Autonomous security for autonomous systems |
| |
Affiliation: | 1. Department of Computer Science, University of New Mexico, Albuquerque, NM 87131, United States;2. Santa Fe Institute, Santa Fe, NM 87501, United States;3. Department of Computer Science, Princeton University, Princeton, NJ 08540, United States;1. Democritus University of Thrace, Department of Production Engineering and Management, 67100 Xanthi, Greece;2. TEI of Kavala, Department of Industrial Informatics, Human–Machines Interaction (HMI) Laboratory, 65404 Kavala, Greece;1. Department of Computer Science, National Chiao Tung University, No. 1001, Ta Hsueh Road, Hsinchu 300, Taiwan;2. Department of Information Management, National Taiwan University of Science and Technology, No. 43, Sec. 4, Keelung Road, Taipei 106, Taiwan;3. Advanced Research Institute, Institute for Information Industry, 1F., No. 133, Sec. 4, Minsheng E. Rd., Taipei 105, Taiwan |
| |
Abstract: | The Internet’s interdomain routing protocol, BGP, supports a complex network of Autonomous Systems which is vulnerable to a number of potentially crippling attacks. Several promising cryptography-based solutions have been proposed, but their adoption has been hindered by the need for community consensus, cooperation in a public key infrastructure (PKI), and a common security protocol. Rather than force centralized control in a distributed network, this paper examines distributed security methods that are amenable to incremental deployment. Typically, such methods are less comprehensive and not provably secure. The paper describes a distributed anomaly detection and response system that provides comparable security to cryptographic methods and has a more plausible adoption path. Specifically, the paper makes the following contributions: (1) it describes pretty good BGP (PGBGP), whose security is comparable (but not identical) to secure origin BGP; (2) it gives theoretical proofs on the effectiveness of PGBGP; (3) it reports simulation experiments on a snapshot of the Internet topology annotated with the business relationships between neighboring networks; (4) it quantifies the impact that known exploits could have on the Internet; and (5) it determines the minimum number of ASes that would have to adopt a distributed security solution to provide global protection against these exploits. Taken together these results explore the boundary between what can be achieved with provably secure centralized security mechanisms for BGP and more distributed approaches that respect the autonomous nature of the Internet. |
| |
Keywords: | |
本文献已被 ScienceDirect 等数据库收录! |
|