A network accountability based verification mechanism for detecting inter-domain routing path inconsistency

摘要

Border Gateway Protocol (BGP) has no mechanism to guarantee the consistency between actual routing path and announced routing path in the inter-domain routing. Due to incentives of gaining more economic benefits, malicious Autonomous Systems (AS) could announce inconsistent path and misroute data packets. In this case, routing policies are meaningless, rational ASes are cheated and stability of Internet is destroyed seriously. Existing methods are devoted to securing announce routing path only or discovering path inconsistency with lots of overhead. Based on network accountability, a routing path verification mechanism is proposed to detect path inconsistency. The mechanism enables Ases in the path to generate routing evidence. Routing evidence is produced by analyzing packets in a time slot and is encrypted with the key of AS. With routing evidence, source AS checks every subpath connecting adjacent Ases until it confirms the existence of path inconsistency. The factors that influence the mechanism and the deployment in the real network are also discussed. The experiment results show that it has a good performance from aspects of effectiveness, overhead and scalability.