互联网BGP路由可视及安全检测技术架构与实践

doi:10.11959/j.issn.1000-0801.2021263

电信科学 ›› 2021, Vol. 37 ›› Issue (12): 110-120.doi: 10.11959/j.issn.1000-0801.2021263

互联网BGP路由可视及安全检测技术架构与实践

叶朝阳¹, 沈辰², 黄明庆³, 张士聪¹, 刘伊莎¹

¹ 浙江省新型互联网交换中心有限公司，浙江杭州 311200
² 中国信息通信研究院，北京 100191
³ 华为技术有限公司，北京 100095

修回日期:2021-12-08 出版日期:2021-12-20 发布日期:2021-12-01
作者简介:叶朝阳（1976- ），男，浙江省新型互联网交换中心有限责任公司总经理、中国互联网协会互联网互联互通工作委员会副主任委员，主要研究方向为新型互联网交换中心网络架构与协议设计、云网交换等
沈辰（1989- ），中国信息通信研究院工程师，主要研究方向为互联网网络互联互通、互联网路由安全、互联网测量与性能分析等
黄明庆（1969- ），男，华为技术有限公司高级IP技术研究专家，主要研究方向为网络空间安全、互联网协议架构等
张士聪（1990- ），男，浙江省新型互联网交换中心有限责任公司技术部经理，主要研究方向为新型互联与网络架构
刘伊莎（1992- ），女，浙江省新型互联网交换中心有限责任公司IT工程师，主要研究方向为新型互联与网络架构信息化

Architecture and practice of BGP internet routing visibility and security detection

Chaoyang YE¹, Chen SHEN², Mingqing HUANG³, Shicong ZHANG¹, Yisha LIU¹

¹ National (Hangzhou) New-Type Internet Exchange Point, Zhejiang 311200, China
² China Academy of Information and Communications Technology, Beijing 100191, China
³ Huawei Technologies Co., Ltd., Beijing 100095, China

Revised:2021-12-08 Online:2021-12-20 Published:2021-12-01

摘要/Abstract

摘要：

边界网关协议（border gateway protocol，BGP）是支撑互联网50年来快速发展的核心协议，因早期设计考虑不足一直存在路由劫持、路由泄露等路由安全威胁漏洞。随着互联网应用日益深入，BGP 路由安全问题逐渐引起业界重视，边界网络安全防护意义重大。提出了一种BGP路由安全检测架构，通过推理构建全球BGP路由知识库实现互联网全局路由可视性，并基于此实现路由劫持、路由泄露等路由安全事件的准实时检测。通过在杭州交换中心部署实践，证明本系统可构造较完整的互联网全局路由知识库、实现较准确和实时的BGP路由安全事件检测。

关键词: BGP, 路由安全, 路由劫持, 路由泄露

Abstract:

Border Gateway Protocol (BGP) is the de facto inter-domain routing protocol of today’s global internet for exchanging routing information.However, it was supposed that all participants were reliable without generating routing security issues by mistakes or on purpose when BGP was designed 50 years ago.As Internet is getting involved in all aspects of our society, internet routing security is becoming the problems that couldn’t be ignored anymore.A general architecture was proposed which coved inference of BGP routing knowledge database and provided visibility of global internet routing.Detection of route security events such as routing hijacks and routing leaks were realized.The deployment shows that the system can provide good visibility of internet routing and precise detection of routing security events.

Key words: BGP, internet routing security, routing hijack, routing leak

中图分类号:

TP393

叶朝阳, 沈辰, 黄明庆, 张士聪, 刘伊莎. 互联网BGP路由可视及安全检测技术架构与实践[J]. 电信科学, 2021, 37(12): 110-120.

Chaoyang YE, Chen SHEN, Mingqing HUANG, Shicong ZHANG, Yisha LIU. Architecture and practice of BGP internet routing visibility and security detection[J]. Telecommunications Science, 2021, 37(12): 110-120.

图/表 6

图1

图2

图3

图4

图5

表1

参考文献 7

[1]	ZHAO X L , PEI D , et al . An Analysis of BGP Multiple Origin AS Conflicts[C]// Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement 2001. New York:ACM Press, 2001.
[2]	CHIN K W , . On the characteristics of BGP multiple origin AS conflicts[C]// Proceedings of 2007 Australasian Telecommunication Networks and Applications Conference. Piscataway:IEEE Press, 2007: 157-162.
[3]	LUCKIE M , HUFFAKER B , DHAMDHERE A ,et al. AS relationships,customer cones,and validation[C]// Proceedings of the 2013 conference on Internet measurement conference. New York:ACM Press, 2013.
[4]	LI Y C , SCOTT C et al . Stable and Practical AS Relationship Inference with ProbLink[C]// Proceedings of 16th {USENIX}Symposium on Networked Systems Design and Implementation ({NSDI} 19). 2019: 581-598.
[5]	GIOTSAS V , LUCKIE M , et al . Inferring Complex AS Relationships[C]// Proceedings of the 2014 conference on Internet measurement conference. New York:ACM Press, 2014.
[6]	FENG G Y , SESHAN S , STEENKISTE P ,et al. PARI:a probabilistic approach to AS relationships inference[EB]. 2019.
[7]	JIN Z T , SHI X G , YANG Y ,et al. TopoScope:recover AS relationships from fragmentary observations[C]// Proceedings of the ACM Internet Measurement Conference. New York:ACM Press, 2020.

链路类型	TP/条	TN/条	FP/条	FN/条	查全率	准确率
P2C	33 870	39 413	94	315	99.08%	99.72%
P2P	39 400	33 872	313	107	99.73%	99.21%

[1]	苏莹莹, 李丹, 叶洪琳. 资源公钥基础设施RPKI：现状与问题[J]. 电信科学, 2021, 37(3): 75-89.
[2]	王皓轮. MPLS VPN业务VRRP回程路由设计[J]. 电信科学, 2020, 36(11): 165-173.
[3]	黄勇军,陆小铭,曹维华. SDN在IP广域网的典型应用与实现[J]. 电信科学, 2016, 32(3): 7-13.
[4]	罗雨佳,欧亮,莫志威,唐宏. 基于BGP增强的流量调度技术[J]. 电信科学, 2016, 32(3): 20-27.
[5]	张届新,吴志明. 基于VxLAN组网的云数据中心互联方案[J]. 电信科学, 2016, 32(12): 122-128.
[6]	董铮,唐海军. 基于路由交换技术的静态专线冗余备份方法[J]. 电信科学, 2015, 31(10): 197-202.
[7]	马迪,沈烁. 基于本地信任锚点管理的RPKI安全运行机制研究[J]. 电信科学, 2013, 29(9): 55-59.
[8]	朱红,张思东,张宏科. 基于IPv6的BGP/MPLS VPN的移动性研究[J]. 电信科学, 2006, 22(4): 54-58.

互联网BGP路由可视及安全检测技术架构与实践

Architecture and practice of BGP internet routing visibility and security detection

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 6

参考文献 7

相关文章 8

Metrics

推荐阅读 0