Multipath Inter-Domain Routing Decision Verification Protocol

Abstract:

Because of complicated security policy collisions and twisted interest conflicts in network domains, inter-domain routing security has been a challenge of secure routing. At present most of related researches focus on the authentication of routing source and true path, but seldom addresses another point of whether the routing decision process matches expected policy. In this paper, a multipath inter-domain routing decision verification protocol was designed, which can verify whether an autonomous domain (AD) keeps its promise about choosing appropriate M from N paths that have the same destination and are received from upstream ADs, and sending to a downstream AD. According to the analysis, the protocol is valid and can protect privacy of participants, as well as can resist attacks such as forgery, modification and replay etc. and deploy on internet incrementally.

• Periodical: Applied Mechanics and Materials (Volumes 713-715)
• Pages: 2269-2275
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.713-715.2269
• Online since: January 2015
• Authors: Xiu Feng Qiu*, Jian Wei Liu, Qian Hong Wu, Qi Zhong
• Keywords: Inter-Domain Routing Decision, PROMISE, Verification

References

[1] Geoff H, Mattia Ri, Grenville A. Securing BGP - A Literature Survey[J]. IEEE Communications Surveys & Tutorials. 2011, 13(2)199-222.

DOI: 10.1109/surv.2011.041010.00041

[2] Kent S, Lynn C, Seo K. Secure border gateway protocol(S-BGP)[J]. IEEE Journal on Selected Areas in Communicatiom, 2000, 8(4)582-592.

DOI: 10.1109/49.839934

[3] White R. Architecture and deployment considerations for secure origin bgp(soBGP)[EB/OL]. (2006-6-15) [2013-4-25]. IETF Internet draft. http: /tools. ietf. org/html/draft-white-sobgp -architecture -02. 2014. 8. 15.

[4] P C VAN OORSCHOT, TAO WAN, EVANGELOS KRANAKIS. On Inter-domain routing security and pretty secure BGP(psBGP) [J]. ACM Transactions on Information and System Security. 2007, 10(3)1-41.

DOI: 10.1145/1266977.1266980

[5] Xin Zhang, Hsu-chun Hsiao, Geoffrey H et al. SCION: Scalability, control, and isolation on next-generation networks[C]. IEEE Symposium on Security and Privacy. USA, IEEE , 2011, 212-227.

DOI: 10.1109/sp.2011.45

[6] M. Lepinski, Ed. BGPSEC Protocol Specification, draft-ietf-sidr-bgpsec -protocol-08[EB/OL]. [2013-11-5], IETF Internet draft. http: /tools. ietf. org/id/draft-ietf-sidr-bgpsec–protocol -08. txt, 2014. 8. 15.

DOI: 10.17487/rfc8205

[7] Mingchen Zhao, Wenchao Zhou, Alexander J.T. Gurney et al. Private and verifiable interdomain routing decisions[C]. ACM SIGCOMM, Finland, ACM, 2012, 383-394.

DOI: 10.1145/2377677.2377755

[8] David G A, Hari B, Nick F et al.  Accountable Internet Protocol (AIP)[C]. ACM SIGCOMM, USA, 2008, 339-350.

[9] Geoffrey G, William A, Timothy G et al, Working around BGP: An incremental approach to improving security and accuracy of interdomain routing[C]. Network and Distributed System Security Symposium, USA, ISOC , (2003).

[10] Jad N, Michael W, A. Nicolosi, Antonio N et al. Verifying and enforcing network paths with icing[C]. ACM CoNEXT, Japan, ACM, (2011).

[11] Andreas H, Ioannis A, Jennifer R et al. NetReview: Detecting when interdomain routing goes wrong[C]. Proceedings of the 6th USENIX symposium on Networked systems design and implementation, USA, USENIX, 2009, 437-452.

[12] Andreas H, Petr K, Peter D. PeerReview: Practical accountability for distributed systems[C]. Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, USA, ACM, 2007, 175-188.

DOI: 10.1145/1294261.1294279

[13] N. Feamster, Z. M. Mao, and J. Rexford. BorderGuard: Detecting cold potatoes from peers[C]. Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, Italy, ACM, 2004, 213-218.

DOI: 10.1145/1028788.1028815