Attacks on Internet routing are typically viewed through the lens of availability and confidentiality, assuming an adversary that either discards traffic or performs eavesdropping. Yet, a strategic adversary can use routing attacks to compromise the security of critical Internet applications like Tor, certificate authorities, and the bitcoin network. In this paper, we survey such application-specific routing attacks and argue that both application-layer and network-layer defenses are essential and urgently needed. While application-layer defenses are easier to deploy in the short term, we hope that our work serves to provide much needed momentum for the deployment of network-layer defenses.
Given the tremendous success of the Internet of Things in interconnecting consumer devices, we observe a natural trend to likewise interconnect devices in industrial settings, referred to as Industrial Internet of Things or Industry 4.0. While this coupling of industrial components provides many benefits, it also introduces serious security challenges. Although sharing many similarities with the consumer Internet of Things, securing the Industrial Internet of Things introduces its own challenges but also opportunities, mainly resulting from a longer lifetime of components and a larger scale of…
Modern embedded and cyber-physical systems are ubiquitous. A large number of critical cyber-physical systems have real-time requirements (e.g., avionics, automobiles, power grids, manufacturing systems, industrial control systems, etc.). Recent developments and new functionality requires real-time embedded devices to be connected to the Internet. This gives rise to the real-time Internet-of-things (RT-IoT) that promises a better user experience through stronger connectivity and efficient use of next-generation embedded devices. However RT- IoT are also increasingly becoming targets for cyber-a…
A Mobile ad hoc Network or MANET is a wireless network of mobile devices that has the ability to self-configure and self-organise and is characterised by an absence of centralised administration and network infrastructure. An appreciable number of routing protocols used in a typical MANET have left the critical aspect of security out of consideration by assuming that all of its constituent nodes are trustworthy and non-malicious. In this paper, we discuss some of the major threats that such networks are vulnerable to, because of these inherently insecure protocols. The focus is specifically on…
Storage networking technology has enjoyed strong growth in recent years, but security concerns and threats facing networked data have grown equally fast. Today, there are many potential threats that are targeted at storage networks, including data modification, destruction and theft, DoS attacks, malware, hardware theft and unauthorized access, among others. In order for a Storage Area Network (SAN) to be secure, each of these threats must be individually addressed. In this paper, we present a comparative study by implementing different security methods in IP Storage network.
In recent years, the static shortest path (SP) problem has been well addressed using intelligent optimization techniques, e.g., artificial neural networks, genetic algorithms (GAs), particle swarm optimization, etc. However, with the advancement in wireless communications, more and more mobile wireless networks appear, e.g., mobile networks [mobile ad hoc networks (MANETs)], wireless sensor networks, etc. One of the most important characteristics in mobile wireless networks is the topology dynamics, i.e., the network topology changes over time due to energy conservation or node mobility. There…
As the de facto routing protocol for many Internet of Things (IoT) networks nowadays, and to assure the confidentiality and integrity of its control messages, the Routing Protocol for Low Power and Lossy Networks (RPL) incorporates three modes of security: the Unsecured Mode (UM), Preinstalled Secure Mode (PSM), and the Authenticated Secure Mode (ASM). While the PSM and ASM are intended to protect against external routing attacks and some replay attacks (through an optional replay protection mechanism), recent research showed that RPL in PSM is still vulnerable to many routing attacks, both in…
We present IPchain, a blockchain to store the allocations and delegations of IP addresses, with the aim of easing the deployment of secure interdomain routing systems. Interdomain routing security is of vital importance to the Internet since it prevents unwanted traffic redirections. IPchain makes use of blockchains' properties to provide flexible trust models and simplified management when compared to existing systems. In this paper we argue that Proof of Stake is a suitable consensus algorithm for IPchain due to the unique incentive structure of this use-case. We have implemented and evaluat…
The internet is now-a-days experiencing a stress due to some inherent problems with the main interdomain routing protocol, boarder gateway protocol (BGP), the amount of time it takes to converge, number of update message exchanged followed by a failure to stabilize, the amount of time required to get a valid alternate path following the failure, the way size of routing table increasing, and security issues like integrity and privacy of routing tables and routing updates exchanged among the routers, are of our primary concern. In our proposed research work we plan to address aforementioned issu…
While there exist compact routing schemes designed for grids, trees, and Internet-like topologies that offer routing tables of sizes that scale logarithmically with the network size, we demonstrate in this paper that in view of recent results in compact routing research, such logarithmic scaling on Internet-like topologies is fundamentally impossible in the presence of topology dynamics or topology-independent (flat) addressing. We use analytic arguments to show that the number of routing control messages per topology change cannot scale better than linearly on Internet-like topologies. We als…
Despite prevailing concerns that the current Internet interdomain routing system will not scale to meet the needs of the 21st century global Internet, networking research has not yet led to the construction of a new routing architecture with satisfactory and mathematically provable scalability characteristics. Worse, continuing empirical trends of the existing routing and topology structure of the Internet are alarming: the foundational principles of the current routing and addressing architecture are an inherently bad match for the naturally evolving structure of Internet interdomain topology…
Though objectives of trusted routing and virtual private networks (VPN) data transfer methods are to guarantee data transfer securely to from senders to receivers over public networks like Internet yet there are paramount differences between the two methods. This paper analyses their differences.
Understanding how packets are routed in Internet is significantly important to Internet measurement and modeling. The conventional solution for route simulation is based on the assumption of unweighted shortest path. However, it has been found and widely accepted that a packet in Internet is usually not transmitted along the unweighted shortest path between its source and destination. To better simulate the routing behavior of a packet, we thoroughly explore the real-world Internet routes and present a novel local information based simulation model, with a tuning parameter, which assigns weigh…
The Tor network is a widely used system for anonymous communication. However, Tor is known to be vulnerable to attackers who can observe traffic at both ends of the communication path. In this paper, we show that prior attacks are just the tip of the iceberg. We present a suite of new attacks, called Raptor, that can be launched by Autonomous Systems (ASes) to compromise user anonymity. First, AS-level adversaries can exploit the asymmetric nature of Internet routing to increase the chance of observing at least one direction of user traffic at both ends of the communication. Second, AS-level a…
The type of business relationships between the Internet autonomous systems (AS) determines the BGP inter-domain routing. Previous works on inferring AS relationships relied on the connectivity information between ASes. In this paper we infer AS relationships by analysing the routing polices of ASes encoded in the BGP attributes Communities and the Locpref. We accumulate BGP data from RouteViews, RIPE RIS and the public Route Servers in August 2010 and February 2011. Based on the routing policies extracted from data of the two BGP attributes, we obtain AS relationships for 39% links in our data…
Wireless medium access control (MAC) and routing protocols are fundamental building blocks of the Internet of Things (IoT). As new IoT networking standards are being proposed and different existing solutions patched, evaluating the end-to-end performance of the network becomes challenging. Specific solutions designed to be beneficial, when stacked may have detrimental effects on the overall network performance. In this paper, an analysis of MAC and routing protocols for IoT is provided with focus on the IEEE 802.15.4 MAC and the IETF RPL standards. It is shown that existing routing metrics do …
A new framework to perform routing at the Autonomous System level is proposed in this paper. This mechanism, called Chain Routing, uses complete orders as its main topological unit. Since complete orders are acyclic digraphs that possess a known topology, it is possible to define an acyclic structure to route packets between a group of Autonomous Systems. The adoption of complete orders also allows easy identification and avoidance of persistent route oscillations, eliminates the possibility of developing transient loops in paths, and provides a structure that facilitates the implementation of…
Adversaries can exploit inter-domain routing vulnerabilities to intercept communication and compromise the security of critical Internet applications. Meanwhile the deployment of secure routing solutions such as Border Gateway Protocol Security (BGPsec) and Scalability, Control and Isolation On Next-generation networks (SCION) are still limited. How can we leverage emerging secure routing backbones and extend their security properties to the broader Internet? We design and deploy an architecture to bootstrap secure routing. Our key insight is to abstract the secure routing backbone as a virtua…
The security of the Internet's routing infrastructure has underpinned much of the past two decades of distributed systems security research. However, the converse is increasingly true. Routing and path decisions are now important for the security properties of systems built on top of the Internet. In particular, BGP poisoning leverages the de facto routing protocol between Autonomous Systems (ASes) to maneuver the return paths of upstream networks onto previously unusable, new paths. These new paths can be used to avoid congestion, censors, geo-political boundaries, or any feature of the topol…
Many works have studied the Internet topology, but few have investigated the question of how it evolves over time. This paper focuses on the Internet routing IP-level topology and proposes a first step towards realistic modeling of its dynamics. We study periodic measurements of routing trees from a single monitor to a fixed destination set and identify invariant properties of its dynamics. We then propose a simple model for the underlying mechanisms of the topology dynamics. Simulations show that it effectively captures the observed behaviors, thus providing key insights of relevant mechanism…
This article first addresses applicability of Euclidean models to the domain of Internet routing. Those models are found (limitedly) applicable. Then a simplistic model of routing is constructed for Euclidean plane densely covered with points-routers. The model guarantees low stretch and logarithmical size of routing tables at any node. The paper concludes with a discussion on applicability of the model to real-world Internet routing.
The Internet infrastructure relies entirely on open standards for its routing protocols. However, the majority of routers on the Internet are closed-source. Hence, there is no straightforward way to analyze them. Specifically, one cannot easily identify deviations of a router's routing functionality from the routing protocol's standard. Such deviations (either deliberate or inadvertent) are particularly important to identify since they may degrade the security or resiliency of the network. A model-based testing procedure is a technique that allows to systematically generate tests based on a mo…
Global freight demand will triple between 2015 and 2050, based on the current demand pathway, as predicted in the Transport Outlook 2019. Hence, a revolutionary change in transport efficiency is urgently needed. One approach to tackle this change is to transfer the successful model of the Digital Internet for data exchange to the physical transport of goods: The so-called Physical Internet (PI, or $π$). The potential of the Physical Internet lies in dynamic routing, which increases the utilization of transport modalities, like trucks and vans, and makes transport more efficient. Previous conce…
The current Internet is based on a fundamental assumption of reliability and good intent among actors in the network. Unfortunately, unreliable and malicious behaviour is becoming a major obstacle for Internet communication. In order to improve the trustworthiness and reliability of the network infrastructure, we propose a novel trust model to be incorporated into BGP routing. In our approach, trust model is defined by combining voting and recommendation to direct trust estimation for neighbour routers located in different autonomous systems. We illustrate the impact of our approach with cases…
BGP is the de-facto Internet routing protocol for exchanging prefix reachability information between Autonomous Systems (AS). It is a dynamic, distributed, path-vector protocol that enables rich expressions of network policies (typically treated as secrets). In this regime, where complexity is interwoven with information hiding, answering questions such as "what is the expected catchment of the anycast sites of a content provider on the AS-level, if new sites are deployed?", or "how will load-balancing behave if an ISP changes its routing policy for a prefix?", is a hard challenge. In this wor…
In this paper, we study the downward routing for network control/actuation in large-scale and heterogeneous wireless sensor networks (WSNs) and Internet of Things (IoT). We propose the Opportunistic Source Routing (OSR), a scalable and reliable downward routing protocol for WSNs/IoT. OSR introduces opportunistic routing into traditional source routing based on the parent set of a node's upward routing in data collection, significantly addressing the drastic link dynamics in low-power and lossy WSNs. We devise a novel adaptive Bloom filter mechanism to effectively and efficiently encode a downw…
Synchronous Flooding (SF) protocols can enhance the wireless connectivity between Internet of Things (IoT) devices. However, existing SF solutions fail to introduce sufficient security measures due to strict time synchronisation requirements, making them vulnerable to malicious actions. Our paper presents a design paradigm for encrypted SF communications. We describe a mechanism for synchronising encryption parameters in a network-wide fashion. Our solution operates with minimal overhead and without compromising communication reliability. Evaluating our paradigm on a real-world, large-scale Io…
BGP-Multipath (BGP-M) is a multipath routing technique for load balancing. Distinct from other techniques deployed at a router inside an Autonomous System (AS), BGP-M is deployed at a border router that has installed multiple inter-domain border links to a neighbour AS. It uses the equal-cost multi-path (ECMP) function of a border router to share traffic to a destination prefix on different border links. Despite recent research interests in multipath routing, there is little study on BGP-M. Here we provide the first measurement and a comprehensive analysis of BGP-M routing in the Internet. We …
In this paper, we present an identity (ID) based protocol that secures AODV and TCP so that it can be used in dynamic and attack prone environments of mobile ad hoc networks. The proposed protocol protects AODV using Sequential Aggregate Signatures (SAS) based on RSA. It also generates a session key for each pair of source-destination nodes of a MANET for securing the end-to-end transmitted data. Here each node has an ID which is evaluated from its public key and the messages that are sent are authenticated with a signature/ MAC. The proposed scheme does not allow a node to change its ID throu…
The Internet's importance for promoting free and open communication has led to widespread crackdowns on its use in countries around the world. In this study, we investigate the relationship between national policies around freedom of speech and Internet topology in countries around the world. We combine techniques from network measurement and machine learning to identify features of Internet structure at the national level that are the best indicators of a country's level of freedom. We find that IP density and path lengths to other countries are the best indicators of a country's freedom. We …
Data transfer is one of the main functions of the Internet. The Internet consists of a large number of interconnected subnetworks or domains, known as Autonomous Systems. Due to privacy and other reasons the information about what route to use to reach devices within other Autonomous Systems is not readily available to any given Autonomous System. The Border Gateway Protocol is responsible for discovering and distributing this reachability information to all Autonomous Systems. Since the topology of the Internet is highly dynamic, all Autonomous Systems constantly exchange and update this reac…
Latency is one of the most critical performance metrics for a wide range of applications. Therefore, it is important to understand the underlying mechanisms that give rise to the observed latency values and diagnose the ones that are unexpectedly high. In this paper, we study the Internet delay space via robust principal component analysis (RPCA). Using RPCA, we show that the delay space, i.e. the matrix of measured round trip times between end hosts, can be decomposed into two components - the expected latency between end hosts with respect to the current state of the Internet and the inflati…
Geocast is the concept of sending data packets to nodes in a specified geographical area instead of nodes with a specific address. To route geocast messages to their destination we need a geographic routing algorithm that can route packets efficiently to the devices inside the destination area. Our goal is to design an algorithm that can deliver shortest path tree like forwarding while relying purely on distributed data without central knowledge. In this paper, we present two algorithms for geographic routing. One based purely on distance vector data, and one more complicated algorithm based o…
The Internet is composed of networks, called Autonomous Systems (or, ASes), interconnected to each other, thus forming a large graph. While both the AS-graph is known and there is a multitude of data available for the ASes (i.e., node attributes), the research on applying graph machine learning (ML) methods on Internet data has not attracted a lot of attention. In this work, we provide a benchmarking framework aiming to facilitate research on Internet data using graph-ML and graph neural network (GNN) methods. Specifically, we compile a dataset with heterogeneous node/AS attributes by collecti…
Though appropriate for core Internet infrastructure, the Internet Protocol is unsuited to routing within and between emerging ad-hoc edge networks due to its dependence on hierarchical, administratively assigned addresses. Existing ad-hoc routing protocols address the management problem but do not scale to Internet-wide networks. The promise of ubiquitous network computing cannot be fulfilled until we develop an Unmanaged Internet Protocol (UIP), a scalable routing protocol that manages itself automatically. UIP must route within and between constantly changing edge networks potentially contai…
The Internet routing protocol BGP expresses topological reachability and policy-based decisions simultaneously in path vectors. A complete view on the Internet backbone routing is given by the collection of all valid routes, which is infeasible to obtain due to information hiding of BGP, the lack of omnipresent collection points, and data complexity. Commonly, graph-based data models are used to represent the Internet topology from a given set of BGP routing tables but fall short of explaining policy contexts. As a consequence, routing anomalies such as route leaks and interception attacks can…
We introduce CCN-RAMP (Routing to Anchors Matching Prefixes), a new approach to content-centric networking. CCN-RAMP offers all the advantages of the Named Data Networking (NDN) and Content-Centric Networking (CCNx) but eliminates the need to either use Pending Interest Tables (PIT) or lookup large Forwarding Information Bases (FIB) listing name prefixes in order to forward Interests. CCN-RAMP uses small forwarding tables listing anonymous sources of Interests and the locations of name prefixes. Such tables are immune to Interest-flooding attacks and are smaller than the FIBs used to list IP a…
Networks (Autonomous Systems-AS) allocate or revoke IP prefixes with the intervention of official Internet resource number authorities, and select and advertise policy-compliant paths towards these prefixes using the inter-domain routing system and its primary enabler, the Border Gateway Protocol (BGP). Securing BGP has been a long-term objective of several research and industrial efforts during the last decades, that have culminated in the Resource Public Key Infrastructure (RPKI) for the cryptographic verification of prefix-to-AS assignments. However, there is still no widely adopted solutio…
The Internet provides physical path diversity between a large number of hosts, making it possible for networks to use alternative paths when one path fails to deliver the required Quality of Service. However, for various reasons, many established protocols (e.g. de facto Internet inter-domain routing protocol, Border-Gateway Protocol - BGP) do not fully exploit such alternate paths. This paper surveys research into techniques for discovering end-to-end alternate paths, including those based on monitoring path performance, choosing paths that are maximally disjoint, and in routing across multip…
Sender anonymity in network communication is an important problem, widely addressed in the literature. Mixnets, combined with onion routing, represent certainly the most concrete and effective approach achieving the above goal. In general, the drawback of these approaches is that anonymity has a price in terms of traffic overhead and latency. On the Internet, to achieve scalability and not to require relevant infrastructure and network-protocol changes, only P2P overlay protocols can be adopted. Among these, the most representative proposal is certainly Tarzan, which is designed to obtain stro…
The Thorup-Zwick (TZ) routing scheme is the first generic stretch-3 routing scheme delivering a nearly optimal local memory upper bound. Using both direct analysis and simulation, we calculate the stretch distribution of this routing scheme on random graphs with power-law node degree distributions, $P_k \sim k^{-γ}$. We find that the average stretch is very low and virtually independent of $γ$. In particular, for the Internet interdomain graph, $γ\sim 2.1$, the average stretch is around 1.1, with up to 70% of paths being shortest. As the network grows, the average stretch slowly decreases. The…
We study the traffic dynamics in complex networks where each link is assigned a limited and identical bandwidth. Although the first-in-first-out (FIFO) queuing rule is widely applied in the routing protocol of information packets, here we argue that if we drop this rule, the overall throughput of the network can be remarkably enhanced. We proposed some efficient routing strategies that do not strictly obey the FIFO rule. Comparing with the routine shortest path strategy, the throughput for both Barabási-Albert (BA) networks and the real Internet, the throughput can be improved more than five t…
The Internet is composed of Autonomous Systems (ASes) or domains, i.e., networks belonging to different administrative entities. Routing between domains/ASes is realised in a distributed way, over the Border Gateway Protocol (BGP). Despite its global adoption, BGP has several shortcomings, like slow convergence after routing changes, which can cause packet losses and interrupt communication even for several minutes. To accelerate convergence, inter-domain routing centralization approaches, based on Software Defined Networking (SDN), have been recently proposed. Initial studies show that these …
The Internet infrastructure is severely stressed. Rapidly growing overheads associated with the primary function of the Internet---routing information packets between any two computers in the world---cause concerns among Internet experts that the existing Internet routing architecture may not sustain even another decade. Here we present a method to map the Internet to a hyperbolic space. Guided with the constructed map, which we release with this paper, Internet routing exhibits scaling properties close to theoretically best possible, thus resolving serious scaling limitations that the Interne…
Internet of underwater things (IoUT) is a technological revolution that could mark a new era for scientific, industrial, and military underwater applications. To mitigate the hostile underwater channel characteristics, this paper hybridizes underwater acoustic and optical wireless communications to achieve a ubiquitous control and high-speed low-latency networking performance, respectively. Since underwater optical wireless communications (UOWC) suffers from limited range, it requires effective multi-hop routing solutions. In this regard, we propose a Sector-based Opportunistic Routing (SectOR…
Contemporary personal computing devices are increasingly required to be portable and mobile enabling user's wireless access, to wired network infrastructures and services. This approach to mobile computing and communication is only appropriate in situations where a coherent infrastructure is available. There are many situations where these requirements are not fulfilled such as; developing nations, rural areas, natural disasters, and military conflicts to name but a few. A practical solution is to use mobile devices interconnected via a wireless medium to form a network, known as a Mobile Ad-h…
The Mirai Distributed Denial-of-Service (DDoS) attack exploited security vulnerabilities of Internet-of-Things (IoT) devices and thereby clearly signalled that attackers have IoT on their radar. Securing IoT is therefore imperative, but in order to do so it is crucial to understand the strategies of such attackers. For that purpose, in this paper, a novel IoT honeypot called ThingPot is proposed and deployed. Honeypot technology mimics devices that might be exploited by attackers and logs their behavior to detect and analyze the used attack vectors. ThingPot is the first of its kind, since it …
Routing and switching capabilities of computer networks seem as the closed environment containing a limited set of deployed protocols, which nobody dares to change. The majority of wired network designs are stuck with OSPF (guaranteeing dynamic routing exchange on network layer) and RSTP (securing loop-free data-link layer topology). Recently, more use-case specific routing protocols, such as Babel, have appeared. These technologies claim to have better characteristic than current industry standards. Babel is a fresh contribution to the family of distance-vector routing protocols, which is gai…
