| 摘要: |
| 提出了一种基于线索平衡二叉排序哈希树认证委分字典的安全高效的源认证(origin authentication,简称OA)方案,用于防范BGP 地址前缀劫持攻击.基于Aiello 和McDaniel 等人提出的OA 服务,通过数值区间对AS 号和IP 地址前缀这两种BGP 前缀宣告资源进行了统一的形式化定义,采用一种方案同时解决了两种前缀宣告资源的源可信问题.该方案不仅解决了原OA 服务中存在的“无效分配关系的证据量是有效分配关系证据量的两倍”的问题,而且与原OA 服务相比,该方案建树所需要的总节点数降低约一半.同时,委分证据集合的平均长度更小.因此,该源认证方案效率更高. |
| 关键词: 源认证 前缀劫持 BGP(border gateway protocol) AS 号 IP 地址前缀 |
| DOI：10.3724/SP.J.1001.2012.04125 |
| 分类号: |
| 基金项目:国家自然科学基金(61003285); 国家重点基础研究发展计划(973)(2007CB310704); 教育部科学技术研究重点项目 |
|
| Origin Authentication Scheme Against BGP Address Prefix Hijacking |
|
LIU Zhi-Hui, SUN Bin, GU Li-Ze, YANG Yi-Xian
|
|
Information Security Center, Beijing University of Posts and Telecommunications, Beijing 100876, China
|
| Abstract: |
| A new origin authentication scheme based on a threaded balanced binary stored hash tree for authenticated delegation/assignment dictionaries is proposed to solve the problems of BGP (border gateway protocol) address prefix hijacking. BGP address prefix announcement is made up of AS number and IP address prefix, and this paper makes use of the number value range to uniformly define two kinds of BGP address prefix announcement resources, so the two kinds of BGP address prefix announcement resources’ origin trustworthy problems are issued by one efficient origin authentication scheme in this paper. This scheme inherits the merit of a threaded binary stored hash tree to correct the shortcomings existing in the William Aiello and Patrick McDaniel’s origin authentication scheme that the amount of the evidence for invalid delegation/assignment is double that of the valid. Meanwhile, in contrast with original OA scheme, this scheme reduces the number of tree nodes to half the amount of the delegation/assignment attestation set, which is smaller, so this scheme is more efficient. |
| Key words: origin authentication prefix hijacking BGP (border gateway protocol) AS number IP address prefix |
