STI: Towards more Secure Inter-Domain Routing

点击翻译按钮获取中文摘要

Improving the reliability of inter-domain routing is arguably one of the most daunting challenges faced in securing the Internet today. Inter-domain routing protocols provide the means by which organizations under cohesive administrative control (e.g., universities, companies, ISPs) exchange and propagate reachability information among themselves. In essence, such protocols de.ne policies by which data traverses the Internet to arrive at its intended destination(s). As such, disruptions in inter-domain routing protocols, whether benign or intentional, may result in large segments ofthe Internet becoming inaccessible.This proposal encompasses the design, analysis and deployment of a protocol to better analyze and validate routing protocols, with particular attention to the Border Gateway Protocol (BGP),which is the de facto inter-domain routing protocol used in the Internet. Rather than attempting to change widely deployed protocols like BGP, this project is an attempt to validate the observed information in messages that result from protocol interactions. In this proposal, we discuss ways in which such a validation protocol, running adjacent to BGP for example, can improve the security and reliability of the Internet, while at the same time, allow for incremental deployment. This latter goal is significant, as it is not realistic to assume that every edge router on the Internet can(or will) adopt a new protocol at the same time.In that regard, the project is specifically designed to offer immediate benefit to anyone deploying a server to support protocol validation, so that the incentive is for sites to participate, regardless of how many others are executing the protocol. However, as adoption increases, so will its benefit to the greater Internet community at large.