A secure network coding scheme based on selective encryption

Abstract

This invention proposes a concise application scheme for multicast networks that integrates network coding, data encryption, and authentication. The scheme maintains high network coding efficiency while ensuring information security. The specific process is as follows: Unencrypted messages transmitted in the network are encrypted. When an intermediate node receives an encrypted message, it determines whether to forward it directly. If forwarded directly, the message is decrypted and re-encrypted. If the message needs to be "mixed" at the node, it is decrypted, mixed, and then forwarded. To ensure the correctness of node encryption and decryption, MAC verification is used.

Description

Technical Field

[0001] This invention relates to the field of communications, and in particular to a secure network coding scheme based on selective encryption. Background Technology

[0002] Network coding, proposed in 2000, is a network data transmission method distinct from traditional source-channel coding. In traditional routing-based networks, network nodes such as routers only perform data forwarding and copying operations; however, network nodes using network coding can perform encoding operations such as linear transformations on received data, and then copy or forward the "mixed" encoded result. This coding method not only improves network throughput but also enhances network bandwidth utilization. Research has shown that network coding technology achieves maximum flow transmission in networks, effectively solving the bottleneck problem of relay node transmission. It is of great significance in improving load balancing, reducing transmission latency, saving node energy consumption, and enhancing network robustness.

[0003] While network coding significantly improves communication efficiency, it also presents some potential problems. For example, the coding calculations at network nodes can lead to transmission delays and increased coding complexity, thus affecting overall performance. Malicious nodes polluting data packets may prevent destination nodes from correctly decoding them, causing security issues. In fact, the "hybrid" operations of some intermediate nodes in network coding inherently possess data hiding capabilities, improving the efficiency of traditional encryption methods for transmitting unbreakable algorithm streams over networks. To address these issues, this invention proposes a secure network coding scheme for multicast networks that integrates network coding, selective data encryption, and authentication. This scheme is simple in construction and maintains high network coding efficiency while ensuring information security. Summary of the Invention

[0004] The secure network coding scheme based on selective encryption of the present invention is as follows: For ease of understanding, the concepts of network coding and multicast networks will be introduced first.

[0005] A. Network coding

[0006] Classic butterfly networks, such as Figure 1 As shown, the principle of network coding can be explained. Figure 1 In the single-source, dual-destination network model shown, S is the source node, R1 and R2 are the two destination nodes, and A, B, C, and D are the four intermediate nodes. The capacity of the inter-node links is 1 bit. Assume that the source node S sends messages a and b to the destination nodes R1 and R2 in the form of multicast.

[0007] Figure 1In (a), the traditional routing method is used to transmit messages. Due to the network communication bottleneck between node C and node D, node C can only transmit message a or message b in the same time slot. Therefore, the two destination nodes R1 and R2 can only receive a maximum of 3 bits of message. Calculations show that using the routing method to transmit messages, the average throughput of destination nodes R1 and R2 is 1.5 bits / node.

[0008] Figure 1 (b) Using network coding to transmit messages, node C first performs binary addition or XOR processing on the received messages a and b, then transmits the processed message a⊕b (XOR) to node D, and then transmits message a⊕b to the two destination nodes R1 and R2. Destination nodes R1 and R2 decode the received messages using XOR to obtain the messages a and b sent by the source node, and the two destination nodes obtain a total of 4 bits of data. Similarly, it can be seen that using network coding to send messages, the average throughput of destination nodes R1 and R2 is 2 bits / node.

[0009] B. Multicast Networks

[0010] With the widespread application of satellite communication, network video, and wireless broadcasting, multicast communication has seen significant development. Typically, data is transmitted over a network as a stream. Due to limited network bandwidth, multicast communication technology is needed to avoid sending data individually to each receiver. Multicast security is a critical issue. Standard, practical communication security solutions generally employ symmetric encryption. However, applying this to IP multicast traffic could allow any receiver to impersonate the sender. IPsec cannot be directly used in multicast schemes because IPsec security associations are bound to two, not multiple, hosts. For multicast networks, the IETF proposed the TESLA (Time Efficient Stream Loss-tolerant Authentication) protocol, which is flexible and meets multicast security requirements.

[0011] The main idea behind the TESLA protocol is to use a symmetric encryption model while leveraging delayed key disclosure to achieve asymmetric encryption. This requires the sender and receiver to synchronize with a loosely spaced key. The sender encrypts each data packet using a key k known only to itself, generating a MAC value. The receiver buffers its received data packets before source verification, discarding packets that take too long to arrive. After a short period, the sender releases the key k, allowing the receiver to verify its previously buffered packets. TESLA can be used at both the network and application layers and is suitable for environments with high packet loss rates.

[0012] How it works: The TESLA protocol guarantees that if message M... i If it wasn't sent by the sender, then the receiver will never receive it. In the TESLA model, the sender's message flow consists of message clusters. Generally, the sender sends data packets P at each network layer. i Send each message cluster M in i This allows the receiver to independently authenticate each message, thus solving the problem that most multicast distribution protocols cannot tolerate packet loss. To achieve this functionality, the sender first determines the required transmission time based on network conditions and divides them into equal-length periodic intervals I. i Let i = 1, 2, 3, ..., N. Use T int This indicates the duration of the interval, where T0 represents the start time of transmission. If the interval is I... i The start time is denoted by T. i This means that T i =T0+i int. Next, the sender must determine a key chain containing N keys. This key chain is generated by a one-way function. The sender randomly selects the last key K in the key chain. n The entire key chain is pre-computed using a pseudo-random function F. Each item in the key chain is defined as: K i =F(K i+1 Then each key can be accessed through K. n It is deduced that: K i =F n-1 (K n ), F j (k)=F j-1 (F(k)), F 0 (k)=k. To avoid using the same key in different operations, Tesla uses another pseudo-random function F' to obtain the key K' used to calculate the Message Authentication Code (MAC), K'=F'(K). Figure 2 This is a diagram showing the relationships between one-way key chains.

[0013] The specific steps of this invention include:

[0014] Step 1: At the source, randomly generate a private key and public key pair, and randomly generate a seed state s0. An algorithm, including but not limited to RSA, can be used to encrypt s0 with the private key to generate a series of states s0, s1, ..., s u The state is hashed to generate a series of keys k0, k1, ..., k u ;

[0015] Step 2: The source node sends its public key and ku , k u-1 ..., k1, k0 are distributed sequentially to intermediate nodes. The i-th intermediate node can obtain the key k it received from itself. u-i k is calculated iteratively. u-j (j >= i), because the intermediate node does not hold the private key of the source node, k cannot be solved. u-j (j < i);

[0016] Step 3: At the source, based on the estimated total communication time, randomly select k. v , will k v and using k v The messages, after being XORed together, are distributed to the intermediate nodes.

[0017] Step 4: At the i-th intermediate node, receive the message sent by the previous node, and determine if there is an encrypted message. If there is an encrypted message, use k... v-i XOR decryption; determine the next node j (j i) Are there any messages to mix? If so, and the number of mixed messages is even, then send the mixed messages; otherwise, generate k. v-j , using k v-j XOR-encrypt the mixed message before sending; if there is no encrypted message, forward it directly.

[0018] Step 5: At the m-th sink node, receive the message sent by the intermediate node and determine if there is an encrypted message; if there is an encrypted message, use the sink node's key k. m XOR decryption; use the decrypted message encoding to solve for other mixed messages.

[0019] The secure network coding scheme of this invention employs an encryption mode with MAC (Macro-MAC Encryption) to process information to ensure the correctness of encryption and decryption. The process includes:

[0020] The i-th node encrypts and sends the data to the j-th node (j... Before message i), the key for the MAC is calculated using another pseudo-random function F', k. v-j '=F'(k v-j ), using k v-j Generate a MAC for the unencrypted message and send the MAC along with the encrypted message to the next node;

[0021] After the i-th intermediate node is decrypted, the key k is calculated using F'. v-i '=F'(k v-i The process generates a new MAC value from the decrypted plaintext; it then compares this new MAC value with the received MAC value. Messages with different MAC values ​​are discarded, while messages with the same MAC value are mixed or encrypted again.

[0022] At the m-th sink node, the key k is calculated using F'. m '=F'(k m The process generates a new MAC value for the decrypted plaintext; it then compares this new MAC value with the received MAC value. Messages with different MAC values ​​are discarded, while messages with the same MAC value are decrypted together.

[0023] Compared with existing solutions, the present invention has the advantages of high security and high efficiency, as detailed below.

[0024] Security: The encryption scheme in this invention ensures that messages transmitted between any two nodes have undergone XOR encryption or mixing, thereby guaranteeing message security. Figure 1 For example, if the message is a⊕k, b⊕k, or a⊕b, the key and the ⊕ operation ensure that the network coding achieves weak security, that is, the attacker cannot recover the information of a or b from the obtained 1 bit of information.

[0025] In more complex network encoding scenarios, for example, if the received message is a, b, c, d, the mixed message might be a⊕b⊕c⊕d; if the received message is a, b, c, the mixed message might be a⊕b / a⊕c / b⊕c. Messages that are not mixed are encrypted and retransmitted, i.e., c⊕k / b⊕k / a⊕k. With more information gathered, an attacker can obtain at least two messages or the XOR value of a message and the key through manipulation, but still cannot recover the value of a single source message.

[0026] The security of the encryption algorithm is guaranteed by comparing MAC values; results from encryption algorithms that fail to function correctly will not be forwarded. The security and authentication of nodes in the network are ensured by key recovery technology, with a security strength equivalent to the TESLA protocol.

[0027] Efficiency: The network coding scheme of this invention adopts linear coding, and the coding matrix is ​​simple and easy to operate. It does not use field multiplication and shift operations, but only direct XOR, which can greatly improve the encryption and encoding / decoding efficiency.

[0028] Encrypting information and then forwarding the ciphertext, key, and MAC value increases bandwidth and encryption costs. The advantage of the encoding scheme presented in this paper is that it encrypts only a portion of the message. Figure 1 Taking a medium-sized network as an example, the increased bandwidth is 6 / 9 bits. In complex multicast networks, the number of nodes that forward only a single message will be greatly reduced, so the increased bandwidth can be reduced accordingly. Assuming there are n messages and m edges in the network, and y paths for a single message to propagate, then the increased bandwidth is y / m bits, and the multicast propagation rate is (ny) / m. Attached Figure Description

[0029] Figure 1A comparison of routing and network coding in butterfly networks.

[0030] Figure 2 It is the process of TESLA protocol key chain and MAC generation.

[0031] Figure 3 This is an example of the present invention. Detailed Implementation

[0032] As many studies have shown, the "mixing" operation of intermediate nodes in network coding serves to hide data, ensuring that an adversary detecting only one node's information cannot obtain the information before mixing. For example, in Figure 1, if an adversary detecting a⊕b cannot obtain any information about a or b (under weak security conditions), then a simple method to protect network coding security is to encrypt unmixed nodes transmitted in the network. When an intermediate node receives an encrypted message, it determines whether to forward it directly: if forwarded directly, it decrypts and re-encrypts; if the message needs to be "mixed" at the node, it decrypts, mixes, and then forwards the message. To ensure the correctness of node encryption and decryption, a Authentication Code (MAC) can be used for verification. Specific encryption and decryption implementations, encryption and decryption with MAC, and examples of encryption and decryption in the butterfly diagram are as follows:

[0033] Encryption / Decryption

[0034] Initialization: TESLA key recovery technology is used to distribute encryption and decryption keys for non-mixed information to each node in the multicast network. Key recovery is based on the RSA algorithm; the source node uses its private key to iteratively decrypt and generate a series of states s0, s1, ..., s0 using a seed state s0. u The state is hashed to generate a series of corresponding keys k0, k1, ..., k for symmetric encryption. u Distribute to intermediate nodes; the i-th intermediate node can use the key k it received from itself. u-i k is calculated iteratively. u-j (j i) Because intermediate nodes do not hold the private key of the source node, they cannot solve for k. u-j (j < i).

[0035] Key selection and encryption / decryption:

[0036] Source node: k randomly selected v (Based on the estimated total communication time), k v and using k v The messages, after being XORed and encrypted, are distributed to the intermediate nodes.

[0037] Intermediate nodes:

[0038] The i-th intermediate node receives the message sent by the previous node and determines whether there is an encrypted message;

[0039] If there is an encrypted message, use k v-i XOR decryption, determine the next node j (j i) Are there any messages being mixed?

[0040] If there are mixed messages, and the number of mixed messages is even, then the mixed messages are sent.

[0041] Otherwise, use the RSA algorithm to iteratively generate k. v-j , using k v-j Send after XOR encryption;

[0042] If there is no encrypted message, forward it directly.

[0043] The m-th sink node:

[0044] Receive messages sent by intermediate nodes and determine if there are encrypted messages;

[0045] If there is an encrypted message, use k m XOR decryption;

[0046] Use the decrypted message encoding to solve for the other mixed messages.

[0047] Encryption and decryption with MAC

[0048] To ensure the correctness of encryption and decryption, an encryption mode with MAC can be used. A pseudo-random function F' is used to obtain the key K' used to calculate the Message Authentication Code (MAC), where K' = F'(K). The specific encryption and decryption process is as follows:

[0049] Source node: k randomly selected v (Based on the estimated total communication time), generate k v ', using k v The message is directly XORed; generate k v ', using k v Generate a MAC for the unencrypted message; set k v The MAC address and the encrypted message are sent together to the intermediate node.

[0050] Intermediate nodes:

[0051] The i-th node receives the message sent by the previous node and determines whether there is an encrypted message;

[0052] If there is an encrypted message, use k v-i XOR decryption, using k v-i Generate a new MAC value. Messages with different MAC values ​​are discarded. If the MAC values ​​are the same, determine the next node j. i) Are there any messages being mixed?

[0053] If there are mixed messages, and the number of mixed messages is even, then the mixed messages are sent.

[0054] Otherwise, use the RSA algorithm to iteratively generate k. v-j , using k v-j XOR encryption of messages, using k v-j Send k after generating MAC v-j MAC address and encrypted message;

[0055] If there is no encrypted message, forward it directly.

[0056] The m-th sink node:

[0057] Receive messages sent by intermediate nodes and determine if there are encrypted messages;

[0058] If there is an encrypted message, use k m XOR decryption, using k m Generate a new MAC value; messages with different MAC values ​​are discarded; use the decrypted message encoding to solve for other mixed messages.

[0059] Encryption and decryption examples of the present invention in butterfly diagrams

[0060] right Figure 1 The butterfly diagram shown illustrates one implementation of the secure network coding scheme of this invention. Figure 3 The specific process is as follows:

[0061] Initialization: The TESLA protocol's key recovery technique is used to distribute encryption and decryption keys for non-mixed information to each node in the multicast network. Key recovery is based on the RSA algorithm. The source node uses its private key to iteratively decrypt and generate a series of states s0, s1, ..., s5 using a seed state s0. These states are then hashed to generate a series of corresponding keys k0, k1, ..., k5 for symmetric encryption, which are distributed to intermediate and destination nodes. The intermediate nodes A, B, C, and D (numbers 1, 2, 3, and 4) distribute keys k5, k4, k3, and k2 respectively, while the destination nodes R2 and R1 (numbers 0 and 1) distribute keys k0 and k1 respectively. Each node can then use the keys k0 and k1 it receives. i k is calculated iteratively. j (j i), but cannot solve for k j (j> i).

[0062] Key selection and encryption / decryption:

[0063] Source node: Distribute a⊕k5 to the first intermediate node A, and distribute b⊕k4 to the second intermediate node B.

[0064] Intermediate nodes:

[0065] The first intermediate node A receives the message sent by the source node, determines that it is encrypted, and decrypts it using k1 XOR to obtain a; it determines that the next node C (the third intermediate node) does not have a mixed message, so it uses the RSA algorithm to generate the key k3 for node C and sends a⊕k3 to node C; it determines that the next node R1 (the first sink node) does not have a mixed message, so it uses the RSA algorithm to generate the key k1 for R1 and sends a⊕k1 to R1.

[0066] The second intermediate node B receives the message sent by the source node, determines that it is encrypted, and decrypts it using k2 XOR to obtain b; it determines that the next node C (the third intermediate node) does not have a mixed message, so it uses the RSA algorithm to generate the key k3 for node C and sends b⊕k3 to node C; it determines that the next node R2 (the 0th sink node) does not have a mixed message, so it uses the RSA algorithm to generate the key k0 for R2 and sends a⊕k0 to R2.

[0067] The third intermediate node C receives the message sent by the first intermediate node A, determines that there is an encrypted message, and uses k5 XOR to decrypt it to get a; the third intermediate node C receives the message sent by the second intermediate node B, determines that there is an encrypted message, and uses k4 XOR to decrypt it to get b; it determines that the next node D (the fourth intermediate node) has messages to mix and that there are an even number of messages, then it sends the mixed message a⊕b.

[0068] The fourth intermediate node D receives the message sent by the third intermediate node, determines that there is no encrypted message and that the existing message has been mixed, and then directly forwards a⊕b to the destination nodes R1 and R2.

[0069] Destination Node:

[0070] The first destination node R1 receives a message sent by intermediate node A, determines that it is encrypted, and uses k1 to XOR decrypt and generate 'a'; it receives a message sent by intermediate node D, determines that it is not encrypted, and gets a⊕b; after mixing and decoding, it obtains messages a and b.

[0071] The 0th destination node R2 receives a message sent by the intermediate node B, determines that it is encrypted, and uses k0 XOR decryption to generate b; it receives a message sent by the intermediate node D, determines that it is not encrypted, and gets a⊕b; after mixing and decoding, it obtains messages a and b.

Claims

1. A secure network coding scheme based on selective encryption, characterized in that, Includes the following steps: Step 1: At the source, randomly generate a private key and public key pair, and randomly generate a seed state s0. An algorithm, including but not limited to RSA, can be used to encrypt s0 with the private key to generate a series of states s0, s1, ..., s u The state is hashed to generate a series of keys k0, k1, ..., k u ; Step 2: The source node sends its public key and k u k u-1 The keys k1, k0, ..., k1 are distributed sequentially to the intermediate nodes. The i-th intermediate node can use the key k it received to start from the key k. u-i k is calculated iteratively. u-j (j≥i), because intermediate nodes do not hold the private key of the source node, k cannot be solved. u-j (j <i); Step 3: At the source, based on the estimated total communication time, randomly select k. v , will k v and using k v The messages, after being XORed together, are distributed to the intermediate nodes. Step 4: At the i-th intermediate node, receive the message sent by the previous node, and determine if there is an encrypted message. If there is an encrypted message, use k... v-i XOR decryption; determine if the next node j (j≥i) has messages to mix. If there are messages to mix, and the number of mixed messages is even, then send the mixed message; otherwise, generate k. v-j , using k v-j XOR-encrypt the mixed message before sending; if there is no encrypted message, forward it directly. Step 5: At the m-th sink node, receive the message sent by the intermediate node and determine if there is an encrypted message; if there is an encrypted message, use the sink node's key k. m XOR decryption; Use the decrypted message encoding to solve for the other mixed messages; Information is processed using an encryption mode with MAC to ensure the correctness of encryption and decryption. The process includes: Before the i-th node encrypts and sends the message to the j-th node (j≥i), it uses another pseudo-random function F' to calculate the key for the MAC, k. v-j '=F'(k v-j ), using k v-j Generate a MAC for the unencrypted message and send the MAC along with the encrypted message to the next node; After the i-th intermediate node is decrypted, the key k is calculated using F'. v-i '=F'(k v-i The process generates a new MAC value from the decrypted plaintext; it then compares this new MAC value with the received MAC value. Messages with different MAC values ​​are discarded, while messages with the same MAC value are mixed or encrypted again. At the m-th sink node, the key k is calculated using F'. m '=F'(k m The process generates a new MAC value from the decrypted plaintext; it then compares this new MAC value with the received MAC value. Messages with different MAC values ​​are discarded, while messages with the same MAC value are decrypted together. Encrypting only some messages reduces the number of nodes that forward only a single message, thus decreasing the increase in bandwidth. Assuming there are n messages and m edges in the network, with y paths for a single message to propagate, the increased bandwidth is y / m bits, and the multicast propagation rate is (ny) / m.

Images