RFC中的安全考量概览
A Bird's-Eye View on Security Considerations in RFCs
浏览论文内容
中文总结 AI 辅助
本研究考察RFC的安全考量章节，发现超90%的抽样RFC明确讨论安全问题，引用量在1990年代中期至2010年代中期达峰，主题多为协议特有，相关结果填补了标准化文献空白。
中文摘要 AI 辅助
请求评论（RFC）是由互联网工程任务组（IETF）制定并发布的关于核心互联网协议的互联网标准、备忘录及相关技术文档。20世纪90年代初，每一份RFC都被要求包含安全考量章节。本研究对这些章节展开考察。根据实证结果：（1）抽样的RFC中超过90%已在这些章节中明确讨论了安全问题；（2）尽管强制性安全要求极少（甚至从未）被施加。此外，（3）安全考量章节特有的RFC到RFC引用网络较为稀疏，不过少数RFC及其安全考量章节被大量引用。另外，（4）引用量在1990年代中期至2010年代中期达到峰值。关于章节中讨论的主题：（5）这些主题并不代表诸如欺骗或窃听之类的通用安全问题，而是大多反映特定协议所独有的安全问题。除了通用网络安全、安全规范和路由之外，（6）这些主题的纵向演变也具有协议特异性。由于该主题此前未被研究过，这些实证结果填补了标准化文献中的一项空白。
英文摘要
Request for comments (RFCs) are Internet standards, memorandums, and related technical documents about core Internet protocols made via and released by the Internet Engineering Task Force (IETF). In the early 1990s each RFC was required to have a section for security considerations. The present work examines these sections. According to the empirical results, (1) over 90% of the RFCs sampled have discussed security explicitly in these sections, (2) although mandatory security requirements have only seldom-if ever-been imposed. Furthermore, (3) the RFC-to-RFC reference network specific to the security consideration sections is sparse, although a few RFCs and their security consideration sections are heavily referenced. In addition, (4) the volume of references peaked during a period from circa mid-1990s to mid-2010s. Regarding the topics discussed in the sections, (5) these do not represent general security issues, such as spoofing or eavesdropping; rather, the topics mostly reflect distinct security issues specific to distinct protocols. With the exceptions of network security in general, security specifications, and routing, (6) also the longitudinal evolution of the topics is protocol-specific. As the subject matter has not been previously examined, these empirical results fill a gap in the standardization literature.
