一种轻量化的边界网关协议路径验证机制  

A Lightweight Mechanism for Border Gateway Protocol Path Verification

作　　者：赵宸[1,2] 孙斌[1,3] 杨义先[1,2] 杨焱[3] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]北京邮电大学灾备技术国家工程实验室,北京100876 [3]北京交通大学轨道交通控制与安全国家重点实验室,北京100044

出　　处：《电子与信息学报》2012年第9期2167-2173,共7页Journal of Electronics & Information Technology

基　　金：国家自然科学基金(61121061);国家重大科技专项(2011ZX03002-005-01);轨道交通控制与安全国家重点实验室(北京交通大学)开放课题基金(2010K010)资助课题

摘　　要：由于边界网关协议(Border Gateway Protocol,BGP)存在安全问题,路径信息(AS_PATH属性)易遭受各种攻击。已有的路径验证方案中,过程复杂和开销巨大严重阻碍了方案的实际部署。基于对AS_PATH属性的分析,该文提出一种轻量化的BGP路径验证机制—FTAPV(First-Two-AS based Path Verification)。FTAPV中,更新报文只需要携带AS_PATH中前两个AS的签名信息就可以有效地为路径信息提供保护。安全分析和性能评估表明,与已有方案相比,该机制在保证安全能力的同时,有效地减少了路由资源的消耗和所需证书的规模,具有良好的可扩展性。Since BGP （Border Gateway Protocol） possesses many security vulnerabilities, BGP Autonomous System PATH information （ASPATH attribute） is vulnerable to various attacks. In proposed BGP path verification mechanisms at present, the high computational overhead and complex process severely block security solutions from being implemented and deployed in reM world. A lightweight method is designed for BGP path verification named First-Two-AS based Path Verification （FTAPV）. Based on analysis of ASPATH attribute, FTAPV can protect path information effectively through carrying signatures of first two ASes in the ASPATH of UPDATEs. Security analysis and performance evaluation demonstrate this mechanism can reduce the route resource expense and the number of used certificates with strong ability of security and good scalability compared with existing method.

关 键 词：信息安全 边界网关协议(BGP) 路径验证 First-Two-AS 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]