Declarative routing

At a fundamental level, all Internet-based applications rely on a dependable packet delivery service provided by the Internet routing infrastructure. However, the Internet is a largescale, complex, loosely coupled distributed system made of many imperfect components. Faults of varying scale and severity occur from time to time. In this article we survey the research efforts over the years aimed at enhancing the dependability of the routing infrastructure. To provide a comprehensive overview of the various efforts, we first introduce a threat model based on known threats, then sketch out a defense framework, and put each of the existing efforts at appropriate places in the framework based on the faults and attacks against which it can defend. Our analysis shows that although individual defense mechanisms may effectively guard against specific faults, no single fence can counter all faults. Thus, a resilient Internet routing infrastructure calls for integrating techniques from cryptographic protection mechanism, statistical anomaly detection, protocol syntax checking, and protocol semantics checking to build a multifence defense system. Work/approach Secure n2n Authenticated Authorized PKI Key communication information information distribution

IEEE Security & Privacy Magazine, 2006

2016

Network operators measure Internet routes to troubleshoot problems, and researchers measure routes to characterize the Internet. However, they still rely on decades-old tools like traceroute, BGP route collectors, and Looking Glasses, all of which permit only a single query about Internet routes--what is the path from here to there? This limited interface complicates answering queries about routes such as "find routes traversing the Level3/AT&T peering in Atlanta," to understand the scope of a reported problem there. This paper presents Sibyl, a system that takes rich queries that researchers and operators express as regular expressions, then issues and returns traceroutes that match even if it has never measured a matching path in the past. Sibyl achieves this goal in three steps. First, to maximize its coverage of Internet routing, Sibyl integrates together diverse sets of traceroute vantage points that provide complementary views, measuring from thousands of networks in...

Proceedings of the 2006 ACM SIGMOD international conference on Management of data, 2006

The networking and distributed systems communities have recently explored a variety of new network architectures, both for applicationlevel overlay networks, and as prototypes for a next-generation Internet architecture. In this context, we have investigated declarative networking: the use of a distributed recursive query engine as a powerful vehicle for accelerating innovation in network architectures [23, 24, 33]. Declarative networking represents a significant new application area for database research on recursive query processing. In this paper, we address fundamental database issues in this domain. First, we motivate and formally define the Network Datalog (NDlog) language for declarative network specifications. Second, we introduce and prove correct relaxed versions of the traditional semi-naïve query evaluation technique, to overcome fundamental problems of the traditional technique in an asynchronous distributed setting. Third, we consider the dynamics of network state, and formalize the "eventual consistency" of our programs even when bursts of updates can arrive in the midst of query execution. Fourth, we present a number of query optimization opportunities that arise in the declarative networking context, including applications of traditional techniques as well as new optimizations. Last, we present evaluation results of the above ideas implemented in our P2 declarative networking system, running on 100 machines over the Emulab network testbed.

IEEE Communications Magazine, 2002

The unprecedented growth of the Internet over the last years, and the expectation of an even faster increase in the numbers of users and networked systems, resulted in the Internet assuming its position as a mass communication medium. At the same time, the emergence of an increasingly large number of application areas and the evolution of the networking technology suggest that in the near future the Internet may become the single integrated communication infrastructure. However, as the dependence on the networking infrastructure grows, its security becomes a major concern, in light of the increased attempt to compromise the infrastructure. In particular, the routing operation is a highly visible target that must be shielded against a wide range of attacks. The injection of false routing information can easily degrade network performance, or even cause denial of service for a large number of hosts and networks over a long period of time. Different approaches have been proposed to secure the routing protocols, with a variety of countermeasures, which, nonetheless, have not eradicated the vulnerability of the routing infrastructure. In this article, we survey the up-to-date secure routing schemes that appeared over the last few years. Our critical point of view and thorough review of the literature are an attempt to identify directions for future research on an indeed difficult and still largely open problem.

In the past decades various security measures have been adopted to improve the data transmission. The past work on enhancing the security over data transmission includes the designs of various cryptography algorithm such as (DES,RSA).We are proposing a dynamic routing algorithm that will randomly deliver the packets for data transmission over wired networks. The proposed algorithm is compatible with routing protocols such as Routing Information Protocol(RIP) which uses hop-count as its metric in wired networks. In RIP , hop count is considered in which only a limited number of hops are been chosen and data transmission are done by selecting the hops randomly in a network. This will improve security as well as it will also controls traffic in a network. The routing table in this algorithm is based on one of the well known dynamic routing algorithm known as “Bellman-Ford” Algorithm. An analytical study on the proposed algorithm is presented and a set of simulation experiments have been conducted which will verify the analytical results and also to show the capability of the proposed algorithm. Keywords- Bellman Ford Algorithm, RIP, Dynamic Routing

2007 International Conference on Parallel and Distributed Systems, 2007

Security is a common problem in completely decentralized peer-to-peer systems. Although several suggestions exist on how to create a secure key-based routing protocol, a practicable approach is still unattended. In this paper we introduce a secure key-based routing protocol based on Kademlia that has a high resilience against common attacks by using parallel lookups over multiple disjoint paths, limiting free nodeId generation with crypto puzzles and introducing a reliable sibling broadcast. The latter is needed to store data in a safe replicated way. We evaluate the security of our proposed extensions to the Kademlia protocol analytically and simulate the effects of multiple disjoint paths on lookup success under the influence of adversarial nodes.

2013

This work would not have been possible without the support and guidance of Prof. Dr. Karl from the first moment, when it crossed my mind to prepare my dissertation. I thank him specially for embarking in the adventure of guiding me from a distance of around 1900 kilometres. I would also like to thank the MONAMI family for their support and all the anonymous evaluators at the different conferences for their comments-some harsh, but all constructive-. All helped me improve my work. A significant part of this work has been possible because there are people collecting data from the Internet routing infrastructure. Without the work of team caring for RIPE's Routing Repository, a significant part of my research would not have been possible. My family has been my inspiration during all this time. Without the vision of my grandparents and parents, who prepared me for a multilingual world at very difficult times, this work would have been much more difficult if not impossible.

Dagstuhl Reports, 2015

This report documents the program and the outcomes of Dagstuhl Seminar 15102 "Secure Routing for Future Communication Networks". Routing is a fundamental mechanism in communication networks, and its security is critical to ensure availability and prevent attacks; however, developing and deploying secure routing mechanism is still a challenge. Significant research effort is required to advance routing security in key areas: intra-domain routing, inter-domain routing, routing in new Internet architectures, and routing in mobile and wireless networks. The seminar covered these general aspects along with the following important guiding questions. How to systematise the topic area of routing security? What are evolutionary or revolutionary options towards more secure routing systems? How to secure inter-domain routing? How to secure intra-domain routing and routing in mobile/wireless settings? How to achieve data plane/forwarding security?

2011

Motivated by limitations in today's host-based IP network architecture, recent studies have proposed clean-slate network architectures centered around alternate first-class principals, such as content, services, or users. However, much like the host-centric IP design, elevating one principal type above others hinders communication between other principals and inhibits the network's capability to evolve. Our work presents the eXpressive Internet Architecture (XIA), an architecture with native support for multiple principals and the ability to evolve its functionality to accommodate new, as yet unforeseen, principals over time. XIA also provides intrinsic security: communicating entities validate that their underlying intent was satisfied correctly without relying on external databases or configuration. In this paper, we focus on core architectural issues and protocols in the XIA data plane. We outline key design requirements relating to expressiveness, intrinsic security, and native support for multiple communicating principals, and then describe how we realize them in XIP, a new internetwork protocol. We demonstrate how rich addressing and forwarding semantics of XIP facilitate evolvability and flexibility, while keeping core network functions, notably packet processing, simple and efficient. Case studies demonstrate how XIA benefits both existing applications, and more novel ones, such as secure service migration. Finally, our evaluation of an XIA prototype demonstrates that XIA's advantages can be realized on today's hardware.