Can you help me understand pairing $e:G \times G \to G_T$ and ( Decision) BDH assumption? From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ 

I have some trouble to understand this map $e:G \times G \to G_T$. Am I right to understand this to be the "multiplication" of two elements in $Z_p^*$ where $p$  is prime. For example, can  $e(U=g^u,V=g^v)$ be "seen" as the form $UV$ in $Z_p^*$ ? 

Another problem is about the BDH assumption, which says that given $g^a,g^b,g^c$ compute $e(g,g)^{abc}$. There are also the Decision-BDH which says that given $g^a,g^b,g^c$ and $e(g,g)^z$, determine whether $$e(g,g)^z \stackrel{?}{=} e(g,g)^{abc}.$$ 

As to this two assumptions, where the obstacle lies? 

At last, as  $e(g^a,g^b)$ can be efficiently solved, what's the algorithm it involved? And could someone do me a favor to give me the source code of the algorithm? If that I will deeply appreciate it.
An attack against the signature scheme over some group where DDH is easy, can be turned into a solver for the CDH problem over the same group, as is shown in Section 2.3 in the Asiacrypt paper you refer to.

So what you are really asking is: In what groups where DDH is easy is CDH still hard?

I would not use elliptic curves over extension fields of low characteristic. Using ordinary elliptic curves over prime fields with a relatively small embedding degree seems ok.