CICI: SSC: Robust and Secure Internet Infrastructure for Scientific Collaboration

科学合作越来越依赖互联网作为关键的通信基础设施。然而，互联网很容易受到拥塞和拒绝服务（DoS）攻击，这可能导致研究资源和结果的毁灭性损失，破坏科学合作以及其他服务。该项目的目标是开发和部署防御，以促进科学合作的稳健和安全的互联网通信。开发的防御将解决两个主要的连接问题：通过减轻放大DoS攻击来最小化拥塞，并防止路由劫持，即绕过可以阻止远程站点之间通信的域间路由的破坏性攻击。在整个研究过程中，pi与康涅狄格大学、康涅狄格教育网以及其他研究和教育网络的网络运营商密切合作。该项目生成经过测试的工具、协议和免费的开源软件，这些软件可以直接集成到运营网络中。该项目开发的保护机制对科学界和整个社会都有很大的好处。该项目解决了互联网基础设施健壮性和安全性面临的两个最大的、长期存在的挑战。首先，该项目开发了新的防御放大带宽的dos攻击；这些攻击和随后的工具与大学网络特别相关。这些防御将新兴的资源公钥基础设施（RPKI）标准与改进的反向路径转发（RPF）技术结合起来，有效地过滤从对等端接收的欺骗数据包。其次，该项目开发、实现和部署了一个改进的RPKI验证器，用于安全的域间路由。这个验证器解决了部署问题和挑战，特别是关于误报的问题，并提供了额外的安全性和功能改进，以促进广泛的部署。在RPKI的好处中，正确部署RPKI可以防止路由劫持，这是互联网域间路由上最常见的攻击类型。路由劫持可能以多种方式被滥用，包括窃听、欺骗和阻止远程站点之间的通信。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Scientific collaboration increasingly relies on the Internet as a critical communication infrastructure. However, the Internet is vulnerable to congestion and Denial-of-Service (DoS) attacks, which can cause devastating losses of research resources and results, disrupting scientific collaboration, as well as to other services. The goal of this project is to develop and deploy defenses to facilitate robust and secure Internet communication for scientific collaboration. The developed defenses will address two major connectivity concerns: minimizing congestion by mitigating amplification DoS attacks, and preventing route hijacking, that is, circumventing devastating attacks on inter-domain routing that can prevent communication between remote sites. Throughout this research, the PIs work closely with the network operators of the University of Connecticut, the Connecticut Educational Network, and other Research and Education networks. The project generates tested tools, protocols and free open- source software, which can be directly integrated into operational networks. The protection mechanisms developed in this project significantly benefits the scientific community and the society in general.This project addresses two of the biggest, long-standing challenges to Internet Infrastructure robustness and security. Firstly, the project develops new defenses against amplification bandwidth-DoS attacks; these attacks and subsequent tools are particularly relevant to university networks. These defenses combine the emerging Resource Public Key Infrastructure (RPKI) standard, with an improved Reverse Path Forwarding (RPF) technique, to effectively filter spoofed packets received from peers. Secondly, the project develops, implements and deploys an improved RPKI validator for secure inter-domain routing. This validator addresses deployment concerns and challenges, in particular concerns about false positives, and provides additional security and functionality improvements to facilitate wide deployment. Amongst RPKI's benefits, correct deployment of RPKI prevents route hijacking, which is the most common type of attacks on Internet inter-domain routing. Route hijacking may be abused in many ways, including eavesdropping, spoofing and preventing communication between remote sites.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.