BGP路由泄露研究

doi:10.11959/j.issn.2096-109x.2016.00074

Abstract

Abstract:

With the rapid expansion of the scale of Internet,BGP plays a more and more important role in the Inter domain routing system.BGP has a lot of security risks,which result in prefix hijacking,AS_PATH hijacking and route leak attacks occuring frequently,causing serious threats to the Internet.In currently,the content introduction and security research mechanism were little,so a detailed study of BGP route leak was carried out.The BGP proto-col,route policy and established rules were introduced,six types of major route leak security incidents were analy-sised,the current security mechanisms and methods were summarized and compared to solve and detect route leak.In the last,a new prospect for the security and protection mechanism of route leak was proposed.

Key words: BGP, route policy, route leak, route security

CLC Number:

TP393.08

Jia JIA,Zhi-wei YAN,Guang-gang GENG,Jian JIN. Study on BGP route leak[J]. Chinese Journal of Network and Information Security, 2016, 2(8): 54-61.

Figures/Tables 9

References 28

[1]	MURPHY S . BGP security vulnerabilities analysis[EB/OL]. .
[2]	NORDSTR?M O , DOVROLIS C . Beware of BGP attacks[J]. ACM Sigcomm Computer Communication Review, 2004, 34(2): 1-8.
[3]	PHOKEER A . Interdomain routing security:motivation and chal-lenges of RPKI[J]. Timss Technical Report, 2013.
[4]	刘欣, 刘华富 . 互联网前缀劫持攻击研究[J]. 计算机技术与发展, 2015(2): 131-134.
	LIU X , LIU H F . Internet prefix hijack attack research[J]. Computer Technology and Development, 2015(2): 131-134.
[5]	HUSTON G , BUSS R . Securing BGP with BGPsec[J]. Internet Society Org. 2011, 6(5): 15-22.
[6]	Secure BGP project (S-BGP) [EB/OL]. .
[7]	WHITE R . Securing BGP through secure origin BGP (SoBGP)[J]. The Internet Protocol Journal. 2003, 6(3): 15-22.
[8]	LEPINSKI M , KENT S . An infrastructure to support secure Inter-net routing[EB/OL]. .
[9]	LEPINSKI M , SRIRAM K . BGpsec protocol specification[EB/OL]. .
[10]	REKHTER Y , LI T , HARES S . A border gateway protocol 4(BGP-4)[S]. RFC 4271, 2006.
[11]	CHEN E . Route refresh capability for BGP-4[S]. RFC 2918, 2000.
[12]	黎松，诸葛建伟，李星 . BGP安全研究[J]. 软件学报， 2013, 24(1): 121-138.
	LI S , ZHU-GE J W , LI X . BGP security studies[J]. Journal of Soft-ware, 2013, 24(1): 121-138.
[13]	GAO L . On inferring autonomous system relationships in the Internet[J]. IEEE/ACM Transation on Networking, 2001, 9(6): 733-745.
[14]	HUSTON G . Leaking routes-the ISP Column 2012[EB/OL]. .
[15]	Finding and diagnosing BGP route leaks[EB/OL]. .
[16]	BGP routing leak detection system routing leak detection sys-tem[EB/OL]. .
[17]	SRIRAM K , MONTGOMERY D , MCPHERSON D , et al. Problem definition and classification of bgp route leaks[S]. RFC 7908, 2016.
[18]	DURAND J , PEPELNJAK I , DOERING G . BGP operations and security[S]. RFC 7454, 2015.
[19]	KUHN R , SRIRAM K , MONTGOMERY D . Border gateway proto-col security[EB/OL] .
[20]	IANA. Special-use IPv4 addresses.RFC 3330[EB/OL]. .
[21]	PATEL K , HARES S . Analysis of Existing work for I2NSF[EB/OL]. .
[22]	Overview of the IRR[EB/OL]. .
[23]	ALAETTINOGLU C , VILLAMIZAR C , GERICH E , et al. Routing policy specification language(RPSL)[S]. RFC 2622.
[24]	BLUNK L , DAMAS J , PARENT F , et al. Routing policy specifica-tion language next generation(RPSLng)[S]. RFC 4012.
[25]	Secure inter-domain routing (sidr)[EB/OL]. .
[26]	SRIRAM K , MONTGOMERY D , DICKSON B , et al. Method for detection and mitigation of BGP route leaks[EB/OL]. .
[27]	HUSTON G , MICHAELSON G . Validation of route origination using the resource certification public key infrastructure(PKI) and route origin authorization (ROAs)[S]. RFC 6483.
[28]	AZIMOV A , BOGOMAZOV E , BUSH R . Route leak detection and filtering using roles in update and open messages[EB/OL]. .

Metrics

Recommended 0

No Suggested Reading articles found!

分组类型	作用
Open分组	用于2个AS的BGP发言人（即边界路由器）之间构建连通关系，使通信初始化
Update分组	用来对某一路由信息进行通告，或者撤销多条路由
Keepalive分组	保证一段时间内相邻AS之间的连通性，AS之间会周期性互发信息
Notification分组	发送检测到的差错信息
Route-refresh分组	请求对等端进行重新通告

发送方	接收方
Customer	Provider
Provider	Customer
Peer	Peer
Internal	Internal

Study on BGP route leak

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 9

References 28

Related Articles 14

Metrics

Recommended 0

路由问题	百分比/%
BGP错误配置	31
前缀劫持	25
路由泄露	22
AS路径篡改	20
其他	2

[1]	Cheng SUN, Hao HU, Yingjie YANG, Hongqi ZHANG. Prediction method of 0day attack path based on cyber defense knowledge graph [J]. Chinese Journal of Network and Information Security, 2022, 8(1): 151-166.
[2]	Yao LYU, Jinpeng HOU, Chong NIE, Mang SU, Bin WANG, Hongling JIANG. Partial blind signature scheme based on SM9 algorithm [J]. Chinese Journal of Network and Information Security, 2021, 7(4): 147-153.
[3]	Cheng SUN, Hao HU, Yingjie YANG, Hongqi ZHANG. Two-layer threat analysis model integrating macro and micro [J]. Chinese Journal of Network and Information Security, 2021, 7(1): 143-156.
[4]	Bin ZHANG,Lixun LI,Shuqin DONG. Malware detection approach based on improved SOINN [J]. Chinese Journal of Network and Information Security, 2019, 5(6): 21-30.
[5]	Jianming ZHU,Hongrui YANG. Data security challenges and countermeasures in financial technology [J]. Chinese Journal of Network and Information Security, 2019, 5(4): 71-79.
[6]	Chuanfeng XU,Hui LIN,Xuancheng GUO,Xiaoding WANG. New collaborative DDoS defense technology based on NFV [J]. Chinese Journal of Network and Information Security, 2019, 5(2): 66-76.
[7]	Shuang WANG,Yueming LU. Information acquisition strategy for security gate-ways based on swing door trending algorithm [J]. Chinese Journal of Network and Information Security, 2018, 4(10): 59-67.
[8]	Juntai HU,Zhenyu WU,Xiao FU,Yichao WANG. Game model based security strategy of heterogeneous controllers in the cloud [J]. Chinese Journal of Network and Information Security, 2018, 4(9): 52-59.
[9]	Junnan YANG,Hongqi ZHANG,Chuanfu ZHANG. Defense decision-making method based on incomplete information stochastic game [J]. Chinese Journal of Network and Information Security, 2018, 4(8): 12-20.
[10]	Binghao YAN,Guodong HAN. Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm [J]. Chinese Journal of Network and Information Security, 2018, 4(7): 48-59.
[11]	Wenyan LIU,Shumin HUO,Qing TONG,Miao ZHANG,Chao QI. Research on models of network security evaluation and analysis [J]. Chinese Journal of Network and Information Security, 2018, 4(4): 1-11.
[12]	Xiaoyu CHEN,Yueming LU. Improved packet classification algorithm based on multidimensional space dynamic division and RFC [J]. Chinese Journal of Network and Information Security, 2018, 4(3): 35-41.
[13]	Haocheng ZHANG,Xiaojie WU,Xiang TANG,Runxuan SHU,Tianchen DING,Xiaoju DONG. System detecting network anomaly with visualization techniques [J]. Chinese Journal of Network and Information Security, 2018, 4(2): 40-54.
[14]	Xiang-dong HU,Ke LIU,Feng ZHANG,Jia-fu LIN,Jun FU,Zhi-hui GUO. Financial phishing detection method based on sensitive characteristics of webpage [J]. Chinese Journal of Network and Information Security, 2017, 3(2): 31-38.