摘要
为了解决目前路由安全方案中只对路由器身份进行认证,而未对路由器平台的完整性进行验证的问题,在基于LSU数字签名的OSPF协议基础上,借鉴可信计算的完整性度量思想,提出了一种新的可信路由协议TC-OSPF(OSPF based on tru-sted computing)。分析了LSU数字签名过程,指出了在LSU签名过程中加入路由平台完整性度量的可行性,在此基础上设计了具有完整性度量功能的LSU报文结构。安全性分析表明,TC-OSPF协议不仅可以对路由器身份进行认证,同时也能对路由平台的完整性进行验证。仿真实验结果表明,TC-OSPF在保证了OSPF协议安全性的同时也兼顾了路由性能。
In order to slove the problems on presented routing secure solutions only to resolve the identity authentication,but no resolve the integrity verification.In order to conquer limitations above-mentioned,a new trusted routing protocol is proposed that is based on trusted computing and the digital signature OSPF using LSU.The new protocol can be called TC-OSPF（OSPF based on trusted computing）.Firstly,the LSU digital signature process is analysed and the feasibility can be given for adding the router platform integrity measurement to the LSU digital signature process.Then,LSU packet is designed which can measure integrity of router platform.The security analysis shows that TC-OSPF can resolve not only the identity authentication,but also the integrity verification.The simulation results show that the TC-OSPF can achieve the goal of OSPF security compatible with routing performance.
出处
《计算机工程与设计》
CSCD
北大核心
2011年第9期2946-2949,共4页
Computer Engineering and Design
基金
国家自然科学基金项目(60951001)
国家科技支撑重点基金项目(2009BAH52B06)
北京市自然科学基金项目(4102057)
