Measuring the Security of Internet Infrastructure

点击翻译按钮获取中文摘要

The rising tide of spam, phishing and other online crime has shown that it's not enough to leave it to website owners to encrypt traffic. You may be misled or defrauded if you visit the wrong website; or if you visit a website with the right name but at the wrong IP address; or if you visit a site at the right IP address, but hosted in another part of the world. It has thus become clear that we have to protect the Internet at the infrastructure level, which means protecting the naming (DNS) and routing (BGP) mechanisms. The industry is about to deploy DNSSEC, and various ad-hoc mechanisms are being used to protect BGP.However these deployments will take years, and many firms will initially get it wrong. There is a clear case for NPL to monitor the process in order to measure what's working and what isn't; to create pressure on sectors of the economy that lag behind; to help improve both authentication and monitoring tools; and to provide an authoritative voice on the move to a more secure infrastructure. Our research programme will help create this capability at NPL by establishing the monitoring framework. We also plan to develop a BGP reflector system to deal with global routing table growth out of band , along with an authentication and validation system for the route servers used by internet exchanges such as LINX and AMSIX to improve peering point resilience and to prevent a number of possible types of attack.We believe that this is of global importance, and that as players such as the US Department of Commerce and the IETF have got bogged down in political wrangling, a UK / European standards lead has a good chance of developing into global leadership.