CN115834211B

CN115834211B - CoAP network security access method based on software defined boundary

Info

Publication number: CN115834211B
Application number: CN202211484839.8A
Authority: CN
Inventors: 张伟; 李子轩; 陈云芳
Original assignee: Nanjing University of Posts and Telecommunications
Current assignee: Nanjing University of Posts and Telecommunications
Filing date: 2022-11-24
Publication date: 2025-09-16
Anticipated expiration: 2042-11-24

Abstract

The embodiment of the invention belongs to the technical field of information security, and relates to a CoAP network security access method based on a software defined boundary. In order to alleviate the security problem of the CoAP server with limited resources, a software defined boundary technology is combined with the CoAP network, and the method comprises the following steps of introducing an SDP controller and an SDP gateway into a CoAP communication system, registering at the SDP controller when a client is on line, sending an SPA data packet containing self identity information and CoAP request context information to the SDP controller by the client, carrying out multi-factor identity authentication and multi-dimensional trust evaluation on the request by the SDP controller, and controlling the SDP gateway to forward the data of the client to the CoAP server by the trusted request. Therefore, the communication security performance of the CoAP server is improved under the condition that the resources of the CoAP server are not occupied.

Description

CoAP network security access method based on software defined boundary

Technical Field

The invention belongs to the technical field of CoAP network security access, and particularly relates to a CoAP network security access method based on a software defined boundary.

Background

With the wide application of the internet of things, the number of internet of things devices presents a rapid growth trend. The number of internet of things (Internet of Things, ioT) devices worldwide is expected to increase from 87.4 billion in 2020 to over 254 billion in 2030. A significant portion of the vast internet of things devices are small, resource-limited devices, and many of the devices' energy sources come from batteries, which can only extend their lives by conserving energy consumption as much as possible.

In view of the resource limitations and heterogeneity of internet of things devices, researchers have developed various lightweight communication protocols for the internet of things, with the most common protocol being the message queue telemetry transport protocol (Message Queuing Telemetry Transport, MQTT) and the constrained application protocol (Constrained Application Protocol, coAP). The CoAP protocol is an HTTP-like request/response protocol designed specifically for small-sized devices of the internet of things, and its transport layer adopts UDP protocol, which is mostly used in limited environments such as wireless sensor networks for web-like communication. CoAP is REST-based, the resource address of the server, like the internet, also has a URI-like format, which provides resource-oriented interactions in the client-server architecture using GET, POST, PUT and DELETE commands that are similar to HTTP. The UDP-based CoAP protocol reduces computational overhead and reduces bandwidth requirements and consumes less resources than the TCP-based MQTT protocol. After the lightweight of the internet of things devices and protocols is achieved, one major problem has to be considered, namely privacy and security issues. CoAP is an emerging internet of things protocol, faces many security threats such as resolution attacks, amplification attacks, man-in-the-middle attacks, denial of service attacks and the like, and in addition, coAP server resources are quite limited, and difficulties exist in solving security problems by adopting complex security functions.

To solve the security problem of CoAP networks, it is necessary to design a security framework based on software defined boundaries. The framework realizes safety protection by means of the SDP controller and the SDP gateway of the third party, and does not occupy the resources of the server. The SDP gateway is deployed in front of the CoAP server to hide server resources externally. The SDP controller performs identity authentication and trust evaluation on the access request. Only if the confidence level is greater than the trust threshold will the SDP controller instruct the SDP gateway to forward the communication data between the client and the server.

Disclosure of Invention

In order to alleviate the security problem of the CoAP server with limited resources, the invention combines the software definition boundary technology with the CoAP network, utilizes the SDP gateway to hide CoAP service, and utilizes the SDP controller to carry out multi-factor identity authentication and multi-dimensional trust evaluation on the client. Therefore, the communication safety of the CoAP client and the CoAP server is ensured under the condition that the resources of the CoAP server are not occupied.

In order to achieve the above purpose, the invention provides a CoAP network security access method based on a software defined boundary, which comprises the following steps:

s1, adding an SDP gateway and an SDP controller before a CoAP server;

S2, the client registers on the SDP controller;

S3, the client sends an SPA data packet to the SDP controller;

S4, the SDP controller carries out identity authentication on the client according to the information in the SPA packet, and if the identity authentication passes, the step S5 is skipped;

S5, the SDP controller performs trust calculation on the request, and if the trust value is greater than a threshold value, the step S6 is skipped;

S6, the SDP controller sends the information of the client to an SDP gateway;

s7, the client sends an SPA data packet to the SDP gateway, the SDP gateway carries out cross verification on the information in the SPA packet and the information received from the SDP controller, and if the verification is passed, the SDP gateway updates firewall rules of the SDP gateway and opens a designated service port for the client in preset time;

and S8, the user establishes a DTLS connection with the CoAP server through the gateway to communicate.

Further, the step S1 includes that the server refers to sdpid as each service or resource number, and provides resource information to the SDP controller and the SDP gateway, and the SDP controller and the SDP gateway store sdpid mapping relation with the server.

Further, the step S2 comprises the step that the client registers own user name and password to the SDP controller, the SDP controller generates a symmetrical encryption key for encrypting the SPA data packet and an HMAC key for generating the abstract for the client, and the address of the SDP gateway, the sdpid of all services and the port numbers mapped on the SDP gateway are provided for the client together.

Further, the step S3 includes that the SPA data packet sent by the client contains the IP, the user name and the password of the client, the context of the CoAP request, the abstract HMAC and the SPA packet is encrypted.

Further, the S4 includes the SDP controller decrypting the SPA packet using the symmetric key and verifying whether the IP, username, cryptographic hash, and HMAC contained in the SPA are correct.

Further, the S5 comprises the steps that the SDP controller calculates the comprehensive trust value and the trust threshold value based on the multidimensional attribute, the comprehensive trust value is larger than the trust threshold value required by the resource, and the client is trusted, otherwise, the client is not trusted.

Further, the calculation method of the trust value and the trust threshold is as follows:

the calculation of the trust value consists of two parts, namely a direct trust value DT and a comprehensive trust value CT;

The direct trust value consists of four parts, namely an initial trust degree T _i of the client, a security trust degree T _dtls of the DTLS, an environment trust value T _e and an abnormal behavior trust evaluation value T _b;

T _i is set to 100 according to the initial trust score obtained after the client is subjected to identity verification;

T _dtls depends on the encryption mode of the DTLS tunnel, different encryption modes correspond to different security levels sl, sl takes positive integers between [0,3], and the value of sl is 0 if the DTLS is NoSec mode, 1 if the DTLS is PRESHAREDKEY mode, 2 if the DTLS is RawPublicKey mode, and 3 if the DTLS is Certificates mode;

The calculation formula of T _dtls is as follows:

T _e is the number of trusted requests received by the SDP controller over the last 1 minute, assuming that the number of trusted requests is N _t and the number of untrusted requests is N _ut,T_e, the calculation formula is as follows:

T _b is the abnormal behavior proportion of the client, and assuming that the number of normal request behaviors of the client evaluated by the system is N _n, the calculation formula of the abnormal request behaviors is N _an,T_b is as follows:

the formula for calculating the direct trust value DT is as follows, w being the weighting coefficient of each trusted source:

DT=T_i+w₁*T_dtls+w₂*T_e+w₃*T_b

The comprehensive trust value is obtained by weighting the direct trust value and the comprehensive trust value in the last access, the SDP controller records the comprehensive trust value of the client and the generation time thereof, t _i is the time of the current request, t _j is the time of the last request, DT _i is the direct trust value of the SDP controller for evaluating the current request, CT _j is the comprehensive trust value calculated in the last request of t _j, and the calculation formula CT _i of the comprehensive trust value of the current request is as follows:

the calculation formula of the trust threshold T _th is as follows:

T_th＝MAX(Op_con*Ob_con,Op_int*Ob_int)

Ob _con refers to the confidentiality of the client access target, ob _int refers to the integrity of the client access target. The density and integrity of the different targets are different, the confidentiality is set to 0 for the targets such as temperature values, but the integrity is higher and set to 100, and the confidentiality is extremely high for the targets related to personal privacy, but the integrity is low.

Op is an influence factor for adding, deleting and checking confidentiality and integrity of target data by four request modes, if a client request mode is GET, a machine density influence factor Op _con is 1, an integrity influence factor Op _int is 0, if a client request mode is POST and PUT, a confidentiality influence factor Op _con is 0.5, an integrity influence factor Op _int is 0.5, and if a client request mode is DELETE, a machine density influence factor Op _con is 0, and an integrity influence factor Op _int is 1.

Further, the S7 comprises the steps that the SDP controller sends the SPA containing the HMAC key and the symmetric encryption key to the SDP gateway, the gateway decrypts the SPA data packet by using the symmetric encryption key, verifies the HMAC digest, compares whether information in the two SPA packets is the same, and if the information is the same, the same client is proved.

Further, the step S7 comprises the steps that the SDP gateway defaults to discard all received non-SPA data packets, and when the SDP gateway passes the verification of the client, the gateway adds a firewall rule, forwards the non-SPA data packets of the client to a corresponding server, and the rule is valid in preset time.

Compared with the prior art, the technical scheme of the invention has the following beneficial technical effects:

CoAP is an emerging internet of things protocol, faces various network security problems, and because of the lightweight characteristic, the traditional complex security function cannot be realized. The SDP technology and the CoAP are combined, a new security framework SDP-CoAP is designed to alleviate advanced security threat faced by the traditional CoAP, and the implementation of the SDP-CoAP architecture is described in detail. Although the SDP authentication process adds delay to the communication between devices, the SDP-CoAP authentication process occurs only once before a connection is established, and running the SDP component does not introduce significant computational overhead to the CoAP client, which is relatively starved of resources. In the method, scheme reference is provided for improving security capability of the lightweight internet of things protocol such as CoAP by introducing a zero trust mechanism.

Drawings

Fig. 1 is a CoAP network structure based on SDP provided in an embodiment of the present invention;

fig. 2 is a structure of an SPA packet according to an embodiment of the present invention;

Fig. 3 is a communication process of a CoAP network based on SDP according to an embodiment of the present invention.

Detailed Description

The following description of the embodiments of the present invention will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are only some, but not all embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.

The terms "comprises" and "comprising" and any variations thereof, in the description and claims, are intended to cover a non-exclusive inclusion, such that a device that comprises a sequence of steps or structures is not necessarily limited to those structures or steps that are expressly listed or inherent to such process or device but may include other steps or structures not expressly listed or inherent to such process or device.

Referring to fig. 1-3, an embodiment of the present invention proposes a CoAP network security access method based on a software defined boundary, the method comprising the steps of:

1, adding an SDP gateway and an SDP controller before a CoAP server;

2, the client registers on the SDP controller;

3, the client sends SPA data packets to the SDP controller;

4, the SDP controller performs identity authentication according to the information in the SPA packet, and if the identity authentication passes, the SDP controller jumps to 5;

5, the SDP controller carries out trust evaluation on the request, and if the trust value is greater than a threshold value, the process jumps to 6;

6, the SDP controller sends the information of the client to the gateway;

The client sends an SPA data packet to the SDP gateway, the SDP gateway carries out cross verification on the information in the SPA packet and the information received from the SDP controller, after verification is passed, the SDP gateway updates firewall rules of the SDP gateway, and a designated service port is opened for the client in preset time;

and 8, establishing DTLS connection between the user and the CoAP server through the gateway.

Further, in step 1, an SDP controller and an SDP gateway are deployed in the CoAP network, as shown in fig. 1. The server numbers each service or resource, referred to as sdpid, and provides the resource information to the SDP controller and SDP gateway. Before the SDP gateway is deployed in the CoAP server, the server hides the URI of the SDP gateway, and the SDP gateway is not provided externally, and only knows the URI of the server corresponding to sdpid.

Further, in step 2, the client registers its ip address, user name and password with the SDP controller, and in order to prevent leakage, the SDP controller stores a hash value of the password instead of the password itself in the database. The controller provides the client with a symmetric encryption key for encrypting SPA packets and an HMAC key for generating message authentication codes, and provides the address of the SDP gateway, sdpid for all services.

Further, in step 3, the packet structure of the SPA is shown in fig. 2. The SPA contains 3 parts, the first part is a UDP header containing the IP information of the visitor. The second part is a basic message part, which contains a time stamp and a 32-bit random number to prevent replay attack, a user name and a password for identity authentication, wherein the password adopts a hash value to prevent password leakage in the transmission process, and the CoAP request context information comprises three information of an access mode, a resource sdpid to be accessed and a DTLS tunnel encryption mode, and the access mode comprises four kinds of GET (check), PUT (increase), POST (change) and DELETE (deletion). NoSec, presharedKey, rawPublicKey, certificates, respectively representing that DLTS connection is not established, establishing the DTLS connection by a pre-shared symmetric encryption key, forcing equipment to establish the DTLS connection by using a pre-set key list, and establishing the DTLS connection by using an asymmetric key and an X.509 certificate, wherein the security is from low to high. The third part is the HMAC digest, which is generated to verify the identity of the device. And finally, encrypting the whole SPA packet, wherein the encryption algorithm adopts a Rijndael algorithm.

Further, in step 4, the SDP controller decrypts the SPA packet using the symmetric key, and first performs identity authentication by comparing the IP, username, and password hash included in the SPA with the database. Device authentication is then performed by decrypting the digest using the HMAC key, if it can be successfully decrypted, indicating that the client device is registered. In addition, the controller records the last valid authorized SPA packet it receives to prevent an attacker from sending old packets for replay attacks. And if the identity authentication and the equipment authentication are passed and are not repeated SPA data packets, the step 5 is skipped, otherwise, nothing is done.

Further, in step 5, the SDP controller calculates a comprehensive trust value and a trust threshold based on the multidimensional attribute, the comprehensive trust value is greater than the trust threshold required by the resource, and the client terminal is trusted, otherwise, the client terminal is not trusted. The calculation of the trust value consists of two parts, namely a direct trust value DT and a comprehensive trust value CT.

t _i is set to 100 according to the initial trust score obtained by the identity verification of the main body;

t _dtls depends on the encryption mode of the DTLS tunnel, different encryption modes correspond to different security levels sl, and the sl takes positive integers between [0 and 3] and takes values as shown in a table.

The calculation formula of T _dtls is as follows:

T _e is determined by the current network environment and is the number of trusted requests received by the SDP controller. Assuming that the number of trusted requests is N _t and the number of untrusted requests is N _ut,T_e in all requests received within the last 1 minute, the calculation formula is as follows:

T _b is the unusual behavior duty cycle of the client. Assuming that the number of normal request behaviors of the client evaluated by the system is N _n times, the calculation formula of the number of abnormal request behaviors is N _an,T_b is as follows.

DT=T_i+w₁*T_dtls+w₂*T_e+w₃*T_b

In order to consider historical factors, comprehensive trust is further introduced, and the comprehensive trust value is weighted by the direct trust value and the comprehensive trust value at the last access. The SDP controller records the comprehensive trust value of the client and the generation time of the comprehensive trust value. Assuming that t _i is the time of the current request, t _j is the time of the last request, DT _i is the direct trust value evaluated by the SDP controller on the current request, CT _j is the integrated trust value calculated at the time of the last request t _j, and the integrated trust value calculation formula CT _i of the current request is as follows:

θ is a gaussian decay function, and the closer the request is to the current request, the greater the reference value, and the effect of the last visit is lessened as time passes. In addition, in order to prevent an attacker from carrying out normal access for several times before carrying out attack to accumulate the trust value, the historical factors are considered only when the last comprehensive trust degree is smaller than the current trust value;

the calculation formula of the trust threshold T _th is as follows:

T_th＝MAX(Op_con*Ob_con,Op_int*Ob_int)

When the integrated trust value is greater than the trust threshold, step 6 is skipped.

Further, in step 6, the SDP controller sends the client terminal information to the SDP gateway, including the IP information of the visitor, the user name and password, the HMAC key, the Rijndael encryption key, the access mode, the resource sdpid to be accessed, and the DTLS tunnel encryption mode.

Further, in step 7, the client generates a SPA packet again, and this time sends it to the SDP gateway. The SDP gateway uses the Rijndael encryption key of the step 6 to decrypt the SPA data packet, uses the HMAC to decrypt the abstract, compares the IP, the user name, the password and the CoAP request context information contained in the SPA with those in the step 6, and if the same is the same, the SDP gateway adds a rule in the iptable to forward the data packet from the client to the CoAP server. This rule is deleted after 20 s.

Further, in step 8, the client sends a CoAP request to the server or establishes a DTLS connection, so that secure communication can be achieved.

While the invention has been described above by way of example, it will be apparent that the invention is not limited to the above embodiments, but is intended to cover various insubstantial modifications of the method concepts and technical solutions of the invention, or applications of the inventive concepts and technical solutions without modifications, as are within the scope of the invention. The protection scope of the present invention shall be subject to the protection scope defined by the claims.

Claims

1. A CoAP network security access method based on software-defined boundaries, characterized in that the method comprises the following steps:

S1: CoAP server adds SDP gateway and SDP controller;

S2: The client registers on the SDP controller;

S3: The client sends a SPA packet to the SDP controller;

S4: The SDP controller authenticates the client based on the information in the SPA data packet. If the authentication succeeds, the process jumps to S5.

S5: The SDP controller performs a trust calculation on this request. If the trust value is greater than the threshold, it jumps to S6.

S6: The SDP controller sends the client information to the SDP gateway;

S7: The client sends an SPA packet to the SDP gateway. The SDP gateway cross-validates the information in the SPA packet with the information received from the SDP controller. If the validation succeeds, the SDP gateway updates its firewall rules and opens the specified service port to the client within a preset time. If the validation fails, the communication fails.

S8: The user establishes a DTLS connection with the CoAP server through the gateway for communication;

The calculation method of the trust value and trust threshold is as follows:

The calculation of trust value consists of two parts: direct trust value DT and comprehensive trust value CT;

The direct trust value consists of four parts: the client's initial trustworthiness _Ti , the DTLS security trustworthiness _Tdtls , the environmental trust value _Te , and the abnormal behavior trust evaluation value _Tb ;

_Ti is the initial trust score obtained after the client has been authenticated and is set to 100;

T _dtls depends on the encryption method of the DTLS tunnel. Different encryption methods correspond to different security levels sl. sl is a positive integer between [0, 3]. If DTLS is in NoSec mode, sl is 0; if DTLS is in PresharedKey mode, sl is 1; if DTLS is in RawPublicKey mode, sl is 2; if DTLS is in Certificates mode, sl is 3.

The calculation formula for T _dtls is as follows:

_Te is the ratio of trusted requests received by the SDP controller. Assuming that among all requests received in the last minute, the number of trusted requests is _Nt and the number of untrusted requests is _Nut , _Te is calculated as follows:

_Tb is the proportion of abnormal behaviors of the client. Assuming that the number of normal request behaviors of the client evaluated by the system is _Nn and the number of abnormal request behaviors is _Nan , the calculation formula of _Tb is as follows:

The calculation formula of direct trust value DT is as follows, where w is the weighted coefficient of each trust source:

DT＝T _i +w ₁ *T _dtls +w ₂ *T _e +w ₃ *T _b

The comprehensive trust value is obtained by weighting the direct trust value and the comprehensive trust value of the last access. The SDP controller records the client's comprehensive trust value and its generation time. Assume that _ti is the time of this request, _tj is the time of the last request, _DTi is the direct trust value evaluated by the SDP controller for this request, and _CTj is the comprehensive trust value calculated at the last request _tj. The formula for calculating the comprehensive trust value of this request _CTi is as follows:

The calculation formula of the trust threshold _Tth is as follows:

T _th =MAX(Op _con *Ob _con ,Op _int *Ob _int )

Ob _con refers to the confidentiality of the client's access to the target, and Ob _int refers to the completeness of the client's access to the target;

If the client request method is GET, the confidentiality impact factor Op _con is 1 and the integrity impact factor Op _int is 0; if the client request method is POST or PUT, the confidentiality impact factor Op _con is 0.5 and the integrity impact factor Op _int is 0.5; if the client request method is DELETE, the confidentiality impact factor Op _con is 0 and the integrity impact factor Op _int is 1.

2. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that S1 includes: the server numbers each service or resource, called sdpid, and provides resource information to the SDP controller and SDP gateway, and the SDP controller and SDP gateway save the mapping relationship between sdpid and the server.

3. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that S2 includes: the client registers its own username and password with the SDP controller, the SDP controller generates a symmetric encryption key for encrypting SPA data packets and an HMAC key for generating a digest for the client, and provides the client with the address of the SDP gateway, the sdpid of all services, and the port number mapped to the SDP gateway.

4. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that the S3 includes: the SPA data packet sent by the client contains its own IP, username and password, CoAP request context, digest HMAC, and the SPA data packet is encrypted.

5. The method for secure CoAP network access based on software-defined boundaries according to claim 1, wherein S4 comprises: the SDP controller decrypts the SPA data packet using a symmetric key and verifies whether the IP, username, password hash, and HMAC contained in the SPA data packet are correct.

6. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that the S5 includes: the SDP controller calculates a comprehensive trust value and a trust threshold based on multi-dimensional attributes, and if the comprehensive trust value is greater than the trust threshold required by the resource, the client is trustworthy; otherwise, it is untrustworthy.

7. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that the S7 includes: the SDP controller sends the HMAC key and the symmetric encryption key contained in the SPA data packet to the SDP gateway; the gateway uses the symmetric encryption key to decrypt the SPA data packet, verify the HMAC digest, and compare whether the information in the two SPA data packets is the same. If the information is the same, it proves that they are the same client.

8. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that S7 includes: the SDP gateway discards all received non-SPA data packets by default. When the SDP gateway verifies the client successfully, the gateway adds a firewall rule to forward the client's non-SPA data packets to the corresponding server. The rule is valid for a preset time.