一种轻量化的边界网关协议路径验证机制

A Lightweight Mechanism for Border Gateway Protocol Path Verification

由于边界网关协议(Border Gateway Protocol,BGP)存在安全问题,路径信息(AS_PATH属性)易遭受各种攻击。已有的路径验证方案中,过程复杂和开销巨大严重阻碍了方案的实际部署。基于对AS_PATH属性的分析,该文提出一种轻量化的BGP路径验证机制—FTAPV(First-Two-AS based Path Verification)。FTAPV中,更新报文只需要携带AS_PATH中前两个AS的签名信息就可以有效地为路径信息提供保护。安全分析和性能评估表明,与已有方案相比,该机制在保证安全能力的同时,有效地减少了路由资源的消耗和所需证书的规模,具有良好的可扩展性。

Since BGP （Border Gateway Protocol） possesses many security vulnerabilities, BGP Autonomous System PATH information （ASPATH attribute） is vulnerable to various attacks. In proposed BGP path verification mechanisms at present, the high computational overhead and complex process severely block security solutions from being implemented and deployed in reM world. A lightweight method is designed for BGP path verification named First-Two-AS based Path Verification （FTAPV）. Based on analysis of ASPATH attribute, FTAPV can protect path information effectively through carrying signatures of first two ASes in the ASPATH of UPDATEs. Security analysis and performance evaluation demonstrate this mechanism can reduce the route resource expense and the number of used certificates with strong ability of security and good scalability compared with existing method.