FAIR: Forwarding Accountability for Internet Reputability

Abstract

Abstract-This paper presents FAIR, a forwarding accountability mechanism that incentivizes ISPs to apply stricter security policies to their customers. The Autonomous System (AS) of the receiver specifies a traffic profile that the sender AS must adhere to. Transit ASes on the path mark packets. In case of traffic profile violations, the marked packets are used as a proof of misbehavior.FAIR introduces low bandwidth overhead and requires no per-packet and no per-flow state for forwarding. We describe integration with IP and demonstrate a software switch running on commodity hardware that can switch packets at a line rate of 120 Gbps, and can forward 140M minimum-sized packets per second, limited by the hardware I/O subsystem.Moreover, this paper proposes a "suspicious bit" for packet headers -an application that builds on top of FAIR's proofs of misbehavior and flags packets to warn other entities in the network.

The state of affairs in BGP security: A survey of attacks and defenses

“…To enable on-line distribution of secrets, Bruhadeshwar et al [117] presented key distribution protocols for [116]. Similar source and path validation methods were also presented in [118,119,120,121,122]. Typically, these works enforce the routers to add a cryptographic primitive to each packet and, thus, ensure that the traffic traverses the correct path.…”

Forwarding Accountability: A Challenging Necessity of the Future Data Plane

“…They examine the evidence in the same way as the source AS and approve or reject the complaint. Based on the approvals and rejections, the ASes can determine the root of the problem, because each complaint is accepted at least by the benign cooperating ASes adjacent to the destination, as shown in FAIR [12].…”

“…The length increase is inevitable, but certain measures can limit the introduced overhead. For instance, a short MAC (4 bits) per ISP is enough to enable misbehavior detection in the context of flooding attacks [12].…”

“…FAIR [12] is a forwarding accountability mechanism that pushes stricter security policies to ISPs. The source and destination ASes set up a communication channel with a corresponding sending policy, which can specify sending properties (e.g., average sending rate) or forbid abnormal packet headers used for malicious activity (e.g., Christmas tree packets).…”

“…This paper's focus is on forwarding accountability with respect to flooding attacks. We extend our recent work, FAIR [12], by outlining an ACcountability-based Ddos Protection framework -ACDP -to hold the sending hosts accountable for the sending rates of their originated flows. Furthermore, we describe the corresponding challenges and present the literature in the area of forwarding accountability.…”