assignee: University of Electronic Science and Technology of China
Priority date: 2007-04-11
Filing date: 2007-04-11
Publication date: 2008-10-15

Abstract

The invention relates to a dynamic secure multicast system architecture in large-scale network environment, which is characterized in that a new set of dynamic secure multicast system architecture is designed; the dynamic secure multicast system architecture divides whole multicast into different areas, only updates the encryption key of a group after the members of each group are changed, avoids system expense brought by the update of the encryption key of whole group caused by frequent changes of group members, realizes the flexible extension mechanism with respect to the encryption key management and data distribution of each subarea, realizes the safe certification mechanism based on Kerberos, so as to carry out management of multicast from the viewpoints of controlling safety and data safety. According to the characteristics and requirements of IPv6 protocol, a set of relatively complete group encryption key management mechanism is realized to be applicable to the requirement for safety and practicability of most multicasts in China Education and Research NET of second generation (CERNET2) and similar network environments.

Description

A kind of large-scale dynamic multicasting security system framework design

Technical field

The present invention relates to the extensive dynamic security multi-cast system framework under a kind of large-scale network environment.At the characteristics and the requirement of IPv6 agreement, realized the more complete group key management mechanism of a cover, with fail safe and the practicality requirement that is applicable to most multicast application in second generation CERNET (CERNET2) and the homogeneous network environment.

Background technology

The fast development of Internet and popularize to the multicast service development powerful market forces, the multicast increased popularity that just becoming is provided.

Multicast is based on the UDP/IP agreement, towards many recipients' communication mode, compare clean culture and can effectively save the server resource and the network bandwidth.Internet Group Management Protocol (IGMP) is used for managing multicast.IGMP does not provide member's access control, just can send IGMP member's report to router as long as the user is known the multicast address that specific transactions uses, without examining the copy that ground adds group and obtains UDP message.Therefore, existing cast communication does not ensure the safety of data.Protect the multicast packet secret, set up the main target that safe communication system is safe multicasting research.

The IP multicast following several big feature arranged:

(1) all members can receive the packet that mails to this multicast address;

(2) multicast provides the group mode of an opening, makes group membership's uncertain data specifically from which member;

(3) any main frame can send packet to this multicast address.

These three features reflect that multicasting technology lacks the access control of network layer in itself, can be summarized as shortage to the control of adding group, lack the control that the group membership sends, receives data, lack the checking of data source authenticity.

Since there is intrinsic unsafe problems in multicast, just need provide corresponding security service at these problems as a safe multicasting architecture.The confidentiality of group security strategy, group key management, data source authentication, group membership management and access control and multicast packet is the important content that architecture guarantees safety.

At the design aspect of multicast architecture, existing work mainly contains:

Patent CN03153932.7 discloses a kind of method that security association is shared that realizes organizing.First node of initiating establishment SA request was created security association during the multicast source node was only organized with this in this patent, generate and share CHILD_SA, when multicast source node initiation establishment SA request, the node that the multicast source node notifies this initiation to create the SA request obtains shared CHILD_SA from generating shared CHILD_SA node to other node again in the group.This method can support to adopt in the cast communication a shared security association under the IPsec framework.For the member node in the multicast group, all at first create before each communication share CHILD_SA or with other internodal IKE_SA of connection, when interstitial content is very big, can greatly influence performance and efficient, thereby not be suitable for extensive multicast application.

Introduced a kind of IETF security of multicast architecture among the RFC3740.This architecture has possessed for extensive multicast group communication provides the function of the safety assurance of many aspects, and has considered the influence of retractility for extensive multicast group.But the IETF structure because the group membership changes the safe handling cost cause greatly, though can reduce this influence by the way that increases the distributed multicast group, the corresponding cost that has increased the multicast group deployment; In a plurality of multicast group of management, exist extra communication overhead to get in touch to guarantee the security service between the multicast group by peer-entities.

This patent is that the basis is improved with the IETF structure, designed the new dynamic security multi-cast system framework of a cover, whole multicast is divided into zones of different, after being changed, the interior member of each group only this group key is upgraded, avoided owing to group membership continually changes the overhead that whole group key management brought that causes, realized in each subdomain about extension mechanism flexibly aspect key management and the data distribution, and on the basis of Kerberos, realized safe authentication mechanism, and then multicast group is managed from the viewpoint of control safety and data security.This patent has been realized the more complete group key management mechanism of a cover at the characteristics and the requirement of IPv6 agreement, is applicable to the fail safe and the practicality requirement of most multicast application in CERNET2 and the homogeneous network.

Summary of the invention

The objective of the invention is by defining different zones, various mutual distinct area can use different group key management schemes when the member changes in certain leaf domains in the system, only need key in this territory to upgrade and get final product, thereby significantly reduce the expense of bringing because of the whole updating system key.

Large-scale dynamic multicasting security system framework design of the present invention comprises: the system framework method for designing;

Large-scale dynamic multicasting security system framework design of the present invention comprises: the key managing project structure;

Large-scale dynamic multicasting security system framework design of the present invention comprises: interim cross-over connection domain server strategy.

The native system framework is divided into " trunk " and " leaf " two parts with whole multicast domain:

A, backbone domain: by key generator, key management unit, groups of nodes controller, strategy and certificate server, compositions such as router.Backbone domain has constituted the key management platform, and in multicast network, it comprises and the relevant agreement of safety (as the kerberos authentication agreement etc.).Backbone domain is the border with groups of nodes controller and key server, and does not contain any member's main frame.

B, leaf domains: the network infrastructure platform, comprise and be used for the entity of building network, by multicast member, sub-group controller and at based on the various different agreements of IPv6 multicast network with realize composition such as assembly.Each leaf domains all is associated with a boundary node group controller and key server, and different leaf nodes has different group key management schemes.

According to the design of system framework, the group key management scheme comprises a strategy and six agreements of multicast key safety: multicast group security strategy, multicast group establishment agreement, group membership's log-in protocol, group membership nullify agreement, the group membership expels agreement, group key management agreement, group to cancel agreement.

The present invention is for non-audio, video data processing the time, and native system can satisfy the requirement of aspect of performance fully.And for a pair of when mostly being main video multicast application, data can be sent terminal (being assumed to be A) strides across the groups of nodes controller and directly links on the backbone network, thereby reduce the process of a data encrypting and deciphering, can satisfy application requirements substantially, and not influence fail safe.

This patent can make when the member changes in the system architecture and only the group key in this leaf domains be upgraded, reduced the overall system expense, improve efficient, and realized extension mechanism flexibly, can be good at satisfying the demand of extensive even ultra-large network multicast security application.

Description of drawings

The extensive dynamic security multicast group of Fig. 1 cipher key management structure figure;

Fig. 2 group key management schematic structure diagram;

The interim cross-over connection domain server of Fig. 3 strategy schematic diagram;

Dynamic multicast operation schematic diagram under this framework of Fig. 4.

Embodiment

Below in conjunction with accompanying drawing technical scheme of the present invention is elaborated.

Fig. 4 has shown the dynamic multicast operation schematic diagram under this framework:

After the group owner or founder (GO) obtained tactful token (PT) with strategic server (PS) mutual (by step 1,2), a multicast group example (step 3) was created in a certain group controller and key server (GCKS) application on backbone domain.This GCKS is called initial GCKS (I-GCKS), and I-GCKS issues the safe multicasting content with group key in the backbone domain in backbone domain.

Need the group membership (GM) who adds multicast group to send (RTJ) message (step 7,8) that joins request to the GCKS of this leaf domains of management, perhaps the S-GCKS by management group proposes to add application (step 5,6,9,10) to GCKS.

The GM that withdraws from multicast group sends to the GCKS of this leaf domains of management and withdraws from request (RTD) message, and perhaps sub-group controller and the key server (S-GCKS) by management group proposes to nullify application to GCKS.

GO generates new PT according to expulsion GM sign, and GCKS sends refusal according to PT to the expulsion member and adds (R_J) message.

On the basis that the group membership changes, GCKS carries out the group key management operation, but the group membership in each leaf domains changes the group key management operation that causes, and will be confined in this leaf domains, can not cause the decreased performance of other leaf domains and backbone domain.

Each GCKS carries out member's renewal and regularly upgrades operation (step 4) in the backbone domain under the control of I-GCKS.Group key management in the backbone domain is confined in the backbone domain.

After the safe multicasting content sent to the GCKS of this leaf domains of management in the leaf domains, GCKS encrypted the back with the backbone domain group key again and issues in backbone domain after content is deciphered by group key in the leaf domains.After each GCKS receives multicast packet in the backbone domain,, in this leaf domains, issue (step 11) then with encrypting with group key in this leaf domains again after the deciphering of backbone domain group key.

Claims

1 one kinds of large-scale dynamic multicasting security system framework designs, it is characterized in that, in the large scale network system, characteristics and requirement at the IPv6 agreement, whole multicast domain is divided into " trunk " and " leaf " two parts, make when multicast member changes in the system architecture and only the group key in this leaf domains is upgraded, reduced the overall system expense, improved efficient, and realized extension mechanism flexibly, can be good at satisfying the demand of extensive even ultra-large network multicast security application.

2 a kind of large-scale dynamic multicasting security system framework designs as claimed in claim 1 is characterized in that it is as follows that whole multicast domain is divided into " trunk " and " leaf " two parts method:

3 a kind of large-scale dynamic multicasting security system framework designs as claimed in claim 2, it is characterized in that the group key management scheme comprises a strategy and six agreements of multicast key safety: multicast group security strategy, multicast group establishment agreement, group membership's log-in protocol, group membership nullify agreement, the group membership expels agreement, group key management agreement, group to cancel agreement.

4 a kind of large-scale dynamic multicasting security system framework designs as claimed in claim 1, it is characterized in that, for with a pair of when mostly being main video multicast application, data can be sent terminal (being assumed to be A) strides across the groups of nodes controller and directly links on the backbone network, thereby reduce the process of a data encrypting and deciphering, substantially can satisfy application requirements, and not influence fail safe.

5 as the described a kind of large-scale dynamic multicasting security system framework design of claim 1 to 4, it is characterized in that the dynamic multicast operational process under this framework is as follows:

After GO and PS mutual (by step 1,2) obtained PT, a multicast group example (step 3) was created in a certain GCKS application on backbone domain.This GCKS is called initial GCKS (I-GCKS), and I-GCKS issues the safe multicasting content with group key in the backbone domain in backbone domain.

Need the GM that adds multicast group to send RTJ message (step 7,8) to the GCKS of this leaf domains of management, perhaps the S-GCKS by management group proposes to add application (step 5,6,9,10) to GCKS.

The GM that withdraws from multicast group sends RTD message to the GCKS of this leaf domains of management, and perhaps the S-GCKS by management group proposes to nullify application to GCKS.

GO generates new PT according to expulsion GM sign, and GCKS sends R_J message according to PT to the expulsion member.