On the risk of misbehaving RPKI authorities

Cooper, Danny; Heilman, Ethan; Brogle, Kyle; Reyzin, Leonid; Goldberg, Sharon

doi:10.1145/2535771.2535787

Cited by 67 publications

(73 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The reason why we make this transform will be explained in the Subsection 2.4. According to ability of an authority impersonating users, there are three levels of trust [27] as follows in Tab. 1.…”

Section: Public/private Key Pairs Issuing For Prefix Ownersmentioning

confidence: 99%

A DSA-based scheme for defending against IP prefix hijacking without repositories

Yang

2016

Teh. vjesn.

View full text Add to dashboard Cite

Original scientific paper IP prefix hijacking poses a serious threat to the security of the Internet. Cryptographic authenticating origin ASes (Autonomous Systems) of advertised prefix, which is an effective way of preventing IP prefix hijacking, has received wide acceptance. However, these existing schemes received various critical comments on their inefficiency when cryptographic authenticating origin ASes. For improving efficiency, we take full advantage of specific characteristics of DSA (Digital Signature Algorithm) and thus present a scheme for preventing IP prefix hijacking. There are two characteristics, which are DSA-based and efficient, in the proposed scheme. Firstly, because DSA is a United States Federal Government standard for digital signatures, the DSA-based can maintain compatibility with the DSA and its analytical tools, and thus it is easier for proposed scheme to be widely accepted and applied into practice. Secondly, public key certificates are not necessary because public keys can be computed by using a formula. Separated verifying signatures in these certificates, which are inevitable in almost all existing cryptography-based schemes, can be replaced with computing of a multi-exponentiation formula. Thus, the efficiency is achieved. Keywords: certificates; DSA; IP prefix hijacking; multi-exponentiation Shema za obranu od krađe IP prefiksa bez repozitorija utemeljena na DSAIzvorni znanstveni članak Krađa IP prefiksa predstavlja ozbiljnu prijetnju za sigurnost Interneta. Kriptografsko ustanovljavanje autentičnosti porijekla ASes (Autonomnih Sustava) oglašenog prefiksa, što predstavlja učinkovit način sprećavanja krađe IP prefiksa, široko je prihvaćeno. Međutim, postojećim se shemama upućuju različiti kritički komentari vezani za njihovu neučinkovitost kod kriptografskog ustanovljavanja autentičnosti porijekla ASes. U svrhu poboljšanja učinkovitosti, koristimo prednosti specifičnih obilježja DSA (Digital Signature Algorithm) te predstavljamo shemu za sprećavanje krađe IP prefiksa. Postoje dva obilježja predložene sheme, temeljena na DSA i učinkovita. Prvo, budući da je DSA standard za digitalne potpise federalne vlade SAD, DSA temeljeno obilježje može zadržati kompatibilnost s DSA i njegovim analitičkim alatima te je na taj način olakšano široko prihvaćanje i primjena u praksi predložene sheme. Drugo, državni ključni certifikati (key certificates) nisu potrebni jer se mogu izračunati pomoću formule. Odvojeni potpisi za verifikaciju u tim certifikatima, koji su neizbježni u gotovo svim postojećim shemama temeljenim na kriptografiji, mogu se zamijeniti računanjem multi-eksponencijalne formule. Na taj je način postignuta učinkovitost.

show abstract

Section: Public/private Key Pairs Issuing For Prefix Ownersmentioning

confidence: 99%

A DSA-based scheme for defending against IP prefix hijacking without repositories

Yang

2016

Teh. vjesn.

View full text Add to dashboard Cite

show abstract

“…The main reasons for slow deployment have been limited incentive for independent organizations, and because there is no single centralized authority that can mandate the deployment of a (common) security solution. Deployment may also have been hampered by political and business implications from hierarchal RPKI management giving some entities (e.g., RIRs) significant control over global Internet routing [15].…”

Section: B Bgp Security and Monitoringmentioning

confidence: 99%

Crowd-based detection of routing anomalies on the internet

Hiran

Carlsson

Shahmehri

2015

2015 IEEE Conference on Communications and Network Security (CNS)

View full text Add to dashboard Cite

Abstract-The Internet is highly susceptible to routing attacks and there is no universally deployed solution that ensures that traffic is not hijacked by third parties. Individuals or organizations wanting to protect themselves from sustained attacks must therefore typically rely on measurements and traffic monitoring to detect attacks. Motivated by the high overhead costs of continuous active measurements, we argue that passive monitoring combined with collaborative information sharing and statistics can be used to provide alerts about traffic anomalies that may require further investigation. In this paper we present and evaluate a user-centric crowd-based approach in which users passively monitor their network traffic, share information about potential anomalies, and apply combined collaborative statistics to identify potential routing anomalies. The approach uses only passively collected round-trip time (RTT) measurements, is shown to have low overhead, regardless if a central or distributed architecture is used, and provides an attractive tradeoff between attack detection rates (when there is an attack) and false alert rates (needing further investigation) under normal conditions. Our data-driven analysis using longitudinal and distributed RTT measurements also provides insights into detector selection and the relative weight that should be given to candidate detectors at different distances from the potential victim node.

show abstract

“…The paper "On the Risk of Misbehaving RPKI Authorities" [31] explains how the RPKI model can impact the Internet if authorities don't behave as they are supposed to. Further analysis is certainly required on RPKI, which carries part of BGP security.…”

Section: Sidr -Secure Inter-domain Routingmentioning

confidence: 99%