The Border Gateway Protocol (BGP) is known to have several security weaknesses. Two major threats are BGP prefix hijacking and BGP route leaks. A hijack refers to the illegitimate announcement of another Autonomous System’s (AS) IP prefix space while a route leak is the accidental forwarding of a route to a peer that should not have received such an announcement. The Resource Public Key Infrastructure (RPKI) provides origin validation and is able to mitigate a subset of prefix hijacking attacks. Route leaks and forged-origin prefix hijacks are not yet properly addressed. Autonomous System Provider Authorization (ASPA) and AS-Cones are two path plausibility algorithms proposed within the Internet Engineering Task Force (IETF) to mitigate these issues. This work implements ASPA and AS-Cones in a simulation testbed. We compare deployment strategies and recommend to start deploying both algorithms in a top-down manner, starting with the AS with the highest connectivity. While AS-Cones requires less ASes to participate it shows similar benefits in route leak mitigation. Only ASPA can mitigate the forged-origin prefix hijack and results heavily depend on the victim AS to participate in ASPA object creation.

The adoption of the Resource Public Key Infrastructure (RPKI) is increasing. To better understand and improve RPKI deployment, measuring route origin authorization (ROA) objects, RPKI route origin validation (ROV), and RPKI resilience is essential. In this paper, we survey RPKI-related research that aims to understand RPKI deployment. Additionally, we enrich our survey with many industry and IETF-related contributions. Our work provides an in-depth analysis of the many ideas and challenges discussed in studies of the RPKI ecosystem and includes lessons from mistakes made in the past, which we should avoid in the future.

BGP is known to be inherently insecure. Many solutions have been proposed, with the RPKI becoming operational in 2011. The RPKI only provides origin validation. This leaves path manipulation attacks and route leaks unsolved. In this demo session, we present our integration of two path plausibility algorithms, namely ASPA and AS-Cones, into the GoBGP routing daemon. We present advantages and drawbacks of both approaches and extend the NIST BGP-SRx software suite with the first implementation of AS-Cones.

BGP has been known to be vulnerable to hijacking and path manipulation attacks for many years. Several solutions have been proposed to secure either the origin, the path, or both. A known issue for new ideas is their evaluation. Simulation environments are easy to use but can only mimic real-world deployments to a certain extent. In this work, we propose BGPEval. A framework that is capable of creating large-scale testbeds based on the KVM hypervisor and Docker container technology that mimics the interconnection of ASes according to a provided AS graph. We use several layers of abstraction to spawn and interconnect as many as 55,000 containers. Our work takes significant effort away from an evaluator, who can now focus on the implementation rather than the creation of testbeds for the evaluation.

The deployment of the Resource Public Key Infrastructure (RPKI) is currently gaining traction within the operator community and so are measurement methodologies trying to measure the current deployment status. These methodologies, which are attempting to infer Autonomous Systems (ASs) performing Route Origin Validation (ROV), are applied onto real world data but validation of the results is usually hard as no ground-truth dataset exists. We propose to build such a dataset with the help of Mininet in a way that ROV measurement methodologies can be evaluated within a testbed in which filtering ASs are known to the experimenter. The Mininet topology generator will not only be specific for RPKI measurements but could be used also as an evaluation testbed for any kind of measurements that require a ground-truth dataset. Our framework is fed with real world BGP collector data, renders an abstraction of the acquired topology graph and translates it into a Mininet topology. In our scenario, RPKI filtering is deployed within the topology such that the testbed can later on be used to evaluate existing RPKI ROV measurement methodologies. We therefore plan to contribute an automated Mininet topology generator and insights into the accuracy of current ROV identification methodologies.

Differentiated Services Code Points are values that can be used on IP packets to mark traffic and allow for different Quality of Service treatment during the traversal through a network. Explicit Congestion Notifications are used to indicate that congestion on a network occurred. Both values are encoded in the previously called Type of Service field in the IP header. In this paper, we look at codepoint values for DSCP and ECN in relation to the ports used on the transport layer, which lets us infer the application that is generating the traffic. We provide new measurement data by analyzing traffic from Internet backbone links collected by CAIDA from the months March, April, and May 2018 in New York City. Our results show that DSCP codepoints are rarely used in IPv4 but even less in IPv6. Moreover, most traffic using DSCP codepoints is only using default values and not values designed for prioritization of packets. ECN-enabled traffic is scarce in IPv4, while in IPv6 it appears to be neglectable. However, we could observe differences for certain application traffic in the usage of DSCP and ECN codepoints and elaborate on their distribution.

Nearly all scenarios in the networking domain require reliable radio communication. However, for some use-cases such as military operations or disaster recovery in the realm of catastrophic events it is even more crucial for successful completion. In practice, MANETs are commonly used for these scenarios as they expose features that suit military as well as civil requirements very well, e.g. strict QoS limitations and specific data type support. Since new applications require not only the transmission of static content, but instead the continuous transfer of large audio and video streams, a network structured according to the MANET architecture might easily be over-utilized. This usually results in higher delays and increased loss rate. However, aforementioned scenarios are a common use-case in which MANETs should still deliver on QoS guarantees to avoid DoS conditions. In this paper, we propose a solution for a MANET that is highly utilized by adding a SDN controller responsible for traffic scheduling, although the traffic itself continues to be routed through the MANET. Our approach monitors the MANET's bandwidth utilization and determines routes according to this knowledge. In addition, the controller decreases the bandwidth of flows if the MANET cannot provide the requested resources. We show, that the use of CSMA/CA for the scheduling algorithm within the controller lacks certain properties and elaborate on solving this issue.

We are currently observing a significant increase in the popularity of Unmanned Aerial Vehicles (UAVs), popularly also known by their generic term drones. This is not only the case for recreational UAVs, that one can acquire for a few hundred dollars, but also for more sophisticated ones, namely professional UAVs, whereby the cost can reach several thousands of dollars. These professional UAVs are known to be largely employed in sensitive missions such as monitoring of critical infrastructures and operations by the police force. Given these applications, and in contrast to what we have been seeing for the case of recreational UAVs, one might assume that professional UAVs are strongly resilient to security threats. In this demo we prove such an assumption wrong by presenting the security gaps of a professional UAV, which is used for critical operations by police forces around the world. We demonstrate how one can exploit the identified security vulnerabilities, perform a Man-in-the-Middle attack, and inject control commands to interact with the compromised UAV. In addition, we discuss appropriate countermeasures to help improving the security and resilience of professional UAVs.