Security Mechanisms Rahul Hiran , Niklas Carlsson, Nahid Shahmehri - - PowerPoint PPT Presentation

▶
security mechanisms
SMART_READER_LITE
LIVE PREVIEW

Security Mechanisms Rahul Hiran , Niklas Carlsson, Nahid Shahmehri - - PowerPoint PPT Presentation

Mar 07, 2023 302 likes •895 views

Does Scale, Size, and Locality Matter? Evaluation of Collaborative BGP Security Mechanisms Rahul Hiran , Niklas Carlsson, Nahid Shahmehri Linkping University, Sweden 1 Routing attacks increasingly common Each day there are large numbers of

slide-1
SLIDE 1

Does Scale, Size, and Locality Matter? Evaluation of Collaborative BGP Security Mechanisms

Rahul Hiran, Niklas Carlsson, Nahid Shahmehri

Linköping University, Sweden

1

slide-2
SLIDE 2

Routing attacks increasingly common

Each day there are large numbers of bogus route announcements

  • e.g., cidr-report.org

Among these we have seen many serious attacks ...

2

slide-3
SLIDE 3

Routing attacks increasingly common

Each day there are large numbers of bogus route announcements

  • e.g., cidr-report.org

Among these we have seen many serious attacks ...

3

slide-4
SLIDE 4

Routing attacks increasingly common

  • List of Bogus route

announcements as listed on www.cidr- report.org.

Each day there are large numbers of bogus route announcements

  • e.g., cidr-report.org

Among these we have seen many serious attacks ...

4

slide-5
SLIDE 5

Routing attacks increasingly common

  • List of Bogus route

announcements as listed on www.cidr- report.org.

Each day there are large numbers of bogus route announcements

  • e.g., cidr-report.org

Among these we have seen many serious attacks ...

5

slide-6
SLIDE 6

Routing attacks increasingly common

  • List of Bogus route

announcements as listed on www.cidr- report.org.

Each day there are large numbers of bogus route announcements

  • e.g., cidr-report.org

Among these we have seen many serious attacks ...

6

slide-7
SLIDE 7

AS

BGP refresher

7

slide-8
SLIDE 8

AS

BGP refresher

7

AS 22394

slide-9
SLIDE 9

AS

BGP refresher

66.174.0.0/16

7

AS 22394

slide-10
SLIDE 10

BGP refresher

ISP 1 Verizon Wireless Level 3 AS 22394

66.174.0.0/16

8

slide-11
SLIDE 11

BGP refresher

ISP 1 Verizon Wireless Level 3 AS 22394

66.174.0.0/16

22394

66.174.0.0/16

8

Normal operation:

  • Origin AS announces prefix
  • Route announcements propagate between ASes
  • Helps ASes learn about “good” paths to reach prefix
slide-12
SLIDE 12

BGP refresher

ISP 1 Verizon Wireless Level 3 AS 22394

66.174.0.0/16

VZW, 22394

66.174.0.0/16

22394

66.174.0.0/16

8

Normal operation:

  • Origin AS announces prefix
  • Route announcements propagate between ASes
  • Helps ASes learn about “good” paths to reach prefix
slide-13
SLIDE 13

BGP refresher

ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

VZW, 22394

66.174.0.0/16

22394

66.174.0.0/16

8

Normal operation:

  • Origin AS announces prefix
  • Route announcements propagate between ASes
  • Helps ASes learn about “good” paths to reach prefix
slide-14
SLIDE 14

BGP refresher

ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

VZW, 22394

66.174.0.0/16

22394

66.174.0.0/16

12

Normal operation:

  • Origin AS announces prefix
  • Route announcements propagate between ASes
  • Helps ASes learn about “good” paths to reach prefix
slide-15
SLIDE 15

BGP refresher

ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

12

slide-16
SLIDE 16

BGP refresher

ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

12

Attacker

slide-17
SLIDE 17

Prefix hijack attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

13

slide-18
SLIDE 18

Prefix hijack attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.0.0/16

13

slide-19
SLIDE 19

Prefix hijack attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.0.0/16

13

AS relationships:

  • Customer-provider
  • Peer-peer
slide-20
SLIDE 20

Prefix hijack attack

Customer path?

?

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.0.0/16

14

AS relationships:

  • Customer-provider
  • Peer-peer
slide-21
SLIDE 21

Prefix hijack attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.0.0/16

15

slide-22
SLIDE 22

Prefix hijack attack

Attacker path is shorter

?

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.0.0/16

15

slide-23
SLIDE 23

Subprefix hijack attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.161.0/24

16

slide-24
SLIDE 24

Attacker prefix is more specific

?

Subprefix hijack attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.161.0/24

16

slide-25
SLIDE 25

Imposture attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.161.0/24

17

slide-26
SLIDE 26

Interception attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.161.0/24

18

slide-27
SLIDE 27

Interception attack

Attacker ISP 1 Verizon Wireless Level 3

Level3, VZW, 22394

66.174.0.0/16

AS 22394

66.174.0.0/16

Attacker

66.174.161.0/24

18

slide-28
SLIDE 28

Examples of systems to secure BGP

Information shared Prefix hijack Subprefix hijack Interception Imposture Example solutions Prefix origin (Hijack prevention) Route filtering, RPKI, ROVER Route path updates (Hijack detection) PHAS, PrefiSec, PG/BGP Passive measurements CrowdSec Active measurements Zheng at. al., PrefiSec

19

slide-29
SLIDE 29

Security gain when large ASes collaborate

20

slide-30
SLIDE 30

Security gain when large ASes collaborate

20

  • Several ASes with few large size AS gives good security
  • Locality aspects often not considered
slide-31
SLIDE 31

AS Relationship issues

  • In October, 2010, Sprint severed its

connection with Cogent

  • These two ASes had issues with

peering relationship that allowed them to exchange traffic at no cost

  • ASes do not agree with each other

22

slide-32
SLIDE 32

AS Relationship issues

  • In October, 2010, Sprint severed its

connection with Cogent

  • These two ASes had issues with

peering relationship that allowed them to exchange traffic at no cost

  • ASes do not agree with each other

22

slide-33
SLIDE 33

AS Relationship issues

  • In October, 2010, Sprint severed its

connection with Cogent

  • These two ASes had issues with

peering relationship that allowed them to exchange traffic at no cost

  • ASes do not agree with each other

22

  • Global collaboration not practical
  • Collaboration among networks

within same region plausible, for example, through legislation

slide-34
SLIDE 34

Research questions

  • How are attack

prevention/detection rates affected

– When location of participant ASes is considered? – When size of participant ASes is considered? – When number of ASes participating in the collaboration is considered?

  • In the context of last two questions,

we consider the locality aspects

23

slide-35
SLIDE 35

Research questions

  • How are attack

prevention/detection rates affected

– When location of participant ASes is considered? – When size of participant ASes is considered? – When number of ASes participating in the collaboration is considered?

  • In the context of last two questions,

we consider the locality aspects

Vs

23

slide-36
SLIDE 36

Research questions

  • How are attack

prevention/detection rates affected

– When location of participant ASes is considered? – When size of participant ASes is considered? – When number of ASes participating in the collaboration is considered?

  • In the context of last two questions,

we consider the locality aspects

Vs Vs

23

slide-37
SLIDE 37

Research questions

  • How are attack

prevention/detection rates affected

– When location of participant ASes is considered? – When size of participant ASes is considered? – When number of ASes participating in the collaboration is considered?

  • In the context of last two questions,

we consider the locality aspects

Vs Vs Vs

23

slide-38
SLIDE 38

Contributions

  • Systematic data-driven evaluation
  • Using real world topologies and routing

information we evaluate the impact of:

– Locality – Scale – Size

  • The research questions are evaluated for three

different techniques that are based on sharing

– Prefix origin – Route path updates – Passively collected RTT

24

slide-39
SLIDE 39

Examples of systems to secure BGP

Information shared Prefix hijack Subprefix hijack Interception Imposture Example solutions Prefix origin Route filtering, RPKI, ROVER Route path updates PHAS, PrefiSec, PG/BGP Passive measurements CrowdSec Active measurements Zheng at. al., PrefiSec

25

slide-40
SLIDE 40

Examples of systems to secure BGP

Information shared Prefix hijack Subprefix hijack Interception Imposture Example solutions Prefix origin Route filtering, RPKI, ROVER Route path updates PHAS, PrefiSec, PG/BGP Passive measurements CrowdSec Active measurements Zheng at. al., PrefiSec

25

slide-41
SLIDE 41

Contributions

  • Systematic data-driven evaluation
  • Using real world topologies and routing

information we evaluate the impact of:

– Locality – Scale – Size

  • The research questions are evaluated for three

different techniques that share:

– Prefix origin  hijack prevention mechanisms – Route path updates  hijack detection mechanisms – Passively collected RTT

26

slide-42
SLIDE 42

Hijack prevention technique evaluation

  • Simulation based evaluation
  • Simulate route propagation using standard

routing policy used over the Internet

  • Modified and used BSIM tool
  • AS-level topology and AS relationship

information that has 51,507 ASes and 199,540 relationships

27

slide-43
SLIDE 43

Evaluation methodology

  • Simulate route propagation when hijack prevention mechanism is present

and absent

  • Measure fraction of ASes that choose correct destination AS for the prefix
  • Calculate percentage increase in ASes that choose correct origin
  • Victim and attacker AS chosen randomly

28

slide-44
SLIDE 44

Evaluation methodology

  • Simulate route propagation when hijack prevention mechanism is present

and absent

  • Measure fraction of ASes that choose correct destination AS for the prefix
  • Calculate percentage increase in ASes that choose correct origin
  • Victim and attacker AS chosen randomly

29

slide-45
SLIDE 45

Global baseline: scale

  • As number of ASes that

collaborate increases, the protection to ASes increases

  • With 500 ASes an average

gain of 15% across attacker-victim pairs

  • Gain rises to 45% when all

ASes with node degree >= 20 deploy the prevention mechanism

vs

30

Global

slide-46
SLIDE 46

Global baseline: size

  • Size of an AS is based on

the number of neighbors

  • f that AS and is termed

as degree of AS

  • As size of ASes that

collaborate increases, the protection to ASes increases

vs

31

Global

slide-47
SLIDE 47
  • Regional deployment provide improvements similar

to global deployment when attacker is local

  • Deployment to prevent attacks from own region
  • Mechanisms for greater good

vs

vs

32

Compare global and regional deployment: scale

Global North America (NA) European Union (EU)

slide-48
SLIDE 48

Compare global and regional deployment: scale

  • 500 randomly selected global ASes vs 431 ASes in

NA region

vs

33

vs

North America (NA) Global

slide-49
SLIDE 49

Contributions

  • Systematic data-driven evaluation
  • Using real world topologies and routing

information we evaluate the impact of:

– Locality – Scale – Size

  • The research questions are evaluated for three

different techniques that share:

– Prefix origin  hijack prevention mechanisms – Route path updates  hijack detection mechanisms – Passively collected RTT

34

slide-50
SLIDE 50

Contributions

  • Systematic data-driven evaluation
  • Using real world topologies and routing

information we evaluate the impact of:

– Locality – Scale – Size

  • The research questions are evaluated for three

different techniques that share:

– Prefix origin  hijack prevention mechanisms – Route path updates  hijack detection mechanisms – Passively collected RTT

35

slide-51
SLIDE 51

Hijack detection system evaluation

  • Extended earlier proposed system that uses

route path announcements to aid in raising alerts for routing attacks

  • Routepath updates from RouteViews project

around large scale routing anomaly

  • On April 8, 2010, China Telecom announced

≈50,000 prefixes allocated to other networks

36

slide-52
SLIDE 52

Global vs regional baseline: scale

  • Number of alerts for prefix hijack increases number of ASes
  • Few ASes needed to detect subprefix hijack alerts
  • High detection rate in rest of the world region despite fewer ASes
  • Confirms result with the hijack prevention mechanisms

37

vs

Global

slide-53
SLIDE 53

Global vs regional baseline: scale

  • Number of alerts for prefix hijack increases number of ASes
  • Few ASes needed to detect subprefix hijack alerts
  • High detection rate in rest of the world region despite fewer ASes
  • Confirms result with the hijack prevention mechanisms

37

vs

vs

Global NA Rest of the world

slide-54
SLIDE 54

Global baseline: size

  • With increasing degree threshold the alerts rate does not increase
  • Regional deployment with complementing ASes from other regions
  • Routes learnt by mid/tier ASes may not reach their providers

vs

38

Global

slide-55
SLIDE 55

Global baseline: size

  • With increasing degree threshold the alerts rate does not increase
  • Regional deployment with complementing ASes from other regions
  • Routes learnt by mid/tier ASes may not reach their providers

vs

38

vs

Global North America (NA) European Union (EU)

slide-56
SLIDE 56

Contributions

  • Systematic data-driven evaluation
  • Using real world topologies and routing

information we evaluate the impact of:

– Locality – Scale – Size

  • The research questions are evaluated for three

different techniques that share:

– Prefix origin – Route path updates – Passively collected RTT

39

slide-57
SLIDE 57

Conclusion

  • Systematic evaluation of three broad classes of

routing attack prevention/detection techniques

  • Locality, size, and scale aspects considered
  • For all three classes of techniques we see cases

where regional deployment provides substantial benefits

  • Regional deployment with carefully selected

participants can outperform global deployment that is not planned

40

slide-58
SLIDE 58

Rahul Hiran rahul.hiran@liu.se

Linköping University

expanding reality

37

Does Scale, Size, and Locality Matter?