互联网码号资源公钥基础设施(RPKI)研究综述

A Survey of the Resource Public Key Infrastructure

由于缺乏内建安全认证机制,边界网关协议(Border Gateway Protocol,BGP)容易遭受前缀劫持、路径伪造和路由泄露等异常路由攻击.互联网码号资源公钥基础设施(Resource Public Key Infrastructure,RPKI)正是针对BGP协议这一缺陷而提出的安全解决方案,其技术框架的标准化工作已于2012年在IETF域间路由安全工作组完成,涵盖体系结构、操作模型、密钥算法、证书策略、业务管理等一系列RPKI运行关键环节.近年来,大型互联网服务提供商、内容提供商和互联网交换中心已逐步开启RPKI在全球范围内部署应用的进程,越来越多的互联网关键基础设施纳入RPKI认证范畴,基于RPKI保障域间路由安全已经成为互联网社群的共识.作为学术界的热点话题,针对RPKI的研究不断涌现,包括安全威胁模型的构建、安全保障体系的设计、数据传递环节的效率优化和部署应用的测量分析等等.本文首先概述了RPKI的发展历史和应用现状.然后,介绍了RPKI体系及其生态系统,包括RPKI认证权威、RPKI依赖方和BGP域间路由系统三个组件,它们担任不同的角色且具有不同的作用,此外,详细统计了三者的软件实现和硬件支持情况.接着,梳理并归纳了RPKI在接入网安全、域间路由安全、域间源地址安全和资源相关服务安全四个领域的具体应用.此外,本文从安全、效率和管理三个方面分析了RPKI体系结构自身以及其部署应用过程中面临的问题和解决思路,结合近年来的应用态势,详细介绍了RPKI的部署测量和数据分析方面的研究进展,以及RPKI的部署现状和原因分析,并提出了相应的部署建议.最后,本文讨论了RPKI体系及其部署应用过程中亟需解决的问题和面临的挑战,并对未来研究方向进行了展望.

Due to the lack of a built-in security certification mechanism,the Border Gateway Protocol(BGP)is vulnerable to abnormal routing attacks such as prefix hijacking,path forging and routing leak,and so on.In other words,the BGP speaker unconditional trusts all the content in route advertisement and does not verify the authenticity of the network layer reachability information in it and the legitimacy of its propagation path.The Resource Public Key Infrastructure(RPKI)is a security enhancement mechanism which proposed for this defect of the BGP,and the standardization of its technical framework has been implemented in the Internet Engineering Task Force(IETF)Secure Inter-Domain Routing(SIDR)working group in 2012.RPKI-related Request for Comments(RFCs)cover a series of crucial links of RPKI,such as system architecture,operation model,key algorithm,certificate policy and business management,and so on.In recent years,Internet Service Providers(ISPs),Internet Content Providers(ICPs),and Internet eXchange Points(IXPs)have gradually begun the process of deploying RPKI on a global scale,and more and more RPKI data objects are published to certify the IP address space where Internet infrastructure is located,which means guaranteeing the security of inter-domain routing system based on RPKI has become the consensus of the Internet community.The deployment rate of RPKI has been increasing year by year.As a hot topic in academia,researches on RPKI are constantly emerging,including the construction of security threat models,the design of security guarantee systems,the efficiency optimization of synchronization,validation,and transmission of RPKI data objects,and the measurement and analysis of current RPKI deployment status,and so on.In this paper,firstly,the history of development and the application status of RPKI are summarized.Then,the key components and ecosystem of RPKI are introduced,including certificate authority(CA),relying party(RP),and BGP inter-domain routing system.They play different roles and have different functions.Among them,CA is responsible for certifying ownership and usage rights of Internet number resources and issuing RPKI objects including resource certificates and route origin authorizations(ROAs).And RP is responsible for locally validating the above RPKI objects and transmitting the resource authorization information to the BGP inter-domain routing system.Therefore,the BGP router uses resource authorization information as the basis for authentication and is responsible for filtering invalid routing announcements.Besides,detailed statistics are made on the software implementation and hardware support of the above three components.After that,the application of RPKI in four areas of access network security,inter-domain routing security,inter-AS source address security,and resource-related service security are sorted out and summarized.Also,current problems and solutions of RPKI itself and its deployment are analyzed in three aspects including security,efficiency,and management.Combined with the application trend in recent years,the research progress on the deployment measurement and data analysis of RPKI are introduced in detail,as well as the current RPKI deployment status and potential reasons for scarce issuance of RPKI data objects and adoption of route origin validation(ROV)mechanism based on RPKI are also given,and the corresponding suggestion for future RPKI deployment are put forward.Finally,the main problems need to be solved and the challenges faced by the RPKI and its deployment process,as well as the future research directions are prospected.