Flexsealing BGP防止管路泄漏：Peerlock主动测量和分析
Flexsealing BGP Against Route Leaks: Peerlock Active Measurement and Analysis
摘要：
BGP路由泄漏经常导致域间路由的严重中断。这些事件已经困扰了互联网几十年，而部署和可用性问题削弱了缓解问题的努力。Peerlock于2016年推出，采用新方法解决了路由泄漏问题。Peerlock使运输提供商之间的过滤协议能够保护自己的网络，而无需广泛的合作或信任基础设施。我们概述了Peerlock系统和一个变种，Peerlock-lite，并进行现场互联网实验，以测量其部署在控制平面上。我们的测量发现了对等集团中第1层网络之间的重要Peerlock保护的证据，其中部署了48%的潜在Peerlock过滤器，并揭示了许多其他网络也部署了针对第1层泄漏的过滤器。为了指导进一步的部署，我们还量化Peerlock的影响，路由泄漏在目前观察到的水平和假设的未来部署方案下，通过BGP模拟。这些实验表明，目前的Peerlock部署限制了Tier 1泄漏出口到10%或更少的网络，模拟泄漏的40%。在所有大型ISP（不到所有网络的1%）中进行战略性的额外Peerlock-lite部署，与部署的对等团体中的Peerlock一起，完全减轻了80%的模拟Tier 1路由泄漏。
英文摘要：
BGP route leaks frequently precipitate serious disruptions to interdomain routing. These incidents have plagued the Internet for decades while deployment and usability issues cripple efforts to mitigate the problem. Peerlock, introduced in 2016, addresses route leaks with a new approach. Peerlock enables filtering agreements between transit providers to protect their own networks without the need for broad cooperation or a trust infrastructure. We outline the Peerlock system and one variant, Peerlock-lite, and conduct live Internet experiments to measure their deployment on the control plane. Our measurements find evidence for significant Peerlock protection between Tier 1 networks in the peering clique, where 48% of potential Peerlock filters are deployed, and reveal that many other networks also deploy filters against Tier 1 leaks. To guide further deployment, we also quantify Peerlock's impact on route leaks both at currently observed levels and under hypothetical future deployment scenarios via BGP simulation. These experiments reveal present Peerlock deployment restricts Tier 1 leak export to 10% or fewer networks for 40% of simulated leaks. Strategic additional Peerlock-lite deployment at all large ISPs (fewer than 1% of all networks), in tandem with Peerlock within the peering clique as deployed, completely mitigates 80% of simulated Tier 1 route leaks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
