RISP: An RPKI-based inter-AS source protection mechanism

Abstract

IP source address spoofing is regarded as one of the most prevalent components when launching an anonymous invasion, especially a Distributed Denial-of-Service (DDoS) attack. Although Source Address Validations (SAVs) at the access network level are standardized by the Internet Engineering Task Force (IETF), SAV at the inter-Autonomous System (AS) level still remains an important issue. To prevent routing hijacking, the IETF is constructing a Resource Public Key Infrastructure (RPKI) as a united trust anchor to secure interdomain routing. In this study, we creatively use the RPKI to support inter-AS SAV and propose an RPKI-based Inter-AS Source Protection (RISP) mechanism. According to the trust basis provided by the RPKI, RISP offers ASes a more credible source-oriented protection for the IP addresses they own and remains independent of the RPKI. Based on the experiments with real Internet topology, RISP not only provides better incentives, but also improves efficacy and economizes bandwidth with a modest resource consumption.

ZbSR: A Data Plane Security Model of SR-BE/TE based on Zero-Trust Architecture

“…TrueNet mechanism deploys trusted computing module (TCB) in each node of the network, and determines malicious links through multi-node security information negotiation [18] centralization of control SDN architecture is usually adopted, such as VeriDP algorithm, which verifies whether the data is transmitted normally through control plane policy, thus improving the accuracy of network behavior detection [19]. DFL mechanism collects the verification information of nodes in the transmission path in a centralized way, but it is difficult to avoid a single point of failure [20] collaborative filtering RISP uses RPKI to protect the inter-domain communication of source address, and completes traffic filtering through the cooperation of server, alliance center and AS border router [21] New technology Using blockchain to build a distributed trust framework can be used for inter-domain routing protocol to realize IP address prefix authentication [22] 2…”

A data plane security model of SR-BE/TE based on zero-trust architecture

“…RPKI uses digital signature and certificate to authenticate routing source, which can effectively prevent route hijacking 16 ; due to the limited deployment of RPKI infrastructure, Tomas and others put forward DISCO, which is based on distributed trust architecture to authenticate routing 17 Trusted hardware TrueNet mechanism deploys TCB(Trusted Computing Base) in each node of the network, and determines malicious links through multi-node security information negotiation 18 Centralization of control SDN architecture is usually adopted, such as VeriDP algorithm, which verifies whether the data is transmitted normally through control plane policy, thus improving the accuracy of network behavior detection 19 . DFL mechanism collects the verification information of nodes in the transmission path in a centralized way, but it is difficult to avoid a single point of failure 20 Collaborative filtering RISP uses RPKI to protect the inter-domain communication of source address, and completes traffic filtering through the cooperation of server, alliance center and AS border router 21 New technology Using blockchain to build a distributed trust framework can be used for inter-domain routing protocol to realize IP address prefix authentication 22 …”

“…Literature [12][13][14][15][16][17][18][19][20][21][22] puts forward a variety of mainstream routing security mechanisms, summarized into 6 categories in this paper, as shown in Table 2. These mechanisms did not consider the label and source routing characteristics of the SR network, and could not directly migrate to the SR scene, nor did they consider and deal with the threats they faced as a whole, so their universality was limited.…”