论文部分内容阅读
提出了一个采用基于身份密码体制的安全域间路由协议--基于身份域间路由协议(identity-based inter-domain routing,简称id2r).id2r协议包括密钥管理机制、源AS验证机制LAP(the longest assignment path)和AS_PATH真实性验证机制IDAPV(identity-based aggregate path verification).密钥管理机制采用一个分布式层次密钥分发协议(distributed and hierarchical key issuing,简称DHKI),以解决基于身份密码系统固有的密钥托管问题.LAP的基本思想是,任一发出前缀可达路由通告的自治系统都必须提供该前缀的分配路径及证明,只有提供前缀最长有效分配路径的自治系统才是该前缀的合法源AS.IDAPV采用基于身份的聚合签名体制,生成保证AS_PATH路径属性真实性的路由聚合证明.性能评估结果显示,基于2007年12月7日的RouteViews数据,id2r路由器仅额外消耗1.71Mbytes内存,是S-BGP的38%;更新报文长度明显短于S-BGP;当硬件实现密码算法时,收敛时间几乎接近于BGP.
An identity-based inter-domain routing protocol (ID2r) is proposed based on the identity-based cryptosystem. The ID2r protocol includes the key management mechanism, the source AS authentication mechanism LAP longest assignment path and identity-based aggregate path verification (IDAPV). The key management mechanism uses a distributed and hierarchical key issuing (DHKI) to solve the problem of identity-based cryptography Inherent key escrow problem.The basic idea of the LAP is that any autonomous system that issues a prefix reachable route advertisement must provide the distribution path and certificate of the prefix and only the autonomous system that provides the longest valid prefix of the prefix is the prefix Of the legal source AS.IDAPV adopts the identity-based aggregation signature scheme to generate the route aggregation certificate that ensures the authenticity of the AS_PATH path attribute.Performance evaluation shows that based on the RouteViews data of December 7, 2007, the id2r router only consumes an additional 1.71Mbytes of memory , Which is 38% of S-BGP; the length of the update message is significantly shorter than S-BGP; when the hardware implementation password When the method, the convergence time is almost close to BGP.