Despite the robust structure of the Internet, it is still susceptible to disruptive routing updates that prevent network traffic from reaching its destination. In this work, we propose a method for early detection of large-scale disruptions based on the analysis of bursty BGP announcements. We hypothesize that the occurrence of large-scale disruptions is preceded by bursty announcements. Our method is grounded in analysis of changes in the inter-arrival times of announcements. BGP announcements that are associated with disruptive updates tend to occur in groups of relatively high frequency, followed by periods of infrequent activity. To test our hypothesis, we quantify the burstiness of inter-arrival times around the date and times of three large-scale incidents: the Indosat hijacking event in April 2014, the Telecom Malaysia leak in June 2015, and the Bharti Airtel Ltd. hijack in November 2015. We show that we can detect these events several hours prior to when they were originally detected. We propose an algorithm that leverages the burstiness of disruptive updates to provide early detection of large-scale malicious incidents using local collector data. We describe limitations, open challenges, and how this method can be used for large-scale routing anomaly detection.
The use of the RPKI alone does not require changes in the BGP protocol. The RPKI is an out-of-band mechanism in which routers download information for decision making and does not require the use of online cryptography. However, there are reasons that limit the scope of the RPKI for securing BGP. Researchers have debated the agreement of a trusted Certificate Authority @cite_69 , difficulties to correctly configure the RPKI @cite_46 , a general lack of commitment and incentives to lead their implementation @cite_42 , and its permissiveness to certain types of attacks, e.g., path shortening attacks @cite_14 .
@cite_46 @cite_14 @cite_69 @cite_42
2511395838 2141544840 2546603560 2087039608
The current Transport Layer Security (TLS) Public-Key Infrastructure (PKI) is based on a weakest-link security model that depends on over a thousand trust roots. The recent history of malicious and compromised Certification Authorities has fueled the desire for alternatives. Creating a new, secure infrastructure is, however, a surprisingly challenging task due to the large number of parties involved and the many ways that they can interact. A principled approach to its design is therefore mandatory, as humans cannot feasibly consider all the cases that can occur due to the multitude of interleavings of actions by legitimate parties and attackers, such as private key compromises (e.g., domain, Certification Authority, log server, other trusted entities), key revocations, key updates, etc. We present ARPKI, a PKI architecture that ensures that certificate-related operations, such as certificate issuance, update, revocation, and validation, are transparent and accountable. ARPKI efficiently supports these operations, and gracefully handles catastrophic events such as domain key loss or compromise. Moreover ARPKI is the first PKI architecture that is co-designed with a formal model, and we verify its core security property using the TAMARIN prover. We prove that ARPKI offers extremely strong security guarantees, where compromising even n 1 trusted signing and verifying entities is insufficient to launch a man-in-the-middle attack. Moreover, ARPKI’s use deters misbehavior as all operations are publicly visible. Finally, we present a proof-of-concept implementation that provides all the features required for deployment. Our experiments indicate that ARPKI efficiently handles the certification process with low overhead. It does not incur additional latency to TLS, since no additional round trips are required. Today's Internet routing protocols are built upon the basic incorrect assumption that routers propagate truthful routing information. As a result, the entire Internet infrastructure is vulnerable to security attacks from routers that propagate incorrect routing information. In fact, a single router is capable of hijacking a significant fraction of routes by launching such an attack. This issue is not just restricted to Internet routing protocols but is widely prevalent in several routing protocols that have been proposed in the research literature. Many existing approaches for addressing the security problems of routing protocols typically assume the existence of a Public-Key Infrastructure (PKI) or some form of prior key distribution mechanism along with a central authority. While a PKI does enable addressing this security threat, building one such key-distribution infrastructure may not always be feasible. One faces serious deployment barriers in building an Internet-wide PKI with a central authority especially given that deploying one such architecture requires approval across political and economic boundaries. Previous efforts for securing Internet routing and the Domain Name System using a PKI have not moved towards adoption. In this dissertation, we address the following question: Using purely decentralized mechanisms (void of a PKI and a central authority), what is the best level of security achievable for a routing protocol in the presence of adversaries? One of the key conclusions that we arrive at is the direct relationship between decentralized security and the reliable communication problem. The reliable communication problem relates to determining the constraints under which a set of good nodes in a network can reliably communicate messages between themselves in the face of adversarial nodes in the network. We show theoretical results on the constraints under which the reliable communication problem is solvable. Based on these results, we describe the design of a reliable communication toolkit that implements our algorithms and provides a suite of generic security primitives that can be used to secure a variety of routing protocols. These security mechanisms supported by the toolkit are well suited for Internet routing since they are both easy to deploy as well as offer good security guarantees. We also show that the toolkit has broader applicability beyond routing protocols to: (a) achieve decentralized key distribution; (b) address the data integrity threat to the Domain Name System (DNS) in a decentralized manner. Existing security mechanisms for managing the Internet infrastructural resources like IP addresses, AS numbers, BGP advertisements and DNS mappings rely on a Public Key Infrastructure (PKI) that can be potentially compromised by state actors and Advanced Persistent Threats (APTs). Ideally the Internet infrastructure needs a distributed and tamper-resistant resource management framework which cannot be subverted by any single entity. A secure, distributed ledger enables such a mechanism and the blockchain is the best known example of distributed ledgers. In this paper, we propose the use of a blockchain based mechanism to secure the Internet BGP and DNS infrastructure. While the blockchain has scaling issues to be overcome, the key advantages of such an approach include the elimination of any PKI-like root of trust, a verifiable and distributed transaction history log, multi-signature based authorizations for enhanced security, easy extensibility and scriptable programmability to secure new types of Internet resources and potential for a built in cryptocurrency. A tamper resistant DNS infrastructure also ensures that it is not possible for the application level PKI to spoof HTTPS traffic. With a cryptographic root-of-trust for Internet routing(RPKI [17]) on the horizon, we can finally start planning the deployment of one of the secure interdomain routing protocols proposed over a decade ago (Secure BGP [22], secure origin BGP [37]). However, if experience with IPv6 is any indicator, this will be no easy task. Security concerns alone seem unlikely to provide sufficient local incentive to drive the deployment process forward. Worse yet, the security benefits provided by the S*BGP protocols do not even kick in until a large number of ASes have deployed them. Instead, we appeal to ISPs' interest in increasing revenue-generating traffic. We propose a strategy that governments and industry groups can use to harness ISPs' local business objectives and drive global S*BGP deployment. We evaluate our deployment strategy using theoretical analysis and large-scale simulations on empirical data. Our results give evidence that the market dynamics created by our proposal can transition the majority of the Internet to S*BGP.