RPKI去中心化安全增强技术综述  

Survey on decentralized security-enhanced technologies for RPKI

作　　者：秦超逸 张宇[1,2] 方滨兴 QIN Chaoyi;ZHANG Yu;FANG Binxing(School of Cyberspace Science,Harbin Institute of Technology,Harbin 150001,China;Pengcheng Laboratory,Shenzhen 518055,China;Cyberspace Institute of Advanced Technology,Guangzhou University,Guangzhou 510006,China)

机构地区：[1]哈尔滨工业大学网络空间安全学院,黑龙江哈尔滨150001 [2]鹏城实验室,广东深圳518055 [3]广州大学网络空间先进技术研究院,广东广州510006

出　　处：《通信学报》2024年第7期196-205,共10页Journal on Communications

基　　金：国家重点研发计划基金资助项目(No.2022YFB3104800);鹏城实验室重大攻关基金资助项目(No.PCL2023A05)。

摘　　要：资源公钥基础设施(RPKI)搭建了中心层级化的IP地址资源认证基础设施。在增强互联网域际路由系统安全的同时,RPKI也将中心性引入路由系统。根据证书认证中心职能,提出RPKI体系中的认证中心、操作中心和发布中心,并从3个中心对RPKI去中心化安全增强技术综述。首先,从认证、操作和发布角度细化RPKI中心化风险。其次,从3个风险角度分类RPKI去中心化安全增强技术的技术思路和解决措施。再次,从安全性、可扩展性和增量部署分析比较相关技术。最后,总结存在的问题并展望未来的研究方向。The resource public key infrastructure(RPKI)deploys a centralized and hierarchical infrastructure for the authorization of IP addresses.It not only enhances the security of the Internet border gateway protocol system,but also introduces centralization into the routing system.According to the functions of the certificate authorities,the authorization center,operation center,and publication center in the RPKI were proposed,and a comprehensive survey on decentralized security-enhanced technologies for the RPKI were presented based on these three centers.Firstly,RPKI centralization risks were refined from the perspective of authorization,operation and publication.Secondly,the technical ideas and solutions of decentralized security-enhanced technologies were classified into these three perspectives.Thirdly,technologies were compared in terms of security,scalability,and incremental deployment.Finally,the existing problems in current technologies were summarized and the future research directions were prospected.

关 键 词：边界网关协议 资源公钥基础设施 域间路由安全 区块链 去中心化 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]