BGP Routing Research Articles

Lightweight Flow‐Based Policy Enforcement for SDN‐Based Multi‐Domain Communication

ABSTRACTAlthough software‐defined networking (SDN) is commonly employed for intra‐domain communication, inter‐domain communication still heavily relies on conventional routing methods, specifically BGP‐based routers. The BGP router plays a crucial role in managing control and data planes, but this traditional approach hinders the exploitation of SDN advantages. Previous studies demonstrated the use of BGP for inter‐domain and end‐to‐end communication. This paper advocates for the adoption of a fully SDN‐based data plane packet switching strategy through the introduction of LPEES, a lightweight policy framework tailored for SDN‐based inter‐domain communication. LPEES strategically confines BGP's functionality to the control plane, preserving SDN benefits. Evaluation results confirm the effectiveness of LPEES compared to the BGP routing approach, as measured by throughput and various network quality of service (QoS) metrics. Additionally, LPEES streamlines inter‐domain communication by utilizing a trust‐based routing policy approach that can establish trust between communicating domains. The presented solution's main advantage is that it loosens the burden on the administrator by requiring less human interference to check the inter‐domain communication security and privacy. Our evaluations show LPEES outperform the BGP‐based in terms of throughput as LPEES achieves a 27 Gbps versus 22 Gbps in the traditional approach. Based on our experiments, LPEES also enhances the communication delay by an average of 17% compared to the traditional BGP‐based approach.

Border Gateway Protocol Route Leak Detection Technique Based on Graph Features and Machine Learning

In the Internet, ASs are interconnected using BGP. However, due to a lack of security considerations in the design of BGP, a series of security issues arise during the propagation of routing information, such as prefix hijacking, route leakage, and AS path tampering. Therefore, this paper conducts research on the detection of route leakage. By analyzing BGP routing information, we abstract the routing propagation relationship between ASs into a network topology graph, and extract graph features from the graph abstracted from routing data at certain time intervals. Based on the structural robustness features and centrality measurement features of the graph, we determine whether a route leakage has occurred during the current time period. To this end, we use machine learning methods and propose a weighted voting model. This model trains multiple single models and assigns weights to them, and through the weighted analysis of the results of multiple models, it can determine whether a route leakage has occurred. In addition, to determine the corresponding weights, we use genetic algorithms for identifying route leaks. The experimental results show that the method used in this paper has a high accuracy rate, and compared with a single model, it performs better on multiple datasets.

BGP convergence in an MRAI-free Internet

In this paper, we study the effect of reducing the use of BGP’s MRAI mechanism in the Internet. MRAI stands for Minimum Route Advertisement Interval and it is a timer that rate-limits BGP route announcements. In particular, we look into the effects of MRAI removal by simulating router topologies representing all the Autonomous Systems (ASes) in the Internet. We consider the two main MRAI implementation flavors, namely per-session and out-delay MRAI. Reducing the fraction of MRAI-enabled ASes is positive in terms of convergence performance, until the adoption reaches 10% of Internet ASes. Below this threshold, the number of messages exchanged when routes are removed sharply increases, and thus the router load. Depending on the time that it takes for routers to process BGP messages, further reductions in the fraction may even increase convergence time for removing a route. We show that keeping MRAI enabled in few highly connected ASes, the tier-1 ASes, provides some protection against the increase in the computing demand of the routers.

Towards Blockchain-Based Secure BGP Routing, Challenges and Future Research Directions

Towards Blockchain-Based Secure BGP Routing, Challenges and Future Research Directions

Vantage Point Placement Based on Inference of AS-level Connections

Internet topology data is useful for evaluating new protocols, services, and vulnerabilities in network infrastructures. To infer the AS-level topology, some projects deploy BGP routers worldwide, mainly on IXPs, collect and publish BGP routing information from other ASes called Vantage Points. Deploying more routers on various IXPs will make the topology data precise, but it is hard to deploy a lot of routers because of administrative costs. So, we carefully choose locations where we can obtain new topological information with a small number of new routers. In this study, we investigate which ASes and IXPs should be used as Vantage Points with a small number of additional routers. This work consists of two stages. First, we analyze current BGP routing information available to infer currently unobserved but possibly existing connections, and find that such connections tend to be between two ASes that have a high percentage not including 100% of common adjacent ASes. Second, we calculate which IXPs should be more suitable for installing BGP routers for the collection using the results on the first stage and data of ASes on IXPs. We also discuss IXPs recommended to deploy new routers are in different countries where many ASes are allocated.

The Juice Is Worth the Squeeze: Analysis of Autonomous System Provider Authorization in Partial Deployment

BGP, the de-facto standard protocol for exchanging routes on a network-wide basis called AS employs invalid routes. Recently, a data object called Autonomous System Provider Authorization (ASPA) was proposed as a new specification for verifying PATH information in BGP security. In this paper, we shed light on the effectiveness of ASPAs in a partial deployment alongside the conventional BGP through experiments based on a real AS topology. To this end, we also present a novel simulation tool, LOTUS, for BGP route exchange, including ASPAs. We then evaluate deployments of ASPAs and their verification with LOTUS for two cases on network topology in Japan: the case in deployment from ASes whose number of connections with other ASes is large, i.e., deployment from top ASes, and the case in deployment from ASes at the end of the network topology, i.e., deployment from leaf-node ASes. As a result, we confirm that the number of victim ASes decreases in the former case, while ASPAs provide no advantage in the latter case. Notably, the number of victim ASes decreases by about 96% on average by deploying the verification with ASPAs in the top-eight ASes. Based on these results, we further conduct extensive experiments in the deployment from the top ASes, whereby ASes outside the network topology advertise malicious routes to the victim ASes. We also discuss a case whereby an adversary tries to leverage ASPAs. Our promising results show that the adversary will no longer obtain an advantage even by leveraging ASPAs.

On the Effectiveness of BGP Hijackers That Evade Public Route Collectors

Routing hijack attacks have plagued the Internet for decades. After many failed mitigation attempts, recent Internet-wide BGP monitoring infrastructures relying on distributed route collection systems, called route collectors, give us hope that future monitor systems can quickly detect and ultimately mitigate hijacks. In this paper, we investigate the effectiveness of public route collectors with respect to future attackers deliberately engineering longer hijacks to avoid being recorded by route collectors. Our extensive simulations (and attacks we device) show that monitor-based systems may be unable to observe many carefully crafted hijacks diverting traffic from thousands of ASes. Hijackers could predict whether their attacks would propagate to some BGP feeders (i.e., monitors) of public route collectors. Then, manipulate BGP route propagation so that the attack never reaches those monitors. This observation remains true when considering plausible future Internet topologies, with more IXP links and up to 4 times more monitors peering with route collectors. We then evaluate the feasibility of performing hijacks not observed by route collectors in the real-world.We experiment with two classifiers to predict the monitors that are dangerous to report the attack to route collectors, one based on monitor proximities (i.e., shortest path lengths) and another based on Gao-Rexford routing policies.We show that a proximity-based classifier could be sufficient for the hijacker to identify all dangerous monitors for hijacks announced to peer-to-peer neighbors. For hijacks announced to transit networks, a Gao-Rexford classifier reduces wrong inferences by ≥ 91% without introducing new misclassifications for existing dangerous monitors.

Analysis of IPSec Implementation on Dynamic Multipoint VPN Protocol Using Routing Border Gateway Protocol

Dynamic Multipoint Virtual Private Network (DMVPN) technology is one of Cisco's solutions to overcome the limitations of VPN scalability. DMVPN has a combination of components: Next hop resolution protocol (NHRP), Multipoint Generic Routing Encapsulation (mGRE) and Routing protocol. This research implements a simple network consisting of Hub, Spoke1, Spoke2, Lan1, Lan2 and Lan3 using the GNS3 simulator. This study compares the performance of IPSec and without IPsec on DMVPN using the BGP Routing protocol on performance parameters namely delay, throughput, jitter and packet loss to evaluate the security impact of the DMVPN network. The results of this study indicate that IPSec DMVPN has an effect on sending UDP packets which have a throughput value without IPSec of 5082.18 kbit/s while IPSec's throughput is 5034.40 kbit/s. The value of packet loss without IPSec has a value of 7.54% while IPSec has a value of 4.79%. The results of the jitter value have the same value. The delay value without IPSec has a value of 0.183s while the IPSec delay value is 0.410s. TCP packet delivery has a throughput value without IPSec is 1139.16 kbit/s while the IPSec throughput value is 1105.20 kbit/s. The results of the packet loss value and the jitter value have the same value. The delay value without IPSec has a value of 0.185s while the IPSec delay value is 0.187s.

RouteChain: Towards Blockchain-based secure and efficient BGP routing

Routing on the Internet is defined among autonomous systems (ASes) based on a weak trust model where it is assumed that ASes are honest. While this trust model strengthens the connectivity among ASes, it also results in an attack surface that can be exploited to hijack the routing paths. One such attack is known as the BGP prefix hijacking, in which a malicious AS broadcasts IP prefixes that belong to a target AS, thereby hijacking its traffic. In this paper, we propose RouteChain: a blockchain-based secure BGP routing system that counters BGP hijacking and maintains a consistent view of the Internet routing paths. Towards that, we leverage provenance assurance and tamper-proof properties of blockchains to augment trust among ASes. We group ASes based on their geographical (network) proximity and construct a bi-hierarchical blockchain model that detects false prefixes prior to their spread over the Internet. We evaluate RouteChain using three different consensus protocols and show its effectiveness by drawing a case study with the Youtube hijacking of 2008. Our results show that RouteChain can efficiently detect false prefix announcements and prevent BGP attacks over the Internet.

AP2Vec: An Unsupervised Approach for BGP Hijacking Detection

BGP hijack attacks deflect traffic between endpoints through the attacker network, leading to man-in-the-middle attacks. Thus its detection is an important security challenge. In this paper, we introduce a novel approach for BGP hijacking detection that is based on the observation that during a hijack attack, the functional roles of ASNs along the route change. To identify a functional change, we build on previous work that embeds ASNs to vectors based on BGP routing announcements and embed each IP address prefix (AP) to a vector representing its latent characteristics, we call it AP2Vec. Then, we compare the embedding of a new route with the AP embedding that is based on the old routes to identify large differences. We compare our unsupervised approach to several other new and previous approaches and show that it strikes the best balance between a high detection rate of hijack events and a low number of flagged events. In particular, for a two-hour route collection with 10-90,000 route changes, our algorithm typically flags 1-11 suspected events (0.01-0.05% FP). Our algorithm also detected most of the previously published hijack events.

Inter-Domain Prefix and Route Validation Using Fast and Scalable DAG Based Distributed Ledger for Secure BGP Routing

Inter-Domain Prefix and Route Validation Using Fast and Scalable DAG Based Distributed Ledger for Secure BGP Routing

Analysis of BGP4 Peering Establishment Time on IPv6 Connection over 6PE and 6VPE

Nowadays, because of the exhaustion of IPv4 address space, IPv6 is increasingly being used on enterprise networks. Usually, an enterprise uses an MPLS network from a Service Provider to interconnect their IPv4 network sites. Although MPLS Service Providers mostly built their MPLS backbone based on IPv4, their MPLS backbone have the capability to transport IPv6 traffic of their customers. Two methods can be used by the MPLS Service Provider to connect its customer IPv6 network, which is 6PE (IPv6 Provider Edge Routers) and 6VPE (IPv6 VPN Provider Edge Router). Enterprises generally use a BGP routing protocol to interconnect their networks, and they need to use the best method that suits their requirement from their MPLS Service Provider to transport their IPv6 traffic (including the BGP protocol). The MPLS Service Providers need to consider the advantages and disadvantages of both methods. This paper illustrates the analysis of BGP4 (current BGP version) IPv6 peering establishment time over 6PE and 6VPE methods. The MPLS Service Providers can use the analysis results of this study to determine the suited method to interconnect its customers' IPv6 networks.

Perancangan dan Implementasi Topologi WAN Menggunakan Routing Dynamic BGP Antar Cabang di PT Bank Woori Saudara Tbk

Technology in the form of a network system is one of the needs that must exist in every company because a large company must have a number of branch offices that are quite far away. especially between the head office which is located far from the branch office with the computer network system making it easier for companies to exchange information effectively and efficiently. One way to support this is by using the internet. However, to connect them there are rules that apply so that the networks communicate with each other, so certain techniques are needed, using wide area network (WAN) network technology. This study aims to facilitate the exchange of data and information communication lines between the Head Office and Branch Offices by designing and implementing a WAN topology, the author will use the concept of BGP Dynamic Routing Between Branches at PT. Bank Woori Saudara Tbk. The results of this study using BGP Routing (Border Gateway Protocol) there is an AS (Autonomous System) number assigned to each router. This AS serves as the identity of the router and router administration in recognizing the path of the neighboring router (neighboor) is active or not. In addition, by adding 1 (one) ISP at the head office of PT. Bank Woori Saudara Indonesia 1906 Tbk, can guarantee that the connection between the head office and branch offices remains connected. Finally, by using Dynamic Routing BGP fail-over can run well, with the dynamic routing work system being able to recognize whether the neighboring network is active or not. If it recognizes that the neighboring network is not active, the router will look for another alternative path.

Off-Path TCP Hijacking Attacks via the Side Channel of Downgraded IPID

In this paper, we uncover a new off-path TCP hijacking attack that can be used to terminate victim TCP connections or inject forged data into victim TCP connections by manipulating the new mixed IPID assignment method, which is widely used in Linux kernel version 4.18 and beyond. Our attack has three steps. First, an off-path attacker can downgrade the IPID assignment for TCP packets from the more secure per-socket-based policy to the less secure hash-based policy, thus building a shared IPID counter that forms a side channel in the victim. Second, the attacker detects the presence of TCP connections by observing the side channel of the shared IPID counter. Third, the attacker infers sequence and acknowledgment numbers of the detected connection by observing the side channel. Consequently, the attacker can completely hijack the connection, e.g., resetting the connection or poisoning the data stream. We evaluate the impacts of our attack in the real world, and we uncover that more than 20% of Alexa top 100k websites are vulnerable to our attack. Our case studies of SSH DoS, manipulating web traffic, and poisoning BGP routing tables show its threat on a wide range of applications. Moreover, we demonstrate that our attack can be further extended to exploit IPv4/IPv6 dual-stack networks on increasing the hash collisions and enlarging vulnerable populations. Finally, we analyze the root cause and develop a new IPID assignment method to defeat this attack. We prototype our defense in Linux 4.18 and confirm its effectiveness in the real world.

Robustness analysis of DNS paths and web access paths in public administration websites

Attacks at the naming or the routing infrastructure of the Internet have long become a reality and one single such attack has the potential of affecting access to Internet-facing services in many organizations. An important question to address is assessing the potential impact of attacks of this sort on the web infrastructure of an entire nation. In this work we examine the dependence of a large set of public administration websites on DNS entities and autonomous systems of four different countries: Italy, Germany, UK and US. We collected the dependencies of those websites from DNS zones, nameservers, networks, autonomous systems, and assessed the potential global impact of localized attacks on those entities. We also analyzed the prevalence of such defensive technologies as BGP Route Origin Authorization, DNSSEC and HTTPS Strict Transport Security. Our analysis highlights the structural interdependencies within the web infrastructures of public interest and illustrates the corresponding open problems, issues whose relevance can only grow.

Analysis of BGP4 Peering Establishment Time on IPv6 Connection over 6PE and 6VPE

Nowadays, because of the exhaustion of IPv4 address space, IPv6 is increasingly being used on enterprise networks. Usually, an enterprise uses an MPLS network from a Service Provider to interconnect their IPv4 network sites. Although MPLS Service Providers mostly built their MPLS backbone based on IPv4, their MPLS backbone have the capability to transport IPv6 traffic of their customers. Two methods can be used by the MPLS Service Provider to connect its customer IPv6 network, which is 6PE (IPv6 Provider Edge Routers) and 6VPE (IPv6 VPN Provider Edge Router). Enterprises generally use a BGP routing protocol to interconnect their networks, and they need to use the best method that suits their requirement from their MPLS Service Provider to transport their IPv6 traffic (including the BGP protocol). The MPLS Service Providers need to consider the advantages and disadvantages of both methods. This paper illustrates the analysis of BGP4 (current BGP version) IPv6 peering establishment time over 6PE and 6VPE methods. The MPLS Service Providers can use the analysis results of this study to determine the suited method to interconnect its customers' IPv6 networks.

Design of Dual Homing Backup Link on Routing Border Gateway Protocol With Method Hot-Swap Routing Protocol

The importance of the role of the network at this time makes companies and organizations look for ways to keep data flows running without downtime. Application of link backup is one way to overcome this. The need for the use of backup links at this time is expected to ensure the smooth running of the company is running its business. In this study, a design that will use BGP routing as well as using the methods HSRP and VLAN (Virtual Local Area Network) on the switch as supporters. The results obtained from the tests that have been carried out have resulted in the application of a backup link using BGP routing with the method HSRP can provide network availability of almost 0 percent in overcoming interference.

PredictRoute: A Network Path Prediction Toolkit

Accurate prediction of network paths between arbitrary hosts on the Internet is of vital importance for network operators, cloud providers, and academic researchers. We present PredictRoute, a system that predicts network paths between hosts on the Internet using historical knowledge of the data and control plane. In addition to feeding on freely available traceroutes and BGP routing tables, PredictRoute optimally explores network paths towards chosen BGP prefixes. PredictRoute's strategy for exploring network paths discovers 4X more autonomous system (AS) hops than other well-known strategies used in practice today. Using a corpus of traceroutes, PredictRoute trains probabilistic models of routing towards prefixes on the Internet to predict network paths and their likelihood. PredictRoute's AS-path predictions differ from the measured path by at most 1 hop, 75% of the time. We expose PredictRoute's path prediction capability via a REST API to facilitate its inclusion in other applications and studies. We additionally demonstrate the utility of PredictRoute in improving real-world applications for circumventing Internet censorship and preserving anonymity online.

PredictRoute: A Network Path Prediction Toolkit

Accurate prediction of network paths between arbitrary hosts on the Internet is of vital importance for network operators, cloud providers, and academic researchers. We present PredictRoute, a system that predicts network paths between hosts on the Internet using historical knowledge of the data and control plane. In addition to feeding on freely available traceroutes and BGP routing tables, PredictRoute optimally explores network paths towards chosen BGP prefixes. PredictRoute's strategy for exploring network paths discovers 4X more autonomous system (AS) hops than other well-known strategies used in practice today. Using a corpus of traceroutes, PredictRoute trains probabilistic models of routing towards prefixes on the Internet to predict network paths and their likelihood. PredictRoute's AS-path predictions differ from the measured path by at most 1 hop, 75% of the time. We expose PredictRoute's path prediction capability via a REST API to facilitate its inclusion in other applications and studies. We additionally demonstrate the utility of PredictRoute in improving real-world applications for circumventing Internet censorship and preserving anonymity online.

Analisis dan Perancangan Simulasi Perbandingan Kinerja Jaringan Komputer Menggunakan Metode Protokol Routing Statis, Open Shortest Path First (OSPF) dan Border Gateway Protocol (BGP) (Studi Kasus Tanri Abeng University)

Network is a communication between two devices to communicate with each other either using wire or wireless media. The LAN network topology used at Tanri Abeng Unversity still uses a static routing topology, where the routing process is still done manually, so that if there is an addition of a new network, it will be difficult to configure the routing table. In this research, a network topology with dynamic routing methods will be built that will help improve network performance at Tanri Abeng University. The purpose of this research is to analyze the comparison of network performance at Tanri Abeng Unversity in sending data packets using static routing protocols, OSPF, and BGP based on the parameters used. In this research also, the ping process was carried out using the cisco packet tracer 100 times with the size of the data packet sent of 32 bytes for each routing method to be compared. Then in this research, the test scenario was carried out eight times on each parameter of throughput, packet loss, delay, and jitter in the hope of determining which routing method is more optimal among static routing, OSPF, and BGP at Tanri Abeng University. The test results show that BGP routing for throughput and packet loss parameters is superior to other routing methods, while OSPF routing for delay and jitter parameters is superior to other routing methods.