标准模型下可证明安全的BGP路由属性保护机制  

Provable Secure Mechanism for BGP Path Protection in the Standard Model

作　　者：李道丰[1,2] 王高才[1,2] 王志伟[3] 钟诚[1,2] 李陶深[1,2] 

机构地区：[1]广西大学计算机与电子信息学院,南宁530004 [2]广西高校并行分布式计算技术重点实验室,南宁530004 [3]南京邮电大学计算机学院,南京210003

出　　处：《计算机学报》2015年第4期859-871,共13页Chinese Journal of Computers

基　　金：国家自然科学基金(61262003;61373006;61362010);广西自然科学(2011GXNSFA018152);广西教育厅基金(YB2014008;2013YB007);广西大学自然科学基金(XBZ110905)资助~~

摘　　要：BGP路由协议是目前大多数网络基础设施所采用的重要协议之一.随着网络攻击技术的发展,如何构造安全且容易部署的BGP协议保护机制,仍然是安全路由协议研究中的热点问题.文中提出标准模型下可证明安全的BGP协议的路由属性保护机制——Identity-based Sanitizable Signature Path Verification(简称IDSPV).IDSPV机制采用基于身份的密码学思想以及可净化签名方案的优点.并结合BGP路由协议特征,在无需证书的条件下,仅需将自己的更新报文签名后再添加到AS_PATH路径中,为BGP路由属性完整性和真实性提供保护.避免证书存储和管理开销.另外,文中给出保护AS_PATH路由属性的安全模型,利用规约技术,在标准模型下给出IDSPV机制的安全证明.通过安全性和性能方面的分析可知,与现有方案相比,IDSPV机制更易于在实际网络中部署.In current, the BGP is one of the important routing protocols that are adopted by most network infrastructures. With the development of network attack technology, how to construct a protected mechanism which is secure and easy to be deployed for BGP is still a hot topic in the research of secure routing protocols. In this paper, based on identity-based cryptography and sanitizable signature scheme, a provable secure path attributes protection mechanism - Identity- based Sanitizable Signature Path Verification （IDSPV） for the BGP in the standard model is proposed. Combines with the features of the BGP, the IDSPV only needs to update messages and add the updated messages to AS_PATH without certification. The protection in the integrity and authenticity for the BGP attribute is proved in the IDSPV. Furthermore the storage space and management overhead for the certification is avoided. In addition, the security model for the AS_PATH attribute is presented and the security proof for the IDSPV mechanism is given by using the reduction method in the standard model. The analysis and experiment results show that the proposed IDSPV mechanism is more feasible and effective than the existing schemes mentioned in the analysis of security and performance.

关 键 词：标准模型 边界网关协议 可证明安全 路由属性保护 可净化签名 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]