抵御违反路由策略攻击的可验证安全路由协议的研究

项目名称： 抵御违反路由策略攻击的可验证安全路由协议的研究

项目编号： No.61472438

项目类型： 面上项目

立项/批准年度： 2015

项目学科： 自动化技术、计算机技术

项目作者： 刘亚萍

作者单位： 中南大学

项目金额： 80万元

中文摘要： 互联网上，对域间路由协议的攻击会造成极其严重的网络安全事件。域间路由协议的控制平面安全问题主要有前缀起源问题、TCP连接问题、路径属性验证问题以及违反策略问题等。其中，以路由泄漏为代表的违反策略路由攻击问题，危害大且最具隐蔽性。目前所有的路由安全机制，包括安全性最强的S-BGP都无法解决该问题。本项目针对路由泄漏这类违反路由策略的隐蔽路由攻击形式，探索研究隐私保护条件下的路由策略一致性验证理论与机制，设计可防范这类攻击的安全路由协议。本项目拟首先建立隐私保护下的路由策略一致性验证问题的通用模型。然后，针对单点攻击，基于社会学中协同验证的思想，提出隐私保护下的路由策略一致性协同验证的研究思路；针对共谋攻击，提出基于信任关系的验证模型与方法。通过理论和模拟的手段对所提机制进行理论验证与性能分析，并开发相应的原型系统进行演示验证。研究成果对于安全域间路由协议的研究具有重要理论和实践意义。

中文关键词： 路由协议；路由策略；路由安全；隐私；可验证性

英文摘要： The attack to the inter-domain routing protocol can lead to serious network security event in Internet. The main security issues for the control plane of inter-domain routing protocol are origin authentication, TCP session, path authentication and policy violation. The policy violation routing attack, for example, route leak, has serious effect and is the most hidden one to be found. However, all the existing secure routing protocols cannot address this issue, even if S-BGP, the current most security one, cannot do. To defense this kind of attack, we will do the research on the theory and technique of routing policy conformation without revealing any private information. Based on that, we will design the corresponding secure inter-domain routing protocol. At first, we can build the model for the policy conformation with keeping privacy. Then, for the single point of attack, we want to use the method of collaborative verification in sociology to make routing policy conformation. For the conspiracy attack, we use the mechanism of policy verification based on the trust relationship. We will evaluate the results of those methods by theoretical analysis and simulation. At last, we will build a prototype to verify the correctness and the validity of our proposed methods with the schemes. In summary, our work can provide theory support and guideline for the security of the inter-domain routing system.

英文关键词： Routing Protocol;Routing Policy;Routing Security;Privacy;Accountability