Abstract:Adversaries can exploit inter-domain routing vulnerabilities to intercept communication and compromise the security of critical Internet applications. Meanwhile the deployment of secure routing solutions such as Border Gateway Protocol Security (BGPsec) and Scalability, Control and Isolation On Next-generation networks (SCION) are still limited. How can we leverage emerging secure routing backbones and extend their security properties to the broader Internet? We design and deploy an architecture to bootstrap secure routing. Our key insight is to abstract the secure routing backbone as a virtual Autonomous System (AS), called Secure Backbone AS (SBAS). While SBAS appears as one AS to the Internet, it is a federated network where routes are exchanged between participants using a secure backbone. SBAS makes BGP announcements for its customers' IP prefixes at multiple locations (referred to as Points of Presence or PoPs) allowing traffic from non-participating hosts to be routed to a nearby SBAS PoP (where it is then routed over the secure backbone to the true prefix owner). In this manner, we are the first to integrate a federated secure non-BGP routing backbone with the BGP-speaking Internet. We present a real-world deployment of our architecture that uses SCIONLab to emulate the secure backbone and the PEERING framework to make BGP announcements to the Internet. A combination of real-world attacks and Internet-scale simulations shows that SBAS substantially reduces the threat of routing attacks. Finally, we survey network operators to better understand optimal governance and incentive models.

An enhanced inter-domain routing architecture

AIR: a Scalable Inter-domain Routing Protocol

Towards End-to-End Quality-of-Service by Domain-Level Routing and Forwarding

Improving Internet Routing Scalability with As Landmarks

Inter-domain Routing Bottlenecks and Their Aggravation

Scalability of Internet Inter-Domain Routing

Federated Routing Scheme for Large-scale Cross Domain Network

Study on Separated Address Space Technology for the Scalable Routing Architecture

Hierarchical Architecture for Better Network Management

Internet Routing: Separating Customers from Providers

NOL: Name Overlay Service for Improving Internet Routing Scalability

Design of Federated Routing Mechanism in Cross-Domain Scenario

The Road Towards Future Internet

An Integrated, Distributed Traffic Control Strategy for the Future Internet

Research on Next-Generation Internet Architecture

ADN:Address Driven Internet Architecture

Creating a Secure Underlay for the Internet

Improving Routing Scalability with Aggressive Route Aggregation

Towards an Aggregation-Aware Internet Routing

Address Switching: Reforming the Architecture and Traffic of Internet

Break the Blackbox! Desensitize Intra-domain Information for Inter-domain Routing