How secure are secure interdomain routing protocols?

Abstract

In response to high-profile Internet outages, BGP security variants have been proposed to prevent the propagation of bogus routing information. To inform discussions of which of these variants should be deployed in the Internet, we quantify the ability of the main protocols (origin authentication, soBGP, S-BGP, and data-plane verification) to blunt trafficattraction attacks; i.e., , an attacker that deliberately attracts traffic to drop, tamper, or eavesdrop on packets.Intuition suggests that an attacker can maximize the amount of traffic he attracts by widely announcing a short path that is not flagged as bogus by the secure protocol. Through simulations on an empirically-determined AS-level topology, we show that this strategy is surprisingly effective, even when the network uses an advanced security solution like S-BGP or data-plane verification. Worse yet, we show that these results underestimate the severity of attacks. We prove that finding the most damaging strategy is NP-hard, and show how counterintuitive strategies, like announcing longer paths, announcing to fewer neighbors, or triggering BGP loop-detection, can be used to attract even more traffic the strategy above. These counterintuitive examples are not merely hypothetical; we searched the empirical AS topology to identify specific ASes that can launch them. Finally, we find that a clever export policy can often attract almost as much traffic as a bogus path announcement. Thus, our work implies that mechanisms that police export policies (e.g., defensive filtering) are crucial, even if S-BGP is fully deployed.

Privacy-Preserving Interdomain Routing at Internet Scale

“…Each AS a computes routes to a given destination AS dest based on a ranking of simple (loop-free) routes between itself and the destination, and an export policy, which specifies, for any such route, the set of neighbors to which that route should be announced. We next present a specific model of routing policies that is often used to simulate BGP routing (see, e.g., [4,31,32]). …”

On the risk of misbehaving RPKI authorities

“…Open Problems. The routing security improvements promised by the RPKI [8,18,29] motivate efforts to harden the RPKI against errors, misconfigurations, and abuse; indeed, concurrently to our work there have been new steps in this direction in the IETF [7,16,25]. There are a number of issues to address.…”

“…Moreover, almost all of the routing attacks seen in the wild (e.g., [13,32,40]) could be prevented if Internet routers dropped routes that the RPKI deems invalid; dropping RPKI-invalid routes is also surprisingly effective against more advanced routing attacks, even those that the RPKI was not designed to prevent [18,29].…”

Economics of traffic attraction by transit providers

“…Again with an exclusive focus on security rather than traffic economics, [9] concludes that filtering is ineffective and that S-BGP is too heavy to get deployed. Goldberg et al [8] study robustness of S-BGP and other secure routing protocols to traffic attraction. [8] argues that the secure routing protocols fail to neutralize traffic attraction and need to be supplemented with defensive filtering.…”

“…Goldberg et al [8] study robustness of S-BGP and other secure routing protocols to traffic attraction. [8] argues that the secure routing protocols fail to neutralize traffic attraction and need to be supplemented with defensive filtering.…”