边界网关协议安全研究综述

发布时间：2019-01-03 16:55

【摘要】：边界网关协议(the Border Gateway Protocol,BGP)是互联网事实上的域间路由标准协议.因BGP的安全脆弱性,互联网路由基础设施易受到攻击,破坏了互联网的网络可达性.从而,安全BGP对于整个互联网的可靠稳定运行具有重要意义.该文对近年来的BGP安全研究现状进行了梳理.首先,清晰界定了BGP威胁模型,从路由信息非真和路由传播非法的角度,将BGP面临的异常路由通告攻击分为前缀劫持、路径伪造和路由泄露这3类,阐述了攻击原理,给出了攻击实例;然后,梳理了BGP安全研究脉络,主要分为BGP安全防护和BGP异常检测两个研究方向,BGP安全防护的研究内容主要包括针对前缀劫持与路径伪造的安全扩展和安全外包技术、路由泄露防护技术,BGP异常检测的研究内容主要包括前缀劫持、路径伪造与路由泄露检测技术、主动响应技术、异常检测系统和BGP可视化工具.该文对上述研究点的主要思想、关键和难点问题、具体机制或方案的原理以及存在的不足等内容进行了深入、翔实的阐述和全面地分析、比较.最后,探讨了BGP安全研究面临的挑战,指出在安全防护、异常检测、域间路由信任和域间路由系统测量等4个方面需要深入研究的内容.该文研究可为相关研究人员和网络安全专家提供参考和借鉴,有助于BGP安全问题的理解和研究的深入.
[Abstract]:The Border Gateway Protocol (the Border Gateway Protocol,BGP) is the Internet's de facto inter-domain routing standard protocol. Because of the security vulnerability of BGP, the Internet routing infrastructure is vulnerable to attack, which destroys the network accessibility of the Internet. Therefore, secure BGP is of great significance to the reliable and stable operation of the whole Internet. This paper reviews the current situation of BGP security research in recent years. First of all, the BGP threat model is clearly defined. From the point of view of non-true routing information and illegal routing propagation, the abnormal routing notification attacks faced by BGP are classified into three categories: prefix hijacking, path forgery and route disclosure. An attack example is given. Then, this paper combs the context of BGP security research, mainly divided into two research directions: BGP security protection and BGP anomaly detection. The research content of BGP security protection mainly includes security expansion and security outsourcing technology for prefix hijacking and path forgery. The research contents of BGP anomaly detection include prefix hijacking, path forgery and route leak detection, active response, anomaly detection system and BGP visualization tools. In this paper, the main ideas, key and difficult problems, the principle of concrete mechanism or scheme, and the shortcomings of the above research points are discussed, analyzed and compared in detail and in an all-round way. Finally, this paper discusses the challenges of BGP security research, and points out that the security protection, anomaly detection, inter-domain routing trust and inter-domain routing system measurement need to be further studied. This paper can provide reference for related researchers and network security experts, and contribute to the understanding and research of BGP security issues.
【作者单位】：解放军信息工程大学;数学工程与先进计算国家重点实验室;
【基金】：国家“八六三”高技术研究发展计划项目基金(2015AA011705) 河南省自然科学基金项目(No.162300410334)资助~~
【分类号】：TP393.08

【相似文献】