NSF-BSF: SaTC: CORE: Small: Prevention, Detection and Mitigation for Secure Interdomain Routing

边界网关协议(BGP)是将数十万个自治系统连接到全球互联网基础设施的粘合剂。然而，从一开始，BGP就没有内置的安全机制。这个漏洞已经被滥用于无数的攻击，其中许多造成了大规模的网络中断和灾难性的经济损失。在保护BGP方面的广泛努力导致了当前越来越多地部署用于认证和确认路由来源的机制。因此，简单的前缀劫持预计将变得不那么有效。虽然这是令人鼓舞的，但攻击者可以采用许多其他形式的更复杂的攻击，例如路径操纵攻击和路由泄漏，这可能具有极大的破坏性。虽然学术界、工业界和标准化组织提出了许多预防技术，但没有一个得到积极应用，部分原因是对部署挑战重视不够。该NSF-BSF项目旨在开发有效且可部署的解决方案，以显著提高BGP安全性。此外，该项目将研究成果纳入课程开发，并为代表性不足的学生提供研究机会。本项目多管齐下，提高BGP安全性。首先，它开发了有效且可部署的策略来防止对BGP的攻击。提出的技术旨在通过将部分部署下显著更好的安全性与显著更低的开销相结合，最终克服长期存在的可部署性障碍。其次，该项目开发了一种先检测后预防的服务，该服务广泛适用于许多类型的攻击，包括难以直接阻止的“隐藏”和“隐蔽”攻击。与此同时，这些方法将使防御系统对故意误导和滥用检测服务的新型攻击保持弹性。第三，该项目开发了自动化缓解技术，具有新颖的按需路由来源授权设计，以及利用内容交付网络和覆盖网络的外包缓解。最后，该项目通过开发准确而灵活的开源模拟工具和正式的分析机制，极大地推进了域间路由安全评估的最新水平。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The Border Gateway Protocol (BGP) is the glue that connects hundreds of thousands of autonomous systems into the global Internet infrastructure. From its inception, BGP however has no built-in security mechanisms. This vulnerability has been abused for myriad attacks, many causing large-scale network disruptions and catastrophic financial loss. Extensive efforts on securing BGP have led to the current increasing deployment of mechanisms for authenticating and validating route origins. As a result, simple prefix hijacks are expected to become less effective. While this is encouraging, attackers can adopt many other forms of more sophisticated attacks, e.g., path manipulation attacks and route leaks, which can be extremely damaging. While many prevention techniques have been proposed by academia, industry and standardization organizations, none of them has been actively deployed , partly because of insufficient attention paid to deployment challenges. This NSF-BSF project aims to develop effective and deployable solutions to significantly improve BGP security. In addition, this project incorporates research outcome in course development and provides research opportunities to underrepresented students. This project takes a multi-pronged approach to improve BGP security. First, it develops effective and deployable strategies to prevent attacks to BGP. Th proposed techniques aim to finally overcome the long-standing obstacle of deploy-ability by combining significantly better security under partial deployment with significantly lower overhead. Second, this project develops a detect-then-prevent service that is broadly applicable to many types of attacks, including 'hidden' and 'stealthy' attacks that are difficult to prevent directly. In the same time the approaches will keep the defense resilient to new classes of attacks that purposely mislead and abuse the detection service. Third, this project develops automated mitigation techniques, with a novel on-demand route origin authorization design, and outsourced-mitigations leveraging content delivery networks and overlay networks. Last, this project significantly advances the state-of-the-art of inter-domain routing security evaluation, by developing accurate and flexible open-source simulation tools and formal analysis mechanisms.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.