Pollution attack node identification method, device and storage medium based on self-checking technology

Abstract

The present invention discloses a contamination attack node identification method, device and storage medium based on self-checking technology. The present invention comprises the following steps: first, in the system initialization stage, the source node needs to determine the total number of layers of the network and allocate corresponding random number seeds to the nodes in the network; secondly, data transmission is performed: then the source node starts malicious node identification: if one or more of the destination nodes find that there is a contamination attack in the network during the data transmission stage, it will immediately send an alarm message to the source node and trigger the identification process of the malicious node. Finally, after completing the identification process of all the first-layer nodes, the source node informs the possible malicious nodes and starts the identification process layer by layer. The present invention can effectively identify potential contamination attack nodes in the network, thereby ensuring the transmission performance and network stability of the network.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a method, device and storage medium for identifying contamination attack nodes based on self-checking technology in a wireless Mesh network. Background Art

[0002] With the continuous development of wireless communication technology, as one of the important means to solve the "last mile" Internet access, wireless mesh networks have attracted more and more attention from researchers. On the other hand, network coding can significantly improve the transmission performance of wireless mesh networks in terms of throughput, bandwidth utilization, etc., so it has become a research hotspot. However, due to the openness of wireless mesh networks, they are vulnerable to various network attacks; and the essential characteristics of network coding "mixing" data packets make them vulnerable to pollution attacks. Pollution attacks can cause extremely severe damage to the transmission performance of the network in a very short time, so it has become a research hotspot in network coding security.

[0003] Pollution attack refers to a type of attack in which, after joining the network, the attacker modifies the data packets before forwarding them or injects new illegal data packets into the network by tampering with or forging data packets, in order to reduce transmission performance and destroy network stability. Since this security issue was raised, researchers have designed a series of detection schemes for illegal data packets in pollution attacks and identification schemes for illegal nodes to deal with the impact of pollution attacks. Despite this, existing defense mechanisms against pollution attacks have many problems, such as the need for additional hardware, the need for a trusted central server, and excessive computing and bandwidth overheads. Summary of the invention

[0004] In order to make up for the deficiencies of the prior art, the present invention provides a method, device and storage medium for identifying a contaminated attack node based on a self-checking technology.

[0005] The technical solution adopted by the present invention is as follows:

[0006] In one aspect of the present invention, a method for identifying a contamination attack node based on a self-checking technique is provided, the method mainly comprising the following steps:

[0007] S1 Initialization

[0008] The source node determines the total number of layers L of the Mesh network and assigns the corresponding random number seed s to the i-th layer node in the network. i .

[0009] S2 Data Transfer

[0010] The lower-level nodes receive data packets sent from the upper-level nodes, select random coefficients to perform linear coding combinations on several data packets, and send the coded data packets to the downstream nodes.

[0011] S3 source node starts malicious node identification

[0012] If one or more of the destination nodes detects a pollution attack in the network during the data transmission phase, it will immediately send an alarm message to the source node and trigger the identification mechanism of the malicious node.

[0013] S4 Identification of malicious nodes at other layers in the network

[0014] If all the data packets sent by a layer 1 node monitored by the source node are verified successfully, then the node is a normal node; otherwise, the node is a malicious node.

[0015] After the source node completes the identification of all the first-layer nodes, it sends an alarm message to the normal nodes to inform them of the possible malicious nodes and start the i-th layer node R layer by layer. i For the lower node R i+1 Identification.

[0016] Preferably, in step S1, the i-th layer node allocates a corresponding random number seed s i The specific ones are:

[0017] For a node v∈VS in the network, its level l(v) in the graph G(V,E) is defined as the number of hops in the shortest path from the source node S to the node v, and the number of layers in the network is defined as the maximum value of all node levels.

[0018] For all i-th layer nodes in the network, the source node S generates a set of random number seeds s for them. i , and distribute it to the corresponding nodes in advance; the nodes in the same layer are assigned the same random number seed.

[0019] Preferably, after receiving the corresponding alarm message in step S3, the source node starts the authentication mechanism for the layer 1 node. The authentication mechanism is as follows:

[0020] For all data packets z received by the source node S, the source node S finds the corresponding data packet x stored in the source node S according to the data packet identifier participating in the linear combination in the data packet z i , and linearly re-combines these packets with the local coding vectors in the coding information of packet z, and checks whether the result is the same as the received packet z.

[0021] Preferably, in step S3, the i-th layer node R is started layer by layer. i For the lower node R i+1 The identification is specifically:

[0022] Assume R i The monitor receives R i+1 A packet sent j , the nodes in the i-th layer that participate in z j The node to be verified is denoted as z j The target nodes of At the same time, j m j The input is denoted as z j The target data packet The collection is recorded as

[0023] R i To all z j The target node Send a request message. After receiving the request message, the target node calculates the hash value of the corresponding target data packet and returns it to R after adding a message authentication code to it. i ; R i After getting the returned hash value, you can use it to verify z j .

[0024] Preferably, the request message includes a target node ID and a target data packet ID, and a message authentication code is used to ensure that the message is not modified by a malicious node.

[0025] Another aspect of the present invention provides a contaminated attack node identification device based on self-checking technology, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned contaminated attack node identification method based on self-checking technology when executing the program.

[0026] In another aspect of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and the computer program is used to execute the above-mentioned contamination attack node identification method based on the self-checking technology.

[0027] Beneficial effects of the present invention: The present invention can effectively identify potential pollution attack nodes in the network, thereby ensuring the transmission performance and stability of the network. In addition, the present invention does not require additional hardware, reduces the corresponding hardware cost, and avoids excessive computing overhead and bandwidth overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a schematic diagram of the present invention.

[0029] Figure 2 It is a structural diagram of the device of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be further described below.

[0031] The contamination attack node identification method based on the self-checking technology in the present invention comprises the following steps:

[0032] S1 System Initialization

[0033] In the system initialization phase, the source node needs to determine the total number of layers L of the Mesh network and assign the corresponding random number seed s to the i-th layer node in the network. i .

[0034] S2 Data Transfer

[0035] The data transmission process in the present invention is basically consistent with traditional random linear network coding, that is, the lower-level node receives the data packet sent from the upper-level node, selects random coefficients to perform linear coding combination on several data packets, and finally sends the coded data packet to the downstream node.

[0036] Unlike traditional network coding pollution attack defense solutions, the present invention does not need to attach corresponding MAC, digital signature or hash value to the data packet to ensure the integrity of the data packet. Instead, it attaches more complete coding information to the data packet so that nodes at the same layer can collaboratively verify the integrity of the data packet.

[0037] S3 source node starts malicious node identification

[0038] If one or more of the destination nodes discovers a contamination attack in the network during the data transmission phase, it will immediately send an alarm message to the source node and trigger the identification process of the malicious node. After receiving the corresponding alarm message, the source node starts the identification process of the layer 1 node.

[0039] The identification process is as follows: For all data packets z received by the source node S, S finds the corresponding data packet x stored in S according to the data packet identifier participating in the linear combination in the data packet z i , and linearly re-combines these packets with the local coding vectors in the coding information of z, and checks whether the result is the same as the received z.

[0040] S4 Identification of malicious nodes at other layers in the network

[0041] If all the data packets sent by a layer 1 node monitored by the source node are verified successfully, then the node is a normal node; otherwise, the node is a malicious node.

[0042] After completing the authentication process of all the first-layer nodes, the source node sends an alarm message to the normal nodes to inform the possible malicious nodes and start the i-th layer node R layer by layer.i For the lower node R i+1 The identification process is described in detail as follows:

[0043] Assume R i The monitor receives R i+1 A packet sent j , due to the “hybrid” nature of network coding, the encoded data packet z j The input of z does not come entirely from the same node, but may come from multiple nodes in the i-th layer. In this case, z j The verification of z needs to be completed by the cooperation of these i-th layer nodes. j The node to be checked is called z j The target nodes of It is worth noting that The nodes in z can be j The coded information field in is obtained.

[0044] At the same time, j m j The input is denoted as z j The target data packet Its collection is denoted as To check z j , R i To all z j The target node A request message is sent, which includes the target node ID and the target data packet ID, and is protected from modification by malicious nodes by a message authentication code (MAC).

[0045] After receiving the request message, the target node calculates the hash value of the corresponding target data packet and returns it to R after adding the message authentication code to it. i . R i After getting the returned hash value, you can use it to verify z j .

[0046] Further, determine the total number of network layers L in step S1 and the random number seed s corresponding to the i-th node in the network i The specific ones are:

[0047] For a node v∈VS in the network, its level l(v) in the graph G(V,E) is defined as the number of hops in the shortest path from the source node S to the node v. The number of layers in the network is defined as the maximum value of all node levels, that is:

[0048] For all i-th layer nodes in the network, the source node S generates a set of random number seeds s for them. i , and distribute it to the corresponding nodes in advance. The random number seeds assigned to the nodes in the same layer are the same.

[0049] More specifically, in this embodiment, a one-way random function f is used to generate all s i :First, the source node selects a random s0 as the base value; then recursively uses the one-way random function f and s0 to calculate the remaining s j , that is, s j =f j (s0),1≤j≤L, where f j (*) indicates that f is applied j times continuously; i After encryption and digital signature, S will s i Distribute to the corresponding i-th layer nodes.

[0050] Further, in step S4, the i-th layer node R i For the lower node R i+1 The identification process is described in detail as follows:

[0051] The batch size of network coding is recorded as m, and the elements of each data packet are finite fields In addition, the i-th layer node R i The data packet monitored is recorded as z j , z j The target node set is recorded as z j The target data packet is recorded as Its collection is denoted as

[0052] Remember: is a pseudo-random function, where k is the random number seed s i The size of b is a security parameter used to control the size of the hash value. From the definition of the pseudo-random function g, we can see that the input of g is a random number seed s i , the output is a b×(m+n) matrix. In addition, according to the pseudo-random characteristics, if the input of g does not change, the generated random numbers will also not change.

[0053] 1) Hash calculation

[0054] In the initialization phase of the network, each node in the i-th layer receives a random seed s from the source node. i , use the pseudo-random function g to generate a random matrix of size b×(m+n) The element in row a and column b of Here a||b represents the concatenation of the binary representations of a and b.

[0055] When the target node Received for z j The target data packet After hashing the request message, the hash is calculated as follows:

[0056] in[·] T represents the transpose operation of the matrix; since is a b×(m+n) matrix, is a (m+n)×1 matrix, so is a b×1 matrix.

[0057] Then, node v sends the hash value of the target data packet to Return to node R i In addition, if v is requested to calculate the hash values ​​of multiple data packets, the corresponding calculation results will be assembled and sent in one data packet to reduce communication overhead.

[0058] 2) Packet verification

[0059] Given all hash values ​​HS, node R i Verify data packet z by judging whether the following formula is true j For completeness:

[0060]

[0061] In the above formula, m j and β j,k From z j The coded information field, The hash value returned by the corresponding target node is obtained. If the above formula is true, it means that z j is a legal data packet; otherwise, z j For illegal data packets, z j The sending node should be removed from the network immediately.

[0062] Combination Figure 1The present invention is further explained. As shown in the figure, the source node S forwards a data packet to the destination node D through the intermediate node. The intermediate nodes in the network can be organized into two layers according to the number of hops from the intermediate nodes to the source node, three of which belong to the first layer L1 and the other two belong to the second layer L2. When the destination node D receives and detects an illegal data packet, it sends an alarm message to the source node to trigger the malicious node identification process. After that, the source node verifies the data packet sent by the monitored L1 node. If there is a malicious node, it will be removed from the network; otherwise, it means that the L1 nodes are all normal nodes. Subsequently, the three nodes in L1 collaboratively verify the data packet sent by the L2 node to find out the malicious nodes. Through this layer-by-layer identification technology, all malicious nodes in the network can be found.

[0063] The embodiments of the present invention can be applied to network devices. The embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of the device in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution, wherein the computer program is used to execute the method determined by the above steps. From the hardware level, such as Figure 2 As shown in the figure, it is a hardware structure diagram of the pollution attack node identification device based on the self-checking technology of the present invention. Figure 2 In addition to the processor, network interface, memory and non-volatile memory shown, the device may also include other hardware to facilitate expansion at the hardware level. On the other hand, the present application also provides a computer-readable storage medium, the storage medium stores a computer program, and the computer program is used to execute the contamination attack node identification method based on the self-checking technology determined in the above steps.

[0064] As for the embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The above-described device embodiments are only illustrative, and those skilled in the art can understand and implement them without creative work.

[0065] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only.

[0066] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity, or apparatus.

[0067] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for identifying contamination attack nodes based on self-checking technology, characterized in that The method mainly includes the following steps: S1 Initialization The source node determines the total number of layers L of the Mesh network and assigns the corresponding random number seed s to the i-th layer node in the network. i ; S2 Data Transfer The lower-layer node receives the data packets sent from the upper-layer node, selects random coefficients to linearly encode several data packets, and sends the encoded data packets to the downstream node; S3 source node starts malicious node identification If one or more of the destination nodes detects a contamination attack in the network during the data transmission phase, it will immediately send an alarm message to the source node and trigger the identification mechanism of the malicious node; S4 Identification of malicious nodes at other layers in the network If all the data packets sent by a layer 1 node monitored by the source node are verified successfully, then the node is a normal node; otherwise, the node is a malicious node; After the source node completes the identification of all the first-layer nodes, it sends an alarm message to the normal nodes to inform them of the possible malicious nodes and start the i-th layer node R layer by layer. i For the lower node R i+1 Identification of In step S4, the i-th layer node R is started layer by layer. i For the lower node R i+1 The identification is specifically: Assume R i The monitor receives R i+1 A packet sent j , the nodes in the i-th layer that participate in z j The node to be verified is denoted as z j The target nodes of At the same time, j m j The input is denoted as z j The target data packet The collection is recorded as R i To all z j The target node Send a request message. After receiving the request message, the target node calculates the hash value of the corresponding target data packet and returns it to R after adding a message authentication code to it. i ; R i After getting the returned hash value, you can use it to verify z j .

2. The method for identifying contamination attack nodes based on self-checking technology according to claim 1 is characterized in that: In step S1, the i-th layer node is assigned the corresponding random number seed s i The specific ones are: For a node v∈VS in the network, its level l(v) in the graph G(V,E) is defined as the number of hops in the shortest path from the source node S to the node v; and the number of layers in the network is defined as the maximum value of all node levels; For all i-th layer nodes in the network, the source node S generates a set of random number seeds s for them. i , and distribute it to the corresponding nodes in advance; the nodes in the same layer are assigned the same random number seed.

3. The method for identifying contamination attack nodes based on self-checking technology according to claim 1 is characterized in that: In step S3, after receiving the corresponding alarm message, the source node starts the authentication mechanism for the first layer node; the authentication mechanism is as follows: For all data packets z received by the source node S, the source node S finds the corresponding data packet x stored in the source node S according to the data packet identifier participating in the linear combination in the data packet z i , And these data packets are linearly recombined with the local coding vectors in the coding information of data packet z, and it is checked whether the result is the same as the received data packet z.

4. The method for identifying contamination attack nodes based on self-checking technology according to claim 1 is characterized in that: The request message includes the target node ID and the target data packet ID, and the message authentication code ensures that it is not modified by malicious nodes.

5. A pollution attack node identification device based on self-checking technology, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the contaminated attack node identification method based on the self-checking technology as described in any one of claims 1 to 4 is implemented.

6. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the contamination attack node identification method based on self-checking technology as described in any one of claims 1 to 4.

Images