Optimization Method of RPKI Certificate Verification Based on Hash Table
CSTR:
Author:
Affiliation:

Clc Number:

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    In RPKI (Resource Public Key Infrastructure), RP (Relying Party) downloads and verifies certificates and signed objects (ROA, Manifest, Ghostbusters) from repository, and then processes those valid ROA objects into authorized relations between IP addresses and AS number that is used to guide the BGP routing. In the current implementation, the certificate verification module recursively finds the parent certificate of the certificate to be verified through the database query to construct the complete certificate chain and complete the final verification by OpenSSL. Because of the large number of certificates in the RPKI system, the method based on database query is inefficient. Combining the characteristic of RPKI running mechanism that transfers the calculation cost from the BGP router (user) to the RP server (server) and the idea of “space-time tradeoff”, we can read information of certificates into memory to reduce the time consumption of I/O. Based on the ideas above, combined with the characteristics of the time complexity that finding item in hash table is optimal O(1), we design and implement an optimization method of RPKI certificate validation based on hash table. The experimental results show that the average time acceleration ratio is 99.03%, 98.45%, and 97.48% in the three designed scenarios, which has effectively reduced the time consumption.

    Reference
    Related
    Cited by
Get Citation

安春林,马迪,王伟,毛伟.基于哈希表的RPKI证书验证优化方法.计算机系统应用,2018,27(2):132-137

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:May 16,2017
  • Revised:June 05,2017
  • Adopted:
  • Online: February 05,2018
  • Published:
Article QR Code
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-3
Address:4# South Fourth Street, Zhongguancun,Haidian, Beijing,Postal Code:100190
Phone:010-62661041 Fax: Email:csa (a) iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063