Turvaline üldotstarbeline võrdõiguslikest sõlmedest koosnev kattevõrk
Date
2013
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Tartu Ülikool
Abstract
Internet disaniti algselt põhimõttega, et kõik otspunktid loovad teineteisega otseühendusi. Tänapäeval on aga laiatarbelises kasutuses NAT tehnoloogia, mis aitab küll lahendada IPv4 aadresside puuduse probleemi, aga seda otseühenduste loomise võimaluse hinnaga. Seetõttu ei ole suur osa seadmeid Interneti kaudu otse kättesaadavad. See lõputöö kirjeldab turvalist p2p protokolli, mis teisi võrgusõlmi releedena kasutades NATi probleemist mööda hiilida. Protokoll kasutab üldlevinud krüptograafilisi vahendeid, et tagada osapoolte integreeritud autentimine ja andmeside krüpteerimine ilma keerulist seadistust nõudmata. Arutatakse sellega seonduvaid peamisi turvaprobleeme ja implementeeritakse protokolli funktsionaalsuse demonstreerimiseks vajalik programm.
The Internet was designed to provide end-to-end connectivity between all the connected hosts. Due to the depletion of IPv4 addresses and widespread deployment of NAT, a lot of devices are no longer directly reachable over the Internet. This paper describes a secure peer-to-peer protocol that is capable of working around NAT by using unrestricted peers as relays. The protocol builds on common cryptographic tools to provide seamless authentication and encryption without requiring difficult key exchange procedures or in- advance key signing by using the hash of the peer's public key as his identity on the network. Some of the main security issues are discussed and a proof-of-concept prototype is implemented to demonstrate the functionality of the protocol.
The Internet was designed to provide end-to-end connectivity between all the connected hosts. Due to the depletion of IPv4 addresses and widespread deployment of NAT, a lot of devices are no longer directly reachable over the Internet. This paper describes a secure peer-to-peer protocol that is capable of working around NAT by using unrestricted peers as relays. The protocol builds on common cryptographic tools to provide seamless authentication and encryption without requiring difficult key exchange procedures or in- advance key signing by using the hash of the peer's public key as his identity on the network. Some of the main security issues are discussed and a proof-of-concept prototype is implemented to demonstrate the functionality of the protocol.