EAGER: USBRCCR: Researching Internet Routing Security in the Wild

互联网提供了一个控制平面来建立到目的地的路由，提供了一个数据平面来发送流量，并且用于这两者的协议都缺乏认证。 缺乏身份验证允许网络声称拥有到其他网络地址的路由，以便虹吸流量（前缀劫持），并允许设备声称其流量来自不同的来源（来源欺骗）。 这些漏洞构成了拒绝服务攻击、流量拦截和窥探、比特币盗窃以及Tor匿名性妥协的基础。 由于这些漏洞，路由研究是网络安全研究的一个重要方面。 然而，研究人员缺乏实验方法，让他们执行互联网路由实验，既现实和控制。 该项目的目的是扩展公共PEGNET研究测试平台，以实现当今学术研究人员无法实现的以安全为中心的路由研究，并随后开发技术来识别哪些网络允许或容易受到前缀劫持和源欺骗。该项目的成果将为新的路由安全研究提供支持，帮助识别易受攻击的网络，绘制僵尸网络地图，并为改善互联网中的路由安全迈出一步。该项目将扩展PEOPLE研究测试平台的安全相关功能，包括在路由器上执行容器的能力，将PEOPLE前缀与RPKI集成（一种用于保护互联网路由方面的基础设施），并使测试床更加可靠。它还将开发算法，以（1）定位欺骗攻击流量的来源，（2）跟踪基于RPKI的保护措施的采用情况，以防止前缀劫持，并确定其应用中可能存在的问题。该算法将使用PENDIX的能力来操纵路由及其在本项目中开发的扩展，以强制路由更改，并观察对从每个对等体接收的欺骗流量的影响，以及哪些Vantage位置使用/不使用违反RPKI的路由。 这些算法将需要解决与互联网路由的可见性有限、缺乏路由策略的基本事实以及缺乏对其他网络路由决策的控制有关的挑战。 研究人员将研究这些算法如何系统地改变路线，以便将可行的解释集缩小到与所有观察结果一致的解释集，从而得出更精确的推断。 该项目对测试平台的扩展将允许其他人进行新的路由安全研究，该项目的算法将识别易受攻击的网络，这是解决互联网缺乏流量和路由认证的关键一步。

The Internet provides a control plane to establish routes to destinations and a data plane to send traffic, and the protocols for both lack authentication. The lack of authentication allows networks to claim ownership of routes to other networks' addresses in order to siphon traffic (prefix hijacking), and allows devices to claim that their traffic came from a different source (source spoofing). These vulnerabilities form the basis for denial-of-service attacks, traffic interception and snooping, Bitcoin theft, and compromises of Tor's anonymity. Because of these vulnerabilities, routing research is a critical aspect of cybersecurity research. However, researchers lack experimental approaches that let them perform Internet routing experiments that are both realistic and controlled. This project aims to extend the public PEERING research testbed to enable classes of security-focused routing research that are beyond the reach of academic researchers today, and to subsequently develop techniques to identify which networks allow or are vulnerable to prefix hijacks and source spoofing. Results from this project will empower novel routing security research, help identify vulnerable networks, map bot populations, and serve as a step towards improved routing security in the Internet.The project will extend the PEERING research testbed with security-related functionality, including the ability to execute containers on routers, integrating PEERING prefixes with the RPKI (an infrastructure for securing aspects of Internet routing), and making the testbed more reliable. It will also develop algorithms to (1) locate the sources of spoofed attack traffic and to (2) track the adoption of RPKI-based protection against prefix hijacking and identify possible problems in its application. The algorithms will use PEERING's ability to manipulate routing and its extensions developed in this project to force route changes and observe the impact on the volume of spoofed traffic received from each peer and which vantage points do/do not use routes that violate the RPKI. The algorithms will need to address challenges related to limited visibility of Internet routes, lack of ground truth about routing policies, and lack of control of routing decisions of other networks. The researchers will investigate how the algorithms can systematically change routes in order to narrow the set of feasible explanations to those consistent with all observations, yielding more precise inferences. The project's extensions to the testbed will allow others to conduct novel routing security research, and the algorithms from the project will identify vulnerable networks, a key step forwards in addressing the Internet's lack of authentication for traffic and routing.