摘要
现有互联网的寻址体系结构对接收和转发的IP分组的源地址并不进行严格的检查,很容易伪造IP分组的源地址。本文提出了在IPv6网络下在自治系统间实现源地址验证的方法,其对IPv6网络的安全,计费,管理和应用都会有所帮助。针对进行源地址验证的两个自治系统直接互联的情况,提出了基于自治系统互联关系的验证方法,针对进行源地址验证的两个自治系统非直接互联的情况,提出了基于签名的验证方法。本文阐述了其设计,实现,以及在CNGI-CERNEF2,一个大规模纯IPv6主干网上部署的情况。
The current Internet addressing architecture does not verify the source address of a packet received and forwarded.This causes serious security problems.This paper proposed the solutions for Inter-AS source address validation in IPv6 network,which can improve the security of IPv6 network.An AS relation based method is proposed for directly connected AS,and a signature based method is proposed for ASes which are not directly connected.This paper discusses the details of design,implementation and deployment into the CNGI-CERNET2 infrastructure-a large-scale native IPv6 backbone network of the China Next Generation Internet project.
基金
国家自然科学基金(90104002)
973计划项目(2003CB314800)
