Secure Routing Architecture Based on Accountability Realm
Author:
Affiliation:

  • Article
  • | |
  • Metrics
  • |
  • Reference [26]
  • |
  • Related [20]
  • | | |
  • Comments
    Abstract:

    The study proposes a novel routing architecture, accountability realm based routing architecture (Arbra for short), to sovle prefix hijacking, routing forgery and source address spoofing. In Arbra, the accountability realm (AR) is an independently administered network operated by distinct administrative unit and also the basic element of network topology. Because AR should be responsible for the network actions of users in it, the paper calls it the accountability realm. This paper first designs a mapping method from automous system to AR, and then proposes a two-level routing architecture based on AR. Further, the study builds a routing design framework, which mainly includes a hybrid addressing scheme, core routing protocol, identifier mapping protocol, packet transmitting process and public key management mechanism. Finally, Arbra and other famous routing architecture (such as LISP, AIP, etc) are compared, and the study analyzes the security, scalability, performance and deployment of Arbra. Analysis and evaluations show that: (1) Arbra can solve prefix hijacking, route forgery and source address spoofing; (2) the routing table needed by Arbra is smaller, so we can say that Arbra has better scalability; (3) the performance and deployment cost of Arbra is reasonable. Above all, it is clear that Arbra is a feasible secure routing architecture.

    Reference
    [1] Ramachandran A, Feamster N. Understanding the network-level behavior of spammers. Computer Communication Review, 2006,36(4):291-302. [doi: 10.1145/1151659.1159947]
    [2] Ballani H, Francis P, Zhang XY. A study of prefix hijacking and interception in the Internet. In: Proc. of the ACM SIGCOMM2007. 2007. [doi: 10.1145/1282380.1282411]
    [3] Bono VJ. 7007 explanation and apology. 1997. http://www.merit.edu/mail.archives/nanog/1997-04/msg00444.html
    [4] Lad M, Oliveira R, Zhang BC, Zhang LX. Understanding resiliency of internet topology against prefix hijack attacks. In: Proc. ofthe DSN. 2007. [doi: 10.1109/DSN.2007.95]
    [5] Cert advisory CA-1996-21 TCP SYN flooding and IP spoofing attacks. 1996. http://www.cert.org/advisories/CA-1996-21.html
    [6] Touch J. Defending TCP against spoofing attacks. RFC 4953, Internet Engineering Task Force, 2007.
    [7] Moore D, Shannon C, Brown DJ, Voelker GM, Savage S. Inferring Internet denial-of-service activity. ACM Trans. on ComputerSystems, 2006. 115-139. [doi: 10.1145/1132026.1132027]
    [8] Cert advisory CA-1998-01 smurf IP denial-of-service attacks. 1998. http://www.cert.org/advisories/CA-1998-01.html
    [9] Paxson V. An analysis of using reflectors for distributed denial-of-service attacks. ACM Computer Communications Review, 2001,31(3):38-47. [doi: 10.1145/505659.505664]
    [10] Scalzo F. Anatomy of recent DNS reflector attacks from the victim and reflector points of view. Nanog37 Presentation, 2006.
    [11] Subramanian L, Roth V, Stoica I, Shenker S, Katz RH. Listen and whisper: Security mechanisms for BGP. In: Proc. of the Symp.on Networked Systems Design and Implementation (NSDI). 2004.
    [12] Lad M, Massey D, Pei D, Wu YG, Zhang BC, Zhang LX. PHAS: A prefix hijack alert system. In: Proc. of the USENIX SecuritySymp. (Security). 2006.
    [13] Goodell G, Aiello W, Griffin T, Ioannidis J, McDaniel P, Rubin A. Working around BGP: An incremental approach to improvingsecurity and accuracy of interdomain routing. In: Proc. of the ISOC NDSS 2003. 2003.
    [14] Karlin J, Forreat S, Rexford J. Pretty good BGP: Improving BGP by cautiously adopting routes. In: Proc. of the IEEE Int’l Conf. onNetwork Protocols. 2006. [doi: 10.1109/ICNP.2006.320179]
    [15] Ferguson P, Senie D. Network ingress filtering: Defending denial of service attacks which employ IP source address spoofing. RFC2827, Internet Engineering Task Force, 2000.
    [16] Killalea T. Internet service provider security service and procedures. RFC3013, Internet Engineering Task Force, 2000.
    [17] Baker F. Requirements for IP version 4 routers. RFC 1812, Internet Engineering Task Force, 1995.
    [18] Baker F, Savola P. Ingress filtering for multihomed networks. RFC 3704, Internet Engineering Task Force, 2004.
    [19] Li J, Mikovic J, Wang MQ, Reiher P, Zhang LX. SAVE: Source address validity enforcement protocol. In: Proc. of the IEEEINFOCOM. 2002. 1557-1566. [doi: 10.1109/INFCOM.2002.1019407]
    [20] Wu JP, Bi J, Bagnulo M, Baker F. Source address validation improvement framework. Draft-ietf-savi-framework-06, InternetEngineering Task Force, 2011.
    [21] Lü GF, Sun ZG, Lu XC. Enhancing the ability of inter-domain IP spoofing prevention. Ruan Jian Xue Bao/Journal of Software,2010,21(7):1704-1716 (in Chinese with English abstract). http://www.jos.org.cn/1000-9825/3573.htm [doi: 10.3724/SP.J.1001.2010.03573]
    [22] Savage S, Wetherall D, Karlin A, Anderson T. Practical network support for IP traceback. In: Proc. of the ACM SIGCOMM 2000.2000. [doi: 10.1145/347059.347560]
    [23] Bellovin SM. ICMP traceback messages. draft-bellovin-itrace-00, Internet Engineering Task Force, 2000.
    [24] Stone R. CenterTrack: An IP overlay network for tracking DoS floods. In: Proc. of the 9th USENIX Security Symp. 2000. 2000.
    [??九??偡卡??晁漬爠??偲乲???剁??????????湆瑉敔爺渠敆瑡??渠杉楮湴敥敲牮楥湴朠?呲慡獣步??潣牫挮攠???????扣爮??学??嵨?匠灉牅楅湅朠?乎???慏桍愠樲愰渰‵刮?′地攰琵栮攼牢慲氾氊?????教慡獡畲爠楁測朠??卲偲?瑧漠灁漬氠潓杯楮敧猠?眮椠瑐桩?爠潁挠歰敡瑴晨甠敩汤???湩??偣牡潴捩??漠晭?瑣桨敡?????却???佥?????ち????びぴ㈠??孯摓漠楡??ち??????吺丠?呲????????????嵅?扅爠??孭??崠??潓汥瑣畵湲?剴???敮牤朠畐獲潩湶?????漲礰‰????椳渭搱攰洷????佯卩债??昰漮爱??倹瘯???剐??????????渹琹攳爳渰敝琼??渾朊楛渲攷敝爠楋湥杮?吠慓猬欠??潮牮挠敃???づは???戠牓??孵??崠??慲汤步楲渠?????楡湹渠数慲牯?副??剬?倨湓札?晇潐爩??偉癅???削????ち?????湓瑥敬牥湣整瑥??湁杲楥湡敳攠物楮渠权?呭慭獵歮??潡牴捩敯??ㄠ?????戩爬??嬰??崱??水愩欺攵?圲椭氵猹漲渮?卛???漺氠礱愰爮搱?丰???甹瀮琸愳?嘹???愼睢歲 ̄??′?潝氠汎敧爠?????潴捥桮畳浩?剮啳???氠求楇灐琠楴捯?捳畵牰癰敯?捴爠祳灥瑣潵杲牥愠灯桲祩???????挠椨灳桯敂片?猩甮椠瑄敲獡?晴漭牮瑧爭慳湯獢灧潰爭瑢?汰愭祥數牴?獮敳捩畯牮椭琰礰??呉?却???剥??????????渠瑔敡牳湫攠瑆??湣来椬渲攰攰父椮渼杢?吾愊獛欲??漠版捵攠??水?ぐ???扩牧??嬬??嵩??極朠楍琮愠汓?卖椺朠湁愠瑳略牣敵?卥琠慰湡摴慨爠摶???卯卲????整摩敮牧愠汦?楲渠晳潥牣浵慲瑩楮潧渠?灇牐漮挠敉獮猺椠湐杲?獣琮愠湯摦愠牴摨獥?灁畃才氠楓捉慇瑃楏潍湍?′?到??吠′??倴匮?偛啤?????????特?????戴父??嬱?㈱崵??愸敝猼慢牲 ̄??″?潝渠摈極攠?告???慨湵渠慐湄?????慧欠獚案洮椠湓慅爭慂祇慐渺愠湁????印瑲潯楡捣慨????匠桂敇湐欠敳牥?卵??剴佹????剡潮甠瑊楩湡杮?潘湵?映求慡瑯?汊慯扵敲汮獡???潦洠灓畯瑦整牷??潥洬洠甲渰椰挸愬琱椹漨渱利攺瘱椶攷眭??财〨ど?????????????????孧摬潩楳???ぢ??????ㄩ??????????????嵯?戮牯??嬮??崯??栰攰漭渹??????椯洱?夷??奴潭漠湛??????‰渮攳眷′???扐愮獊攮搱‰猰椱朮渲愰琰甸爮攰‰眱椶琷桝?扢慲琾挊桛″瘱敝爠楌晩椠捑愬琠楗潵渠??刬攠灘潵爠瑍?水?じ????ㄠ???牮祧瀠瑘潗氮漠杇祥?敂假牐椺渠瑁??牯捯桤椭癥敮???と????扵牲??孹??嵇??爠慃湨杩敮牥?剥??偯慵杲敮????卦琠慃浯?????慲牳搬眠愲爰攰?愬渳搲?猳漩昺琵眰愶爭攵?渵漠爨浩慮氠?扨慩獮楥獳?愠牷楩瑴桨洠故瑮楧捬?晳潨爠?灢慳楴牲楡湣杴?戮愼獢敲搾?捛爳礲灝琠潗条牮慧瀠桎礬?楚湨?挠桙慊爬愠捚瑨敡牮楧猠瑊楈挬?瑃桨牥敮敧??????呡牮慧渠獂??漠湉??潮浴灩畴瑹攭牂獡????び??????????????ね??孮搠潲楯???の?ㄠ?ひ??呯??????????嵊?扡牮??孵??嵡?唯湊楯癵敲牮獡楬琠祯?漠晓?佦牴敷条潲湥?删漲田琰改嘬椠攲眰猨?瀲爩漺樳攲挲琳?″栲琳琹瀠???眠睃睨?牮潥畳瑥攠癷楩整睨猠?潮牧杬?扳牨??孢??嵲??慴氩氮?????漺搯是牷敷祷?偪???副潲畧琮楣湮术?琰愰戰氭改猸?‵?猳″猹洶愮汨汴敭爠?牤敯慩氺氠礱‰洮申挷栲?戯敓瑐琮敊爮?‰?渱?′倰爰漹挮?″漳昹?瑝格敢??漊瑛丳攳瑝猠??塮????ㄠこ??戠牋??孓??嵵??慴特椠湡慲捣捨楩?????畲汥氠敦牯?嘠???攠祩敮牴?????攠睰楲獯?????漮挠慒瑆潃爠????猬攠灉慮牴慥瑲楮潥湴?灅牮潧瑩潮捥潥汲????協偡????牯慲晣瑥?映愲爰椰渵愮挼换楲?氊楛猳瀴?ㄠ????湘琬攠牌湩攠瑁??湙条楮湧攠敘牗椬渠杗呥慴獨步??潬牬挠敄???ちび???扲牴??孓??嵵?奥愠湡杮?堠坡??坰整瑡桢敬牥愠汳汯?????湡摵整牨獥潮湴?呣??呩噯??????漠獐?汯楣洮椠瑯楦渠杴?湥攠琵睴潨爠歕?慅牎捉桘椠瑓敹捭瑰甮爠敯???????????呓特慳湴??潳渠?乥敳瑩睧潮爠欦椠湉杭???ねづ????????ㄨ????ㄠ有????嬮搠漲椰??????????吸丮?呢?资《せ???ㄠ??つ?嵲sen DG, Balakrishnan H, Feamster N, Keoponen T, Moon D, Shenker S. Accountable Internet protocol (AIP). ComputerCommunication Review, 2008,38(4):339-350. [doi: 10.1145/1402946.1402997]
    [36] Hinden R. New scheme for internet routing and addressing
    Cited by
    Comments
    Comments
    分享到微博
    Submit
Get Citation

卢宁宁,张宏科.一种基于责任域的安全路由体系.软件学报,2013,24(6):1274-1294

Copy
Share
Article Metrics
  • Abstract:3379
  • PDF: 6031
  • HTML: 0
  • Cited by: 0
History
  • Received:July 15,2011
  • Revised:May 31,2012
  • Online: June 07,2013
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-4
Address:4# South Fourth Street, Zhong Guan Cun, Beijing 100190,Postal Code:100190
Phone:010-62562563 Fax:010-62562533 Email:jos@iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063