{"id":35550,"date":"2019-10-31T22:04:58","date_gmt":"2019-10-31T19:04:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pochemu-internet-do-sih-por-onlajn\/"},"modified":"2019-10-31T22:04:58","modified_gmt":"2019-10-31T19:04:58","slug":"pochemu-internet-do-sih-por-onlajn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochemu-internet-do-sih-por-onlajn","title":{"rendered":"Pse Interneti \u00ebsht\u00eb akoma online?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Internet duket si nj\u00eb struktur\u00eb e fort\u00eb, t\u00eb pavarur dhe t\u00eb pat\u00ebmet\u00eb. N\u00eb teori, q\u00ebndrueshm\u00ebria e rrjetit \u00ebsht\u00eb e mjaftueshme p\u00ebr t\u00eb p\u00ebrballuar nj\u00eb shp\u00ebrthim b\u00ebrthamor. N\u00eb realitet, interneti mund t\u00eb bjer\u00eb nga nj\u00eb router i vog\u00ebl. T\u00eb gjitha k\u00ebto p\u00ebr shkak se interneti \u00ebsht\u00eb nj\u00eb grumbull kontradiktash, dob\u00ebsish, gabimesh dhe videosh me mace. Baza e internetit, protokolli BGP, p\u00ebrmban shum\u00eb probleme. \u00cbsht\u00eb e \u00e7uditshme q\u00eb ende \u00ebsht\u00eb n\u00eb funksion. P\u00ebrve\u00e7 gabimeve brenda vet\u00eb internetit, ai gjithashtu shkat\u00ebrrohet nga t\u00eb gjith\u00eb ata q\u00eb do: ofrues t\u00eb m\u00ebdhenj t\u00eb internetit, korporata, shtete dhe sulme DDoS. \u00c7far\u00eb duhet b\u00ebr\u00eb me k\u00ebt\u00eb dhe si mund t\u00eb jetojm\u00eb me t\u00eb?<\/p>\n

\"Pse
\n
\nP\u00ebrgjigjen e di Aleksei Uchakin<\/b> (Night_Snake<\/a><\/noindex>) \u2013 lider i ekipit t\u00eb inxhinier\u00ebve rrjet\u00eb n\u00eb kompanin\u00eb IQ Option. Detyra kryesore e tij \u00ebsht\u00eb sigurimi i aksesit n\u00eb platform\u00eb p\u00ebr p\u00ebrdoruesit. N\u00eb p\u00ebrshkrimin e raportit t\u00eb Alekseit n\u00eb\u00a0Saint HighLoad++ 2019<\/a><\/noindex> do t\u00eb flasim p\u00ebr BGP, sulmet DDoS, \u00e7el\u00ebsin p\u00ebr internetin, gabimet e ofruesve, decentralizimin dhe rastet kur nj\u00eb router i vog\u00ebl e d\u00ebrgoi internetin n\u00eb gjum\u00eb. N\u00eb fund - disa k\u00ebshilla se si t\u2019i p\u00ebrballojm\u00eb k\u00ebto.
\n<\/a><\/noindex>
\n

\r\n \"Luaj\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Dita kur Interneti u prish<\/h2>\n

\nDo t\u00eb p\u00ebrmend vet\u00ebm disa incidente kur ka pasur prishje t\u00eb lidhjes n\u00eb Internet. Kjo do t\u00eb jet\u00eb e mjaftueshme p\u00ebr nj\u00eb pamje t\u00eb plot\u00eb.<\/p>\n

\u00abIncidenti me AS7007\u00bb<\/b>. Her\u00eb e par\u00eb interneti u prish n\u00eb prill 1997. N\u00eb softuerin e nj\u00eb routeri nga sistemi autonom 7007 kishte nj\u00eb gabim. N\u00eb nj\u00eb moment, routeri shpalli tabel\u00ebn e tij t\u00eb brendshme t\u00eb routing-ut dhe d\u00ebrgoi gjysm\u00ebn e rrjetit n\u00eb black hole.<\/p>\n

\u00abPakistan kund\u00ebr YouTube\u00bb<\/b>. N\u00eb vitin 2008, disa djem t\u00eb guximsh\u00ebm nga Pakistani vendos\u00ebn t\u00eb bllokojn\u00eb YouTube tek ata. E b\u00ebn\u00eb k\u00ebt\u00eb kaq mir\u00eb, saq\u00eb gjysma e bot\u00ebs mbeti pa mace.<\/p>\n

\u00abKapja e prefikseve VISA, MasterCard dhe Symantec nga Rostelecom\u00bb<\/b>. N\u00eb vitin 2017, Rostelecom p\u00ebr inat gabimi filloi t\u00eb shpallte prefikset e VISA, MasterCard dhe Symantec. Si rezultat, trafik financiar u drejtua p\u00ebrmes kanaleve t\u00eb kontrolluara nga ofruesi. Shkarkimi zgjati p\u00ebr nj\u00eb koh\u00eb t\u00eb shkurt\u00ebr, por kompanit\u00eb financiare ndiheshin keq.<\/p>\n

\u00abGoogle kund\u00ebr Japonis\u00eb\u00bb<\/b>. N\u00eb gusht 2017, Google filloi t\u00eb shpallte n\u00eb disa prej uplink-eve t\u00eb tij prefikset e ofruesve t\u00eb m\u00ebdhenj japonez\u00eb NTT dhe KDDI. Trafiku u d\u00ebrgua n\u00eb Google si tranzit, mbase p\u00ebr gabim. Duke qen\u00eb se Google nuk \u00ebsht\u00eb nj\u00eb ofrues dhe nuk lejon trafik tranzit, pjesa m\u00eb e madhe e Japonis\u00eb mbeti pa internet.<\/p>\n

\u00abDV LINK kap prefikset e Google, Apple, Facebook, Microsoft\u00bb<\/b>. N\u00eb vitin 2017, ofruesi rus DV LINK filloi t\u00eb reklamonte pa ndonj\u00eb arsye rrjetet e Google, Apple, Facebook, Microsoft dhe disa lojtar\u00eb t\u00eb tjer\u00eb t\u00eb m\u00ebdhenj.<\/p>\n

\u00abeNet nga SHBA ka kapur prefiksat AWS Route53 dhe MyEtherwallet\u00bb<\/b>. N\u00eb vitin 2018, nj\u00eb ofrues nga Ohio ose ndonj\u00eb nga klient\u00ebt e tij njoftoi rrjetet Amazon Route53 dhe portofolin kripto MyEtherwallet. Sulmi ishte i suksessh\u00ebm: edhe pse kishte nj\u00eb certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar, e cila shfaqte nj\u00eb paralajm\u00ebrim p\u00ebr p\u00ebrdoruesit kur vizitonin faqen MyEtherwallet, shum\u00eb portofol\u00eb u grabit\u00ebn dhe nj\u00eb pjes\u00eb e kriptomonedhave u vodh.<\/p>\n

K\u00ebto incidente vet\u00ebm p\u00ebr vitin 2017 ishin m\u00eb shum\u00eb se 14,000! Rrjeti \u00ebsht\u00eb ende i decentralizuar, prandaj nuk bie gjith\u00e7ka dhe jo te t\u00eb gjith\u00eb. Por incidentet ndodhin me mij\u00ebra, dhe t\u00eb gjitha ato jan\u00eb t\u00eb lidhura me protokollin BGP, mbi t\u00eb cilin funksionon interneti.<\/p>\n

BGP dhe problemet e tij<\/h2>\n

\nProtokolli BGP - Protokolli i Kalimit t\u00eb Kufijve<\/b>, u p\u00ebrshkrua p\u00ebr her\u00eb t\u00eb par\u00eb n\u00eb vitin 1989 nga dy inxhinier\u00eb nga IBM dhe Cisco Systems n\u00eb tri \"servieta\" - flet\u00eb formati A4. K\u00ebto \"servieta\"<\/a><\/noindex> ende ndodhen n\u00eb zyr\u00ebn kryesore t\u00eb Cisco Systems n\u00eb San Francisco si nj\u00eb relikvi e bot\u00ebs s\u00eb rrjetit.<\/p>\n

N\u00eb thelb t\u00eb protokollit \u00ebsht\u00eb nd\u00ebrveprimi i sistemeve autonome<\/b>\u00a0\u2014 Sistemet Autonome ose shkurtimisht \u2014 AS. Nj\u00eb sistem autonom \u00ebsht\u00eb thjesht nj\u00eb ID, pas t\u00eb cilit regjistrohen rrjetet IP n\u00eb regjistrin publik. Nj\u00eb router me k\u00ebt\u00eb ID mund t\u00eb njoftoj\u00eb k\u00ebto rrjete n\u00eb bot\u00eb. K\u00ebshtu, \u00e7do rrug\u00eb n\u00eb internet mund t\u00eb p\u00ebrfaq\u00ebsohet si nj\u00eb vektor, t\u00eb cilin e quajn\u00eb AS Path<\/b>. Vektori p\u00ebrb\u00ebhet nga numra t\u00eb sistemeve autonome q\u00eb duhet t\u00eb kalojm\u00eb p\u00ebr t\u00eb arritur n\u00eb rrjetin e destinuar.<\/p>\n

P\u00ebr shembull, ekziston nj\u00eb rrjet nga nj\u00eb num\u00ebr i caktuar sistemesh autonome. Duhet t\u00eb arrijm\u00eb nga sistemi AS65001 n\u00eb sistemin AS65003. Rruga nga nj\u00eb sistem p\u00ebrfaq\u00ebsohet nga AS Path n\u00eb diagram. Ai p\u00ebrb\u00ebhet nga dy autonomi: 65002 dhe 65003. P\u00ebr \u00e7do adres\u00eb t\u00eb destinimit ekziston nj\u00eb vektor AS Path, i cili p\u00ebrb\u00ebhet nga numrat e sistemeve autonome q\u00eb duhet t\u00eb kalojm\u00eb.<\/p>\n

\"Pse
\n
\nPra, \u00e7far\u00eb probleme ka BGP?<\/p>\n

BGP \u00ebsht\u00eb nj\u00eb protokoll besimi<\/h3>\n

\nProtokolli BGP \u00ebsht\u00eb i bazuar n\u00eb besim. Kjo do t\u00eb thot\u00eb se ne n\u00eb p\u00ebrgjith\u00ebsi i besojm\u00eb fqinjit ton\u00eb. Kjo \u00ebsht\u00eb nj\u00eb ve\u00e7ori e shum\u00eb protokolleve q\u00eb u zhvilluan n\u00eb fillim t\u00eb internetit. Le t\u00eb kuptojm\u00eb \u00e7far\u00eb do t\u00eb thot\u00eb \"t\u00eb besojm\u00eb\".<\/p>\n

Nuk ka autentifikim t\u00eb fqinjit<\/b>. Formalisht ekziston MD5, por MD5 n\u00eb vitin 2019 \u00ebsht\u00eb\u2026<\/p>\n

Nuk ka filtrimin<\/b>. BGP ka filtra dhe ato jan\u00eb p\u00ebrshkruar, por ato nuk p\u00ebrdoren ose p\u00ebrdoren gabimisht. M\u00eb von\u00eb do t\u00eb shpjegoj pse.<\/p>\n

Shum\u00eb e leht\u00eb p\u00ebr t\u00eb vendosur fqinj\u00ebsin\u00eb<\/b>. Konfigurimi i fqinj\u00ebsis\u00eb n\u00eb protokollin BGP pothuajse n\u00eb \u00e7do router \u00ebsht\u00eb disa rreshta konfigurimi.<\/p>\n

Nuk k\u00ebrkohen t\u00eb drejtat p\u00ebr menaxhimin e BGP<\/b>. Nuk \u00ebsht\u00eb e nevojshme t\u00eb jepni provime q\u00eb tregojn\u00eb kualifikimin tuaj. Askush nuk do t'ju heq\u00eb t\u00eb drejtat p\u00ebr konfigurimin e BGP n\u00eb gjendje t\u00eb dehur.<\/p>\n

Dy probleme kryesore<\/h3>\n

\nD\u00ebmtimi i prefikseve - prefix hijacks<\/b>. D\u00ebmtimi i prefiksit \u00ebsht\u00eb shpallja e nj\u00eb rrjeti q\u00eb nuk i p\u00ebrket juve, si\u00e7 ndodhi me MyEtherwallet. Ne mor\u00ebm disa prefikse, u dakorduam me ofruesin ose e hakuam at\u00eb, dhe p\u00ebrmes tij shpallim k\u00ebto rrjete.<\/p>\n

Shkarkimet e rrug\u00ebve - route leaks<\/b>. Me shkarkimet \u00ebsht\u00eb pak m\u00eb e komplikuar. Shkarkim \u00ebsht\u00eb ndryshimi i AS Path<\/b>. N\u00eb rastin m\u00eb t\u00eb mir\u00eb, ndryshimi do t\u00eb \u00e7oj\u00eb n\u00eb vonesa m\u00eb t\u00eb m\u00ebdha, sepse duhet t\u00eb ndjek\u00ebsh nj\u00eb rrug\u00eb m\u00eb t\u00eb gjat\u00eb ose p\u00ebrmes nj\u00eb lidhjeje m\u00eb t\u00eb shkurt\u00ebr. N\u00eb rastin m\u00eb t\u00eb keq, ndodhi p\u00ebrs\u00ebri rasti me Google dhe Japonin\u00eb.<\/p>\n

Google nuk \u00ebsht\u00eb operatori dhe as nj\u00eb sistem autonom i tranzitit. Por kur ai njoftoi ofruesin e tij t\u00eb rrjetit t\u00eb operator\u00ebve japonez\u00eb, trafiku p\u00ebrmes Google duket si m\u00eb prioritare n\u00eb AS Path. Trafiku shkoi atje dhe u ndal p\u00ebr shkak t\u00eb asaj q\u00eb konfigurimet e ruter\u00ebve brenda Google jan\u00eb m\u00eb t\u00eb nd\u00ebrlikuara se thjesht filtrat n\u00eb kufi.<\/p>\n

Pse nuk funksionojn\u00eb filtrat?<\/h3>\n

\nAskush nuk e ka r\u00ebnd\u00ebsi<\/b>. Kjo \u00ebsht\u00eb arsyeja kryesore - askush nuk i ndihmon. Admini i nj\u00eb ofruesi t\u00eb vog\u00ebl ose i nj\u00eb kompanie q\u00eb \u00ebsht\u00eb lidhur me ofruesin p\u00ebrmes BGP, ka marr\u00eb nj\u00eb MikroTik, e ka konfiguruar at\u00eb p\u00ebr BGP dhe as nuk e din q\u00eb ka mund\u00ebsi p\u00ebr t\u00eb konfiguruar filtrat.<\/p>\n

Gabimet n\u00eb konfigurim<\/b>. Di\u00e7ka u debaghuar, u gabua n\u00eb mask\u00eb, vendosi rrjetin e gabuar - dhe ja, p\u00ebrs\u00ebri gabim.<\/p>\n

Nuk ka mund\u00ebsi teknike<\/b>. P\u00ebr shembull, ofruesit e sh\u00ebrbimeve kan\u00eb shum\u00eb klient\u00eb. Me t\u00eb drejt\u00eb, duhet t\u00eb p\u00ebrdit\u00ebsohen automatikisht filtrat p\u00ebr \u00e7do klient - t\u00eb ndiqni n\u00ebse ai ka nj\u00eb rrjet t\u00eb ri, n\u00ebse ai e ka dh\u00ebn\u00eb rrjetin e tij me qira. T\u00eb ndjek\u00ebsh k\u00ebt\u00eb \u00ebsht\u00eb e v\u00ebshtir\u00eb, me duar - madje edhe m\u00eb e v\u00ebshtir\u00eb. Prandaj, vendosin thjesht filtrat e relaksuar ose nuk vendosin filtrat fare.<\/p>\n

P\u00ebrjashtimet<\/b>. KaThere jan\u00eb p\u00ebrjashtime p\u00ebr klient\u00ebt e dashur dhe t\u00eb m\u00ebdhenj. Sidomos n\u00eb rastin e lidhjeve nd\u00ebroperator\u00ebve. P\u00ebr shembull, TransTeleCom dhe Rostelecom kan\u00eb shum\u00eb rrjete dhe mes tyre \u00ebsht\u00eb lidhja. N\u00ebse lidhja d\u00ebshtojn\u00eb \u2013 askujt nuk do t'i jet\u00eb mir\u00eb, prandaj filtrat relaksohen ose hiqen krejt\u00ebsisht.<\/p>\n

Informacione t\u00eb vjetra ose jo t\u00eb azhurnuara n\u00eb IRR<\/b>. Filtrat ndodhen n\u00eb baz\u00eb t\u00eb informacionit q\u00eb \u00ebsht\u00eb regjistruar n\u00eb\u00a0IRR \u2013 Internet Routing Registry<\/b>. K\u00ebto jan\u00eb regjistra t\u00eb regjistruesve t\u00eb internetit rajonal. Shpesh n\u00eb regjistra ka informacione t\u00eb vjetra ose jo t\u00eb azhurnuara, ose t\u00eb dyja bashk\u00eb.<\/p>\n

Kush jan\u00eb k\u00ebta regjistrues?<\/h3>\n

\"Pse
\n
\nT\u00eb gjitha adresat n\u00eb internet i p\u00ebrkasin organizat\u00ebs IANA \u2013 Internet Assigned Numbers Authority<\/b>. Kur blini rrjet IP nga dikush, ju nuk blini adresat, por t\u00eb drejt\u00ebn p\u00ebr t'i p\u00ebrdorur ato. Adresat jan\u00eb nj\u00eb burim jo-material, dhe sipas marr\u00ebveshjes s\u00eb p\u00ebrgjithshme, t\u00eb gjitha u p\u00ebrkasin agjencis\u00eb IANA.<\/p>\n

Sistemi funksionon k\u00ebshtu. IANA delegon menaxhimin e adresave IP dhe numrave t\u00eb sistemeve autonome pes\u00eb regjistruesve rajonal\u00eb. Ata japin sisteme autonome LIR \u2013 regjistruesve t\u00eb internetit lokal\u00eb<\/b>. M\u00eb pas LIR ndan adresat IP p\u00ebr p\u00ebrdoruesit fundor\u00eb.<\/p>\n

Mungesa e sistemit \u00ebsht\u00eb se \u00e7do regjistrues rajonal e menaxhon regjistrin e tij n\u00eb m\u00ebnyr\u00ebn e tij. \u00c7do regjistrues ka pik\u00ebpamjet e tij mbi at\u00eb se \u00e7far\u00eb informacioni duhet t\u00eb p\u00ebrfshihet n\u00eb regjistra, kush duhet ose nuk duhet ta verifikoj\u00eb at\u00eb. Si rezultat, kemi kaosin q\u00eb ekziston tani.<\/p>\n

Si mund t\u00eb luftojm\u00eb k\u00ebto probleme ndryshe?<\/h3>\n

\nIRR - cil\u00ebsi e dob\u00ebt<\/b>. Sa p\u00ebr IRR-n\u00eb, aty gjendja \u00ebsht\u00eb keq.<\/p>\n

BGP-communities<\/b>. Ky \u00ebsht\u00eb nj\u00eb atribut i caktuar q\u00eb p\u00ebrshkruhet n\u00eb protokoll. Ne mund t\u00eb vendosim, p\u00ebr shembull, nj\u00eb komunitet t\u00eb ve\u00e7ant\u00eb n\u00eb njoftimin ton\u00eb, n\u00eb m\u00ebnyr\u00eb q\u00eb fqinja t\u00eb mos e d\u00ebrgoj\u00eb rrjetin ton\u00eb te fqinj\u00ebt e tij. Kur kemi nj\u00eb lidhje P2P, ne shp\u00ebrndajm\u00eb vet\u00ebm rrjetet tona. Q\u00eb t\u00eb mos ndodh\u00eb q\u00eb rruga t\u00eb shkoj\u00eb rast\u00ebsisht n\u00eb rrjete t\u00eb tjera, ne vendosim komunitetin.<\/p>\n

Komunitetet nuk jan\u00eb transitive<\/b>. Ky \u00ebsht\u00eb gjithmon\u00eb nj\u00eb marr\u00ebveshje midis dy pal\u00ebve, dhe kjo \u00ebsht\u00eb nj\u00eb dob\u00ebsi e tyre. Nuk mund t\u00eb krijojm\u00eb ndonj\u00eb komunitet, p\u00ebrve\u00e7 nj\u00ebrit q\u00eb pranohet automatikisht nga t\u00eb gjith\u00eb. Nuk mund t\u00eb jemi t\u00eb sigurt se ky komunitet do t\u00eb pranohet nga t\u00eb gjith\u00eb dhe do t\u00eb interpretohet sakt\u00eb. Prandaj, n\u00eb rastin m\u00eb t\u00eb mir\u00eb, n\u00ebse arrini nj\u00eb marr\u00ebveshje me uplink-un tuaj, ai do ta kuptoj\u00eb se \u00e7far\u00eb d\u00ebshironi nga ai n\u00eb lidhje me komunitetin. Por mund t\u00eb mos e kuptoj\u00eb fqinj\u00ebt e tij, ose operatori thjesht mund t\u00eb heq\u00eb etiket\u00ebn tuaj, dhe nuk do t\u00eb arrini at\u00eb q\u00eb donit.<\/p>\n

RPKI + ROA zgjidh vet\u00ebm nj\u00eb pjes\u00eb t\u00eb vog\u00ebl t\u00eb problemeve<\/b>. RPKI \u00ebsht\u00eb Infrastruktura e \u00c7el\u00ebsit Publik t\u00eb Burimeve\u00a0<\/b> \u2014 nj\u00eb korniz\u00eb speciale p\u00ebr n\u00ebnshkrimin e informacionit mbi rrug\u00ebt. Nj\u00eb ide e mir\u00eb p\u00ebr t\u00eb detyruar LIR-t\u00eb dhe klient\u00ebt e tyre t\u00eb mbajn\u00eb nj\u00eb baz\u00eb t\u00eb azhurnuar t\u00eb hap\u00ebsir\u00ebs adresuese. Por ka nj\u00eb problem me t\u00eb.<\/p>\n

RPKI \u00ebsht\u00eb gjithashtu nj\u00eb sistem hierakik \u00e7el\u00ebsh publik. IANA ka nj\u00eb \u00e7el\u00ebs, nga i cili krijohen \u00e7el\u00ebsat RIR, dhe nga ata \u00e7el\u00ebsat LIR? me t\u00eb cil\u00ebt n\u00ebnshkruajn\u00eb hap\u00ebsir\u00ebn e tyre adresuese me ROA \u2014 Autorizimet e Origjin\u00ebs s\u00eb Rrug\u00ebve:<\/p>\n

\u2014 Po e konfirmoj se ky prefiks do t\u00eb njoftohet n\u00eb em\u00ebr t\u00eb k\u00ebsaj autonomike.<\/i><\/p>\n

P\u00ebrve\u00e7 ROA-s\u00eb, ka edhe objekte t\u00eb tjera, por do t\u00eb flasim p\u00ebr to m\u00eb von\u00eb. Duket se \u00ebsht\u00eb nj\u00eb gj\u00eb e mir\u00eb dhe e dobishme. Megjithat\u00eb, ajo nuk na mbron fare nga rrjedhjet dhe nuk zgjidh t\u00eb gjitha problemet me grabitjen e prefikseve. Prandaj, lojtar\u00ebt nuk po nxitojn\u00eb ta zbatojn\u00eb at\u00eb. Megjithat\u00eb, ka b\u00ebr\u00eb premtime nga lojtar\u00eb t\u00eb m\u00ebdhenj si AT&T dhe IX t\u00eb m\u00ebdhenj q\u00eb prefikset me regjistrim invalid ROA do t\u00eb hiqen. <\/p>\n

Ndoshta ata do ta b\u00ebjn\u00eb, por p\u00ebr momentin kemi nj\u00eb num\u00ebr t\u00eb madh prefiksh q\u00eb nuk jan\u00eb n\u00ebnshkruar. Nga nj\u00ebra an\u00eb, nuk \u00ebsht\u00eb e qart\u00eb n\u00ebse ato jan\u00eb t\u00eb vlefshme p\u00ebr t'u shpallur. Nga ana tjet\u00ebr, ne nuk mund t'i heqim ato automatikisht, sepse nuk jemi t\u00eb sigurt n\u00ebse \u00ebsht\u00eb e drejt\u00eb apo jo.<\/p>\n

\u00c7far\u00eb ka tjet\u00ebr?<\/h3>\n

\nBGPSec<\/b>. Ky \u00ebsht\u00eb nj\u00eb sistem i shk\u00eblqyer, i krijuar nga akademik\u00ebt p\u00ebr rrjetin e kalit roz\u00eb. Ata than\u00eb:<\/p>\n

\u2014 Kemi RPKI + ROA \u2014 nj\u00eb mekaniz\u00ebm p\u00ebr v\u00ebrtetimin e n\u00ebnshkrimit t\u00eb hap\u00ebsir\u00ebs adresore. Le t\u00eb krijojm\u00eb nj\u00eb atribut t\u00eb ve\u00e7ant\u00eb BGP dhe ta quajm\u00eb BGPSec Path. \u00c7do router do t\u00eb n\u00ebnshkruaj\u00eb shpalljet q\u00eb ai shpall p\u00ebr fqinj\u00ebt e tij. K\u00ebshtu do t\u00eb kemi nj\u00eb rrug\u00eb t\u00eb besueshme nga nj\u00eb varg shpalljesh t\u00eb n\u00ebnshkruara dhe do t\u00eb mund ta verifikojm\u00eb at\u00eb.<\/i><\/p>\n

N\u00eb teori \u00ebsht\u00eb mir\u00eb, por n\u00eb praktik\u00eb ka shum\u00eb probleme. BGPSec prish shum\u00eb mekanizma ekzistues t\u00eb BGP p\u00ebr zgjedhjen e next-hop dhe menaxhimin e trafikut q\u00eb hyn\/del direkt n\u00eb router. BGPSec nuk funksionon derisa t\u00eb implementohet nga 95% e pjes\u00ebmarr\u00ebsve t\u00eb t\u00eb gjith\u00eb tregut, q\u00eb vete \u00ebsht\u00eb nj\u00eb utopi.<\/p>\n

BGPSec ka probleme t\u00eb m\u00ebdha me performanc\u00ebn. N\u00eb harduerin aktual, shpejt\u00ebsia e verifikimit t\u00eb njoftimeve \u00ebsht\u00eb rreth 50 prefikse n\u00eb sekond\u00eb. P\u00ebr krahasim: tabela aktuale e internetit me 700,000 prefikse do t\u00eb ngarkohet p\u00ebr 5 or\u00eb, p\u00ebr t\u00eb cilat do t\u00eb ndodhin edhe 10 ndryshime.<\/p>\n

BGP Open Policy (BGP i bazuar n\u00eb rol)<\/b>. Propozimi i ri bazuar n\u00eb modelin Gao-Rexford<\/b>. K\u00ebta jan\u00eb dy shkenc\u00ebtar\u00eb q\u00eb merren me hulumtimin e BGP.<\/p>\n

Modeli Gao-Rexford p\u00ebrfshin t\u00eb following. N\u00ebse e thjeshtojm\u00eb, n\u00eb rastin e BGP ka nj\u00eb num\u00ebr t\u00eb vog\u00ebl llojesh nd\u00ebrveprimesh:<\/p>\n