可信任是下一代互联网的重要特征,真实地址访问是可信任的基础和前提.自治域级真实地址访问是整个可信任互联网体系结构中最为复杂的一个层次.基于标签的源地址验证不受拓扑结构影响,无需中间节点特殊处理,是实现域间真实地址访问的有效方法.然而,现有方法中信任联盟过于扁平化和单一化的问题导致验证开销随联盟规模增大而急剧增大,影响和制约了机制的可扩展性和过滤能力,难以进行增量部署.对此,文中提出了一种层次化的基于标签替换的域间真实源地址验证方法(Hidasav),该方法通过合理规划联盟层次和聚类整合,构建出一种多级并存的信任联盟体系结构,通过引入实现轻量级标签替换的联盟边界,将每一层级联盟和外界网络隔离,使得下层联盟和更高层联盟内部的网络环境彼此互不可见、互无影响.与现有同类典型方法在CNGI真实环境中的实验结果比较表明,该方法能够在确保域间高速通信的同时有效降低边界路由设备的状态机存储、更新和报文验证开销.%Next generation Internet is highly concerned with the issue of trustworthy. An important foundation of trustworthy is authentication of the source IP address. With existing signature- and-verification based defense mechanisms, there is a lack of hierarchical architecture, which makes the structure of the trust alliance excessively flat and single. Moreover, with the increasing scale of trust alliances, costs of validation grow so quickly that they do not adapt to incremental deployment. Via comparing with traditional solutions, this paper proposes a hierarchical, inter-domain authenticated source address validation solution named Hidasav. Hidasav employs two intelligent designs: lightweight tag replacement and a hierarchical partitioning scheme, each of which helps to ensure that Hidasav can construct trustworthy and hierarchical trust alliances without the negative influences and complex operations on de facto networks. Experiments in CNGI also indicate that Hidasav can effectively obtain the design goals of a hierarchical architecture, along with lightweight, loose coupling and "multi-fence support" as well as supporting incremental deployment.
展开▼
