How biased is our validation (data) for AS relationships?

Prehn, Lars; Feldmann, Anja

doi:10.1145/3487552.3487825

Cited by 7 publications

(1 citation statement)

References 45 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, it is often difficult to estimate how many malicious routes can be prevented for an AS network in advance. Since route advertisements are often biased depending on the relationships among ASes [45], it is desirable to identify how the effectiveness of ASPAs and their correspondence ASPV is affected when they are deployed in each AS, respectively.…”

Section: B Security With Partially-deployed Aspamentioning

confidence: 99%

The Juice Is Worth the Squeeze: Analysis of Autonomous System Provider Authorization in Partial Deployment

Umeda

Kimura

Yanai

2023

IEEE Open J. Commun. Soc.

View full text Add to dashboard Cite

BGP, the de-facto standard protocol for exchanging routes on a network-wide basis called AS employs invalid routes. Recently, a data object called Autonomous System Provider Authorization (ASPA) was proposed as a new specification for verifying PATH information in BGP security. In this paper, we shed light on the effectiveness of ASPAs in a partial deployment alongside the conventional BGP through experiments based on a real AS topology. To this end, we also present a novel simulation tool, LOTUS, for BGP route exchange, including ASPAs. We then evaluate deployments of ASPAs and their verification with LOTUS for two cases on network topology in Japan: the case in deployment from ASes whose number of connections with other ASes is large, i.e., deployment from top ASes, and the case in deployment from ASes at the end of the network topology, i.e., deployment from leaf-node ASes. As a result, we confirm that the number of victim ASes decreases in the former case, while ASPAs provide no advantage in the latter case. Notably, the number of victim ASes decreases by about 96% on average by deploying the verification with ASPAs in the top-eight ASes. Based on these results, we further conduct extensive experiments in the deployment from the top ASes, whereby ASes outside the network topology advertise malicious routes to the victim ASes. We also discuss a case whereby an adversary tries to leverage ASPAs. Our promising results show that the adversary will no longer obtain an advantage even by leveraging ASPAs.

show abstract

Section: B Security With Partially-deployed Aspamentioning

confidence: 99%