STI: Towards more Secure Inter-Domain Routing

STI：迈向更安全的域间路由

• 批准号: 0334108
• 负责人: Aviel Rubin
• 金额: $ 61.65万
• 依托单位: Johns Hopkins University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2003
• 资助国家: 美国
• 起止时间: 2003-09-01 至 2006-10-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0334108&HistoricalAwards=false
• 关键词: STI; Towards; more; Secure; Inter

Improving the reliability of inter-domain routing is arguably one of the most daunting challenges faced in securing the Internet today. Inter-domain routing protocols provide the means by which organizations under cohesive administrative control (e.g., universities, companies, ISPs) exchange and propagate reachability information among themselves. In essence, such protocols de.ne policies by which data traverses the Internet to arrive at its intended destination(s). As such, disruptions in inter-domain routing protocols, whether benign or intentional, may result in large segments ofthe Internet becoming inaccessible.This proposal encompasses the design, analysis and deployment of a protocol to better analyze and validate routing protocols, with particular attention to the Border Gateway Protocol (BGP),which is the de facto inter-domain routing protocol used in the Internet. Rather than attempting to change widely deployed protocols like BGP, this project is an attempt to validate the observed information in messages that result from protocol interactions. In this proposal, we discuss ways in which such a validation protocol, running adjacent to BGP for example, can improve the security and reliability of the Internet, while at the same time, allow for incremental deployment. This latter goal is significant, as it is not realistic to assume that every edge router on the Internet can(or will) adopt a new protocol at the same time.In that regard, the project is specifically designed to offer immediate benefit to anyone deploying a server to support protocol validation, so that the incentive is for sites to participate, regardless of how many others are executing the protocol. However, as adoption increases, so will its benefit to the greater Internet community at large.

提高域间路由的可靠性可以说是当今保护互联网安全所面临的最艰巨的挑战之一。域间路由协议为处于统一管理控制下的组织(例如，大学、公司、互联网服务提供商)提供了在它们之间交换和传播可达性信息的方法。本质上，这样的协议决定了数据通过互联网到达其预期目的地的策略(S)。因此，域间路由协议的中断，无论是良性的还是故意的，都可能导致互联网的大片区域变得无法访问。该建议包括设计、分析和部署协议，以更好地分析和验证路由协议，并特别关注边界网关协议(BGP)，这是事实上在互联网中使用的域间路由协议。该项目不是试图改变广泛部署的协议(如BGP)，而是尝试验证由协议交互产生的消息中观察到的信息。在该提案中，我们讨论了这样的验证协议(例如，与BGP相邻运行)如何能够提高互联网的安全性和可靠性，同时允许增量部署。后一个目标很重要，因为假设Internet上的每个边缘路由器都可以(或将)同时采用一种新协议是不现实的。在这方面，该项目专门设计为任何部署服务器以支持协议验证的人提供即时好处，以便激励站点参与，而不管有多少其他站点正在执行该协议。然而，随着采用率的增加，其对广大互联网社区的好处也将随之增加。