数据与计算发展前沿 ›› 2022, Vol. 4 ›› Issue (3): 90-109.

CSTR: 32002.14.jfdc.CN10-1649/TP.2022.03.007

doi: 10.11871/jfdc.issn.2096-742X.2022.03.007

• 技术与应用 • 上一篇    下一篇

基于行为透明性的RPKI撤销检测机制

邹慧1,2,3,*(),李彦彪1,2(),于晨晖1,2(),马迪1,3(),毛伟1,3()   

  1. 1.中国科学院计算机网络信息中心, 北京 100083
    2.中国科学院大学,北京 100049
    3.互联网域名系统北京市工程研究中心,北京 100190
  • 收稿日期:2021-10-20 出版日期:2022-06-20 发布日期:2022-06-20
  • 通讯作者: 邹慧
  • 作者简介:邹慧,中国科学院计算机网络信息中心,博士研究生,主要研究方向为域间路由安全与互联网基础设施。
    本文承担工作为：BT机制及其部署方案的设计,安全问题的分析,实验方案的规划。
    ZOU Hui is a Ph.D. candidate at th Computer Network Infor-mation Center of Chinese Academy of Sciences (CNIC). Her main research interests are secure inter-domain routing and the Internet infrastructure.
    In this paper, she undertakes the following tasks: the design of the BT mechanism and deployment plans, the analysis of security threats, and the planning of the experimental scheme.
    E-mail: zouhui@cnic.cn|李彦彪,中国科学院计算机网络信息中心,副研究员,主要研究方向为云网融合系统架构及关键技术,路由安全防护与治理。
    本文承担工作为：BT机制的整体架构设计。
    LI Yanbiao is an associate professor of the Computer Network Information Center of Chinese Academy of Sciences (CNIC). His main research interests are cloud network architecture and routing security and governance.
    In this paper, he undertakes the following tasks: the architecture design of the BT mechanism.
    E-mail: lybmath@cnic.cn|于晨晖,中国科学院计算机网络信息中心,硕士研究生,主要研究方向为域间路由安全和网络仿真。
    本文承担工作为：实验平台的搭建与实验代码的编写。
    YU Chenhui is a graduate student at the Computer Network Information Center of Chinese Academy of Sciences (CNIC). His main research interests are inter-domain routing security and network simulation.
    In this paper, he undertakes the following tasks: the construc-tion of experimental platforms and the implementation of exper-imental codes.
    E-mail: yuchenhui21@mails.ucas.ac.cn|马迪,互联网域名系统北京市工程研究中心,高级工程师,主要研究方向为资源的命名和寻址、互联网码号资源管理。
    本文承担工作为：BT机制的需求分析。
    MA Di is an senior engineer at the ZD-NS. His main research interests are resource naming and addressing and Internet number resource management.
    In this paper, he undertakes the following tasks: demand anal-ysis of the BT mechanism.
    E-mail: madi@zdns.cn|毛伟,互联网域名系统北京市工程研究中心,研究员,主要研究方向为下一代互联网和资源的命名和寻址。
    本文承担工作为：研究指导。
    MAO Wei is a professor at the ZDNS His main research interests are the nextgen-eration Internet and resource naming and addressing.
    In this paper, he undertakes the following task: research gui-dance.
    E-mail: mao@zdns.cn

A Revocation Detection Mechanism in RPKI Based on Behavior Transparency

ZOU Hui1,2,3,*(),LI Yanbiao1,2(),YU Chenhui1,2(),MA Di1,3(),MAO Wei1,3()   

  1. 1. Computer Network Information Center, Chinese Academy of Sciences, Beijing 100083, China
    2. University of Chinese Academy of Sciences, Beijing 100049, China
    3. ZDNS, Beijing 100190, China
  • Received:2021-10-20 Online:2022-06-20 Published:2022-06-20
  • Contact: ZOU Hui

RichHTML

10

PDF

52

摘要：

【目的】为应对当前互联网码号资源公钥基础设施（Resource Public Key Infrastructure, RPKI）层级式认证机制下因单边撤销导致的资源失效问题,本文提出了一种基于行为透明性（Behavior Transparency, BT）的单边撤销检测机制,并通过实验验证了该机制的效果和性能。【方法】本文详细分析了当前RPKI架构下的单边撤销问题和由此导致的下级认证权威（Certificate Authority, CA）资源失效风险,通过部署日志服务器记录CA签发行为来提高CA签发行为的透明性,并以此为基础设计了高效的单边撤销实时监测和应急处置机制。【结果】实验结果表明,在部署有日志服务器且日志服务器足够安全可控的前提下,该机制的检测效率能满足当前架构性能需求,且准确率达到100%,传输开销可忽略不计。【局限】该机制在面向未来的RPKI大规模部署环境下的效率、准确率和可扩展性还有待进一步验证。【结论】本文所提基于行为透明性的RPKI撤销检测在当前RPKI实际部署环境下新引入的开销较小,能有效实现检测目的,支持CA实时监测其自持有资源有效性以及针对其的单边撤销行为。

关键词: IP地址, AS号, 域间路由安全, 互联网码号资源公钥基础设施, 透明性

Abstract:

[Objective] In response to the issue of resource failure caused by the unilateral revocation in the current Resource Public Key Infrastructure (RPKI), this paper proposes a novel scheme based on Behavior Transparency (BT) to detect unilateral revocations, and demonstrates its effect and performance via extensive experiments. [Methods] This paper first analyzes in detail the issue of unilateral revocation, as well as the risk of resource failures resulting from it, and then proposes to monitor and handle unilateral revocations with the help of a log server that records issuance behaviors of CAs. [Results] According to the experimental results, the efficiency of the proposed scheme satisfies the performance demand posed by the current RPKI system, and its accuracy in detecting unilateral revocations can reach 100% as long as a credible and fully controllable log server is deployed. Moreover, additional transmission overhead resulting from communicating with the log server is negligible. [Limitations] The accuracy, performance, and scalability of the proposed scheme need to be further evaluated in large-scale RPKI systems to verify its value in case that RPKI is fully or near-fully deployed in the future. [Conclusions] In the current RPKI systems, the proposed scheme can effectively detect unilateral revocations with negligible overhead, enabling CAs to monitor the effectiveness of their resources and the revocations to the issuances.

Key words: IP address, AS number, secure inter-domain routing, resource public key infrastructure, transparency