Towards A Longitudinal Study of Adoption of RPKI-Based Route Filtering
|
|
|
- Toby Austin
- 5 years ago
- Views:
Transcription
1 1 Towards A Longitudinal Study of Adoption of RPKI-Based Route Filtering Ethan Katz-Bassett (University of Southern California) with: Andreas Reuter and Matthias Wahlisch (Freie Universität Berlin), Brandon Schlinker (), Italo Cunha ( Brazil), Randy Bush (IIJ), Thomas C. Schmidt (HAW Hamburg), Doug Montgomery (NIST) Supported By:
2 Background Prefix hijack prevention using Resource Public Key Infrastructure requires three steps: Route Origin Authorization (ROA) + Route Origin + Local Policy Validation Attests which AS is authorized to announce IP prefix Router operation to verify BGP Updates based on ROA data Decide handling of invalid BGP routes: drop? prefer valid?
3 Problem Statement & Challenge Prefix hijack prevention using Resource Public Key Infrastructure requires three steps: Route Origin Authorization (ROA) + Route Origin + Local Policy Validation Attests which AS is authorized to announce IP prefix Router operation to verify BGP Updates based on ROA data Decide handling of invalid BGP routes: drop? prefer valid? Goal: Measure the adoption of RPKI-based filter policies.
4 Problem Statement & Challenge Prefix hijack prevention using Resource Public Key Infrastructure requires three steps: Route Origin Authorization (ROA) + Route Origin Validation + Local Policy Attests which AS is authorized to announce IP prefix Public Data Router operation to verify BGP Updates based on ROA data Private Data Decide handling of invalid BGP routes: drop? prefer valid? Goal: Measure the adoption of RPKI-based filter policies. Challenge: Private data must be inferred from measurements.
5 Uncontrolled experiments are unsuitable Natural (uncontrolled) experiments can lead to incorrect inference: Suppose an AS is announcing a valid prefix and an invalid one. Can we compare the 2 paths to infer route origin validation? NO! Not definitively, as multiple explanations are plausible: Origin Observation: Possible ROV inference: Alternate explanation: Same paths Different paths No path to invalid No ROV Monitor Origin ROV policy to prefer valid, but none exist ROV on path TE by Origin Monitor Origin ROV on path Monitor Limited visibility: Peer route not exported to monitor
6 Hand-crafted ROAs and active BGP Updates from testbed.
7 Hand-crafted ROAs and active BGP Updates from testbed. L3 Hurr. Electric
8 Hand-crafted ROAs and active BGP Updates from testbed. L3 Hurr. Electric
9 Hand-crafted ROAs and active BGP Updates from testbed. L3 Hurr. Electric
10 Hand-crafted ROAs and active BGP Updates from testbed. P L3 P Hurr. Electric
11 Hand-crafted ROAs and active BGP Updates from testbed. P L3 P P Hurr. Electric
12 Hand-crafted ROAs and active BGP Updates from testbed. P L3 P Hurr. L3 Electric P P
13 Hand-crafted ROAs and active BGP Updates from testbed. P L3 P Hurr. L3 Electric P P
14 Hand-crafted ROAs and active BGP Updates from testbed. P L3 P Hurr. L3 Electric P P
15 Hand-crafted ROAs and active BGP Updates from testbed. P L3 P Hurr. L3 Electric P P
16 Hand-crafted ROAs and active BGP Updates from testbed. P L3 P Hurr. L3 Electric P P
17 Hand-crafted ROAs and active BGP Updates from testbed. P P L3 P Hurr. L3 Electric P P
18 Hand-crafted ROAs and active BGP Updates from testbed. P P L3 P L3 P Hurr. L3 Electric P P
19 Hand-crafted ROAs and active BGP Updates from testbed. P P L3 P L3 P Hurr. L3 Electric P P P
20 Hand-crafted ROAs and active BGP Updates from testbed. P P L3 P L3 P Hurr. L3 Electric P P P
21 Hand-crafted ROAs and active BGP Updates from testbed. P P L3 P L3 P Hurr. L3 Electric P P P
Measuring Adoption of RPKI Route Origin Validation and Filtering
PEERING The BGP Testbed Measuring Adoption of RPKI Route Origin Validation and Filtering Andreas Reuter (andreas.reuter@fu-berlin.de) Joint work with Randy Bush, Ethan Katz-Bassett, Italo Cunha, Thomas
Measuring the Adoption of Route Origin Validation and Filtering
Measuring the Adoption of Route Origin Validation and Filtering Andreas Reuter (andreas.reuter@fu-berlin.de) Joint work with Randy Bush, Ethan Katz-Bassett, Italo Cunha, Thomas C. Schmidt, and Matthias
RPKI MIRO & RTRlib. Andreas Reuter, Matthias Wählisch Freie Universität Berlin
RPKI MIRO & RTRlib RIPE 74, Budapest Andreas Reuter, Matthias Wählisch Freie Universität Berlin {andreas.reuter,m.waehlisch}@fu-berlin.de Thomas Schmidt HAW Hamburg t.schmidt@haw-hamburg.de RPKI Overview
Measuring RPKI Route Origin Validation in the Wild
Master Thesis Measuring RPKI Route Origin Validation in the Wild Andreas Reuter Matr. 4569130 Supervisor: Prof. Dr. Matthias Wählisch Institute of Computer Science, Freie Universität Berlin, Germany January
Towards a Rigorous Methodology for Measuring Adoption of RPKI Route Validation and Filtering
Towards a Rigorous Methodology for Measuring Adoption of RPKI Route Validation and Filtering Andreas Reuter Freie Universitaet Berlin andreas.reuter@fuberlin.de Ethan Katz-Bassett USC / Columbia University
PEERING: An AS for Us
1 : An AS for Us Ethan Katz-Bassett (University of Southern California) with: Brandon Schlinker and Kyriakos Zarifis (USC) Italo Cunha (UFMG Brazil) Nick Feamster (Georgia Tech) Supported By: : An AS for
Impactful Routing Research with the PEERING Testbed
1 Impactful Routing Research with the PEERING Testbed Combining intradomain emulation with real BGP connectivity Ethan Katz-Bassett (University of Southern California) with: Brandon Schlinker and Kyriakos
RTRlib. An Open-Source Library in C for RPKI-based Prefix Origin Validation. Matthias Wählisch, Fabian Holler, Thomas C. Schmidt, Jochen H.
RTRlib An Open-Source Library in C for RPKI-based Prefix Origin Validation Matthias Wählisch, Fabian Holler, Thomas C. Schmidt, Jochen H. Schiller m.waehlisch@fu-berlin.de schmidt@informatik.haw-hamburg.de
Some Thoughts on Integrity in Routing
Some Thoughts on Integrity in Routing Geoff Huston Chief Scientist, APNIC What we want We want the routing system to advertise the correct reachability information for legitimately connected prefixes at
Publish Subscribe Deployment Option for NDN in the Constrained IoT
Publish Subscribe Deployment Option for NDN in the Constrained IoT draft-gundogan-icnrg-pub-iot-02 Cenk Gündoğan 1 Thomas Schmidt 1 Matthias Wählisch 2 1 HAW Hamburg 2 Freie Universität Berlin March 18,
RPKI Workshop Routing Lab
RPKI Workshop Routing Lab NANOG / Denver 2011.06.12 Randy Bush Michael Elkins Rob Austein Serpil Bayraktar 2011.06.12 RPKI Router Lab
Securing BGP: The current state of RPKI. Geoff Huston Chief Scientist, APNIC
Securing BGP: The current state of RPKI Geoff Huston Chief Scientist, APNIC Incidents What happens when I announce your addresses in BGP? All the traffic that used to go to you will now come to me I can
Jumpstarting BGP Security. Yossi Gilad Joint work with: Avichai Cohen, Amir Herzberg, and Michael Schapira
Jumpstarting BGP Security Yossi Gilad Joint work with: Avichai Cohen, Amir Herzberg, and Michael Schapira Prefix hijacking Victim Path: 111 AS X AS 111 Boston University BGP Ad. AS 666 Data flow 2 Prefix
Resource Certification
Resource Certification Guide to Resource Certification in MyAPNIC Registration Guide for MyAPNIC Page 1 of 11 Table of Contents 1 Guide to Resource Certification in MyAPNIC... 3 1.1 Access to Resource
BGP Origin Validation (RPKI)
University of Amsterdam System & Network Engineering BGP Origin Validation (RPKI) July 5, 2013 Authors: Remy de Boer Javy de Koning Supervisors: Jac Kloots
Idealized BGPsec: Formally Verifiable BGP
Idealized BGPsec: Formally Verifiable BGP JaNOG 27.5 / Tokyo 2011.04.14 Randy Bush for the Informal BGPsec Design Group 2011.04.14 JaNOG BGPsec 1 Informal BGPsec Group chris morrow (google)
Internet Engineering Task Force (IETF) Category: Informational ISSN: February 2012
Internet Engineering Task Force (IETF) G. Huston Request for Comments: 6483 G. Michaelson Category: Informational APNIC ISSN: 2070-1721 February 2012 Abstract Validation of Route Origination Using the
Life After IPv4 Depletion
1 Life After IPv4 Depletion Jon Worley Analyst Securing Core Internet Functions Resource Certification, RPKI Mark Kosters Chief Technology Officer 2 Core Internet Functions: Routing & DNS The Internet
BGP Configuration Automation on Edge Routers
BGP Configuration Automation on Edge Routers System and Network Engineering Msc. Research Project Stella Vouteva & Tarcan Turgut Supervisor: Stavros Konstantaras, NLNetLabs Introduction Big Internet Depletion
Sibyl A Practical Internet Route Oracle
Sibyl A Practical Internet Route Oracle Ítalo Cunha1, Pietro Marchetta2, Matt Calder3, Yi-Ching Chiu3 Brandon Schlinker3, Bruno Machado1, Antonio Pescapè2 Vasileios Giotsas4, Harsha Madhyastha5, Ethan
Internet Engineering Task Force (IETF) Request for Comments: Google K. Patel Cisco Systems August 2015
Internet Engineering Task Force (IETF) Request for Comments: 7607 Updates: 4271 Category: Standards Track ISSN: 2070-1721 W. Kumari R. Bush Internet Initiative Japan H. Schiller K. Patel Cisco Systems
Implementation of RPKI and IRR filtering on the AMS-IX platform. Stavros Konstantaras NOC Engineer
Implementation of RPKI and IRR filtering on the AMS-IX platform Stavros Konstantaras NOC Engineer RIPE EDUCA 2018 Agenda AMS-IX Route Servers Architecture Features Filtering IRRdb RPKI BGP Communities
The RPKI & Origin Validation
The RPKI & Origin Validation RIPE / Praha 2010.05.03 Randy Bush Rob Austein Steve Bellovin And a cast of thousands! Well, dozens :) 2010.05.03 RIPE RPKI
Problem Statement and Considerations for ROA Mergence. 96 SIDR meeting
Problem Statement and Considerations for ROA Mergence draft-yan-sidr-roa-mergence-00 @IETF 96 SIDR meeting fuyu@cnnic.cn Background RFC 6482 1/19 ROA mergence What is the ROA mergence? is a common case
The RPKI and BGP Origin Validation
The RPKI and BGP Origin Validation APRICOT / New Delhi 2012.02.27 Randy Bush Rob Austein Steve Bellovin And a cast of thousands! Well, dozens :) 2012.02.27
BGP Origin Validation
BGP Origin Validation ISP Workshops These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/) Last updated
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI RIPE 56 / Berlin 2008.05.07 Randy Bush http://rip.psg.com/~randy/080507.ripe-v4-trad-rpki.pdf 2008.05.07 RIPE v4 Trade RPKI 2 Internet Initiative Japan
Internet Engineering Task Force (IETF) Updates: 6811 September 2018 Category: Standards Track ISSN:
Internet Engineering Task Force (IETF) R. Bush Request for Comments: 8481 Internet Initiative Japan Updates: 6811 September 2018 Category: Standards Track ISSN: 2070-1721 Abstract Clarifications to BGP
Resource Certification. Alex Band, Product Manager DENIC Technical Meeting
Resource Certification Alex Band, Product Manager DENIC Technical Meeting Internet Routing Routing is non-hierarchical, open and free Freedom comes at a price: - You can announce any address block on your
APNIC s role in stability and security. Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013
APNIC s role in stability and security Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013 Overview Introducing APNIC Working with LEAs The APNIC Whois Database
Secure Routing with RPKI. APNIC44 Security Workshop
Secure Routing with RPKI APNIC44 Security Workshop Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
Security in inter-domain routing
DD2491 p2 2011 Security in inter-domain routing Olof Hagsand KTH CSC 1 Literature Practical BGP pages Chapter 9 See reading instructions Beware of BGP Attacks (Nordström, Dovrolis) Examples of attacks
The RPKI & Origin Validation
The RPKI & Origin Validation NANOG / Denver 2011.06.12 Randy Bush Rob Austein Steve Bellovin Michael Elkins And a cast of thousands!
RPKI in practice. Sebastian Wiesinger DE-CIX Technical Meeting June 2017
RPKI in practice Sebastian Wiesinger sebastian.wiesinger@noris.net DE-CIX Technical Meeting June 2017 Generate ROAs Generate ROAs for your prefixes RIPE NCC makes this very easy Available at the LIR portal
Introducción al RPKI (Resource Public Key Infrastructure)
Introducción al RPKI (Resource Public Key Infrastructure) Roque Gagliano rogaglia@cisco.com 4 Septiembre 2013 Quito, Equator 2011 Cisco and/or its affiliates. All rights reserved. 1 Review of problem to
Misdirection / Hijacking Incidents
Security Tutorial @ TWNOG SECURE ROUTING WITH RPKI 1 Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
Deploying RPKI An Intro to the RPKI Infrastructure
Deploying RPKI An Intro to the RPKI Infrastructure VNIX-NOG 24 November 2016 Hanoi, Vietnam Issue Date: Revision: Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours)
An introduction to BGP security
An introduction to BGP security Marco d Itri @rfc1036 Seeweb s.r.l. Albanian Network Operators Group meeting - 14 November 2018 Internet: independent networks exchanging traffic The Internet
BGP Route Security Cycling to the Future! Alexander Azimov Qrator Labs
BGP Route Security Cycling to the Future! Alexander Azimov Qrator Labs aa@qrator.net Malicious Hijacks/Leaks FISHING SITES HIJACK OF HTTPS CERTIFICATES SPAM/BOTNET ACTIVITY DOS ATTACKS BGP Hijack Factory
Securing Core Internet Functions Resource Certification, RPKI. Mark Kosters ARIN CTO
Securing Core Internet Functions Resource Certification, RPKI Mark Kosters ARIN CTO Core Internet Functions: Routing & DNS The Internet relies on two critical resources DNS: Translates domain names to
BGP Origin AS Validation
The feature helps prevent network administrators from inadvertently advertising routes to networks they do not control. This feature uses a Resource Public Key Infrastructure (RPKI) server to authenticate
LIFEGUARD: Practical Repair of Persistent Route Failures
LIFEGUARD: Practical Repair of Persistent Route Failures Ethan Katz-Bassett (USC) Colin Scott, David Choffnes, Italo Cunha, Valas Valancius, Nick Feamster, Harsha Madhyastha, Tom Anderson, Arvind Krishnamurthy
The Transition to BGP Security Is the Juice Worth the Squeeze?
The Transition to BGP Security Is the Juice Worth the Squeeze? RPKI Sharon Goldberg Boston University November 2013 Work with Kyle Brogle (Stanford), Danny Cooper (BU), Ethan Heilman (BU), Robert Lychev
Active BGP Measurement with BGP-Mux. Ethan Katz-Bassett (USC) with testbed and some slides hijacked from Nick Feamster and Valas Valancius
Active BGP Measurement with BGP-Mux Ethan Katz-Bassett (USC) with testbed and some slides hijacked from Nick Feamster and Valas Valancius 2 Before I Start Georgia Tech system, I am just an enthusiastic
Resource Certification
Resource Certification CISSP, science group manager RIPE NCC robert@ripe.net 1 Contents Motivation for Resource Certification (RPKI) Architecture overview Participating in RPKI Most importantly: use cases
An Operational ISP & RIR PKI
An Operational ISP & RIR PKI ARIN / Montreal 2006.04.10 Randy Bush Quicksand Unknown quality of whois data Unknown quality of IRR data No formal
Robust Inter-Domain Routing
Establishing the Technical Basis for Trustworthy Networking Robust Inter-Domain Routing Addressing Systemic Vulnerabilities in BGP Doug Montgomery (dougm@nist.gov) Manager, Internet and Scalable Systems
Idealized BGPsec: Formally Verifiable BGP
Idealized BGPsec: Formally Verifiable BGP 2011.05.04 Randy Bush for the Informal BGPsec Design Group 2011.05.04 RIPE BGPsec 1 Informal BGPsec Group chris morrow (google) pradosh mohapatra
Idealized BGPsec: Formally Verifiable BGP
Idealized BGPsec: Formally Verifiable BGP 2011.04.10 Randy Bush for the Informal BGPsec Design Group 2011.04.10 ARIN BGPsec 1 Informal BGPsec Group chris morrow (google) pradosh mohapatra
ISP 1 AS 1 Prefix P peer ISP 2 AS 2 Route leak (P) propagates Prefix P update Route update P Route leak (P) to upstream 2 AS 3 Customer BGP Update messages Route update A ISP A Prefix A ISP B B leaks
Verifying Wide-Area Routing Configuration
Verifying Wide-Area Routing Configuration Nick Feamster and Hari Balakrishnan M.I.T. Computer Science and Artificial Intelligence Laboratory {feamster,hari}@csail.mit.edu http://nms.lcs.mit.edu/bgp/ BGP
Understanding BGP Miscounfiguration
Understanding Archana P Student of Department of Electrical & Computer Engineering Missouri University of Science and Technology appgqb@mst.edu 16 Feb 2017 Introduction Background Misconfiguration Outline
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC Target Audience Knowledge of Internet Routing(specially BGP) Fair idea on Routing Policy No need to know Cryptography Basic knowledge
RPKI. Resource Pubic Key Infrastructure
RPKI Resource Pubic Key Infrastructure Purpose of RPKI RPKI replaces IRR or lives side by side? Side by side: different advantages Security, almost real time, simple interface: RPKI Purpose of RPKI Is
Update on Resource Certification. Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008
Update on Resource Certification Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008 Address and Routing Security What we have had for many years is a relatively insecure interdomain routing system
Internet Engineering Task Force (IETF) BCP: 185 January 2014 Category: Best Current Practice ISSN:
Internet Engineering Task Force (IETF) R. Bush Request for Comments: 7115 Internet Initiative Japan BCP: 185 January 2014 Category: Best Current Practice ISSN: 2070-1721 Abstract Origin Validation Operation
BGP Routing Security and Deployment Strategies
Bachelor Informatica Informatica Universiteit van Amsterdam BGP Routing Security and Deployment Strategies Bryan Eikema June 17, 2015 Supervisor(s): Benno Overeinder (NLnet Labs), Stavros Konstantaras
Methods for Detection and Mitigation of BGP Route Leaks
Methods for Detection and Mitigation of BGP Route Leaks ietf-idr-route-leak-detection-mitigation-00 (Route leak definition: draft-ietf-grow-route-leak-problem-definition) K. Sriram, D. Montgomery, and
RPKI and Internet Routing Security ~ The regional ISP operator view ~
RPKI and Internet Routing Security ~ The regional ISP operator view ~ APNIC 29/APRICOT 2010 NEC BIGLOBE, Ltd. (AS2518) Seiichi Kawamura 1 Agenda Routing practices of the regional ISP today How this may
RPKI Introduction. APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By:
RPKI Introduction APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By: 1 Content Why do we need RPKI What is RPKI How to deploy RPKI Configuration case Misdirection / Hijacking Incidents
Internet Kill Switches Demystified
Internet Kill Switches Demystified Benjamin Rothenberger, Daniele E. Asoni, David Barrera, Adrian Perrig EuroSec 17, Belgrade B.Rothenberger 23.04.2017 1 B.Rothenberger 23.04.2017 2 Internet Kill Switches
Internet-Draft Intended status: Standards Track July 4, 2014 Expires: January 5, 2015
Network Working Group M. Lepinski, Ed. Internet-Draft BBN Intended status: Standards Track July 4, 2014 Expires: January 5, 2015 Abstract BGPSEC Protocol Specification draft-ietf-sidr-bgpsec-protocol-09
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI MENOG 3 / Salmiya 2008.04.15 Randy Bush http://rip.psg.com/~randy/080415.menog-v4-trad-rpki.pdf 2008.04.15 MENOG v4 Trade RPKI 2 Internet Initiative
Temporal and Efficient Analysis of Services Availability
Temporal and Efficient Analysis of Services Availability Johannes Klick, Stephan Lau Matthias Wählisch, Volker Roth {johannes.klick,stephan.lau,m.waehlisch,volker.roth}@fu-berlin.de 1 / 17 Measuring Deployment
MANRS Mutually Agreed Norms for Routing Security
27 March 2018 MANRS Mutually Agreed Norms for Routing Security Kevin Meynell meynell@isoc.org Presentation title Client name Internet Society 1992 2016 1 The Problem A Routing Security Overview 2 The Basics:
Enhanced Feasible-Path Unicast Reverse Path Filtering draft-sriram-opsec-urpf-improvements-01
Enhanced Feasible-Path Unicast Reverse Path Filtering draft-sriram-opsec-urpf-improvements-01 K. Sriram and D. Montgomery OPSEC Working Group Meeting, IETF-99 July 2017 Acknowledgements: The authors are
The Implementation of BGP Monitoring, Alarming, and Protecting System by a BGP-UPDATE-Based Method using ECOMMUNITY in Real Time
The Implementation of BGP Monitoring, Alarming, and Protecting System by a BGP-UPDATE-Based Method using ECOMMUNITY in Real Time Je-kuk Yun 1, Beomseok Hong 2, and Yanggon Kim 3 1 Information Technology,
RPKI and Routing Security
Presentation September 2015 Yerevan Regional Meeting Routing Security 2 Routing Registry route objects RPKI (Resource Public Key Infrastructure) ROAs (Route Origin Authorisation) What is the Purpose of
Introduction to BGP. ISP Workshops. Last updated 30 October 2013
Introduction to BGP ISP Workshops Last updated 30 October 2013 1 Border Gateway Protocol p A Routing Protocol used to exchange routing information between different networks n Exterior gateway protocol
The German Internet Infrastructure: Exposure and Monitoring
The German Internet Infrastructure: Exposure and Monitoring Thomas Schmidt (HAW Hamburg), Matthias Wählisch (link-lab & FU-Berlin), Markus de Brün, Thomas Häberlen (BSI Bonn) {t.schmidt,waehlisch}@ieee.org,
Collective responsibility for security and resilience of the global routing system
Collective responsibility for security and resilience of the global routing system Andrei Robachevsky www.internetsociety.org Let us look at the problem first BGP is based on trust
BGP Attributes and Path Selection
BGP Attributes and Path Selection ISP Training Workshops 1 BGP Attributes The tools available for the job 2 What Is an Attribute?... Next Hop AS Path MED...... Part of a BGP Update Describes the characteristics
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN. Mark Kosters CTO
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN Mark Kosters CTO What is RPKI? Resource Public Key Infrastructure Attaches digital certificates to network resources AS Numbers
Lecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015
Lecture 6 Internet Security: How the Internet works and some basic vulnerabilities Thursday 19/11/2015 Agenda Internet Infrastructure: Review Basic Security Problems Security Issues in Routing Internet
Auto-Detecting Hijacked Prefixes?
Auto-Detecting Hijacked Prefixes? Geoff Huston APNIC @RIPE 50 May 2005 1 Address Hijacking Is the unauthorized use of an address prefix as an advertised route object on the Internet It s not a bogon the
Lessons learned running an RPKI service
Lessons learned running an RPKI service Alex Band Product Manager @alexander_band NANOG 63, San Antonio, Texas RPKI: Ultra Quick Intro 2 RIR becomes a Certificate Authority - Puts IPs and ASNs on a digital
Lab Guide 2 - BGP Configuration
IXP Workshop Lab Lab Guide 2 - BGP Configuration Objective: The focus of this lab is to connect 8 customers with IXP. Customers are connected with AS17821 as transit and received customer prefixes, also
Real-time Blackhole Analysis with Hubble
Real-time Blackhole Analysis with Hubble Ethan Katz-Bassett, Harsha V. Madhyastha, John P. John, Arvind Krishnamurthy, Thomas Anderson University of Washington NANOG 40, June 2007 1 Global Reachability
IETF81 Secure IDR Rollup TREX Workshop David Freedman, Claranet
IETF81 Secure IDR Rollup TREX Workshop 2011 David Freedman, Claranet Introduction to Secure IDR (SIDR) You are in a darkened room at the IETF. You are surrounded by vendors. A lone operator stands quietly
48hrs after the 1st BGP Hackathon
48hrs after the 1st BGP Hackathon Alberto Dainotti alberto@caida.org www.caida.org Center for Applied Internet Data Analysis University of California, San Diego BGP HACKATHON 2016 https://www.caida.org/workshops/bgp-hackathon/1602/
Problem. BGP is a rumour mill.
Problem BGP is a rumour mill. We want to give it a bit more authorita We think we have a model AusNOG-03 2009 IP ADDRESS AND ASN CERTIFICATION TO IMPROVE ROUTING SECURITY George Michaelson APNIC R&D ggm@apnic.net
Collective responsibility for security and resilience of the global routing system
Collective responsibility for security and resilience of the global routing system Phil Roberts roberts@isoc.org Andrei Robachevsky www.internetsociety.org Let us look at the problem
Vendor: Alcatel-Lucent. Exam Code: 4A Exam Name: Alcatel-Lucent Border Gateway Protocol. Version: Demo
Vendor: Alcatel-Lucent Exam Code: 4A0-102 Exam Name: Alcatel-Lucent Border Gateway Protocol Version: Demo QUESTION 1 Upon the successful establishment of a TCP session between peers, what type of BGP message
DE-CIX Academy: BGP Introduction. Notice of Liability. BGP Configuration Examples. Network Diagram for all examples. Links and Examples
Notice of Liability Despite careful checking of content, we accept no liability for the content of external links. Content on linked sites is exclusively the responsibility of the respective website operator.
Quantifying Violations of Destination-based Forwarding on the Internet
Quantifying Violations of Destination-based Forwarding on the Internet Tobias Flach, Ethan Katz-Bassett, and Ramesh Govindan University of Southern California November 14, 2012 Destination-based Routing
Routing Is At Risk. Let's Secure It Together. Andrei Robachevsky 1
Routing Is At Risk. Let's Secure It Together Andrei Robachevsky robachevsky@isoc.org 1 No Day Without an Incident 120 6 month of suspicious activity 100 80 60 Hijack Leak 40 20 0 1/1/17 2/1/17 3/1/17 4/1/17
Resource Public Key Infrastructure
Resource Public Key Infrastructure A pilot for the Internet2 Community to secure the global route table Andrew Gallo The Basics The Internet is a self organizing network of networks. How do you find your
9/6/2015. COMP 535 Lecture 6: Routing Security. Agenda. In the News. September 3, 2015 Andrew Chi
COMP 535 Lecture 6: Routing Security September 3, 2015 Andrew Chi Includes content used with permission by Angelos Keromytis (Columbia), Philip Smith (APNIC), and Steve Kent (BBN) Agenda
Route Security for Inter-domain Routing
Route Security for Inter-domain Routing Alvaro Retana (aretana@cisco.com) Distinguished Engineer, Cisco Services 3 This could happen to YOUR network 4 This could happen be happening to YOUR network 5 Agenda
High Performance BGP Security: Algorithms and Architectures
High Performance BGP Security: Algorithms and Architectures Mehmet Adalier, Ko0kalapudi Sriram, Oliver Borchert, Kyehwan Lee, Doug Montgomery Email: madalier@antarateknik.com; ksriram@nist.gov Acknowledgements:
Performance Analysis of Multicast Mobility in a H-MIP Proxy Environment
Performance Analysis of Multicast Mobility in a H-MIP Proxy Environment Thomas C. Schmidt, Matthias Wählisch {schmidt, mw}@fhtw-berlin.de HAW Hamburg & FHTW Berlin MIPv6 Ready for Release and Now? What
Securing the Internet at the Exchange Point Fernando M. V. Ramos
Securing the Internet at the Exchange Point Fernando M. V. Ramos 18.09.2017 Securing the Internet at the Exchange Point Fernando M. V. Ramos 18.09.2017 There are vulnerabilities in the Internet architecture
US West-Coast Future Internet Infrastructure Pacific Wave Update Pacific Research Platform International Routing Research Collaboration
SwitchON Workshop 16 October 2015 São Paulo, Brasil US West-Coast Future Internet Infrastructure Pacific Wave Update Pacific Research Platform International Routing Research Collaboration John Silvester,
Network Forensics Prefix Hijacking Theory Prefix Hijacking Forensics Concluding Remarks. Network Forensics:
Network Forensics: Network OS Fingerprinting Prefix Hijacking Analysis Scott Hand September 30 th, 2011 Outline 1 Network Forensics Introduction OS Fingerprinting 2 Prefix Hijacking Theory BGP Background
Technical update part 2. Arnaud Fenioux France-IX GM-2016
Technical update part 2 Arnaud Fenioux France-IX GM-2016 Oxidized It's a RANCID replacement! Written in ruby to backup equipment s configuration into a git repository Lots of Vendor OS supported Web interface
The ISP Column A column on various things Internet. Securing the Routing System at NANOG 74. A Legal Perspective. October 2018 Geoff Huston
The ISP Column A column on various things Internet October 2018 Geoff Huston Securing the Routing System at NANOG 74 The level of interest in the general topic of routing security seems to come in waves
Routing Is At Risk. Let's Secure It Together. Andrei Robachevsky 1
Routing Is At Risk. Let's Secure It Together Andrei Robachevsky robachevsky@isoc.org 1 No Day Without an Incident 120 6 month of suspicious activity 100 80 60 Hijack Leak 40 20 0 1/1/17 2/1/17 3/1/17 4/1/17
Securing Routing: RPKI Overview. Mark Kosters Chief Technology Officer
Securing Routing: RPKI Overview Mark Kosters Chief Technology Officer Why are DNSSEC and RPKI important? Two of the most critical resources DNS Routing Hard to tell when resource is compromised Focus of
Towards root cause analysis of BGP routing dynamics. Matthew Caesar, Lakshmi Subramanian, Randy H. Katz
Towards root cause analysis of BGP routing dynamics Matthew Caesar, Lakshmi Subramanian, Randy H. Katz mccaesar@cs.berkeley.edu Motivation Interdomain routing suffers from many problems Instability Slow
MCR IBM Cloud Direct Link Connect
MCR IBM Cloud Direct Link Connect 1 MCR IBM Cloud Direct Link Connect MCR Connections to IBM Cloud using Direct Link: IBM Cloud s private connection model is called Direct Link. IBM Direct Link enables