中文摘要：

BGP路由协议是目前大多数网络基础设施所采用的重要协议之一.随着网络攻击技术的发展,如何构造安全且容易部署的BGP协议保护机制,仍然是安全路由协议研究中的热点问题.文中提出标准模型下可证明安全的BGP协议的路由属性保护机制——Identity-based Sanitizable Signature Path Verification（简称IDSPV）.IDSPV机制采用基于身份的密码学思想以及可净化签名方案的优点.并结合BGP路由协议特征,在无需证书的条件下,仅需将自己的更新报文签名后再添加到AS_PATH路径中,为BGP路由属性完整性和真实性提供保护.避免证书存储和管理开销.另外,文中给出保护AS_PATH路由属性的安全模型,利用规约技术,在标准模型下给出IDSPV机制的安全证明.通过安全性和性能方面的分析可知,与现有方案相比,IDSPV机制更易于在实际网络中部署.

英文摘要：

In current, the BGP is one of the important routing protocols that are adopted by most network infrastructures. With the development of network attack technology, how to construct a protected mechanism which is secure and easy to be deployed for BGP is still a hot topic in the research of secure routing protocols. In this paper, based on identity-based cryptography and sanitizable signature scheme, a provable secure path attributes protection mechanism - Identity- based Sanitizable Signature Path Verification （IDSPV） for the BGP in the standard model is proposed. Combines with the features of the BGP, the IDSPV only needs to update messages and add the updated messages to AS_PATH without certification. The protection in the integrity and authenticity for the BGP attribute is proved in the IDSPV. Furthermore the storage space and management overhead for the certification is avoided. In addition, the security model for the AS_PATH attribute is presented and the security proof for the IDSPV mechanism is given by using the reduction method in the standard model. The analysis and experiment results show that the proposed IDSPV mechanism is more feasible and effective than the existing schemes mentioned in the analysis of security and performance.