DISCO: Sidestepping RPKI's Deployment Barriers
DISCO: Sidestepping RPKI's Deployment Barriers
复制标题
DOI：
10.14722/ndss.2020.24355
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Tom Hlavacek;Ítalo F. S. Cunha;Y. Gilad;A. Herzberg;Ethan Katz-Bassett;Michael Schapira;Haya Schulmann
中科院分区：
文献类型：
--
作者：
Tom Hlavacek;Ítalo F. S. Cunha;Y. Gilad;A. Herzberg;Ethan Katz-Bassett;Michael Schapira;Haya Schulmann
BGP是当今互联网上的一个巨大的安全漏洞，无数的互联网中断和停电，反复的流量劫持和监视事件证明了这一点。为了防止前缀劫持，资源公钥基础设施（RPKI）已经标准化。然而，尽管付出了巨大的努力，由于RPKI的手动和容易出错的认证过程，RPKI的无处不在的部署仍然很遥远。我们认为，大规模部署起源身份验证需要取代的标准要求，证明法律的所有权的IP地址块的目标是证明事实上的所有权。我们表明，解决事实上的所有权是足以防止危险的前缀劫持，可以完成，而不需要任何改变今天的路由基础设施。我们提出DISCO，一个易于部署的系统，自动证明事实上的所有权，并在路由器上生成适当的BGP路径过滤规则。我们评估DISCO的安全性和可部署性，通过现场实验在互联网上使用DISCO的原型实现，并通过模拟的虚拟衍生数据集。为了促进我们的结果的再现性，我们开源了我们的原型，模拟器和测量分析代码[30]。
BGP is a gaping security hole in today’s Internet, as evidenced by numerous Internet outages and blackouts, repeated traffic hijacking, and surveillance incidents. To protect against prefix hijacking, the Resource Public Key Infrastructure (RPKI) has been standardized. Yet, despite Herculean efforts, ubiquitous deployment of the RPKI remains distant, due to RPKI’s manual and error-prone certification process. We argue that deploying origin authentication at scale requires substituting the standard requirement of certifying legal ownership of IP address blocks with the goal of certifying de facto ownership. We show that settling for de facto ownership is sufficient for protecting against hazardous prefix hijacking and can be accomplished without requiring any changes to today’s routing infrastructure. We present DISCO, a readily deployable system that automatically certifies de facto ownership and generates the appropriate BGPpath-filtering rules at routers. We evaluate DISCO’s security and deployability via live experiments on the Internet using a prototype implementation of DISCO and through simulations on empirically-derived datasets. To facilitate the reproducibility of our results, we open source our prototype, simulator, and measurement analysis code [30].