互联网地址安全体系与关键技术  

Architecture and Key Technologies of Internet Address Security

作　　者：徐恪[1,2] 朱亮[1,2] 朱敏[1,2] 

机构地区：[1]清华信息科学与技术国家实验室(清华大学),北京100084 [2]清华大学计算机科学与技术系,北京100084

出　　处：《软件学报》2014年第1期78-97,共20页Journal of Software

基　　金：国家自然科学基金(61170292);国家重点基础研究发展计划(973)(2009CB320501;2012CB315803);国家科技重大专项(2012ZX03005001-001);国家高技术研究发展计划(863)(2013AA013302);国家科技支撑计划(2011BAK08B05-02;2012BAH01 B01)

摘　　要：当前,互联网体系结构不具备地址真实性验证机制,源地址伪造与路由地址前缀欺骗造成了极大危害.解决地址安全问题、构建真实可信的互联网环境,已成为亟待解决的重要课题.地址的真实性是互联网可信的基础和前提.针对这些问题,研究者们从不同角度提出了很多解决方案.首先,该文介绍了地址的概念及其欺骗现状,分析了地址安全的含义,并从研究体系、实现机制以及关键技术这3个维度,对地址安全研究思路进行了归纳分析.然后,对典型地址安全方案的性能指标进行了总结.最后,给出了一个地址与标识通用实验管理平台的设想,基于该平台,可以为不同的地址标识方案提供统一的部署实验环境.Forged source address and routing address prefix hijacking have caused great threats since there are no source address validation mechanisms on the current Internet. Solving the address security problem and constructing a reliable lnternet environment have become a critical issue. The foundation of a trustworthy Internet is the authenticated IP addresses. Therefore, researchers have proposed many solutions from different perspectives on these problems. This paper first introduces the notion of address and the current situation of address spoofing, then gives an analysis to the meaning of the address security. The paper analyzes and compares these security solutions in three dimensions： The architecture, the mechanism and the key technical means. Their performances are also summarized and evaluated. Finally, the study provides a proposal of constructing a general experimental platform for network addresses which enables different address schemes to be deployed and experimented.

关 键 词：地址欺骗 前缀劫持 地址安全 地址认证 通用地址平台 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]