NSF-BSF: SaTC: CORE: Small: Prevention, Detection and Mitigation for Secure Interdomain Routing

点击翻译按钮获取中文摘要

The Border Gateway Protocol (BGP) is the glue that connects hundreds of thousands of autonomous systems into the global Internet infrastructure. From its inception, BGP however has no built-in security mechanisms. This vulnerability has been abused for myriad attacks, many causing large-scale network disruptions and catastrophic financial loss. Extensive efforts on securing BGP have led to the current increasing deployment of mechanisms for authenticating and validating route origins. As a result, simple prefix hijacks are expected to become less effective. While this is encouraging, attackers can adopt many other forms of more sophisticated attacks, e.g., path manipulation attacks and route leaks, which can be extremely damaging. While many prevention techniques have been proposed by academia, industry and standardization organizations, none of them has been actively deployed , partly because of insufficient attention paid to deployment challenges. This NSF-BSF project aims to develop effective and deployable solutions to significantly improve BGP security. In addition, this project incorporates research outcome in course development and provides research opportunities to underrepresented students. This project takes a multi-pronged approach to improve BGP security. First, it develops effective and deployable strategies to prevent attacks to BGP. Th proposed techniques aim to finally overcome the long-standing obstacle of deploy-ability by combining significantly better security under partial deployment with significantly lower overhead. Second, this project develops a detect-then-prevent service that is broadly applicable to many types of attacks, including 'hidden' and 'stealthy' attacks that are difficult to prevent directly. In the same time the approaches will keep the defense resilient to new classes of attacks that purposely mislead and abuse the detection service. Third, this project develops automated mitigation techniques, with a novel on-demand route origin authorization design, and outsourced-mitigations leveraging content delivery networks and overlay networks. Last, this project significantly advances the state-of-the-art of inter-domain routing security evaluation, by developing accurate and flexible open-source simulation tools and formal analysis mechanisms.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.