基于門限機(jī)制的密鑰管理方案能提供高的安全性，但認(rèn)證成功率較低，可擴(kuò)展性差；基于證書鏈的密鑰管理方案適合自組網(wǎng)的特點，但其安全性僅取決于證書鏈中節(jié)點的信任度，不能滿足高安全要求的應(yīng)用環(huán)境。該文提出了門限機(jī)制和證書鏈信任值方法相結(jié)合的混合式密鑰管理和認(rèn)證方案，在增加少量通信量的情況下，方案提高了自組網(wǎng)的認(rèn)證成功率和系統(tǒng)的安全性，較好地平衡了自組網(wǎng)的安全性和認(rèn)證成功率，滿足自組網(wǎng)應(yīng)用的安全要求。
關(guān) 鍵 詞 自組網(wǎng); 證書鏈; 密鑰管理; 門限機(jī)制

A New Hybrid Key Management Scheme for Ad hoc Networks
WANG Hao1，XIE Ying1，ZHENG Wu2
(1. College of Automation, Chongqing University of Posts and Telecommunications Nan′an Chongqing 400065; 2. School of Computer Science and Engineering, University of Electronic Science and Technology of China Chengdu 610054)
Abstract Key management schemes based on threshold mechanism can provide high security, but lower certificate success rate and bad scalability; key management schemes based on certification chain satisfy self-organized features, but their security depends on trust degree of nodes and could not be applied high security environment. We advance hybrid key management scheme based on threshold mechanism and certification chain. Simulation shows that with less increment of communication overhead, our scheme can improve both certificate success rate and system security and better balances security and availability, and satisfies security needs of Ad hoc networks.
Key words Ad hoc; certification chain; key management; threshold mechanism

無線移動自組網(wǎng)是一種節(jié)點可任意移動、拓?fù)浣Y(jié)構(gòu)高度動態(tài)變化、沒有預(yù)設(shè)網(wǎng)絡(luò)基礎(chǔ)設(shè)施的多跳無線網(wǎng)絡(luò)。這種無線網(wǎng)絡(luò)具有可臨時組網(wǎng)、快速展開、無控制中心、抗毀滅等特點，在軍事通信和民用系統(tǒng)中有著廣泛的應(yīng)用。然而，由于自組網(wǎng)的無線鏈路、動態(tài)拓?fù)洹⑷狈泄芾砗唾Y源受限等特點，其本身就是很脆弱的，容易遭受多種攻擊，而且傳統(tǒng)的安全機(jī)制不再適合于它，極大地阻礙了自組網(wǎng)的應(yīng)用，特別是在關(guān)系到國防安全的軍事領(lǐng)域。自組網(wǎng)的密鑰管理和認(rèn)證是自組網(wǎng)安全研究的核心問題之一，也是自組網(wǎng)安全研究中最困難的問題之一，是研究自組網(wǎng)安全通信和安全路由的基礎(chǔ)[1]。