On the State of the Inter-domain and Intra-domain Routing Security
|
|
|
- Pierce O’Neal’
- 6 years ago
- Views:
Transcription
1 On the State of the Inter-domain and Intra-domain Routing Security Mingwei Zhang April 19, 2016 Mingwei Zhang Internet Routing Security 1 / 54
2 Section Internet Routing Security Background Internet Routing Security 1 Internet Routing Security Background Internet Routing Security 2 3 Security Solutions of SDN Security Solutions Using SDN 4 Mingwei Zhang Internet Routing Security 2 / 54
3 Internet Architecture Background Internet Routing Security The Internet consists of many domains, i.e., autonomous systems (ASes) Routing protocols are used to exchange reachability information about IP addresses and prefixes Mingwei Zhang Internet Routing Security 3 / 54
4 Internet Architecture Background Internet Routing Security The Internet consists of many domains, i.e., autonomous systems (ASes) Routing protocols are used to exchange reachability information about IP addresses and prefixes Inter-domain routing: IP prefixes; among multiple ASes Mingwei Zhang Internet Routing Security 3 / 54
5 Internet Architecture Background Internet Routing Security The Internet consists of many domains, i.e., autonomous systems (ASes) Routing protocols are used to exchange reachability information about IP addresses and prefixes Inter-domain routing: IP prefixes; among multiple ASes Intra-domain routing: IP addresses; within one AS Mingwei Zhang Internet Routing Security 3 / 54
6 Internet Architecture Background Internet Routing Security Mingwei Zhang Internet Routing Security 4 / 54
7 Inter-domain Routing Background Internet Routing Security Inter-domain routing: exchanges reachability information about IP prefixes among ASes Border Gateway Protocol (BGP) is the de facto inter-domain routing protocol. Mingwei Zhang Internet Routing Security 5 / 54
8 Inter-domain Routing Background Internet Routing Security Inter-domain routing: exchanges reachability information about IP prefixes among ASes Border Gateway Protocol (BGP) is the de facto inter-domain routing protocol. ASes have two main BGP operations: Originate prefixes: if you want to reach prefix A, please forward the traffic to me Propagate routes toward prefixes: you can reach prefix A through me Mingwei Zhang Internet Routing Security 5 / 54
9 Inter-domain Routing Background Internet Routing Security Inter-domain routing: exchanges reachability information about IP prefixes among ASes Border Gateway Protocol (BGP) is the de facto inter-domain routing protocol. ASes have two main BGP operations: Originate prefixes: if you want to reach prefix A, please forward the traffic to me Propagate routes toward prefixes: you can reach prefix A through me Vulnerable to attacks: Prefix hijacking AS path spoofing Mingwei Zhang Internet Routing Security 5 / 54
10 Intra-domain Routing Background Internet Routing Security Intra-domain routing: decide forwarding paths for traffic within one AS. Software-defined networking (SDN) is the new paradigm for intra-domain routing that provides the following benefits: Programmable switches Centralized control at the controller node Unified communication interface: OpenFlow Mingwei Zhang Internet Routing Security 6 / 54
11 Intra-domain Routing Background Internet Routing Security Intra-domain routing: decide forwarding paths for traffic within one AS. Software-defined networking (SDN) is the new paradigm for intra-domain routing that provides the following benefits: Programmable switches Centralized control at the controller node Unified communication interface: OpenFlow SDN suffers from security problems Flooding attacks on the controllers Control message forgeries Application conflicts Mingwei Zhang Internet Routing Security 6 / 54
12 Routing Security Solutions Background Internet Routing Security We investigate the security solutions for both BGP and SDN BGP security: Attack prevention Attack detection SDN security: Attack prevention Attack detection Security using SDN Mingwei Zhang Internet Routing Security 7 / 54
13 Taxonomy of Security Mechanisms Background Internet Routing Security Attack prevention solutions: Proactively stop routing attacks Find loopholes and prevent attacks Upgrade the protocol design or operations Mingwei Zhang Internet Routing Security 8 / 54
14 Taxonomy of Security Mechanisms Background Internet Routing Security Attack prevention solutions: Proactively stop routing attacks Find loopholes and prevent attacks Upgrade the protocol design or operations Attack detection solutions: Reactively detect routing attacks Mostly through anomaly detection approaches Usually do not require changes of the protocol or infrastructure Especially needed when prevention mechanisms cannot be deployed Mingwei Zhang Internet Routing Security 8 / 54
15 Taxonomy of Security Mechanisms Background Internet Routing Security Mingwei Zhang Internet Routing Security 9 / 54
16 Section Internet Routing Security 1 Internet Routing Security Background Internet Routing Security 2 3 Security Solutions of SDN Security Solutions Using SDN 4 Mingwei Zhang Internet Routing Security 10 / 54
17 Internet Routing Security BGP mainly exchanges the information about: IP prefix ownership: unit of reachability AS path: routes toward any IP prefixes BGP lacks sufficient verification for the update messages Mingwei Zhang Internet Routing Security 11 / 54
18 Internet Routing Security BGP mainly exchanges the information about: IP prefix ownership: unit of reachability AS path: routes toward any IP prefixes BGP lacks sufficient verification for the update messages : Prefix hijacking: falsely announce ownership AS-path spoofing: forge or modify routes Mingwei Zhang Internet Routing Security 11 / 54
19 BGP Attack Prefix Hijacking Mingwei Zhang Internet Routing Security 12 / 54
20 BGP Attack AS Path Spoofing Mingwei Zhang Internet Routing Security 13 / 54
21 Outline Internet Routing Security 2 Mingwei Zhang Internet Routing Security 14 / 54
22 Mingwei Zhang Internet Routing Security 15 / 54
23 Mingwei Zhang Internet Routing Security 15 / 54
24 Non-cryptography-based Attack Prevention from the Control Plane Internet Routing Registry (IRR) Centralized routing information registry BGP updates can be verified using IRR databases Incomplete and inaccurate information ASes lack motivation to submit their routing information They also do not update IRR data frequently Mingwei Zhang Internet Routing Security 16 / 54
25 Non-cryptography-based Attack Prevention from the Control Plane Internet Routing Registry (IRR) Centralized routing information registry BGP updates can be verified using IRR databases Incomplete and inaccurate information ASes lack motivation to submit their routing information They also do not update IRR data frequently Internet Route Validation (IRV) Query IRV servers of the ASes on an AS path ASes will respond whether they have seen/propagated the routes Problems: Unclear how to find the IRV servers Not effective during partial deployment Attackers can also forge IRV messages Mingwei Zhang Internet Routing Security 16 / 54
26 Cryptography-based Attack Prevention from the Control Plane Depend heavily on cryptographic operations to secure the content of the BGP updates Focus on securing the prefix origin and AS paths information Two main solutions are being deployed: RPKI and BGPsec Other previous solutions: sobgp, psbgp, SPV Mingwei Zhang Internet Routing Security 17 / 54
27 Cryptography-based Prevention RPKI RPKI helps prevent prefix hijacking RPKI provides cryptographically verifiable certificates that show the origin ASes of every registered prefix Contains credentials for every registered AS, such as public key Mingwei Zhang Internet Routing Security 18 / 54
28 Cryptography-based Prevention RPKI RPKI helps prevent prefix hijacking RPKI provides cryptographically verifiable certificates that show the origin ASes of every registered prefix Contains credentials for every registered AS, such as public key Mingwei Zhang Internet Routing Security 18 / 54
29 Cryptography-based Prevention BGPsec BGPsec also protects AS paths Utilizes the RPKI to validate prefix ownership announcement Requires every AS to sign all updates when propagating them Mingwei Zhang Internet Routing Security 19 / 54
30 Cryptography-based Prevention BGPsec BGPsec also protects AS paths Utilizes the RPKI to validate prefix ownership announcement Requires every AS to sign all updates when propagating them Mingwei Zhang Internet Routing Security 19 / 54
31 Cryptography-based Prevention BGPsec BGPsec also protects AS paths Utilizes the RPKI to validate prefix ownership announcement Requires every AS to sign all updates when propagating them Mingwei Zhang Internet Routing Security 19 / 54
32 Attack Prevention from the Data Plane Data-plane solutions secure the communication between BGP routers Mingwei Zhang Internet Routing Security 20 / 54
33 Attack Prevention from the Data Plane Data-plane solutions secure the communication between BGP routers TCP MD5 Signature: only verifies integrity Mingwei Zhang Internet Routing Security 20 / 54
34 Attack Prevention from the Data Plane Data-plane solutions secure the communication between BGP routers TCP MD5 Signature: only verifies integrity IPSEC: encrypts entire communication Mingwei Zhang Internet Routing Security 20 / 54
35 Attack Prevention from the Data Plane Data-plane solutions secure the communication between BGP routers TCP MD5 Signature: only verifies integrity IPSEC: encrypts entire communication Generalized TTL Security Mechanism (GTSM): restricts hop distance Mingwei Zhang Internet Routing Security 20 / 54
36 Outline Internet Routing Security 2 Mingwei Zhang Internet Routing Security 21 / 54
37 BGP attack prevention solutions are slowly being deployed, while the attacks happen with increasing frequency Need quick BGP attack detection and reaction Categorize by data sources: Control-plane solutions Data-plane solutions Categorize by methodologies: Active monitoring solutions Passive monitoring solutions Mingwei Zhang Internet Routing Security 22 / 54
38 Taxonomy Mingwei Zhang Internet Routing Security 23 / 54
39 Passive Monitoring from the Control Plane Passively listen to the control-plane messages Prefix hijacking detection: Prefix-origin relationship: PHAS, PGBGP Prefix-prefix relationship: Buddyguard Mingwei Zhang Internet Routing Security 24 / 54
40 Prefix Hijackings Detection: Prefix-Origin Relationship During training phase: build prefix-origin mapping During monitoring phase: PHAS: alert inconsistent BGP updates PGBGP: quarantines inconsistent BGP updates Mingwei Zhang Internet Routing Security 25 / 54
41 Prefix Hijackings Detection: Prefix-Origin Relationship During training phase: build prefix-origin mapping During monitoring phase: PHAS: alert inconsistent BGP updates PGBGP: quarantines inconsistent BGP updates Problems: Cleanness of the training data cannot be guaranteed Mingwei Zhang Internet Routing Security 25 / 54
42 Prefix Hijackings Detection: Prefix-Origin Relationship During training phase: build prefix-origin mapping During monitoring phase: PHAS: alert inconsistent BGP updates PGBGP: quarantines inconsistent BGP updates Problems: Cleanness of the training data cannot be guaranteed Unable to capture the quiet prefixes Mingwei Zhang Internet Routing Security 25 / 54
43 Prefix Hijackings Detection: Prefix-Origin Relationship During training phase: build prefix-origin mapping During monitoring phase: PHAS: alert inconsistent BGP updates PGBGP: quarantines inconsistent BGP updates Problems: Cleanness of the training data cannot be guaranteed Unable to capture the quiet prefixes Unable to update model for the legitimate changes Mingwei Zhang Internet Routing Security 25 / 54
44 Prefix Hijackings Detection: Prefix-Prefix Relationship Buddyguard discovers the fate-sharing prefixes as buddies for the monitored prefix Suspicious behavior: path change of target prefix but not its buddies It is resilient against attackers countermeasures Hard to obtain the list of buddies Hard to hijack all buddies Mingwei Zhang Internet Routing Security 26 / 54
45 Active Monitoring from the Control Plane Mingwei Zhang Internet Routing Security 27 / 54
46 Active Monitoring from the Control Plane Active monitoring solutions: queries to third-party registries for routing information combine data from various sources to construct knowledge base Mingwei Zhang Internet Routing Security 27 / 54
47 Active Monitoring from the Control Plane Active monitoring solutions: queries to third-party registries for routing information combine data from various sources to construct knowledge base Information: routing information: e.g., from IRR geographical information Mingwei Zhang Internet Routing Security 27 / 54
48 1. Probe Routing Information for Anomaly Detection Siganos et al. proposed Neighborhood Watch that utilizes information from IRR to detect anomalies Actively probes IRR for information related to suspicious BGP updates Detect inconsistencies between IRR and BGP updates Problems: IRR has out-of-date information Sriram et al. proposed to validate routing information from IRR before usage to improve accuracy Mingwei Zhang Internet Routing Security 28 / 54
49 2. Combine Routing Information with Other Sources Kruegel et al. designed a system that incorporates topological and geographical information constructs clusters of ASes based on their geographical distances between each other categorizes the ASes into edge and inner ASes only edge AS can connect to ASes from other cluster Mingwei Zhang Internet Routing Security 29 / 54
50 Attack Detection from the Data Plane Other approaches utilize data-plane information Mingwei Zhang Internet Routing Security 30 / 54
51 Attack Detection from the Data Plane Other approaches utilize data-plane information They focus on detecting the impacts from prefix hijackings: Traffic changes Reachability changes End-host information changes Mingwei Zhang Internet Routing Security 30 / 54
52 1. Detecting Traffic Changes Liu et al. proposed to detect changes of the traffic load distribution (LDC) LDC shows how the traffic to a prefix is distributed among all the ASes Suspicious changes can be detected comparing with the normal clusters Mingwei Zhang Internet Routing Security 31 / 54
53 1. Detecting Traffic Changes Liu et al. proposed to detect changes of the traffic load distribution (LDC) LDC shows how the traffic to a prefix is distributed among all the ASes Suspicious changes can be detected comparing with the normal clusters Hiran et al. proposed to measure round-trip time (RTT) to detect prefix hijackings The system passively collects RTT to the monitored prefix from many vantage points It detects suspicious increases of RTT as an indication of prefix hijacking Mingwei Zhang Internet Routing Security 31 / 54
54 2. Detecting Reachability Changes ispy, Argus, and Listen detect prefix hijackings by monitoring the reachability of the target prefixes Mingwei Zhang Internet Routing Security 32 / 54
55 2. Detecting Reachability Changes ispy, Argus, and Listen detect prefix hijackings by monitoring the reachability of the target prefixes Mingwei Zhang Internet Routing Security 32 / 54
56 2. Detecting Reachability Changes ispy, Argus, and Listen detect prefix hijackings by monitoring the reachability of the target prefixes Mingwei Zhang Internet Routing Security 32 / 54
57 2. Detecting Reachability Changes ispy, Argus, and Listen detect prefix hijackings by monitoring the reachability of the target prefixes Mingwei Zhang Internet Routing Security 32 / 54
58 3. Detecting Changes of End-hosts Information Hu et al. designed a fingerprinting system that creates profiles for the machines in a network When a prefix hijacking happens, the profiles of the machines in that prefix will not match anymore Similarly, Schlamp et al. propose to build profiles for only the HTTPS servers in the network. Mingwei Zhang Internet Routing Security 33 / 54
59 Section Internet Routing Security Security Solutions of SDN Security Solutions Using SDN 1 Internet Routing Security Background Internet Routing Security 2 3 Security Solutions of SDN Security Solutions Using SDN 4 Mingwei Zhang Internet Routing Security 34 / 54
60 Intra-domain Routing Security Solutions of SDN Security Solutions Using SDN Traditional intra-domain routing Protocols include RIP, OSPF, IS-IS, EIGRP, etc. Use vendor specific management software Equipment lacks extensibility Lack of unified management mechanism Mingwei Zhang Internet Routing Security 35 / 54
61 Intra-domain Routing Security Solutions of SDN Security Solutions Using SDN Traditional intra-domain routing Protocols include RIP, OSPF, IS-IS, EIGRP, etc. Use vendor specific management software Equipment lacks extensibility Lack of unified management mechanism Software-Defined Networking (SDN) Centralized control over all switches Unified communication protocol: OpenFlow Switches are programmable to conduct different tasks on demand Mingwei Zhang Internet Routing Security 35 / 54
62 Software-Defined Networking Security Solutions of SDN Security Solutions Using SDN Mingwei Zhang Internet Routing Security 36 / 54
63 Software-Defined Networking Security Solutions of SDN Security Solutions Using SDN Mingwei Zhang Internet Routing Security 36 / 54
64 Outline Internet Routing Security Security Solutions of SDN Security Solutions Using SDN 3 Security Solutions of SDN Security Solutions Using SDN Mingwei Zhang Internet Routing Security 37 / 54
65 Security Solutions of SDN Security Solutions Using SDN Securing SDN against Malicious Controllers Fleet defends against malicious controllers Any new rules requires acknowledgment from other controllers (Shamir s scheme) Mingwei Zhang Internet Routing Security 38 / 54
66 Security Solutions of SDN Security Solutions Using SDN Securing SDN against Malicious Controllers Fleet defends against malicious controllers Any new rules requires acknowledgment from other controllers (Shamir s scheme) Mingwei Zhang Internet Routing Security 38 / 54
67 Security Solutions of SDN Security Solutions Using SDN Securing SDN against Malicious Controllers Fleet defends against malicious controllers Any new rules requires acknowledgment from other controllers (Shamir s scheme) Problems: many controller software only support one controller per network all controllers share the same set of configuration and policies, making it less cost-effective Mingwei Zhang Internet Routing Security 38 / 54
68 Security Solutions of SDN Security Solutions Using SDN Securing SDN against Malicious Applications Malicious (or conflicting) SDN applications are the main concern in this field Solutions take different approaches to secure SDN against malicious applications: Modeling checking: NICE, ConfigChecker, Flowchecker Rule conflict detection: FortNOX, FlowGuard, VeriFlow, NetPlumber Network isolation: FlowVisor Mingwei Zhang Internet Routing Security 39 / 54
69 1. Model Checking Solutions Security Solutions of SDN Security Solutions Using SDN NICE, FlowChecker and ConfigChecker use model checking technique to explore all possible states of an OpenFlow application Combined with symbolic execution, they are able to locate erroneous states without executing programs on the switch Mingwei Zhang Internet Routing Security 40 / 54
70 2. Rule Conflict Detection Security Solutions of SDN Security Solutions Using SDN FortNOX detect conflicts from rules generated by different applications FlowGuard, NetPlumber, and Veriflow detect rules that violate security policies Mingwei Zhang Internet Routing Security 41 / 54
71 3. Network Isolation Internet Routing Security Security Solutions of SDN Security Solutions Using SDN FlowVisor divides one physical network into multiple slices of virtual networks Each slice has its own controller and topology FlowVisor can be used to isolate erroneous applications, and often be used to enable multiple controllers on one physical network Mingwei Zhang Internet Routing Security 42 / 54
72 3. Network Isolation Internet Routing Security Security Solutions of SDN Security Solutions Using SDN FlowVisor divides one physical network into multiple slices of virtual networks Each slice has its own controller and topology FlowVisor can be used to isolate erroneous applications, and often be used to enable multiple controllers on one physical network Problems: FlowVisor relies on other software to resolve issues from malicious applications Mingwei Zhang Internet Routing Security 42 / 54
73 Security Solutions of SDN Security Solutions Using SDN Detecting Compromised SDN Switches Chi et al. focused on detecting compromised switches The system carefully crafts rules and packets to detect these misbehaviors Mingwei Zhang Internet Routing Security 43 / 54
74 Security Solutions of SDN Security Solutions Using SDN Securing SDN against Malicious End-hosts The end-hosts in an SDN network can also present various threats Mingwei Zhang Internet Routing Security 44 / 54
75 Security Solutions of SDN Security Solutions Using SDN Securing SDN against Malicious End-hosts The end-hosts in an SDN network can also present various threats Control message flooding attack Mingwei Zhang Internet Routing Security 44 / 54
76 Security Solutions of SDN Security Solutions Using SDN Defending OpenFlow Message Flooding Attack AVANT-GUARD defends specifically the flooding caused by TCP SYN flood Mingwei Zhang Internet Routing Security 45 / 54
77 Security Solutions of SDN Security Solutions Using SDN Defending OpenFlow Message Flooding Attack AVANT-GUARD defends specifically the flooding caused by TCP SYN flood Mingwei Zhang Internet Routing Security 45 / 54
78 Security Solutions of SDN Security Solutions Using SDN Defending OpenFlow Message Flooding Attack AVANT-GUARD defends specifically the flooding caused by TCP SYN flood Mingwei Zhang Internet Routing Security 45 / 54
79 Security Solutions of SDN Security Solutions Using SDN Defending OpenFlow Message Flooding Attack AVANT-GUARD defends specifically the flooding caused by TCP SYN flood Mingwei Zhang Internet Routing Security 45 / 54
80 Security Solutions of SDN Security Solutions Using SDN Defending OpenFlow Message Flooding Attack AVANT-GUARD defends specifically the flooding caused by TCP SYN flood FloodGuard defends against the flooding traffic by slowing down the traffic to the controller Mingwei Zhang Internet Routing Security 45 / 54
81 Outline Internet Routing Security Security Solutions of SDN Security Solutions Using SDN 3 Security Solutions of SDN Security Solutions Using SDN Mingwei Zhang Internet Routing Security 46 / 54
82 SDN Can Help Secure Networks Security Solutions of SDN Security Solutions Using SDN SDN s centralized management benefits these tasks Monitor traffic over the entire network Perform actions on matched flows, such as dropping or rate-limiting Mingwei Zhang Internet Routing Security 47 / 54
83 SDN Can Help Secure Networks Security Solutions of SDN Security Solutions Using SDN SDN s centralized management benefits these tasks Monitor traffic over the entire network Perform actions on matched flows, such as dropping or rate-limiting Researchers have investigated the potential applications of SDN in the following areas: Traffic anomaly detection Distributed denial-of-service attack defense Mingwei Zhang Internet Routing Security 47 / 54
84 Traffic Anomaly Detection Security Solutions of SDN Security Solutions Using SDN Mehdi et al. ported existing anomaly detection systems into SDN environment and evaluated their performance They showed that SDN can work well with traditional algorithms in terms of traffic anomaly detection Mingwei Zhang Internet Routing Security 48 / 54
85 Traffic Anomaly Detection Security Solutions of SDN Security Solutions Using SDN Mehdi et al. ported existing anomaly detection systems into SDN environment and evaluated their performance They showed that SDN can work well with traditional algorithms in terms of traffic anomaly detection Shin et al. proposed FRESCO, a programming framework for network security The authors demonstrated a anomaly detection function with less than one hundred lines of code needed in FRESCO framework Mingwei Zhang Internet Routing Security 48 / 54
86 DDoS Defense Internet Routing Security Security Solutions of SDN Security Solutions Using SDN Distributed denial-of-service (DDoS) attack has been plaguing the Internet for years SDN s flexible control of the network equipment enables a set of new approaches toward defending DDoS attack Traffic filtering solution: Remote Blackhole Network maneuvering solutions: Virtual IP, Random Host Mutation Mingwei Zhang Internet Routing Security 49 / 54
87 Section Internet Routing Security 1 Internet Routing Security Background Internet Routing Security 2 3 Security Solutions of SDN Security Solutions Using SDN 4 Mingwei Zhang Internet Routing Security 50 / 54
88 Internet Routing is Not Secure Internet routing suffers and will still suffer from various attacks Mingwei Zhang Internet Routing Security 51 / 54
89 Internet Routing is Not Secure Internet routing suffers and will still suffer from various attacks Inter-domain routing Prefix hijacking and AS path spoofing attacks happen more and more frequently Prevention solutions are not deployed widely Detection solutions cannot mitigate the attack Mingwei Zhang Internet Routing Security 51 / 54
90 Internet Routing is Not Secure Internet routing suffers and will still suffer from various attacks Inter-domain routing Prefix hijacking and AS path spoofing attacks happen more and more frequently Prevention solutions are not deployed widely Detection solutions cannot mitigate the attack Intra-domain routing SDN attracts great attention from industry and academia However, security still weighs less than usability Mingwei Zhang Internet Routing Security 51 / 54
91 What is still missing? BGP security Prevention solutions that are effective in partial deployment Motivation study for the deployment of prevention solutions Effective detection + mitigation system Mechanisms that can discourage misbehaviors Mingwei Zhang Internet Routing Security 52 / 54
92 What is still missing? BGP security Prevention solutions that are effective in partial deployment Motivation study for the deployment of prevention solutions Effective detection + mitigation system Mechanisms that can discourage misbehaviors SDN security Studies on the controller security Evaluation framework to study various solutions Applications of SDN on other network security topics Mingwei Zhang Internet Routing Security 52 / 54
93 Future Research Directions Securing the end-to-end communication requires both inter-domain and intra-domain routing security Mingwei Zhang Internet Routing Security 53 / 54
94 Future Research Directions Securing the end-to-end communication requires both inter-domain and intra-domain routing security BGP attack detection system with effective mitigation Mingwei Zhang Internet Routing Security 53 / 54
95 Future Research Directions Securing the end-to-end communication requires both inter-domain and intra-domain routing security BGP attack detection system with effective mitigation SDN security and its application on defending against other security problems Mingwei Zhang Internet Routing Security 53 / 54
96 Thank you Internet Routing Security Thank you! Q & A Mingwei Zhang Internet Routing Security 54 / 54
TDC 375 Network Protocols TDC 563 P&T for Data Networks
TDC 375 Network Protocols TDC 563 P&T for Data Networks Routing Threats TDC 375/563 Spring 2013/14 John Kristoff DePaul University 1 One of two critical systems Routing (BGP) and naming (DNS) are by far
Security in inter-domain routing
DD2491 p2 2011 Security in inter-domain routing Olof Hagsand KTH CSC 1 Literature Practical BGP pages Chapter 9 See reading instructions Beware of BGP Attacks (Nordström, Dovrolis) Examples of attacks
A Survey of BGP Security Review
A Survey of BGP Security Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka November 16, 2011 1 Introduction to the topic and the reason for the topic being interesting Border
CNT Computer and Network Security: BGP Security
CNT 5410 - Computer and Network Security: BGP Security Professor Kevin Butler Fall 2015 Internet inter-as routing: BGP BGP (Border Gateway Protocol): the de facto standard BGP provides each AS a means
Security Issues of BGP in Complex Peering and Transit Networks
Technical Report IDE-0904 Security Issues of BGP in Complex Peering and Transit Networks Presented By: Supervised By: Muhammad Adnan Khalid Qamar Nazir Olga Torstensson Master of Computer network engineering
A Survey of BGP Security: Issues and Solutions
A Survey of BGP Security: Issues and Solutions Butler, Farley, McDaniel, Rexford Kyle Super CIS 800/003 October 3, 2011 Outline Introduction/Motivation Sources of BGP Insecurity BGP Security Today BGP
Securing BGP Networks using Consistent Check Algorithm
Securing BGP Networks using Consistent Check Algorithm C. K. Man, K.Y. Wong, and K. H. Yeung Abstract The Border Gateway Protocol (BGP) is the critical routing protocol in the Internet infrastructure.
Routing Security Security Solutions
Routing Security Security Solutions CSE598K/CSE545 - Advanced Network Security Prof. McDaniel - Spring 2008 Page 1 Solving BGP Security Reality: most attempts at securing BGP have been at the local level
ANALYSIS OF INTRUSION DETECTION SYSTEM (IDS) IN BORDER GATEWAY PROTOCOL
ANALYSIS OF INTRUSION DETECTION SYSTEM (IDS) IN BORDER GATEWAY PROTOCOL By Muhammad Mujtaba Principal Supervisor: Dr.Priyadarsi Nanda Co- Supervisor: Prof. Xiangjian He FACULTY OF ENGINEERING AND INFORMATION
Listen and Whisper: Security Mechanisms for BGP
Listen and Whisper: Security Mechanisms for BGP Lakshminarayanan Subramanian UC Berkeley Joint work with: Volker Roth, Ion Stoica, Scott Shenker, Randy Katz BGP Route Verification BGP speakers blindly
SENSS: Software-defined Security Service
SENSS: Software-defined Security Service Minlan Yu University of Southern California Joint work with Abdulla Alwabel, Ying Zhang, Jelena Mirkovic 1 Growing DDoS Attacks Average monthly size of DDoS attacks
BGP Security. Kevin s Attic for Security Research
Kevin s Attic for Security Research kevinkoo001@gmail.com Table 1. BGP Operation (1): Concept & Topology 2. BGP Operation (2): Message Exchange, Format and Path Decision Algorithm 3. Potential Attacks
Security in Mobile Ad-hoc Networks. Wormhole Attacks
Security in Mobile Ad-hoc Networks Wormhole Attacks What are MANETs Mobile Ad-hoc Network (MANET) is a collection of wireless mobile hosts without fixed network infrastructure and centralized administration.
Collective responsibility for security and resilience of the global routing system
Collective responsibility for security and resilience of the global routing system Phil Roberts roberts@isoc.org Andrei Robachevsky www.internetsociety.org Let us look at the problem
Routing Security DDoS and Route Hijacks. Merike Kaeo CEO, Double Shot Security
Routing Security DDoS and Route Hijacks Merike Kaeo CEO, Double Shot Security merike@doubleshotsecurity.com DISCUSSION POINTS Understanding The Growing Complexity DDoS Attack Trends Packet Filters and
SENSS Against Volumetric DDoS Attacks
SENSS Against Volumetric DDoS Attacks Sivaram Ramanathan 1, Jelena Mirkovic 1, Minlan Yu 2 and Ying Zhang 3 1 University of Southern California/Information Sciences Institute 2 Harvard University 3 Facebook
Design and development of the reactive BGP peering in softwaredefined routing exchanges
Design and development of the reactive BGP peering in softwaredefined routing exchanges LECTURER: HAO-PING LIU ADVISOR: CHU-SING YANG (Email: alen6516@gmail.com) 1 Introduction Traditional network devices
Routing Security We can do better!
Routing Security We can do better! And how MANRS can help Andrei Robachevsky robachevsky@isoc.org 1 No Day Without an Incident 120 6 month of suspicious activity 90 60 Hijack Leak 30 0 1/5/17 1/16/17 1/27/17
Network Policy Enforcement
CHAPTER 6 Baseline network policy enforcement is primarily concerned with ensuring that traffic entering a network conforms to the network policy, including the IP address range and traffic types. Anomalous
Jumpstarting BGP Security. Yossi Gilad Joint work with: Avichai Cohen, Amir Herzberg, and Michael Schapira
Jumpstarting BGP Security Yossi Gilad Joint work with: Avichai Cohen, Amir Herzberg, and Michael Schapira Prefix hijacking Victim Path: 111 AS X AS 111 Boston University BGP Ad. AS 666 Data flow 2 Prefix
Enhancing the Trust of Internet Routing with Lightweight Route Attestation
1 Enhancing the Trust of Internet Routing with Lightweight Route Attestation Qi Li, Student Member, IEEE, Mingwei Xu, Member, IEEE, Jianping Wu, Fellow, IEEE, Xinwen Zhang, Member, IEEE, Patrick P. C.
Lecture outline. Internet Routing Security Issues. Previous lecture: Effect of MinRouteAdver Timer. Recap of previous lecture
Lecture outline Internet Routing Security Issues Z. Morley Mao Lecture 3 Jan 14, 2003 Recap of last lecture, any questions? Existing routing security mechanisms - SBGP General threats to routing protocols
Distributed Denial of Service (DDoS)
Distributed Denial of Service (DDoS) Defending against Flooding-Based DDoS Attacks: A Tutorial Rocky K. C. Chang Presented by Adwait Belsare (adwait@wpi.edu) Suvesh Pratapa (suveshp@wpi.edu) Modified by
Securing the Internet at the Exchange Point Fernando M. V. Ramos
Securing the Internet at the Exchange Point Fernando M. V. Ramos 18.09.2017 Securing the Internet at the Exchange Point Fernando M. V. Ramos 18.09.2017 There are vulnerabilities in the Internet architecture
Data Sheet. DPtech Anti-DDoS Series. Overview. Series
Data Sheet DPtech Anti-DDoS Series DPtech Anti-DDoS Series Overview DoS (Denial of Service) leverage various service requests to exhaust victims system resources, causing the victim to deny service to
Accurate Real-time Identification of IP Hijacking. Presented by Jacky Mak
Accurate Real-time Identification of IP Hijacking Presented by Jacky Mak Outline Problem and Objectives Interdomain Routing and BGP Basics Attack Model of IP Hijacking Real-time Detection Techniques Implementation
Securing BGP. Geoff Huston November 2007
Securing BGP Geoff Huston November 2007 Agenda An Introduction to BGP BGP Security Questions Current Work Research Questions An Introduction to BGP Background to Internet Routing The routing architecture
Lecture 13: Routing in multihop wireless networks. Mythili Vutukuru CS 653 Spring 2014 March 3, Monday
Lecture 13: Routing in multihop wireless networks Mythili Vutukuru CS 653 Spring 2014 March 3, Monday Routing in multihop networks Figure out a path from source to destination. Basic techniques of routing
Mutually Agreed Norms for Routing Security NAME
Mutually Agreed Norms for Routing Security NAME EMAIL The Problem A Routing Security Overview 2 Routing Incidents are Increasing In 2017 alone, 14,000 routing outages or attacks such as hijacking, leaks,
Why dynamic route? (1)
Routing Why dynamic route? (1) Static route is ok only when Network is small There is a single connection point to other network No redundant route 2 Why dynamic route? (2) Dynamic Routing Routers update
CS 43: Computer Networks. 24: Internet Routing November 19, 2018
CS 43: Computer Networks 24: Internet Routing November 19, 2018 Last Class Link State + Fast convergence (reacts to events quickly) + Small window of inconsistency Distance Vector + + Distributed (small
Lecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015
Lecture 6 Internet Security: How the Internet works and some basic vulnerabilities Thursday 19/11/2015 Agenda Internet Infrastructure: Review Basic Security Problems Security Issues in Routing Internet
Basic Concepts in Intrusion Detection
Technology Technical Information Services Security Engineering Roma, L Università Roma Tor Vergata, 23 Aprile 2007 Basic Concepts in Intrusion Detection JOVAN GOLIĆ Outline 2 Introduction Classification
Accurate Real-time Identification of IP Hijacking
Accurate Real-time Identification of IP Hijacking 1 Xin Hu Z. Morley Mao University of Michigan huxin@umich.edu zmao@umich.edu Abstract In this paper, we present novel and practical techniques to accurately
Protecting BGP from Invalid Paths
Protecting BGP from Invalid Paths Josh Karlin University of New Mexico karlinjf@cs.unm.edu Stephanie Forrest University of New Mexico Santa Fe Institute forrest@cs.unm.edu Jennifer Rexford Princeton University
Collective responsibility for security and resilience of the global routing system
Collective responsibility for security and resilience of the global routing system Andrei Robachevsky www.internetsociety.org Let us look at the problem first BGP is based on trust
Bamboozling Certificate Authorities with BGP
Bamboozling Certificate Authorities with BGP Henry Birge-Lee Princeton University Jennifer Rexford Princeton University Yixin Sun Princeton University Prateek Mittal Princeton University Anne Edmundson
StrobeLight: Lightweight Availability Mapping and Anomaly Detection. James Mickens, John Douceur, Bill Bolosky Brian Noble
StrobeLight: Lightweight Availability Mapping and Anomaly Detection James Mickens, John Douceur, Bill Bolosky Brian Noble At any given moment, how can we tell which enterprise machines are online and
Routing and router security in an operator environment
DD2495 p4 2011 Routing and router security in an operator environment Olof Hagsand KTH CSC 1 Router lab objectives A network operator (eg ISP) needs to secure itself, its customers and its neighbors from
Network Forensics Prefix Hijacking Theory Prefix Hijacking Forensics Concluding Remarks. Network Forensics:
Network Forensics: Network OS Fingerprinting Prefix Hijacking Analysis Scott Hand September 30 th, 2011 Outline 1 Network Forensics Introduction OS Fingerprinting 2 Prefix Hijacking Theory BGP Background
Distributed Denial of Service
Distributed Denial of Service Vimercate 17 Maggio 2005 anegroni@cisco.com DDoS 1 Agenda PREFACE EXAMPLE: TCP EXAMPLE: DDoS CISCO S DDoS SOLUTION COMPONENTS MODES OF PROTECTION DETAILS 2 Distributed Denial
MANRS Mutually Agreed Norms for Routing Security
27 March 2018 MANRS Mutually Agreed Norms for Routing Security Kevin Meynell meynell@isoc.org Presentation title Client name Internet Society 1992 2016 1 The Problem A Routing Security Overview 2 The Basics:
A Framework for Resilient Internet Routing Protocols
A Framework for Resilient Internet Routing Protocols Dan Pei and Lixia Zhang, UCLA Dan Massey, USC/ISI Abstract At a fundamental level, all Internet-based applications rely on a dependable packet delivery
Region-based BGP Announcement Filtering for Improved BGP Security
Region-based BGP Announcement Filtering for Improved BGP Security Fernando Sanchez Florida State University sanchez@cs.fsu.edu Zhenhai Duan Florida State University duan@cs.fsu.edu ABSTRACT BGP prefix
J. A. Drew Hamilton, Jr., Ph.D. Director, Information Assurance Laboratory and Associate Professor Computer Science & Software Engineering
Auburn Information Assurance Laboratory J. A. Drew Hamilton, Jr., Ph.D. Director, Information Assurance Laboratory and Associate Professor Computer Science & Software Engineering 107 Dunstan Hall Auburn
CIS 5373 Systems Security
CIS 5373 Systems Security Topic 4.1: Network Security Basics Endadul Hoque Slide Acknowledgment Contents are based on slides from Cristina Nita-Rotaru (Northeastern) 2 Network Security INTRODUCTION 3 What
SCION: A Secure Internet Architecture Samuel Hitz CTO Anapaya Systems ETH Zurich
SCION: A Secure Internet Architecture Samuel Hitz CTO Anapaya Systems ETH Zurich March 2019 Internet: The network of networks The Internet is a network of Autonomous Systems (ASes). Each AS is itself a
Introduction and Statement of the Problem
Chapter 1 Introduction and Statement of the Problem 1.1 Introduction Unlike conventional cellular wireless mobile networks that rely on centralized infrastructure to support mobility. An Adhoc network
Check Point DDoS Protector Introduction
Check Point DDoS Protector Introduction Petr Kadrmas SE Eastern Europe pkadrmas@checkpoint.com Agenda 1 (D)DoS Trends 2 3 4 DDoS Protector Overview Protections in Details Summary 2 (D)DoS Attack Methods
A Framework for Resilient Internet Routing Protocols
1 A Framework for Resilient Internet Routing Protocols Dan Pei, UCLA; Daniel Massey, USC/ISI; Lixia Zhang, UCLA Technical Report TR-030052 UCLA Computer Science Department November 13th, 2003 Abstract
bgpand - Architecting a modular BGP4 Attack & Anomalies Detection Platform
bgpand - Architecting a modular BGP4 Attack & Anomalies Detection Platform Mayank Bhatnagar TechMahindra Limited, SDF B-1, NSEZ, Noida-201305, India E-mail : mayank.bhatnagar2@techmahindra.com Abstract
MANRS. Mutually Agreed Norms for Routing Security. Jan Žorž
MANRS Mutually Agreed Norms for Routing Security Jan Žorž The Problem A Routing Security Overview 2 No Day Without an Incident http://bgpstream.com/ 3 Routing Incidents Cause Real World
Internet Infrastructure
Internet Infrastructure Internet Infrastructure Local and inter-domain routing TCP/IP for routing and messaging BGP for routing announcements Domain Name System Find IP address from symbolic name (www.cc.gatech.edu)
Inter-domain routing validator based spoofing defence system
University of Wollongong Research Online Faculty of Informatics - Papers (Archive) Faculty of Engineering and Information Sciences 2010 Inter-domain routing validator based spoofing defence system Lei
CSC 4900 Computer Networks: Routing Protocols
CSC 4900 Computer Networks: Routing Protocols Professor Henry Carter Fall 2017 Last Time Link State (LS) versus Distance Vector (DV) algorithms: What are some of the differences? What is an AS? Why do
A PKI For IDR Public Key Infrastructure and Number Resource Certification
A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC If You wanted to be Bad on the Internet And you wanted to: Hijack a site Inspect
A Configuration based Approach to Mitigating Man-inthe-Middle Attacks in Enterprise Cloud IaaS Networks running BGP
A Configuration based Approach to Mitigating Man-inthe-Middle Attacks in Enterprise Cloud IaaS Networks running BGP Stephen Brako Oti Isaac Bansah Tonny M. Adegboyega ABSTRACT Cloud IaaS service providers
BGP. Daniel Zappala. CS 460 Computer Networking Brigham Young University
Daniel Zappala CS 460 Computer Networking Brigham Young University 2/20 Scaling Routing for the Internet scale 200 million destinations - can t store all destinations or all prefixes in routing tables
Internetwork Expert s CCNA Security Bootcamp. Common Security Threats
Internetwork Expert s CCNA Security Bootcamp Common Security Threats http:// Today s s Network Security Challenge The goal of the network is to provide high availability and easy access to data to meet
Insights on IPv6 Security
Insights on IPv6 Security Bilal Al Sabbagh, MSc, CISSP, CCSP Senior Information & Network Security Consultant - NXme Information Security Researcher Stockholm University 10/9/10 NXme FZ-LLC 1 NIXU Middle
snoc Snoc DDoS Protection Fast Secure Cost effective Introduction Snoc 3.0 Global Scrubbing Centers Web Application DNS Protection
Snoc DDoS Protection Fast Secure Cost effective sales@.co.th www..co.th securenoc Introduction Snoc 3.0 Snoc DDoS Protection provides organizations with comprehensive protection against the most challenging
TNG IP routing online course specification
TNG IP routing online course specification Illuminating Technology Course Aim: To describe the role, facilities, and operation of the various protocols that discover routes over an IP network and to describe
Introduction to IP Routing. Geoff Huston
Introduction to IP Routing Geoff Huston Routing How do packets get from A to B in the Internet? A Internet B Connectionless Forwarding Each router (switch) makes a LOCAL decision to forward the packet
Inter-Autonomous-System Routing: Border Gateway Protocol
Inter-Autonomous-System Routing: Border Gateway Protocol Antonio Carzaniga Faculty of Informatics University of Lugano June 14, 2005 Outline Hierarchical routing BGP Routing Routing Goal: each router u
EFFECTIVE SERVICE PROVIDER DDOS PROTECTION THAT SAVES DOLLARS AND MAKES SENSE
SOLUTION BRIEF EFFECTIVE SERVICE PROVIDER DDOS PROTECTION THAT SAVES DOLLARS AND MAKES SENSE Building effective, affordable and scalable DDoS defense, then monetizing investments with value added scrubbing
Internet Routing : Fundamentals of Computer Networks Bill Nace
Internet Routing 14-740: Fundamentals of Computer Networks Bill Nace Material from Computer Networking: A Top Down Approach, 6 th edition. J.F. Kurose and K.W. Ross Looking Ahead Lab #2 just due Quiz #2
TOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS
TOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS 1 Introduction Your data and infrastructure are at the heart of your business. Your employees, business partners, and
Our Narrow Focus Computer Networking Security Vulnerabilities. Outline Part II
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2016 www.cs.cmu.edu/~prs/15-441-f16 Yes: Creating a secure channel for communication (Part I) Protecting
Active defence through deceptive IPS
Active defence through deceptive IPS Authors Apostolis Machas, MSc (Royal Holloway, 2016) Peter Komisarczuk, ISG, Royal Holloway Abstract Modern security mechanisms such as Unified Threat Management (UTM),
Routing Is At Risk. Let's Secure It Together. Andrei Robachevsky 1
Routing Is At Risk. Let's Secure It Together Andrei Robachevsky robachevsky@isoc.org 1 No Day Without an Incident 120 6 month of suspicious activity 100 80 60 Hijack Leak 40 20 0 1/1/17 2/1/17 3/1/17 4/1/17
ERT Threat Alert New Risks Revealed by Mirai Botnet November 2, 2016
Abstract The Mirai botnet struck the security industry in three massive attacks that shook traditional DDoS protection paradigms, proving that the Internet of Things (IoT) threat is real and the grounds
Computer Science 461 Final Exam May 22, :30-3:30pm
NAME: Login name: Computer Science 461 Final Exam May 22, 2012 1:30-3:30pm This test has seven (7) questions, each worth ten points. Put your name on every page, and write out and sign the Honor Code pledge
Improving Network Agility with Seamless BGP Reconfigurations
Improving Network Agility with Seamless BGP Reconfigurations Corneliu Claudiu Prodescu School of Engineering and Sciences Jacobs University Bremen Campus Ring 1, 28759 Bremen, Germany Monday 18 th March,
COMP211 Chapter 5 Network Layer: The Control Plane
COMP211 Chapter 5 Network Layer: The Control Plane All material copyright 1996-2016 J.F Kurose and K.W. Ross, All Rights Reserved Computer Networking: A Top Down Approach 7 th edition Jim Kurose, Keith
Inter-Autonomous-System Routing: Border Gateway Protocol
Inter-Autonomous-System Routing: Border Gateway Protocol Antonio Carzaniga Faculty of Informatics University of Lugano December 10, 2014 Outline Hierarchical routing BGP Routing 2005 2007 Antonio Carzaniga
Chapter 7. Denial of Service Attacks
Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU),
The Protocols that run the Internet
The Protocols that run the Internet Attack types in the Internet Seminarvortrag Sommersemester 2003 Jens Gerken Content Internet Attacks Introduction Network Service Attacks Distributed Denial of Service
Enhancing the Trust of Internet Routing with Lightweight Route Attestation
Enhancing the Trust of Internet Routing with Lightweight Route Attestation Qi Li, Mingwei Xu, Jianping Wu, Xinwen Zhang, Patrick P. C. Lee, Ke Xu Dept. of Computer Science, Tsinghua University, Tsinghua
CS 43: Computer Networks Internet Routing. Kevin Webb Swarthmore College November 16, 2017
CS 43: Computer Networks Internet Routing Kevin Webb Swarthmore College November 16, 2017 1 Hierarchical routing Our routing study thus far - idealization all routers identical network flat not true in
PrecisionAccess Trusted Access Control
Data Sheet PrecisionAccess Trusted Access Control Defeats Cyber Attacks Credential Theft: Integrated MFA defeats credential theft. Server Exploitation: Server isolation defeats server exploitation. Compromised
F5 DDoS Hybrid Defender : Setup. Version
F5 DDoS Hybrid Defender : Setup Version 13.1.0.3 Table of Contents Table of Contents Introducing DDoS Hybrid Defender... 5 Introduction to DDoS Hybrid Defender...5 DDoS deployments... 5 Example DDoS Hybrid
Module: Routing Security. Professor Patrick McDaniel Spring CMPSC443 - Introduction to Computer and Network Security
CMPSC443 - Introduction to Computer and Network Security Module: Routing Security Professor Patrick McDaniel Spring 2009 1 Routing 101 Network routing exists to provide hosts desirable paths from the source
ARAKIS An Early Warning and Attack Identification System
ARAKIS An Early Warning and Attack Identification System Piotr Kijewski Piotr.Kijewski@cert.pl 16th Annual FIRST Conference June 13-18, Budapest, Hungary Presentation outline Trends in large scale malicious
1536 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 22, NO. 9, SEPTEMBER 2011
1536 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 22, NO. 9, SEPTEMBER 2011 Symmetric Key Approaches to Securing BGP A Little Bit Trust Is Enough Bezawada Bruhadeshwar, Member, IEEE, Sandeep
MANRS Mutually Agreed Norms for Routing Security
December 2017 MANRS Mutually Agreed Norms for Routing Security Andrei Robachevsky robachevsky@isoc.org Presentation title Client name 1 Internet Society 1992 2016 The Problem A Routing Security Primer
Protecting DNS from Routing Attacks -Two Alternative Anycast Implementations
Protecting DNS from Routing Attacks -Two Alternative Anycast Implementations Boran Qian StudentID 317715 Abstract The Domain Names System (DNS) is an important role of internet infrastructure and supporting
Routing Is At Risk. Let's Secure It Together. Andrei Robachevsky 1
Routing Is At Risk. Let's Secure It Together Andrei Robachevsky robachevsky@isoc.org 1 No Day Without an Incident 120 6 month of suspicious activity 100 80 60 Hijack Leak 40 20 0 1/1/17 2/1/17 3/1/17 4/1/17
Detecting inconsistencies in INRDB data
Detecting inconsistencies in INRDB data to identify MOAS cases and possible illegitimate Internet resource usage Peter Ruissen System and Network Engineering University of Amsterdam December 11, 2007 1
Interdomain Routing Security (BGP-4)
Interdomain Routing Security (BGP-4) A Comparison between S-BGP and sobgp in tackling security vulnerabilities in the Border Gateway Protocol By Rostom Zouaghi and Stephen Wolthusen BGP 1 THE BORDER GATEWAY
Chapter 10: Denial-of-Services
Chapter 10: Denial-of-Services Technology Brief This chapter, "Denial-of-Service" is focused on DoS and Distributed Denial-of-Service (DDOS) attacks. This chapter will cover understanding of different
CE Advanced Network Security Routing Security II
CE 817 - Advanced Network Security Routing Security II Lecture 21 Mehdi Kharrazi Department of Computer Engineering Sharif University of Technology Acknowledgments: Some of the slides are fully or partially
Secure Routing with RPKI. APNIC44 Security Workshop
Secure Routing with RPKI APNIC44 Security Workshop Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
5.1 introduction 5.5 The SDN control 5.2 routing protocols plane. Control Message 5.3 intra-as routing in Protocol the Internet
Chapter 5: outline 5.1 introduction 5.5 The SDN control 5.2 routing protocols plane link state 5.6 ICMP: The Internet distance vector Control Message 5.3 intra-as routing in Protocol the Internet t 5.7
Network Security: Routing security. Aapo Kalliola T Network security Aalto University, Nov-Dec 2012
Network Security: Routing security Aapo Kalliola T-110.5241 Network security Aalto University, Nov-Dec 2012 Outline 1. Structure of internet 2. Routing basics 3. Security issues 4. Attack 5. Solutions
Security for SIP-based VoIP Communications Solutions
Tomorrow Starts Today Security for SIP-based VoIP Communications Solutions Enterprises and small to medium-sized businesses (SMBs) are exposed to potentially debilitating cyber attacks and exploitation
Interdomain Routing Design for MobilityFirst
Interdomain Routing Design for MobilityFirst October 6, 2011 Z. Morley Mao, University of Michigan In collaboration with Mike Reiter s group 1 Interdomain routing design requirements Mobility support Network
BGP Origin Validation
BGP Origin Validation ISP Workshops These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/) Last updated
On the State of IP Spoofing Defense
On the State of IP Spoofing Defense TOBY EHRENKRANZ and JUN LI University of Oregon 6 IP source address spoofing has plagued the Internet for many years. Attackers spoof source addresses to mount attacks
PrepAwayExam. High-efficient Exam Materials are the best high pass-rate Exam Dumps
PrepAwayExam http://www.prepawayexam.com/ High-efficient Exam Materials are the best high pass-rate Exam Dumps Exam : HP0-Y24 Title : Securing HP ProCurve Networks Vendors : HP Version : DEMO Get Latest
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 18: Network Attacks Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Network attacks denial-of-service (DoS) attacks SYN