Information Security in Software-Defined Network

: The Border Gateway Protocol (BGP), which is used to distribute routing information between autonomous systems (ASes), is a critical component of the Internet's routing infrastructure. It is highly vulnerable to a variety of malicious attacks due to the lack of a secure means of verifying the authenticity and legitimacy of BGP control traffic. The Secure BGP projects designed a secure, scalable, deployable architecture (S-BGP) for an authorization and authentication system that addresses most of the security problems associated with BGP. This contract final report includes the following documents concerning S-BGP: Lessons Learned from the Secure BGP Proof-of-Concept Implementation; Secure Border Gateway Protocol (S-BGP); Design and Analysis of the Secure Border Gateway Protocol (S-BGP). The last two items discuss the vulnerabilities and security requirements associated with BGP, describe the S-BGP countermeasures, and explain how they address these vulnerabilities and requirements. In addition, the papers provide a comparison of this architecture with other approaches that have been proposed, analyze the performance implications of the proposed countermeasures, and address operational issues.

Border gateway protocol (BGP) version 4 is routing current Internet for more than 20 years. BGP is the only protocol that has proven its routing capability of such size network with continually growing nature. Although BGP is scalable and network layer reachability information it lacks quality of service metrics like latency. BGP routing decision algorithm uses as-path length between autonomous systems (AS) as main factor for most of its best-path calculations. Because of more affordable peering architectures as-path length is generally decreasing in worldwide internet network resulting in less efficient routes for real-time internet protocol traffic. This study proposes future internet architecture consisting of multiple AS which provide latency aware routing in software defined network (SDN). For highest reliability there are bilateral latency measurements between each pair of connected autonomous systems. Latency measurement results are stored in distributed decentralized blockchain network where each AS holds its share. Each AS hosts an SDN instance for interconnection with neighbor SDN controllers over AS border. SDN instances processes latency measurement data from blockchain network, validates data integrity and manages latency aware routing for real-time data flows.

The Border Gateway Protocol (BGP), which is used to distribute routing information between autonomous systems (ASes), is a critical component of the Internet's routing infrastructure. It is highly vulnerable to a variety of malicious attacks, due to the lack of a secure means of verifying the authenticity and legitimacy of BGP control traffic. This paper describes a secure, scalable, deployable architecture, S-BGP, for a system that addresses most of the security problems associated with BGP. The paper discusses the vulnerabilities and security requirements associated with BGP, describes the S-BGP countermeasures, and explains how they address these vulnerabilities and requirements. The paper also provides a comparison of this architecture with other approaches that have been proposed, analyzes the performance implications of the proposed countermeasures, and reports on prototype implementation experience.

With the rapid development of internet technology and the increasing popularity of e-commerce, data encryption technology plays a very important role in data security. Information security has two aspects: security protocol and cryptographic algorithm and the latter is the foundation and core technology of information security. Advanced Encryption Standard (AES) encryption algorithm is one of the most commonly used algorithms in symmetric encryption algorithms. Such algorithms face issues when used in the context of key management and security functions. This paper focuses on the systematic analysis of these issues and summarizes AES algorithm implementation, comprehensive application and algorithm comparison with other existing methods. To analyze the performance of the proposed algorithm and to make full use of the advantages of AES encryption algorithm, one needs to reduce round key and improve the key schedule, as well as organically integrate with RSA algorithm. Java language is used to implement the algorithm due to its large library, then to show the efficiency of the proposed method we compare different parameters, such as encryption/decryption speed, entropies and memory consumption...) with a classic algorithm. Based on the results of the comparison between AES and the hybrid AES algorithm, the proposed algorithm shows good performance and high security. It therefore can be used for key management and security functions, particularly for sharing sensitive files through insecure channel. This analysis provides a reference useful for selecting different encryption algorithms according to different business needs.

Border Gateway Protocol (BGP) is a path-vector routing protocol used to exchange routing and reachability information between autonomous system (AS) that offers flexibility and scalability. BGP is capable of handling scalability issues using classless inter-domain routing and is more efficient than alternatives. However, BGP related challenges have been encountered, including growing routing tables, load balancing issues, hijacking, and AS transit delays, leading to increased convergence delay. Convergence delay is the time gap between the commencement of the best-path selection process and when the router is updated. Convergence delay has become a significant issue for larger networks because frequent routing path updates can lead to network instability. Network instability causes packet loss, delayed packet delivery and occasional loss of network connectivity. The research aims to incorporate Software Defined Networking (SDN) technology with gateway operation to reduce the BGP convergence time.

In traditional IP networks, border gateway protocol (BGP) serves as the dominant protocol for inter-domain routing information exchange. In a hybrid network with both traditional network domains and software-defined networking (SDN) domains, the simultaneous inter-domain routing information exchange requires collaboration among different autonomous systems (ASes). However, the rigid routing policies of the conventional BGP are sometimes inadequate to meet the demand of applications with low-latency requirements like augmented reality (AR). In this paper, we propose a Latency Reduction Software-Defined BGP (LRSD-BGP) framework to reduce the latency in inter-domain initial link setup. Furthermore, a controller-to-controller (C2C) communication module is designed to accelerate the routing link establishment procedure of inter-domain traffic by pre-allocating and installing routing paths for the AS in the next hop. LRSD-BGP is evaluated in terms of BGP convergence time and first round-trip time (RTT). Experimental results demonstrated that LRSD-BGP can outperform SD-BGP in terms of first RTT even in highly loaded cases.

The Consultative Committee for Space Data Systems (CCSDS) recommends AES algorithm as a cryptographic algorithm to maintain confidentiality and data security between spacecraft and ground systems. In implementation, there are several AES algorithm operating modes including Cipher-Block Chaining (CBC), Electronic Codebook (EBC), Cipher Feedback (CFB), Output Feedback (OFB), and counter mode (CTR). One of the operating modes of AES algorithm recommended by CCSDS is CTR because it has advantages in terms of efficiency of implementation and offers a high level of data security. LAPAN-A4 as the next generation of LAPAN satellites also uses CCSDS standard in terms of data exchange between satellites and ground stations including telemetry and telecommand (TTC) data and satellite payload data. In order to protect LAPAN-A4 satellite data, especially TTC data, in this paper AES algorithm was implemented in CTR operating mode on the FPGA which will then be implemented on LAPAN-A4 satellite onboard data handling (OBDH) as one of LAPAN-A4 satellite data security systems. To overcome the limited resource of FPGA, optimization is also done using basic iterative AES hardware reused method, which is to reuse hardware that has been designed n times for same operation for AES algorithm. From the results of implementation and optimization, efficiency of logic gates used is increasing almost a quarter less than the previous research.

The Internet consists of a large number of autonomous systems (ASes) that exchange routing information using the border gateway protocol (BGP). Each AS applies local policies for selecting routes and propagating routes to others, with important implications for the reliability and stability of the global system. In and of itself, BGP does not ensure that every pair of hosts can communicate. In addition, routing policies are not guaranteed be safe, and may cause protocol divergence. Backup routing is often used to increase the reliability of the network under link and router failures, at the possible expense of safety. This paper presents a general model for backup routing that increases network reliability while allowing each AS to apply local routing policies that are consistent with the commercial relationships it has with its neighbors. In addition, our model is inherently safe in the sense that the global system remains safe under any combination of link and router failures. Our model and the proof of inherent safety are cast in terms of the stable paths problem, a static formalism that captures the semantics of interdomain routing policies. Then, we describe how to realize our model in BGP with locally-implementable routing policies. To simplify the specification of local policies, we propose a new BGP attribute that conveys the avoidance level of a route. We also describe how to realize these policies without modification to BGP by using the BGP community attribute.

Examining the Jurisdictions of Internet Routes to Prevent Data Exfiltration

Network automation has evolved into a solution that emphasizes efficiency in all areas. Furthermore, communication and computer networks rely on a platform that provides the necessary technological infrastructure for packet transfer through the Internet using routing protocols. Border Gateway Protocol (BGP) is a standardized gateway protocol that exchanges routing information across autonomous systems (AS) on the Internet. The traditional technique to configure BGP is inefficient compared to the network automation concept. Network automation helps to assist network administrators in automating and verifying the BGP configuration using scripting. This paper implemented network automation using Ansible to configure BGP routing and advanced configuration in the live network environment. This study is focused on automated scripting to configure IP Addresses to the interfaces, BGP routing protocol, configuration backup. Ansible ran the scripting on Network Automation Docker and pushed the configurations to the routers. The network automation controller communicated with other routers via SSH. The findings show that Ansible has successfully deployed the configuration to the routers with no errors. Ansible can help network administrators minimized human mistakes, reduce time-consuming and enable device visibility across the network environment. This study can help network administrators minimized human mistakes, reduce time-consuming and enable device visibility across the network environment. Implementing different types of authentication and hardening process can enhance the network security level for future

Currently, the architecture of network device is closed. This is detrimental to the network inno vation. Software defined networking (SDN) [1] decouples the vertically coupled architecture, and reconstructs the Internet as a modular structure. The idea of SDN is widely accepted by both of the academic and industry researchers, and is considered as a promising way to re-architect the Internet. OpenFlow as a typical instance of the SDN has been deployed by many universities and research institutions all over the world. However, the research and technologies on transitioning the existing networks to SDN are not mature. So this paper takes the instance OpenFlow for example and proposes a simple and practical BGP (Border Gateway Protocol) based transition solution named BTSDN. BTSDN fully explores the characteristics of OpenFlow network, proposes to continue using the current BGP protocol, and retains the legacy BGP border routers to connect the OpenFlow network with the rest of Internet. The experiment at the end of this paper preliminary verifies the feasibility of BTSDN.

Border Gateway Protocol (BGP) is the defacto inter-domain routing protocol in the Internet. It was designed without an inherent security mechanism and hence is prone to a number of vulnerabilities which can cause large scale disruption in the Internet. Route leak is one such inter-domain routing security problem which has the potential to cause wide-scale Internet service failure. Route leaks occur when Autonomous systems violate export policies while exporting routes. As BGP security has been an active research area for over a decade now, several security strategies were proposed, some of which either advocated complete replacement of the BGP or addition of new features in BGP, but they failed to achieve global acceptance. Even the most recent effort in this regard, lead by the Secure Inter-Domain Routing (SIDR) working group (WG) of IETF fails to counter all the BGP anomalies, especially route leaks. In this paper we look at the efforts in countering the policy related BGP problems and provide an analytical insights into why they are ineffective. We contend a new direction for future research in managing the broader security issues in the inter-domain routing. In that light, we propose a naive approach for countering the route leak problem by analyzing the information available at hand, such as the RIB of the router. The main purpose of this paper was to position and highlight the autonomous smart analytical approach for tackling policy related BGP security issues.

The border gateway protocol (BGP) is the default inter domain routing protocol used on the internet for exchanging information between autonomous systems. Available literature suggests that BGP is vulnerable to session hijacking attacks. There are a number of proposals aimed at improving BGP security which have not been fully implemented. This paper examines a number of approaches for securing BGP through a comparative study and identifies the reasons why these proposals have not been implemented commercially. This paper analyses the architecture of internet routing and the design of BGP while focusing on the problem of BGP session hijacking attacks. Using Graphical Network Simulator 3 (GNS-3), a session hijack is demonstrated and a solution which involves the implementation of route filtering, policy-maps and route-maps on CISCO routers representing ASes is carried out. In the end, a workable industry standard framework for securing and protecting BGP sessions and border routers from exploitation with little or no modification to the existing routing infrastructure is demonstrated.

Border Gateway Protocol (BGP) is a widely used Internet routing protocol. While several security features have been introduced and implemented to prevent attacks and address routing instabilities, BGP remains vulnerable due to lack of integrity and authentication of BGP messages. BGP operations strongly depend on its security and attacks on BGP adversely influence packet routing. Given the importance of BGP security, several approaches have been developed to enhance security of BGP sessions. The Resource Public Key Infrastructure (RPKI), a specialized Public Key Infrastructure (PKI), was developed to help secure the Internet routing. It uses cryptographically verifiable statements to ensure that Autonomous Systems (ASes), the Internet resource holders, are certifiably linked to the routing information they generate thus resulting in a reliable routing origin. In this paper, we describe a testbed developed for validating route origin and present simulation results.

Inter-domain routing protocol routes network reachability information between autonomous systems (ASs) in the network. Network reachability information contains the details about the neighbors of the ASs and it contains messages used to maintain the connection between ASs. On one hand, given the size and the rapid growth of the Internet, any inter-domain routing protocol should satisfy basic desirable algorithmic properties, such as scalability, robustness and rapid convergence by Griffin, T., and Wilford, G. 1999. On the other hand, for economic reasons inter-domain routing should support policy routing, where Internet service providers (ISPs) have the flexibility to implement a wide variety of private routing policies that ISPs choose not to reveal. Moreover, the routing protocol should provide sufficient information to enable ISPs to make informed policy decisions. Border gateway protocol (BGP) by Goodell, G. et al. (2003) is the inter-domain routing protocol that is currently being used. BGP has a number of problems which includes scalability and large convergence time by Labovitz, C et al. (2000). This paper explains in detail the alternative to BGP which is the hybrid optimized link-state path-vector routing protocol (HLP) [1] and gives a comparison based on the simulation of these protocols. The comparison shows us that HLP overcomes some of the important problems faced in BGP.