RISP: An RPKI-Based Inter-AS Source Protection Mechanism

IP source address spoofing is regarded as one of the most prevalent components when launching an anonymous invasion, especially a Distributed Denial-of-Service (DDoS) attack. Although Source Address Validations (SAVs) at the access network level are standardized by the Internet Engineering Task Force (IETF), SAV at the inter-Autonomous System (AS) level still remains an important issue. To prevent routing hijacking, the IETF is constructing a Resource Public Key Infrastructure (RPKI) as a united trust anchor to secure interdomain routing. In this study, we creatively use the RPKI to support inter-AS SAV and propose an RPKI-based Inter-AS Source Protection (RISP) mechanism. According to the trust basis provided by the RPKI, RISP offers ASes a more credible source-oriented protection for the IP addresses they own and remains independent of the RPKI. Based on the experiments with real Internet topology, RISP not only provides better incentives, but also improves efficacy and economizes bandwidth with a modest resource consumption.

IP源地址欺骗被视为发起匿名入侵，尤其是分布式拒绝服务（DDoS）攻击时最常见的手段之一。尽管互联网工程任务组（IETF）已经对接入网络层面的源地址验证（SAV）进行了标准化，但自治系统间（AS）层面的源地址验证仍然是一个重要问题。为了防止路由劫持，IETF正在构建一个资源公钥基础设施（RPKI）作为统一的信任锚来保障域间路由安全。在本研究中，我们创造性地利用RPKI来支持自治系统间的源地址验证，并提出了一种基于RPKI的自治系统间源保护（RISP）机制。根据RPKI提供的信任基础，RISP为自治系统所拥有的IP地址提供了一种更可靠的面向源的保护，并且独立于RPKI。基于真实互联网拓扑结构的实验表明，RISP不仅提供了更好的激励措施，而且在资源消耗适中的情况下提高了效率并节省了带宽。