Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
research-article
Free access

Rethinking security for internet routing

Published: 22 September 2016 Publication History
  • Get Citation Alerts
  • Abstract

    Combine simple whitelisting technology, notably prefix filtering, in most BGP-speaking routers with weaker cryptographic protocols.

    Supplementary Material

    PDF File (p48-lychev-supp.pdf)
    Supplemental material.

    References

    [1]
    Anwar, R., Niaz, H., Choffnes, D., Cunha, I., Gill, P., and Bassett, E.-K. Investigating interdomain routing policies in the wild. In Proceedings of the Internet Measurement Conference (Tokyo, Japan, Oct. 28--30). ACM Press, New York, 2015.
    [2]
    Arnbak, A. and Goldberg, S. Loopholes for circumventing the Constitution: Unrestrained bulk surveillance on Americans by collecting network traffic abroad. Michigan Telecommunications and Technology Law Review 317 (2015); http://repository.law.umich.edu/mttlr/vol21/iss2/3
    [3]
    Boldyreva, A. and Lychev, R. Provable security of S-BGP and other path vector protocols: Model, analysis and extensions. In Proceedings of the 19th ACM Conference on Computer and Communications Security (Raleigh, NC, Oct. 16--18). ACM Press, New York, 2012, 541--552.
    [4]
    Brown, M.A. Pakistan hijacks YouTube. Dyn Research blog, Feb. 2008; http://research.dyn.com/2008/02/pakistan-hijacks-youtube-1/
    [5]
    Butler, K., Farley, T., McDaniel, P., and Rexford, J. A survey of BGP security issues and solutions. Proceedings of the IEEE 98, 1 (2010), 100--122.
    [6]
    Chi, Y.-J., Oliveira, R., and Zhang, L. Cyclops: The Internet AS-level observatory. ACM SIGCOMM Computer Communication Review 38, 5 (2008), 5--16.
    [7]
    Cooper, D., Heilman, E., Brogle, K., Reyzin, L., and Goldberg, S. On the risk of misbehaving RPKI authorities. In Proceedings of HotNets XII, the 12th ACM Workshop on Hot Topics in Networks (College Park, MD, Nov. 212-22). ACM Press, New York, 2013.
    [8]
    Cowie, J. China's 18-minute mystery. Dyn Research blog, Nov. 2010; http://research.dyn.com/2010/11/chinas-18-minute-mystery/
    [9]
    Durand, J., Pepelnjak, I., and Doering, G. RFC 7454: BGP Operations and Security. Internet Engineering Task Force, 2015; http://tools.ietf.org/html/rfc7454
    [10]
    Gallo, A. RPKI: BGP Security Hammpered by a Legal Agreement. Packetpushers blog, Dec. 2014; http://packetpushers.net/rpki-bgp-security-hammpered-legal-agreement/
    [11]
    Gao, L. and Rexford, J. Stable Internet routing without global coordination. IEEE/ACM Transactions on Networking 9, 6 (2001): 681--692.
    [12]
    Gill, P., Schapira, M., and Goldberg, S. A survey of interdomain routing policies. ACM SIGCOMM Computer Communication Review 44, 1 (2013), 28--34.
    [13]
    Giotsas, V., Luckie, M., Huffaker, B., and claffy, kc. IPv6 AS relationships, cliques, and congruence. In Proceedings of the International Conference on Passive and Active Network Measurement (New York, Mar. 19--20). Springer International Publishing, 2015, 111--122.
    [14]
    Goldberg, S., Schapira, M., Hummon, P., and Rexford, J. How secure are secure interdomain routing protocols? In Proceedings of ACM SIGCOMM'10 Conference (New Delhi, India, Aug. 30--Sept. 3). ACM Press, New York, 2010, 87--98.
    [15]
    Goodin, D. Hacking team orchestrated brazen BGP hack to hijack IPs it didn't own. Ars Technica (July 12, 2015); http://arstechnica.com/security/2015/07/hacking-team-orchestrated-brazen-bgp-hack-to-hijack-ips-it-didnt-own/
    [16]
    Griffin, T. and Huston, G. RFC 4264: BGP Wedgies. Internet Engineering Task Force, 2005; http://tools.ietf.org/html/rfc4264
    [17]
    Huston, G. Peering and settlements - Part I,II. The Internet Protocol Journal 2, 1 (Mar. 1999).
    [18]
    Kent, S., Lynn, C., and Seo, K. Secure Border Gateway Protocol (S-BGP). IEEE Journal on Selected Areas in Communications 18, 4 (Apr. 2000), 582--592.
    [19]
    Lepinski, M. draft-ietf-sidr-bgpsec-protocol-14: BGPSEC Protocol Specification. Internet Engineering Task Force, 2015; https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol-14
    [20]
    Lepinski, M. and Kent, S. RFC 6480: An Infrastructure to Support Secure Internet Routing. Internet Engineering Task Force, 2012; http://tools.ietf.org/html/rfc6480
    [21]
    Litke, P. and Stewart, J. BGP Hijacking for Cryptocurrency Profit. Dell SecureWorks Counter Threat Unit, Aug. 7, 2014; http://www.secureworks.com/cyber-threat-intelligence/threats/bgp-hijacking-for-cryptocurrency-profit/
    [22]
    Lychev, R. Evaluating Security-Enhanced Interdomain Routing Protocols in Full and Partial Deployment. Ph.D. thesis, Georgia Tech, Atlanta, GA, 2014; https://smartech.gatech.edu/handle/1853/52325
    [23]
    Lychev, R., Goldberg, S., and Schapira, M. BGP security in partial deployment: Is the juice worth the squeeze? In Proceedings of the SIGCOMM'13 Conference (Hong Kong, China, Aug. 12--16). ACM Press, New York, 2013, 171--182.
    [24]
    Madory, D. Global Collateral Damage of TMnet Leak. Dyn Research blog, June 12, 2015; http://research.dyn.com/2015/06/global-collateral-damage-of-tmnet-leak/
    [25]
    Mao, Z., Rexford, J., Wang, J., and Katz, R.H. Towards an accurate AS-level traceroute tool. In Proceedings of the SIGCOMM'03 Conference (Karlsruhe, Germany, Aug. 25--29). ACM Press, New York, 2003, 365--378.
    [26]
    McDaniel, P., Aiello, W., Butler, K., and Ioannidis, J. Origin authentication in interdomain routing. Computer Networks 50, 16 (2006), 2953--2980.
    [27]
    McPherson, D., Amante, S., Osterweil, E., and Mitchell, D., Eds. Route-Leaks & MITM Attacks Against BGPSEC. Internet Draft, ETF Network Working Group, Nov. 18, 2013; http://tools.ietf.org/html/draft-ietf-grow-simple-leak-attack-bgpsec-no-help-03
    [28]
    Misel, S. Wow, AS7007! Merit NANOG Archive, Apr. 1997; https://www.nanog.org/mailinglist/mailarchives/old_archive/1997-04/msg00340.html
    [29]
    National Institute of Standards and Technology. RPKI Deployment Monitor, Gaithersburg, MD; http://www-x.antd.nist.gov/rpki-monitor/
    [30]
    Paseka. T. Why Google Went Offline Today and a Bit about How the Internet Works, Cloudare blog, Nov. 6, 2012; https://blog.cloudflare.com/why-google-went-offline-today-and-a-bit-about/
    [31]
    Peterson, A. Researchers say U.S. Internet traffic was re-routed through Belarus. That's a problem. The Washington Post (Nov. 20, 2013); https://www.washingtonpost.com/news/the-switch/wp/2013/11/20/researchers-say-u-s-internet-traffic-was-re-routed-through-belarus-thats-a-problem/
    [32]
    Pilosov, A. and Kapela, T. Stealing the Internet: An Internet-scale man-in-the-middle attack. In DEFCON (Las Vegas, NV, Aug. 8--10, 2008).
    [33]
    Ramachandran, A. and Feamster, N. Understanding the network-level behavior of spammers. ACM SIGCOMM Computer Communication Review 36, 4 (Sept. 2006), 291--302.
    [34]
    Shaw, A. Spam? Not Spam? Tracking a hijacked Spamhaus IP. Greenhost, Mar. 21, 2013; https://greenhost.nl/2013/03/21/spam-not-spam-tracking-hijacked-spamhaus-ip/
    [35]
    Steenbergen, R., Volk, R., Kumari, W., Blunk, L., and McPherson, D. ISP route filtering: Responsibilities & technical challenges. In NANOG'43 North American Network Operators' Group Conference (Brooklyn, NY, June 1-4, 2008).
    [36]
    Sun, Y., Edmundson, A., Vanbever, L., Li, O., Rexford, J., Chiang, M., and Mittal, P. RAPTOR: Routing Attacks on Privacy in Tor. In Proceedings of the 24th USENIX Security Symposium (Washington, D.C., Aug. 12--14). USENIX Society, Berkeley, CA, 2015, 11--20.
    [37]
    Toonk, A. Massive route leak causes Internet slowdown. BGPmon blog, June 12, 2015; http://www.bgpmon.net/massive-route-leak-cause-internet-slowdown/
    [38]
    Underwood, T. Con-Ed Steals the 'Net. Dyn Research blog, Jan. 2006; http://research.dyn.com/2006/01/coned-steals-the-net/
    [39]
    Vervier, P.-A., Thonnard, O., and Dacier, M. Mind your blocks: On the stealthiness of malicious BGP hijacks. In Proceedings of the NDSS'15 Network and Distributed System Security Symposium (San Diego, CA, Feb. 8--11). Internet Society, Reston, VA, 2015.
    [40]
    White, R. Deployment Considerations for Secure Origin BGP (soBGP). IETF Internet Draft, Network Working Group, June 25, 2003; https://datatracker.ietf.org/doc/draft-white-sobgp-bgp-deployment/

    Cited By

    View all
    • (2023)APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsecIEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences10.1587/transfun.2022CIP0024E106.A:3(170-184)Online publication date: 1-Mar-2023
    • (2023)The Juice Is Worth the Squeeze: Analysis of Autonomous System Provider Authorization in Partial DeploymentIEEE Open Journal of the Communications Society10.1109/OJCOMS.2022.32338334(269-306)Online publication date: 2023
    • (2021)APVAS+: A Practical Extension of BGPsec with Low Memory RequirementICC 2021 - IEEE International Conference on Communications10.1109/ICC42927.2021.9500278(1-7)Online publication date: Jun-2021
    • Show More Cited By

    Index Terms

    1. Rethinking security for internet routing

        Recommendations

        Comments

        Information & Contributors

        Information

        Published In

        cover image Communications of the ACM
        Communications of the ACM  Volume 59, Issue 10
        October 2016
        85 pages
        ISSN:0001-0782
        EISSN:1557-7317
        DOI:10.1145/3001840
        • Editor:
        • Moshe Y. Vardi
        Issue’s Table of Contents
        Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

        Publisher

        Association for Computing Machinery

        New York, NY, United States

        Publication History

        Published: 22 September 2016
        Published in CACM Volume 59, Issue 10

        Permissions

        Request permissions for this article.

        Check for updates

        Qualifiers

        • Research-article
        • Popular
        • Refereed

        Contributors

        Other Metrics

        Bibliometrics & Citations

        Bibliometrics

        Article Metrics

        • Downloads (Last 12 months)208
        • Downloads (Last 6 weeks)17
        Reflects downloads up to 09 Aug 2024

        Other Metrics

        Citations

        Cited By

        View all
        • (2023)APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsecIEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences10.1587/transfun.2022CIP0024E106.A:3(170-184)Online publication date: 1-Mar-2023
        • (2023)The Juice Is Worth the Squeeze: Analysis of Autonomous System Provider Authorization in Partial DeploymentIEEE Open Journal of the Communications Society10.1109/OJCOMS.2022.32338334(269-306)Online publication date: 2023
        • (2021)APVAS+: A Practical Extension of BGPsec with Low Memory RequirementICC 2021 - IEEE International Conference on Communications10.1109/ICC42927.2021.9500278(1-7)Online publication date: Jun-2021
        • (2020)Unveiling the Mystery of Internet Packet ForwardingACM Computing Surveys10.1145/340979653:5(1-34)Online publication date: 28-Sep-2020
        • (undefined)Reviewing a Historical Internet Vulnerability: Why Isn't BGP More Secure and What Can We Do About it?SSRN Electronic Journal10.2139/ssrn.3141666

        View Options

        View options

        PDF

        View or Download as a PDF file.

        PDF

        eReader

        View online with eReader.

        eReader

        Digital Edition

        View this article in digital edition.

        Digital Edition

        Magazine Site

        View this article on the magazine site (external)

        Magazine Site

        Get Access

        Login options

        Full Access

        Media

        Figures

        Other

        Tables

        Share

        Share

        Share this Publication link

        Share on social media