Collaborative Research: CT-ISG: Mitigating Exploits of the Current Interdomain Routing Infrastructure

合作研究：CT-ISG：缓解当前域间路由基础设施的漏洞该项目使用理论分析和实践工具解决了互联网路由基础设施的基本缺陷。研究结果不仅提高了当前Internet的安全性，而且为下一代协议的安全路由设计提供了有用的原则。该项目通过正式定义协议安全性的全面需求，而不是强加新技术来解决一两个特定的漏洞，倡导了一种不同于该领域先前工作的方法。边界网关协议（BGP）提供了Internet各组成网络之间的最佳连接，这一任务称为域间路由。但是BGP缺乏任何安全机制，可能会导致路由器的意外配置错误或恶意攻击，从而对网络的稳定性和流量造成深远的影响。此外，仅仅增加安全机制是不够的，因为BGP也不能保证符合规范的输入总是在网络中产生稳定的路由。本项目通过研究各种保证良好路由行为的假设，以及验证或执行这些假设以防止偏离该行为的方法来解决这些缺点。我们识别和解决以前已经研究过的攻击以及尚未在文献中受到关注的新攻击。我们将增量部署的优势和计算效率作为首要目标；因此，我们的解决方案可以为立即采用提供激励，而无需进行系统范围的更改。通过其教育成分，我们的项目向学生介绍跨学科研究。这鼓励了研究项目中的合作，并允许开发集成安全，网络和理论的课程作业，以便及时应用领域。

0716511Rebecca WrightStevens Institute of Technology0716564Aaron JaggardTulane UniversityCollaborative Research: CT-ISG: Mitigating Exploits of the CurrentInterdomain-Routing InfrastructureThis project addresses fundamental flaws in Internet-routinginfrastructure using both theoretical analysis and practical tools.The results not only improve the security of the current Internet, butalso advance principles of secure routing design useful fornext-generation protocols. The project advocates a different approachthan previous work in this area by formally defining comprehensiverequirements for protocol security, rather than imposing newtechnologies to address one or two specific exploits.The Border Gateway Protocol (BGP) provides best-effort connectivitybetween the component networks of the Internet, a task calledinterdomain routing. However, BGP lacks any security mechanism,allowing accidental router misconfiguration or intentional attacksthat have far-reaching effects on network stability and trafficflow. Furthermore, simply adding security mechanisms is insufficientbecause BGP also lacks the guarantee that specification-compliantinputs always produce stable routes across the network.This project addresses these shortcomings through research on variousassumptions that guarantee good routing behavior and on methods toverify or enforce these assumptions to prevent deviation from thatbehavior. We identify and address attacks that have previously beenstudied as well as new attacks that have not yet received attention inthe literature. We target incremental-deployment benefits andcomputational efficiency as primary desiderata; thus, our solutionscan offer incentives for immediate adoption without system-widechanges. Through its educational component, our project introducesstudents to cross-disciplinary research. This encourages collaborationin research projects and allows development of coursework integratingsecurity, networking, and theory for a timely application domain.