域间安全路由机制对路由劫持的防御能力研究

信息安全研究 ›› 2021, Vol. 7 ›› Issue (1): 44-52.

域间安全路由机制对路由劫持的防御能力研究

王海洋¹,杨言¹,王维²

1. 中关村网络安全与信息化产业联盟
2. 北京国融工发投资管理有限公司

收稿日期:2021-01-10 出版日期:2021-01-05 发布日期:2021-01-10
通讯作者: 王海洋
作者简介:王海洋硕士，高级项目经理，主要从事网络安全、安全评估与检测等方面的研究。 2567479016@qq.com 杨言博士研究生，主要从事互联网域间路由安全方面的研究。yy19920519@sina.com 王维高级工程师，主要从事规划咨询及课题研究、产业及政策研究、投资咨询等工作。 wangwei@bjsidic.com

Research On Defense Capabilities Of Secure Inter-domain Routing Mechanisms Against Routing Hijackings

Received:2021-01-10 Online:2021-01-05 Published:2021-01-10

摘要/Abstract

摘要： 为了降低路由劫持对互联网可能产生的威胁，学术界在近十几年来提出了形形色色的域间安全路由机制以阻止或限制路由劫持事件的产生和传播。本文介绍路由劫持的基本概念和常见种类，对几种重要的域间安全路由机制的原理进行分析和比较，总结其针对的常见劫持类型，通过路由仿真分析不同安全机制在不同部署时期对路由劫持的具体防御能力。

关键词: 路由协议, 路由劫持, 域间安全路由机制, 路由仿真, 自治系统

Abstract: To mitigate the threaten posed by route hijackings to the Internet, various secure inter-domain routing mechanisms have been proposed to prevent hijackings or limit their propagations. This paper introduces the basic concept of routing hijackings, presents a taxonomy of them, and makes a through analysis and comparison on these mechanisms. With Internet scale route simulation, their defense capabilities against the most common routing hijackings are inferred under different deployment scenarios.

Key words: routing protocol, route hijacking, secure inter-domain routing, route simulation, Autonomous System.

王海洋杨言王维. 域间安全路由机制对路由劫持的防御能力研究[J]. 信息安全研究, 2021, 7(1): 44-52.

参考文献

[1] Ripe N. Youtube hijacking a ripe ncc ris case study. [EB/OL].2008[November,2020]http://www.ripe. net/news/study-youtube- hijacking. html [2] Johann S, Georg C, Biersack E W, et al. A forensic case study on as hijacking[J]. Computer Communication Review, 2013,43 (2): 5-12 [3] BGPMon: Hijack Event Today by Indosat. November, 2020. [EB/OL]获取和访问路径http://www.bgpmon.net/ hijack-event-today-by-indosat/. [4] Bush R, Austein R. The resource public key infrastructure (rpki) to router protocol[R]. RFC 6810, January:RFC 6810, 2013 [5] Bellovin S, Bush R, Ward D. Security requirements for bgp path validation[R]. RFC 7353, August:RFC 7353, 2014 [6] Shi Xingang, Xiang Yang, Wang Zhiliang, et al. Detecting prefix hijackings in the internet with argus[C] // Proceedings of the 2012 Internet Measurement Conference.Boston:ACM, 2012: 15-28 [7] Sermpezis P, Kotronis V, Gigis P, et al. Artemis: Neutralizing bgp hijacking within a minute[J]. IEEE/ACM Transactions on Networking, 2018, 26(6):2471-2486 [8] Cohen A, Gilad Y, Herzberg A, et al. Jumpstarting bgp security with path-end validation [C]// Proceedings of the 2016 ACM SIGCOMM Conference. Brazil:ACM,2016: 342-355 [9] Zhao Jinjing, Wen Yan. Analysis on the effect of prefix hijacking attack and internet hierarchy [C]// 2012 IEEE 12th International Conference on Computer and Information Technology. Chengdu:IEEE, 2012: 375-382 [10] Lad M, Oliveira R, Zhang B, et al. Understanding resiliency of internet topology against prefix hijack attacks [C]// 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN’07). Edinburgh :IEEE, 2007: 368-377 [11] Gill P, Schapira M, Goldberg S. Modeling on quicksand: dealing with the scarcity of ground truth in interdomain routing data[J]. ACM SIGCOMM Computer Communication Review, 2012, 42(1):40-46 [12] Gao Linxin, Rexford J. Stable internet routing without global coordination[J]. IEEE/ACM Transactions on networking, 2001, 9(6):681-692 [13] Patel K, Snijders J, Housley R. A profile for autonomous system provider authorization draft-azimov-sidrops-aspa-profile-01[S]. RFC draft ,2018 [14] Xiang Yang, Wang Zhiliang, Wu Jianping, et al. Sign what you really care about–secure bgp as-paths efficiently[J]. Computer Networks, 2013, 57(10):2250-2265 [15] Katz-B E, Scott C, Choffnes D R, et al. Lifeguard: Practical repair of persistent route failures[J]. ACM SIGCOMM Computer Communication Review, 2012, 42(4):395-406 [16] Lad M, Oliveira R, Zhang Beichuan, et al. Understanding resiliency of internet topology against prefix hijack attacks [C]// 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN’07). Edinburgh :IEEE, 2007: 368-377 [17] Liu Yujing, Dai Bin, Zhu Peidong, et al. Whom to convince? it really matters in bgp prefix hijacking attack and defense [M] Future Information Technology. Berlin Heidelberg:Springer, 2011: 1-10 [18] Gersch J, Massey D. Characterizing vulnerability to ip hijack attempts [C]// 2013 IEEE International Conference on Technologies for Homeland Security (HST). Waltham:IEEE, 2013: 328-333 [19] Zhang Zheng, Zhang Ying, Hu Y C, et al. Ispy: detecting ip prefix hijacking on my own [C]// Proceedings of the ACM SIGCOMM 2008 conference on Data communication. Seattle:ACM,2008: 327-338 [20] Schlamp J, Holz R, Jacquemart Q, et al. Heap: reliable assessment of bgp hijacking attacks[J]. IEEE Journal on Selected Areas in Communications, 2016, 34(6):1849-1861 [21] Kent S, Lynn C, Seo K. Secure border gateway protocol (s-bgp) [J].IEEE Journal on Selected Areas in Communications, 2000,18(4):582-592 [22] Zhang Minggui, Liu Bin, Zhang Beichuan. Safeguarding data delivery by decoupling path propagation and adoption [C]// 2010 Proceedings IEEE INFOCOM. San Diego :IEEE, 2010: 1-5 [23] Gersch J, Massey D. Rover: Route origin verification using dns [C]// 2013 22nd International Conference on Computer Communication and Networks (ICCCN). Nassau:IEEE, 2013: 1-9 [24] Heilman E, Cooper D, Reyzin L, et al. From the consent of the routed: Improving the transparency of the rpki [C]// Proceedings of the 2014 ACM conference on SIGCOMM. Chicago:ACM,2014: 51-62 [25] Gill P, Schapira M, Goldberg S. Let the market drive deployment: A strategy for transitioning to bgp security[J]. ACM SIGCOMM computer communication review, 2011, 41(4):14-25 [26] Lychev R, Goldberg S, Schapira M. Bgp security in partial deployment: Is the juice worth the squeeze? [C]// Proceedings of the ACM SIGCOMM 2013 conference on SIGCOMM. Hong Kong:ACM,2013: 171-182 [27] Goldberg S, Schapira M, Hummon P, et al. How secure are secure interdomain routing protocols[J]. ACM SIGCOMM Computer Communication Review, 2010, 40(4):87-98 [28] White R. Securing bgp through secure origin bgp (sobgp)[J]. Business Communications Review, 2003, 33(5):15-22