Research on Intrinsic Security in Future Internet Architecture

未来互联网体系结构试图通过其内生安全特性解决目前互联网中的安全问题。新型的未来互联网体系结构命名空间普遍使用了具备自认证能力的网络标识支持网络的内生安全，但目前的方案不能将用户标识符、网络标识符、公钥三者在脱离 PKI的情况下实现同时绑定。本文提出了基于组合公钥密码体制的自认证标识(SCI-CPK)命名方案，可用于未来互联网体系结构命名空间中标识安全绑定，并给出了在未来互联网体系结构 XIA、MobilityFirst 和 NDN 中支持实体鉴别的应用方法。分析表明， SCI-CPK方案能够支持未来互联网中泛在互联和泛在移动场景下的大规模实体身份和地址鉴别。The characteristics of intrinsic security in the future Internet architecture have been used to conquer the secu-rity problems of current Internet. Self-certifying addresses are introduced in future Internet architecture (FIA) to enable the intrinsic security properties. However, without PKI, these approaches in FIA miss the intrinsic binding between user-level descriptor, network-level identifier and correspondent public key. To this end, a naming scheme of Self-Certifying Identi-fier in FIA based on Combined Public Key (CPK), named as SCI-CPK, is proposed in this paper. The use cases of identity authentication based on SCI-CPK in FIA designs are also given, including XIA, MobilityFirst and NDN. The analysis shows that the proposed method is benefit of ubiquitous access and vast mobility scenario in the future Internet.国家自然科学基金项目(Nos.61170263、61421091)资助。236-45