EAGER: USBRCCR: Researching Internet Routing Security in the Wild

Internet提供了一个控制平面来建立到目的地的路由，一个数据平面来发送流量，这两个平面的协议都缺乏认证。由于缺乏身份验证，网络可以声称对通往其他网络地址的路由拥有所有权，以虹吸流量（前缀劫持），并允许设备声称它们的流量来自不同的来源（源欺骗）。这些漏洞构成了拒绝服务攻击、流量拦截和窥探、比特币盗窃和Tor匿名性妥协的基础。由于这些漏洞，路由研究是网络安全研究的一个关键方面。然而，研究人员缺乏实验方法，使他们能够进行既现实又可控的互联网路由实验。该项目旨在扩展公共对等网络研究测试平台，以实现目前学术研究人员无法达到的以安全为重点的路由研究类别，并随后开发技术来识别哪些网络允许或容易受到前缀劫持和源欺骗的攻击。该项目的结果将支持新的路由安全研究，帮助识别易受攻击的网络，绘制机器人种群，并作为改进互联网路由安全性的一步。该项目将通过安全相关功能扩展对等网络研究测试平台，包括在路由器上执行容器的能力，将对等网络前缀与RPKI（一种保护互联网路由的基础设施）集成，并使测试平台更加可靠。它还将开发算法来(1)定位欺骗攻击流量的来源，(2)跟踪采用基于rpki的防止前缀劫持的保护措施，并识别其应用中可能出现的问题。该算法将利用对等网络操纵路由的能力及其在本项目中开发的扩展来强制更改路由，并观察对从每个对等端接收的欺骗流量的影响，以及哪些有利位置使用/不使用违反RPKI的路由。算法将需要解决与互联网路由的有限可见性、缺乏路由策略的地面真实性以及缺乏对其他网络路由决策的控制相关的挑战。研究人员将研究算法如何系统地改变路线，以便将可行的解释集缩小到与所有观察结果一致的解释集，从而产生更精确的推断。该项目对测试平台的扩展将允许其他人进行新的路由安全研究，该项目的算法将识别易受攻击的网络，这是解决互联网缺乏流量和路由认证的关键一步。

The Internet provides a control plane to establish routes to destinations and a data plane to send traffic, and the protocols for both lack authentication. The lack of authentication allows networks to claim ownership of routes to other networks' addresses in order to siphon traffic (prefix hijacking), and allows devices to claim that their traffic came from a different source (source spoofing). These vulnerabilities form the basis for denial-of-service attacks, traffic interception and snooping, Bitcoin theft, and compromises of Tor's anonymity. Because of these vulnerabilities, routing research is a critical aspect of cybersecurity research. However, researchers lack experimental approaches that let them perform Internet routing experiments that are both realistic and controlled. This project aims to extend the public PEERING research testbed to enable classes of security-focused routing research that are beyond the reach of academic researchers today, and to subsequently develop techniques to identify which networks allow or are vulnerable to prefix hijacks and source spoofing. Results from this project will empower novel routing security research, help identify vulnerable networks, map bot populations, and serve as a step towards improved routing security in the Internet.The project will extend the PEERING research testbed with security-related functionality, including the ability to execute containers on routers, integrating PEERING prefixes with the RPKI (an infrastructure for securing aspects of Internet routing), and making the testbed more reliable. It will also develop algorithms to (1) locate the sources of spoofed attack traffic and to (2) track the adoption of RPKI-based protection against prefix hijacking and identify possible problems in its application. The algorithms will use PEERING's ability to manipulate routing and its extensions developed in this project to force route changes and observe the impact on the volume of spoofed traffic received from each peer and which vantage points do/do not use routes that violate the RPKI. The algorithms will need to address challenges related to limited visibility of Internet routes, lack of ground truth about routing policies, and lack of control of routing decisions of other networks. The researchers will investigate how the algorithms can systematically change routes in order to narrow the set of feasible explanations to those consistent with all observations, yielding more precise inferences. The project's extensions to the testbed will allow others to conduct novel routing security research, and the algorithms from the project will identify vulnerable networks, a key step forwards in addressing the Internet's lack of authentication for traffic and routing.