RISP:ARPKI-BasedInter-ASSourceProtectionMechanism资源-CSDN文库

183 浏览量 2021-02-11 19:45:06 上传评论收藏 679KB PDF 举报

### RISP: 一种基于RPKI的跨自治系统源地址保护机制 #### 摘要与背景在当今数字化世界中，网络安全问题日益突出。分布式拒绝服务（DDoS）攻击作为最常见的网络攻击手段之一，其危害性和影响力不容忽视。源地址欺骗是发起匿名入侵时最普遍的组件之一，尤其是用于DDoS攻击。虽然互联网工程任务组（IETF）已经标准化了接入网络层面的源地址验证，但在跨自治系统（AS）层面的源地址验证仍然是一个重要问题。为防止路由劫持，IETF正在构建资源公钥基础设施（RPKI），作为一种统一的信任锚点来确保域间路由的安全性。本文创造性地利用RPKI支持跨AS的源地址验证，并提出了一种基于RPKI的跨AS源保护机制（RISP）。 #### 基于RPKI的跨AS源保护机制（RISP） ##### RPKI简介资源公钥基础设施（Resource Public Key Infrastructure，简称RPKI）是一种用于管理互联网资源分配和路由安全的技术。它提供了一个框架，使得网络运营商可以发布和验证有关IP地址块和自治系统编号的信息，从而防止BGP路由注入、路由泄露等攻击。RPKI通过建立一个信任链，确保了这些资源信息的真实性，从而提高了整个互联网路由系统的安全性。 ##### RISP的核心思想 RISP机制的核心思想是利用RPKI提供的信任基础来加强跨AS的源地址验证。具体来说，该机制允许AS为其拥有的IP地址提供更可信的源导向保护，并且与RPKI保持独立。通过这种方式，RISP不仅能够提高激励措施的有效性，还能够在适度的资源消耗下实现效率提升和带宽节约。 ##### 技术细节 1. **RPKI的信任锚**：RPKI系统中的信任锚由一系列的证书构成，这些证书由根证书颁发机构（CA）签名。这些证书构成了信任链的基础，使得AS可以验证其他AS发布的资源信息的真实性。 2. **源地址验证流程**：当数据包穿过不同AS时，接收方AS可以通过查询RPKI数据库来验证数据包源地址是否属于声称拥有该地址的发送方AS。如果验证成功，则数据包继续转发；如果失败，则数据包被丢弃或标记为可疑。 3. **实验结果**：通过对实际互联网拓扑结构进行实验，结果显示RISP机制不仅提供了更好的激励措施，还显著提高了效率并节约了带宽资源。这些改进表明RISP是一种可行的解决方案，可以有效地减轻DDoS攻击带来的威胁。 #### 关键词解释 - **IP欺骗**：是指攻击者伪造数据包的源IP地址，使接收方误认为数据包来自另一个地方。 - **源地址验证**：是指验证数据包的源地址是否真实有效的过程。 - **跨AS**：指的是数据包跨越多个自治系统的情况。 - **RPKI**：资源公钥基础设施，用于管理互联网资源分配和路由安全。 - **DDoS**：分布式拒绝服务攻击，是一种常见的网络攻击方式。 #### 结论 RISP作为一种创新性的跨AS源地址保护机制，利用RPKI提供的信任基础，为解决跨AS源地址验证问题提供了一种可行的解决方案。通过实验证明，RISP不仅提高了网络安全性，还在资源消耗方面实现了优化。随着网络攻击手段的不断演变和发展，像RISP这样的机制对于保护互联网基础设施的安全至关重要。

资源推荐

资源详情

资源评论

TSINGHUA SCIENCE AND TECHNOLOGY

ISSNll1007-0214 0?/?? pp???–???

DOI: 1 0 . 2 6 5 9 9 / T S T . 2 0 1 8 . 9 0 1 0 0 2 5

Volume 1, Number 1, Septembelr 2018

RISP: A RPKI-Based Inter-AS Source Protection Mechanism

Yihao Jia, Ying Liu, Gang Ren* and Lin He

Abstract: Source address spooﬁng is regarded as one of the most prevalent components when launching an

anonymous invasion, especially a distributed denial-of-service (DDoS) attack. Although source address validations

at the access network level are being standardized by the Internet Engineering Task Force (IETF), source address

validation at the inter-autonomous system (AS) level still remains an important issue. To prevent routing hijacking,

the IETF is constructing resource public key infrastructure (RPKI) as a unitive trust anchor to secure inter-domain

routing. In this paper, we creatively use the RPKI to support inter-AS source address validation and propose

a RPKI-based Inter-AS source protection (RISP) mechanism. According to the trust basis provided by the RPKI,

RISP offers ASes a more credible source-oriented protection for the IP addresses they own and remain independent

of the RPKI. Based on the experiments with real Internet topology, RISP not only provides better incentives, but

also presents efﬁcacy improvement and bandwidth economization with modest resource consumption.

Key words: IP spooﬁng, source address validation, inter-AS, RPKI, DDoS

1 Introduction

The distributed denial-of-service (DDoS)

[1]

attack is

the most prevalent weapon

[2]

used to destroy the

availability of any Internet-based service

[3]

. IP

spooﬁng, which is the most critical dependency of

a DDoS attack, is the core challenge we truly face.

Theoretically, there are two types of IP spooﬁng:

d-DDoS for ‘d’estination-orientated and s-DDoS for

‘s’ource-orientated attacks

[4]

. The d-DDoS may attack

the target with arbitrary source addresses to simply

remain anonymous, while the s-DDoS, which is also

deﬁned as a reﬂection attack, sends packets with the

target’s source addresses to innocent destination hosts,

whose replies may then ﬂood the target. In most cases,

it is the “source” that who suffer most from the IP

spooﬁng attacks. Taking the network time protocol

• Yihao Jia, Ying Liu, Gang Ren and Lin He are with the Institute

for Network Sciences and Cyberspace, Tsinghua University,

Beijing 100084, China.

∗ To whom correspondence should be addressed.

Email: rengang@cernet.edu.cn

- Manuscript received: 2017-07-16; accepted: 2017-09-17

based reﬂection attack in 2014

[5]

as an example, to

form the 400-Gbps extensive convergence ﬂooding with

amplifying trafﬁc, it is the source, not the destination

that acts as the assault target. Therefore, the deﬁciency

of source protection for IP address holders should be a

main reason that leads to such reﬂection scenarios.

The source address validation architecture (SAVA)

[6]

is the most recent and intense research topic in this

area. SAVA divides the mission into three levels

with different granularity: the access network, intra-

autonomous system (AS), and inter-AS. The ﬁrst two

levels focus the validation of the packets that originate

in the AS, whereas the last level considers the packets

originating from other ASes. In spite of the fact

that standardization at the access network level

[7]

effectively conducted by the Internet Engineering Task

Force (IETF) Source Address Validation Improvements

(SAVI) working group, IP spooﬁng are not going

to be eradicated only by the internal defense way.

Although methods like Ingress/Egress Filtering (IEF)

[8]

are indeed cost-effective, it is not able to prevent

spooﬁng unless globe deployment. In this reason,

inter-AS source address validation is still indispensable

against IP spooﬁng since it is the only and last defense

2 Tsinghua Science and Technology

to prevent IP spooﬁng from outside of an AS according

to SAVA architecture.

The resource public key infrastructure (RPKI)

[9]

, as

the major trust anchor of the Internet promoted by IETF

Secure Inter-Domain Routing (SIDR) working group,

is constructed to solve the problem of authenticity of

routing origination. The ﬁrst application of RPKI—

route origination authorization (ROA)

[10]

—naturally

provides a built-in stipulation where ASes can be the

hosts for a given IP preﬁx. Therefore, we envision

that data source security for inter-AS source address

validation (SAV) will also beneﬁt from the RPKI system

indirectly.

In this paper, by probing the substance of RPKI,

we creatively integrate inter-AS SAV into RPKI

and propose RPKI based Inter-AS Source Protection

(RISP). RISP simplify the logic of inter-AS SAV

by decoupling the function of it, making the system

focusing on the validation while RPKI focusing on

the rest. Through analyzing, such reciprocal attribute

brings inter-AS SAV a more concise and modularized

structure, which improves the ﬁltering efﬁciency

referring to the traditional ways. To the best of our

knowledge, this is the ﬁrst work that tries to solve

inter-AS SAV within the RPKI architecture. The

key contributions in this paper can be summarized as

follows.

1. Decoupled Structure: RISP is an RPKI-based

and RPKI-decoupled method. RISP adequately

leverages the trust basis provided by RPKI and

works well in the partial deployment of RPKI.

2. Source-oriented Protection: By valuing

“protections” over “validation”, RISP provides

deployer ASes a more credible protection for IP

addresses they own, triggering decent incentives

for themselves.

3. Filtering Efﬁciency: RISP beneﬁts from the

power-law theorem of the Internet to a large extent,

achieving high defensive performance with only

small deployment rate.

Through mathematical analysis and related

experiments, it is shown that RISP brings deployer

ASes decent incentives with modest resource

consumption, and realizes performance improvements

and bandwidth savings over typical cryptography based

way.

The rest of this paper is organized as follows.

Section 2 covers related work. Then we intensively

detail RISP in Section 3. This is followed by

the evaluation in Section 4. Section 5 discusses

security issues, and concluding remarks are presented

in Section 6.

2 Related Work

2.1 Inter-AS Source Address Validation

Inter-AS SAV methodology that implementing at

Internet routers can be primarily classiﬁed into

two types: routing-based validation and labeling-

based validation. Routing-based validation verify

source address by restricting the feasible incoming

interfaces for each IP space according to the routing

information. However, in most cases, routing-

based validations neglect beneﬁts for deployed ASes

themselves, resulting in weak incentives in deployment.

Besides, in practice, false positives is another challenge

for routing-based method because of the dynamics

of inter-domain routing. Labeling-based validation

usually involves cryptography, and it veriﬁes source

address by an exclusive customized label. Although

methods in this way introduce extra cost in validating

these cryptographic labels, it offers the deployers

higher incentives and ﬂexibility even if these ASes are

nonadjacent. Challenges for this method mainly focus

on the optimizations of the labeling algorithm and key

distribution. In this regard, labeling-based validation

usually presents a trade-off between ﬂexibility and

complexity.

In this section, we present the main technologies

used for each type of the methods in order to pinpoint

both characteristics and the lessons that should be taken

away.

2.1.1 Routing-based Validation

Source Address Validity Enforcement (SAVE)

[11]

, on

the behalf of this kind of method, attempts to provide

a new protocol to notify each routers the potential

incoming interfaces for each source address space.

However, SAVE only works if it is fully deployed,

lacking mechanisms for partial deployment.

Different from SAVE which depending on

collaboration between numerous ASes, Inter Domain

Packet Filters (IDPF)

[12]

deployers construct a

validation table by individually backward predicting

from BGP update messages. Although IDPF act

as a classical representative which inheriting the

剩余11页未读，继续阅读

评论收藏

内容反馈

weixin_38716872

粉丝: 2
资源: 926

RISP: A RPKI-Based Inter-AS Source Protection Mechanism

risp:Ruby中带有宏和互操作的LISP解释器，因为为什么不呢？

risp：Rust中的Lisp实现

risp:使用 ruby​​ 的简单 lisp 实现

RISP062:IHEID RISP062的材料

Room-temperature-quarter-wave-res_2018_Nuclear-Instruments-and-Methods-in-Ph

yaml.ar:yaml.ar是yaml的可运行子集

RTP协议学习大总结从原理到代码

融合动态采样剖析的可重构指令集处理器.pdf

2009级计算机网络设计性实验.doc

lisp_in_rust_land

九年级英语全册Unit14IremembermeetingallofyouinGrade7单词表Word素材新版人教新目标版

需求工程教案介绍.pdf

定制数据流计算软件处理器中的热点分析和数据流分析

基于CORDIC的反正弦和反余弦计算的FPGA实现

BA无标度网络中的SIR模型

使用3DCNN和卷积LSTM进行手势识别学习时空特征

基于三次贝塞尔曲线的类汽车曲率连续路径平滑

基于机器学习的设备剩余寿命预测方法综述

基于维纳过程的退化模型，具有递归过滤算法，可用于估计剩余使用寿命

基于FPGA的奇异值和特征值分解的快速实现。

磁悬浮系统自适应模糊PID控制器的设计

基于BP神经网络的人口预测

两轮平衡车的建模与控制研究

无人机协同目标的多无人机协同搜索方法

基于改进遗传算法的六自由度机器人时间最优轨迹规划

一种基于深度学习的机械臂抓取方法

最新资源

risp:使用 ruby 的简单 lisp 实现