PROJECT TITLE :

Invalidating Idealized BGP Security Proposals and Countermeasures

ABSTRACT:

Border Gateway Protocol (BGP) is prone to routing attacks as a result of of the shortage of inherent verification mechanism. Many secure BGP schemes have been proposed to stop routing attacks by leveraging cryptographic verification of BGP routing updates. During this paper, we tend to gift a replacement sort of attacks, known as TIGER, which aims to invalidate the “proven” security of these secure BGP schemes and allow ASes to announce cast routes even underneath full deployment of any existing secure BGP proposal. By launching TIGER attacks, malicious ASes will simply generate and announce forged routes that will be successfully verified by the present secure BGP schemes. Furthermore, TIGER attacks can evade existing routing anomaly detection schemes by guaranteeing routing knowledge-plane availability and consistency of management- and knowledge-plane. Toward a brand new securing BGP theme, we propose Anti-TIGER to detect and defend against TIGER attacks. Anti-TIGER allows strong TIGER detection by collaborations between ASes. In explicit, we tend to leverage Unfold Spectrum Communication technique to watermark bound special probing packets, which manifest the existence of TIGER attacks. Anti-TIGER does not need any modifications in routing knowledge-plane, so it's simple to deploy and incrementally deployable. We evaluate the effectiveness of TIGER and Anti-TIGER by experiments with real AS topologies of the Internet. Our experiment results show that TIGER attacks can successfully hijack a substantial variety of prefixes. Within the meanwhile, Anti-TIGER will achieve a hundred p.c detection ratio of TIGER attacks.