BGP路由泄露研究

贾佳; 延志伟; 耿光刚; 金键

doi:10.11959/j.issn.2096-109x.2016.00074

您当前的位置：

首页 >

文章列表页 >

BGP路由泄露研究

学术论文 | 更新时间：2024-06-03

- BGP路由泄露研究
- Study on BGP route leak
- 网络与信息安全学报 2016年2卷第8期页码：54-61
- 作者机构：
  
  1. 中国科学院大学计算机网络信息中心，北京 100190
  2. 中国互联网络信息中心互联网域名管理技术国家工程实验室，北京 100190
- 作者简介：
  
  [ "贾佳（1992-），女，河北石家庄人，中国科学院大学硕士生，主要研究方向为BGP安全。" ]
  [ "延志伟（1985-），男，山西兴县人，博士，中国互联网络信息中心副研究员，主要研究方向为IPv6、DNS、BGP等。" ]
  [ "耿光刚（1980-），男，山东泰安人，博士，中国互联网络信息中心研究员，主要研究方向为机器学习、对抗性信息检索。" ]
  [ "金键（1976-），男，湖北十堰人，博士，中国互联网络信息中心高级工程师，主要研究方向为 DNS、大规模分布式数据协同、网络可信与安全等。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61303242)
- DOI：10.11959/j.issn.2096-109x.2016.00074
  中图分类号： TP393.08
- 网络首发：2016-08，
  
  纸质出版：2016-08-15
- 稿件说明：
移动端阅览
贾佳, 延志伟, 耿光刚, 等. BGP路由泄露研究[J]. 网络与信息安全学报, 2016,2(8):54-61.

Jia JIA, Zhi-wei YAN, Guang-gang GENG, et al. Study on BGP route leak[J]. Journal of network and information security, 2016, 2(8): 54-61.
贾佳, 延志伟, 耿光刚, 等. BGP路由泄露研究[J]. 网络与信息安全学报, 2016,2(8):54-61. DOI： 10.11959/j.issn.2096-109x.2016.00074.

Jia JIA, Zhi-wei YAN, Guang-gang GENG, et al. Study on BGP route leak[J]. Journal of network and information security, 2016, 2(8): 54-61. DOI： 10.11959/j.issn.2096-109x.2016.00074.

摘要

随着互联网规模的急剧扩大，边界网关协议（BGP

border gateway protocol）在域间路由系统中的作用愈加重要。BGP本身存在很大的安全隐患，导致前缀劫持、AS_PATH劫持及路由泄露攻击事件频频发生，给互联网造成了严峻的安全威胁。目前，国内外针对路由泄露的介绍及安全研究机制相对较少。对 BGP 路由泄露进行了详细研究，介绍了 BGP 内容、路由策略及制定规则，分析了重大路由泄露安全事件及发生路由泄露的6种类型，并比较了当前针对路由泄露的安全机制和检测方法，最后对路由泄露安全防范机制提出了新的展望。

Abstract

With the rapid expansion of the scale of Internet

BGP plays a more and more important role in the Inter domain routing system.BGP has a lot of security risks

which result in prefix hijacking

AS_PATH hijacking and route leak attacks occuring frequently

causing serious threats to the Internet.In currently

the content introduction and security research mechanism were little

so a detailed study of BGP route leak was carried out.The BGP proto-col

route policy and established rules were introduced

six types of major route leak security incidents were analy-sised

the current security mechanisms and methods were summarized and compared to solve and detect route leak.In the last

a new prospect for the security and protection mechanism of route leak was proposed.

关键词

Keywords

references

MURPHY S . BGP security vulnerabilities analysis [EB/OL ] . https://tools.ietf.org/pdf/draft-ietf-idr-bgp-vuln-01.pdf https://tools.ietf.org/pdf/draft-ietf-idr-bgp-vuln-01.pdf .

NORDSTRÖM O , DOVROLIS C . Beware of BGP attacks [J ] . ACM Sigcomm Computer Communication Review , 2004 , 34 ( 2 ): 1 - 8 .

PHOKEER A . Interdomain routing security:motivation and chal-lenges of RPKI [J ] . Timss Technical Report , 2013 .

刘欣 , 刘华富 . 互联网前缀劫持攻击研究 [J ] . 计算机技术与发展 , 2015 ( 2 ): 131 - 134 .

LIU X , LIU H F . Internet prefix hijack attack research [J ] . Computer Technology and Development , 2015 ( 2 ): 131 - 134 .

HUSTON G , BUSS R . Securing BGP with BGPsec [J ] . Internet Society Org . 2011 , 6 ( 5 ): 15 - 22 .

Secure BGP project (S-BGP) [EB/OL ] . http://www.ir.bbn.com/sbgp/ http://www.ir.bbn.com/sbgp/ .

WHITE R . Securing BGP through secure origin BGP (SoBGP) [J ] . The Internet Protocol Journal . 2003 , 6 ( 3 ): 15 - 22 .

LEPINSKI M , KENT S . An infrastructure to support secure Inter-net routing [EB/OL ] . https://www.rfc-editor.org/rfc/rfc6480.txt https://www.rfc-editor.org/rfc/rfc6480.txt .

LEPINSKI M , SRIRAM K . BGpsec protocol specification [EB/OL ] . http://ietfreport.isoc.org/all-ids/draft-ietf-sidr-bgpsec-protocol-15.txt http://ietfreport.isoc.org/all-ids/draft-ietf-sidr-bgpsec-protocol-15.txt .

REKHTER Y , LI T , HARES S . A border gateway protocol 4(BGP-4) [S ] . RFC 4271 , 2006 .

CHEN E . Route refresh capability for BGP-4 [S ] . RFC 2918 , 2000 .

黎松，诸葛建伟，李星 . BGP安全研究 [J ] . 软件学报， 2013 , 24 ( 1 ): 121 - 138 .

LI S , ZHU-GE J W , LI X . BGP security studies [J ] . Journal of Soft-ware , 2013 , 24 ( 1 ): 121 - 138 .

GAO L . On inferring autonomous system relationships in the Internet [J ] . IEEE/ACM Transation on Networking , 2001 , 9 ( 6 ): 733 - 745 .

HUSTON G . Leaking routes-the ISP Column 2012 [EB/OL ] . http://www.potaroo.net/isp col/2012-03/leaks.html http://www.potaroo.net/isp col/2012-03/leaks.html .

Finding and diagnosing BGP route leaks [EB/OL ] . http://blog.thou-sande yes.com/finding-and-diagnosing-bgp-route-leaks/ http://blog.thou-sande yes.com/finding-and-diagnosing-bgp-route-leaks/ .

BGP routing leak detection system routing leak detection sys-tem [EB/OL ] . http://pu ck.nether.net/bgp/eakinfo.cgi http://pu ck.nether.net/bgp/eakinfo.cgi .

SRIRAM K , MONTGOMERY D , MCPHERSON D , et al . Problem definition and classification of bgp route leaks [S ] . RFC 7908 , 2016 .

DURAND J , PEPELNJAK I , DOERING G . BGP operations and security [S ] . RFC 7454 , 2015 .

KUHN R , SRIRAM K , MONTGOMERY D . Border gateway proto-col security [EB/OL ] http://csrc.nist.gov/publications/nistpubs/800-54/SP800-54.pdf http://csrc.nist.gov/publications/nistpubs/800-54/SP800-54.pdf .

IANA . Special-use IPv4 addresses.RFC 3330 [EB/OL ] . https://www.rfc-editor.org/rfc/pdfrfc/rfc3330.txt.pdf https://www.rfc-editor.org/rfc/pdfrfc/rfc3330.txt.pdf .

PATEL K , HARES S . Analysis of Existing work for I2NSF [EB/OL ] . https://www.ietf.org/id/draft-ietf-idr-aspath-orf-11.txt https://www.ietf.org/id/draft-ietf-idr-aspath-orf-11.txt .

Overview of the IRR [EB/OL ] . http://www.irr.net/docs/overview.html http://www.irr.net/docs/overview.html .

ALAETTINOGLU C , VILLAMIZAR C , GERICH E , et al . Routing policy specification language(RPSL) [S ] . RFC 2622 .

BLUNK L , DAMAS J , PARENT F , et al . Routing policy specifica-tion language next generation(RPSLng) [S ] . RFC 4012 .

Secure inter-domain routing (sidr) [EB/OL ] . http://datatracker.ietf.org/wg/sidr/ http://datatracker.ietf.org/wg/sidr/ .

SRIRAM K , MONTGOMERY D , DICKSON B , et al . Method for detection and mitigation of BGP route leaks [EB/OL ] . http://www.ietf.org/id/draft-ietf-idr-route- leak-detection- mitigation-04.txt http://www.ietf.org/id/draft-ietf-idr-route- leak-detection- mitigation-04.txt .

HUSTON G , MICHAELSON G . Validation of route origination using the resource certification public key infrastructure(PKI) and route origin authorization (ROAs) [S ] . RFC 6483 .

AZIMOV A , BOGOMAZOV E , BUSH R . Route leak detection and filtering using roles in update and open messages [EB/OL ] . http://www.potaroo.net/ietf/idref/draft-ymbk-idr-bgp-open-policy/ http://www.potaroo.net/ietf/idref/draft-ymbk-idr-bgp-open-policy/ .

浏览量

21176

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据