Improving the Security and Robustness of Internet Routing: What Can We Do Today?

Attacks at the control and routing plane may be the next generation of threats for the Internet. Manipulation of the routing layer could originate from profiteering, malice, or simply human error. The community has recognized this danger and several promising approaches have been proposed. Most of these approaches attempt to capture and block routing anomalies. In practice, the difficulty of deploying such approaches limits their usefulness. Our goal is to develop a scheme that can have immediate impact today. In this light, we propose a reactive approach that can help reduce the extent and impact of routing errors. More specifically, we develop an approach and a tool to identify routing errors in BGP routing by using the policies that Autonomous Systems register in the Internet Routing Registries. We use the policy of an AS as found in these registries to detect deviations between the intended policy and the actual policy seen in BGP. As a proof of concept, we use the RIPE registry to monitor the European Internet routing for ten days. We found that for 97% of the prefixes we can validate their origin AS using the RIPE registry. Additionally, we find that for 60% of the networks, their policy is fresh and can be used to check their routing for abnormal routing behavior.