改进的BGP安全机制

An Improved BGP Security Mechanism

由于边界网关协议(BGP)缺少必要的安全机制,面临严重的安全威胁,虽有多种安全方案被提出,但繁复的密钥管理和过量的存储开销严重阻碍了方案的实际部署.为此,将代理重签名机制引入BGP安全机制(SE-BGP)方案中,修改了自治系统联盟结构,改进了分布式信任模型,解决了关键节点在联盟之间交叉认证的问题,提出了一种改进的BGP安全机制.安全和性能分析结果表明,在保证安全能力的同时,该机制进一步减少了路由资源的消耗,所需的证书规模约为SE-BGP的31%,具有更好的可扩展性.

For lack of necessary security mechanism, the border gateway protocol （BGP） faces serious security threats. In proposed BGP security mechanisms, the management of complicated certificatation and excessive storage overhead severely block security solutions from being implemented and deployed in real world. Based on modification of autonomous system alliance＇ s structure, the proxy re-signature is introduced into security enhanced BGP （SE-BGP） to improve translator trust model. An improved BGP security mechanism named improved SE-BGP is also designed for solving the problem of cross-certification of key nodes between autonomous system alliances. Security analysis and performance evaluation demonstrate that this mechanism continues to reduce the route resource expenses to have better scalability and good security capability. The number of used certificates is about 31% of the SE-BGP.