| 本文已被：浏览 1102次 下载 1116次 |
码上扫一扫！ |
|
|
| RPKI测量研究综述 |
|
张泽源1, 刘翔2, 张宇1,2, 张伟哲1,2, 方滨兴2,3
|
|
1.哈尔滨工业大学 网络空间安全学院, 黑龙江 哈尔滨 150001;2.鹏城实验室, 广东 深圳 518055;3.哈尔滨工业大学(深圳), 广东 深圳 518055
|
|
| 摘要: |
| RPKI作为一项BGP安全增强的关键技术, 通过密码学验证路由中的起源真实性, 以防范BGP前缀劫持等攻击. RPKI自2012年正式部署至今, 其部署规模日益增长, 目前互联网中一半以上的IP地址前缀已被RPKI覆盖. 为了解RPKI部署情况, RPKI测量研究有助于更清晰地了解RPKI部署现状, 发现部署中存在的安全问题. 从RPKI数据对象测量、ROV测量和RPKI基础设施测量这3个方向总结现有的RPKI测量工作. 对RPKI对象覆盖规模和ROV覆盖规模的测量结果进行总结, 展示了近年来RPKI部署的发展趋势, 并深入分析了不同ROV测量方案的优缺点. 还总结了RPKI的安全缺陷与RPKI的数据质量等问题, 最后给出了推动RPKI规模化安全部署的建议. |
| 关键词: 边界网关协议安全 资源公钥基础设施 资源公钥基础设施测量 |
| DOI：10.13328/j.cnki.jos.007459 |
| 分类号:TP309 |
| 基金项目:国家重点研发计划 (2022YFB3104800); 鹏城实验室重大攻关基金(PCL2023A05) |
|
| Survey on RPKI Measurement Research |
|
ZHANG Ze-Yuan1, LIU Xiang2, ZHANG Yu1,2, ZHANG Wei-Zhe1,2, FANG Bin-Xing2,3
|
|
1.School of Cyberspace Science, Harbin Institute of Technology, Harbin 150001, China;2.Pengcheng Laboratory, Shenzhen 518055, China;3.Harbin Institute of Technology (Shenzhen), Shenzhen 518055, China
|
| Abstract: |
| Resource public key infrastructure (RPKI) is a key technology for enhancing border gateway protocol (BGP) security, using cryptographic verification to prevent attacks such as prefix hijacking. Since its formal deployment in 2012, RPKI has grown to cover over half of Internet prefixes. Ongoing research on RPKI deployment helps to provide insights into current trends and identify security issues. This study reviews existing works on RPKI measurement from three perspectives: RPKI data object measurement, ROV measurement, and RPKI infrastructure measurement. It analyzes RPKI data object and ROV coverage metrics, deployment trends, and the effectiveness of different measurement approaches. Moreover, key security vulnerabilities and data quality issues are identified, and recommendations to promote large-scale RPKI deployment are proposed. |
| Key words: BGP security resource pubic key infrastructure (RPKI) RPKI measurement |
