改进的BGP安全机制  

An Improved BGP Security Mechanism

作　　者：赵宸[1,2] 孙斌[1,3] 杨义先[1,2] 杨焱[3] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]北京邮电大学灾备技术国家工程实验室,北京100876 [3]北京交通大学轨道交通控制与安全国家重点实验室,北京100044

出　　处：《北京邮电大学学报》2012年第6期87-91,共5页Journal of Beijing University of Posts and Telecommunications

基　　金：国家自然科学基金项目(61121061);轨道交通控制与安全国家重点实验室(北京交通大学)开放课题(2010K010);国家重大科技专项项目(2011ZX03002-005-01)

摘　　要：由于边界网关协议(BGP)缺少必要的安全机制,面临严重的安全威胁,虽有多种安全方案被提出,但繁复的密钥管理和过量的存储开销严重阻碍了方案的实际部署.为此,将代理重签名机制引入BGP安全机制(SE-BGP)方案中,修改了自治系统联盟结构,改进了分布式信任模型,解决了关键节点在联盟之间交叉认证的问题,提出了一种改进的BGP安全机制.安全和性能分析结果表明,在保证安全能力的同时,该机制进一步减少了路由资源的消耗,所需的证书规模约为SE-BGP的31%,具有更好的可扩展性.For lack of necessary security mechanism, the border gateway protocol （BGP） faces serious security threats. In proposed BGP security mechanisms, the management of complicated certificatation and excessive storage overhead severely block security solutions from being implemented and deployed in real world. Based on modification of autonomous system alliance＇ s structure, the proxy re-signature is introduced into security enhanced BGP （SE-BGP） to improve translator trust model. An improved BGP security mechanism named improved SE-BGP is also designed for solving the problem of cross-certification of key nodes between autonomous system alliances. Security analysis and performance evaluation demonstrate that this mechanism continues to reduce the route resource expenses to have better scalability and good security capability. The number of used certificates is about 31% of the SE-BGP.

关 键 词：边界网关协议 交叉认证 代理重签名 安全 

分 类 号：TN393[电子电信—物理电子学]