Collaborative Research: CT-ISG: Mitigating Exploits of the Current Interdomain Routing Infrastructure

0716511 Rebecca WrightStevens理工学院Aaron Jaggard杜兰大学合作研究：CT-ISG：减少当前域间路由基础设施的漏洞该项目使用理论分析和实用工具解决了互联网路由基础设施中的根本缺陷。其结果不仅提高了当前互联网的安全性，还提出了适用于下一代协议的安全路由设计原则。该项目倡导一种与该领域以前的工作不同的方法，通过正式定义协议安全的全面要求，而不是强加新技术来解决一个或两个特定的利用。边界网关协议(BGP)提供Internet组件网络之间的最佳连接，这一任务称为域间路由。然而，BGP缺乏任何安全机制，允许意外的路由器错误配置或故意攻击，从而对网络稳定性和流量产生深远影响。此外，简单地添加安全机制是不够的，因为BGP也不能保证符合规范的输入总是在网络上产生稳定的路由。本项目通过研究保证良好的路由行为的各种假设以及验证或实施这些假设以防止偏离该行为的方法来解决这些缺陷。我们识别和解决以前研究过的攻击以及尚未在文献中引起注意的新攻击。我们将增量部署的好处和计算效率作为首要目标；因此，我们的解决方案可以在不改变系统范围的情况下提供立即采用的激励措施。通过它的教育部分，我们的项目向学生介绍跨学科的研究。这鼓励研究项目中的合作，并允许开发整合了安全、网络和理论的课程，以便及时应用领域。

0716511Rebecca WrightStevens Institute of Technology0716564Aaron JaggardTulane UniversityCollaborative Research: CT-ISG: Mitigating Exploits of the CurrentInterdomain-Routing InfrastructureThis project addresses fundamental flaws in Internet-routinginfrastructure using both theoretical analysis and practical tools.The results not only improve the security of the current Internet, butalso advance principles of secure routing design useful fornext-generation protocols. The project advocates a different approachthan previous work in this area by formally defining comprehensiverequirements for protocol security, rather than imposing newtechnologies to address one or two specific exploits.The Border Gateway Protocol (BGP) provides best-effort connectivitybetween the component networks of the Internet, a task calledinterdomain routing. However, BGP lacks any security mechanism,allowing accidental router misconfiguration or intentional attacksthat have far-reaching effects on network stability and trafficflow. Furthermore, simply adding security mechanisms is insufficientbecause BGP also lacks the guarantee that specification-compliantinputs always produce stable routes across the network.This project addresses these shortcomings through research on variousassumptions that guarantee good routing behavior and on methods toverify or enforce these assumptions to prevent deviation from thatbehavior. We identify and address attacks that have previously beenstudied as well as new attacks that have not yet received attention inthe literature. We target incremental-deployment benefits andcomputational efficiency as primary desiderata; thus, our solutionscan offer incentives for immediate adoption without system-widechanges. Through its educational component, our project introducesstudents to cross-disciplinary research. This encourages collaborationin research projects and allows development of coursework integratingsecurity, networking, and theory for a timely application domain.