{"id":35550,"date":"2019-10-31T22:04:58","date_gmt":"2019-10-31T19:04:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/pochemu-internet-do-sih-por-onlajn\/"},"modified":"2019-10-31T22:04:58","modified_gmt":"2019-10-31T19:04:58","slug":"pochemu-internet-do-sih-por-onlajn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/pochemu-internet-do-sih-por-onlajn","title":{"rendered":"Pse Interneti \u00ebsht\u00eb ende online?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Internet \u00ebsht\u00eb dukur si nj\u00eb struktur\u00eb e fuqishme, t\u00eb pavarur dhe t\u00eb pat\u00ebmet\u00eb. N\u00eb teori, fuqia e rrjetit \u00ebsht\u00eb e mjaftueshme p\u00ebr t\u00eb p\u00ebrballuar nj\u00eb shp\u00ebrthim b\u00ebrthamor. N\u00eb realitet, interneti mund t\u00eb bjer\u00eb p\u00ebr shkak t\u00eb nj\u00eb router-i t\u00eb vog\u00ebl. T\u00eb gjitha k\u00ebto ndodhin sepse interneti \u00ebsht\u00eb nj\u00eb grumbull kund\u00ebrth\u00ebniesh, dob\u00ebsish, gabimesh dhe videosh p\u00ebr mace. Baza e internetit \u2014 protokolli BGP \u2014 ka shum\u00eb probleme. \u00cbsht\u00eb befasuese q\u00eb ai ende funksionon. P\u00ebrve\u00e7 gabimeve n\u00eb vet\u00eb internetin, ky i fundit i thyhet nga \u00e7do kush: ofruesit e m\u00ebdhenj t\u00eb internetit, korporatat, shtetet dhe sulmet DDoS. \u00c7far\u00eb t\u00eb b\u00ebjm\u00eb me k\u00ebt\u00eb dhe si t\u00eb jetojm\u00eb me t\u00eb?<\/p>\n

\"Pse
\n
\nP\u00ebrgjigjen e di Aleksej U\u00e7akin<\/b> (Night_Snake<\/a><\/noindex>) \u2014 lideri i ekipit t\u00eb inxhinier\u00ebve t\u00eb rrjetit n\u00eb kompanin\u00eb IQ Option. Detyra e tij kryesore \u00ebsht\u00eb disponueshm\u00ebria e platform\u00ebs p\u00ebr p\u00ebrdoruesit. N\u00eb p\u00ebrkthimin e raportit t\u00eb Aleksejit n\u00eb\u00a0Saint HighLoad++ 2019<\/a><\/noindex> do t\u00eb flasim p\u00ebr BGP, sulmet DDoS, nd\u00ebrprerjen e internetit, gabimet e ofruesve, decentralizimin dhe rastet kur nj\u00eb router i vog\u00ebl d\u00ebrgoi internetin p\u00ebr dreka. N\u00eb fund \u2014 disa k\u00ebshilla se si t\u00eb kalojm\u00eb p\u00ebrmes k\u00ebsaj.
\n<\/a><\/noindex>
\n

\r\n \"Luaj\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

Dita kur Interneti u prish<\/h2>\n

\nDo t\u00eb paraqes vet\u00ebm disa incidente kur lidhshm\u00ebria n\u00eb Internet u prish. Kjo do t\u00eb mjaftoj\u00eb p\u00ebr nj\u00eb pasqyr\u00eb t\u00eb plot\u00eb.<\/p>\n

\"Incidenti me AS7007\"<\/b>. Her\u00ebn e par\u00eb q\u00eb interneti u prish ishte n\u00eb prill 1997. N\u00eb softin e nj\u00eb router-i nga sistemi autonom 7007 kishte nj\u00eb gabim. N\u00eb nj\u00eb moment, router-i njoftoi fqinj\u00ebt e tij p\u00ebr tabel\u00ebn e tij t\u00eb brendshme t\u00eb rrug\u00ebve dhe d\u00ebrgoi gjysm\u00ebn e rrjetit n\u00eb nj\u00eb black hole.<\/p>\n

\"Pakistani kund\u00ebr YouTube\"<\/b>. N\u00eb vitin 2008, djemt\u00eb e guximsh\u00ebm nga Pakistani vendos\u00ebn t\u00eb bllokojn\u00eb YouTube n\u00eb vendin e tyre. E b\u00ebn\u00eb k\u00ebt\u00eb aq mir\u00eb, sa q\u00eb gjysma e bot\u00ebs mbeti e privuar nga video t\u00eb maceve.<\/p>\n

\"Kapja e prefikseve VISA, MasterCard dhe Symantec nga Rostelecom\"<\/b>. N\u00eb vitin 2017, Rostelecom nga gabimi filloi t\u00eb njoftonte prefiksat VISA, MasterCard dhe Symantec. Si rezultat, trafiku financiar iu drejtua kanaleve t\u00eb kontrolluara nga ofruesi. D\u00ebmtimi zgjati p\u00ebr pak, por kompanit\u00eb financiare ishin t\u00eb pak\u00ebnaqura.<\/p>\n

\"Google kund\u00ebr Japonis\u00eb\"<\/b>. N\u00eb gusht 2017, Google filloi t\u00eb njoftonte n\u00eb nj\u00eb pjes\u00eb t\u00eb uplink-ut t\u00eb tij prefiksat e ofruesve t\u00eb m\u00ebdhenj japonez\u00eb NTT dhe KDDI. Trafiku u d\u00ebrgua te Google si tranzit, ndoshta p\u00ebr shkak t\u00eb nj\u00eb gabimi. P\u00ebr shkak se Google nuk \u00ebsht\u00eb ofrues dhe nuk kalon trafik tranzit, nj\u00eb pjes\u00eb e konsiderueshme e Japonis\u00eb mbeti pa internet.<\/p>\n

\u00abDV LINK ka kapur prefiksat e Google, Apple, Facebook, Microsoft\u00bb<\/b>. N\u00eb at\u00eb vit 2017, provideri rus DV LINK filloi t\u00eb njoftoj\u00eb rrjetet e Google, Apple, Facebook, Microsoft dhe disa lojtar\u00eb t\u00eb tjer\u00eb t\u00eb m\u00ebdhenj.<\/p>\n

\u00abeNet nga SHBA ka kapur prefiksat e AWS Route53 dhe MyEtherwallet\u00bb<\/b>. N\u00eb vitin 2018, nj\u00eb ofrues nga Ohio ose ndokush nga klient\u00ebt e tij njoftoi rrjetet e Amazon Route53 dhe portofolit kripto MyEtherwallet. Sulmi doli t\u00eb jet\u00eb i suksessh\u00ebm: edhe pse kishte nj\u00eb certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar, me nj\u00eb paralajm\u00ebrim q\u00eb shfaqej p\u00ebr p\u00ebrdoruesin kur dilte n\u00eb faqen MyEtherwallet, shum\u00eb portofol\u00eb u vodh\u00ebn dhe nj\u00eb pjes\u00eb e kriptovalut\u00ebs u grabit.<\/p>\n

T\u00eb ngjashme incidente vet\u00ebm p\u00ebr vitin 2017 ishin m\u00eb shum\u00eb se 14,000! Rrjeti \u00ebsht\u00eb ende i decentralizuar, prandaj nuk prishen t\u00eb gjitha dhe nuk ndodhin te t\u00eb gjith\u00eb. Por incidentet ndodhin me mij\u00ebra, dhe t\u00eb gjitha jan\u00eb t\u00eb lidhura me protokollin BGP, mbi t\u00eb cilin funksionon interneti.<\/p>\n

BGP dhe problemet e tij<\/h2>\n

\nProtokolli BGP - Border Gateway Protocol<\/b>, i p\u00ebrshkruar p\u00ebr her\u00eb t\u00eb par\u00eb n\u00eb vitin 1989 nga dy inxhinier\u00eb nga IBM dhe Cisco Systems n\u00eb tri \"napkin\" - flet\u00eb formati A4. K\u00ebto \"napkin\"<\/a><\/noindex> ende ndodhen n\u00eb zyr\u00ebn qendrore t\u00eb Cisco Systems n\u00eb San Francisco si nj\u00eb relike e bot\u00ebs rrjetore.<\/p>\n

N\u00eb thelb t\u00eb protokollit \u00ebsht\u00eb nd\u00ebrveprimi i sistemeve autonome<\/b>\u00a0\u2014 Autonomous Systems ose shkurtimisht AS. Nj\u00eb sistem autonom \u00ebsht\u00eb thjesht nj\u00eb ID, prapa t\u00eb cilit n\u00eb regjistrin publik jan\u00eb t\u00eb lidhura rrjetet IP. Nj\u00eb router me nj\u00eb ID t\u00eb till\u00eb mund t\u00eb njoftoj\u00eb n\u00eb bot\u00eb k\u00ebto rrjete. Prandaj, \u00e7do rrug\u00eb n\u00eb internet mund t\u00eb paraqitet si nj\u00eb vektor, t\u00eb cilin e quajn\u00eb AS Path<\/b>. Vektori p\u00ebrb\u00ebhet nga numra t\u00eb sistemeve autonome, t\u00eb cilat duhet t'i kalojm\u00eb p\u00ebr t\u00eb arritur n\u00eb rrjetin e destinacionit.<\/p>\n

P\u00ebr shembull, ekziston nj\u00eb rrjet i disa sistemeve autonome. Duhet t\u00eb arrijm\u00eb nga sistemi AS65001 n\u00eb sistemin AS65003. Rruga nga nj\u00eb sistem paraqitet AS Path n\u00eb diagram. Ai p\u00ebrb\u00ebhet nga dy autonome: 65002 dhe 65003. P\u00ebr \u00e7do adres\u00eb t\u00eb destinacionit ka nj\u00eb vektor AS Path, i cili p\u00ebrb\u00ebhet nga numrat e sistemeve autonome q\u00eb duhet t\u00eb kalojm\u00eb.<\/p>\n

\"Pse
\n
\nK\u00ebshtu, \u00e7far\u00eb probleme ka BGP?<\/p>\n

BGP - \u00ebsht\u00eb nj\u00eb protokoll besimi<\/h3>\n

\nProtokolli BGP - \u00ebsht\u00eb i bazuar n\u00eb besim. Kjo do t\u00eb thot\u00eb se ne normalisht u besojm\u00eb fqinj\u00ebve tan\u00eb. Kjo \u00ebsht\u00eb nj\u00eb karakteristik\u00eb e shum\u00eb protokoleve q\u00eb u zhvilluan n\u00eb fillim t\u00eb internetit. Le t\u00eb kuptojm\u00eb se \u00e7far\u00eb do t\u00eb thot\u00eb \"t\u00eb besojm\u00eb\".<\/p>\n

Nuk ka autentifikim t\u00eb fqinjit<\/b>. Formalisht ekziston MD5, por MD5 n\u00eb vitin 2019 - nj\u00eb m\u00ebnyr\u00eb jo e mrekullueshme...<\/p>\n

Nuk ka filtrim<\/b>. BGP ka filtre dhe ato jan\u00eb t\u00eb p\u00ebrshkruara, por nuk p\u00ebrdoren, ose p\u00ebrdoren gabimisht. M\u00eb von\u00eb do t\u00eb shpjegoj se pse.<\/p>\n

Shum\u00eb leht\u00eb p\u00ebr t\u00eb vendosur fqinj\u00ebsin\u00eb<\/b>. Konfigurimi i fqinj\u00ebsis\u00eb n\u00eb protokollin BGP p\u00ebr \u00e7do router \u00ebsht\u00eb gati nj\u00eb dy rreshta konfigurimi.<\/p>\n

Nuk k\u00ebrkohen t\u00eb drejta p\u00ebr menaxhimin e BGP<\/b>. Nuk \u00ebsht\u00eb nevoj\u00eb p\u00ebr t\u00eb dh\u00ebn\u00eb provime q\u00eb t\u00eb v\u00ebrtetojn\u00eb kualifikimin tuaj. Askush nuk do t'ju heq\u00eb t\u00eb drejt\u00ebn p\u00ebr t\u00eb konfiguruar BGP n\u00eb gjendje t\u00eb dehur.<\/p>\n

Dy problemet kryesore<\/h3>\n

\nKthejshet e prefikseve - prefix hijacks<\/b>. Kthimi i prefikseve \u00ebsht\u00eb shpallja e nj\u00eb rrjeti q\u00eb nuk ju p\u00ebrket, si\u00e7 \u00ebsht\u00eb rasti me MyEtherwallet. Ne mor\u00ebm disa prefikse, u dakorduam me ofruesin ose e kemi hakuar at\u00eb, dhe p\u00ebrmes tij shpallim k\u00ebto rrjete.<\/p>\n

Shp\u00ebrndarjet e rrug\u00ebve - route leaks<\/b>. Me shp\u00ebrndarjet \u00ebsht\u00eb pak m\u00eb e komplikuar. Shp\u00ebrndarja \u00ebsht\u00eb ndryshimi i AS Path<\/b>. N\u00eb rastin m\u00eb t\u00eb mir\u00eb, ndryshimi do t\u00eb \u00e7oj\u00eb n\u00eb nj\u00eb vones\u00eb m\u00eb t\u00eb madhe, sepse duhet t\u00eb kaloni nj\u00eb rrug\u00eb m\u00eb t\u00eb gjat\u00eb ose p\u00ebrmes nj\u00eb lidhjeje m\u00eb t\u00eb ngarkuar. N\u00eb rastin m\u00eb t\u00eb keq, do t\u00eb p\u00ebrs\u00ebritet rasti me Google dhe Japonin\u00eb.<\/p>\n

Vet\u00eb Google nuk \u00ebsht\u00eb operator dhe nuk \u00ebsht\u00eb nj\u00eb sistem autonom kalimtar. Por kur ai shpalli ofruesit t\u00eb tij rrjetet e operator\u00ebve japonez\u00eb, trafiku p\u00ebrmes Google duke par\u00eb AS Path dukej si m\u00eb prioritar. Trafiku shkoi atje dhe u hodh thjesht sepse konfigurimet e ruterimit brenda Google ishin m\u00eb t\u00eb komplikuara se thjesht filtrat n\u00eb kufi.<\/p>\n

Pse nuk funksionojn\u00eb filtrat?<\/h3>\n

\nAskush nuk i intereson<\/b>. Kjo \u00ebsht\u00eb arsyeja kryesore - askujt nuk i intereson. Administratori i nj\u00eb ofruesi t\u00eb vog\u00ebl ose i nj\u00eb kompanie q\u00eb \u00ebsht\u00eb lidhur me ofruesin p\u00ebrmes BGP, mori MikroTik, e konfigurua at\u00eb p\u00ebr BGP dhe madje nuk e dinte se \u00e7far\u00eb mund t\u00eb konfigurohet me filtrat.<\/p>\n

Gabimet n\u00eb konfigurim<\/b>. Dicka e debukuar, gabuan n\u00eb mask\u00eb, vendos\u00ebn gabimen rrjet - dhe ja, p\u00ebrs\u00ebri gabim.<\/p>\n

Nuk ka mund\u00ebsi teknike<\/b>. P\u00ebr shembull, ofruesit e komunikimeve kan\u00eb shum\u00eb klient\u00eb. N\u00eb m\u00ebnyr\u00eb inteligjente, duhet automatikisht t\u00eb p\u00ebrdit\u00ebsohen filtrat p\u00ebr \u00e7do klient - t\u00eb ndjekin q\u00eb ai ka nj\u00eb rrjet t\u00eb ri, q\u00eb ai ia dha rrjetin e tij ndonj\u00ebkujt me qira. T\u00eb ndjek\u00ebsh k\u00ebt\u00eb \u00ebsht\u00eb e v\u00ebshtir\u00eb, me duar \u00ebsht\u00eb edhe m\u00eb e v\u00ebshtir\u00eb. Prandaj vendosin thjesht filtre t\u00eb relaksuar ose madje nuk vendosin filtrat fare.<\/p>\n

P\u00ebrjashtimet<\/b>. Ka p\u00ebrjashtime p\u00ebr klient\u00ebt e preferuar dhe t\u00eb m\u00ebdhenj. Sidomos n\u00eb rastin e lidhjeve nd\u00ebroperuese. P\u00ebr shembull, TransTeleCom dhe Rostelecom kan\u00eb shum\u00eb rrjete dhe midis tyre ka lidhje. N\u00ebse lidhja bie - askujt nuk do t'i jet\u00eb mir\u00eb, prandaj filtrat relaksohen ose hiqen fare.<\/p>\n

Informacion e vjet\u00ebr ose joaktive n\u00eb IRR<\/b>. Filtrat nd\u00ebrtohen mbi informatat q\u00eb jan\u00eb shkruar n\u00eb\u00a0IRR - Regjistri i Ruter\u00ebve t\u00eb Internetit<\/b>. K\u00ebto jan\u00eb regjistrat e regjistruesve t\u00eb internetit rajonal\u00eb. Shpesh n\u00eb regjistrat ka informacion t\u00eb vjet\u00ebr ose joaktiv, ose t\u00eb dyja.<\/p>\n

Kush jan\u00eb k\u00ebta regjistrues?<\/h3>\n

\"Pse
\n
\nT\u00eb gjitha adresat n\u00eb internet i p\u00ebrkasin organizat\u00ebs IANA - Autoriteti i Numrave t\u00eb Caktuar t\u00eb Internetit<\/b>. Kur blini nj\u00eb rrjet IP nga dikush, ju blini jo adresat, por t\u00eb drejt\u00ebn p\u00ebr t'i p\u00ebrdorur ato. Adresat jan\u00eb nj\u00eb burim jo-material, dhe sipas marr\u00ebveshjes s\u00eb p\u00ebrgjithshme, t\u00eb gjitha u p\u00ebrkasin agjencis\u00eb IANA.<\/p>\n

Sistemi funksionon k\u00ebshtu. IANA delegon menaxhimin e adresave IP dhe numrave t\u00eb sistemeve autonome te pes\u00eb regjistruesit rajonal\u00eb. Ata japin sisteme autonome LIR - regjistruesve lokal\u00eb t\u00eb internetit<\/b>. M\u00eb pas, LIR ndan adresat IP p\u00ebr p\u00ebrdoruesit final.<\/p>\n

Mang\u00ebsia e sistemit \u00ebsht\u00eb se \u00e7do regjistrues rajonal mban regjistrat e tij si t\u00eb d\u00ebshiron. \u00c7do nj\u00ebra ka pik\u00ebpamjet e veta mbi \u00e7far\u00eb informacioni duhet t\u00eb p\u00ebrmbaj\u00eb regjistri, kush duhet ose nuk duhet ta verifikoj\u00eb at\u00eb. Si rezultat, rezulton nj\u00eb kaos, i till\u00eb si\u00e7 \u00ebsht\u00eb tani.<\/p>\n

Si mund t\u00eb luftohet ndryshe me k\u00ebto probleme?<\/h3>\n

\nIRR - cil\u00ebsi e mesme<\/b>. Me IRR \u00ebsht\u00eb e qart\u00eb - atje gjith\u00e7ka \u00ebsht\u00eb keq.<\/p>\n

BGP-communities<\/b>. Ky \u00ebsht\u00eb nj\u00eb atribut q\u00eb p\u00ebrshkruhet n\u00eb protokoll. Ne mund t\u00eb vendosim, p\u00ebr shembull, nj\u00eb community speciale n\u00eb anonsin ton\u00eb, p\u00ebr t\u00eb siguruar q\u00eb fqinj\u00ebt tan\u00eb t\u00eb mos d\u00ebrgojn\u00eb rrjetet tona te fqinj\u00ebt e tyre. Kur kemi nj\u00eb lidhje P2P, ne shk\u00ebmbehet vet\u00ebm me rrjetet tona. Q\u00eb rruga t\u00eb mos shkoj\u00eb rast\u00ebsisht n\u00eb rrjete t\u00eb tjera, ne vendosim nj\u00eb community.<\/p>\n

Community nuk jan\u00eb tranzitive<\/b>. Kjo gjithmon\u00eb \u00ebsht\u00eb nj\u00eb marr\u00ebveshje p\u00ebr dy veta, dhe kjo \u00ebsht\u00eb mang\u00ebsia e tyre. Ne nuk mund t\u00eb vendosim ndonj\u00eb community, p\u00ebrve\u00e7 nj\u00ebrit q\u00eb pranohet nga t\u00eb gjith\u00eb si standard. Ne nuk mund t\u00eb jemi t\u00eb sigurt se t\u00eb gjith\u00eb do ta pranojn\u00eb k\u00ebt\u00eb community dhe do ta interpretojn\u00eb at\u00eb si\u00e7 duhet. Prandaj, n\u00eb rastin m\u00eb t\u00eb mir\u00eb, n\u00ebse ju bini dakord me uplink-un tuaj, ai do ta kuptoj\u00eb se \u00e7far\u00eb d\u00ebshironi nga community. Por fqinj\u00ebt e tij mund t\u00eb mos e kuptojn\u00eb, ose operatori mund ta heq\u00eb etiket\u00ebn tuaj, dhe ju nuk do t\u00eb arrini at\u00eb q\u00eb d\u00ebshironit.<\/p>\n

RPKI + ROA zgjidh vet\u00ebm nj\u00eb pjes\u00eb t\u00eb vog\u00ebl t\u00eb problemeve<\/b>. RPKI \u00ebsht\u00eb Infrastruktura Publike e \u00c7el\u00ebsave t\u00eb Burimeve\u00a0<\/b> \u2014 nj\u00eb korniz\u00eb speciale p\u00ebr n\u00ebnshkrimin e informacionit t\u00eb rrug\u00ebve. Nj\u00eb ide e mir\u00eb p\u00ebr t\u00eb b\u00ebr\u00eb q\u00eb LIR-\u00ebt dhe klient\u00ebt e tyre t\u00eb mbajn\u00eb nj\u00eb baz\u00eb t\u00eb p\u00ebrdit\u00ebsuar t\u00eb hap\u00ebsir\u00ebs adresore. Por ka nj\u00eb problem me t\u00eb.<\/p>\n

RPKI po ashtu \u00ebsht\u00eb nj\u00eb sistem hierarkik i \u00e7el\u00ebsave t\u00eb hapur. IANA ka nj\u00eb \u00e7el\u00ebs, nga i cili krijohen \u00e7el\u00ebsat RIR, dhe nga ata, \u00e7el\u00ebsat LIR, t\u00eb cil\u00ebt n\u00ebnshkruajn\u00eb hap\u00ebsir\u00ebn e tyre adresore me ndihm\u00ebn e ROA-ve \u2014 Autorizimeve t\u00eb Origjin\u00ebs s\u00eb Rrug\u00ebve:<\/p>\n

\u2014 Un\u00eb po e garanton se ky prefiks do t\u00eb shpallet n\u00eb em\u00ebr t\u00eb k\u00ebsaj autonomke.<\/i><\/p>\n

P\u00ebrve\u00e7 ROA-ve, ka dhe objekte t\u00eb tjera, por do t\u00eb flasim p\u00ebr to m\u00eb von\u00eb. Duket se \u00ebsht\u00eb nj\u00eb gj\u00eb e mir\u00eb dhe e dobishme. Por nuk na mbron nga rrjedhjet n\u00eb m\u00ebnyr\u00eb t\u00eb plot\u00eb dhe nuk zgjidh t\u00eb gjitha problemet me grabitjen e prefikseve. Prandaj, lojtar\u00ebt nuk jan\u00eb shum\u00eb t\u00eb nxituar ta zbatojn\u00eb. Megjithat\u00eb, nga lojtar\u00ebt e m\u00ebdhenj si AT&T dhe IX t\u00eb m\u00ebdhenj, ka p\u00ebrkushtime se prefikset me regjistrin invalid ROA do t\u00eb hiqen. <\/p>\n

Ndoshta ata do ta b\u00ebjn\u00eb k\u00ebt\u00eb, por deri tani kemi nj\u00eb num\u00ebr t\u00eb madh prefiksh q\u00eb nuk jan\u00eb n\u00ebnshkruar. Nga nj\u00eb an\u00eb, nuk \u00ebsht\u00eb e qart\u00eb n\u00ebse ata jan\u00eb t\u00eb vlefsh\u00ebm. Nga ana tjet\u00ebr, ne nuk mund t'i heqim ato si norm\u00eb, sepse nuk jemi t\u00eb sigurt se \u00ebsht\u00eb e drejt\u00eb ose jo.<\/p>\n

\u00c7far\u00eb tjet\u00ebr ka?<\/h3>\n

\nBGPSec<\/b>. Kjo \u00ebsht\u00eb nj\u00eb gj\u00eb e shk\u00eblqyer, e shpikur nga akademik\u00ebt p\u00ebr rrjetin e ponive roz\u00eb. Ata than\u00eb:<\/p>\n

\u2014 Ne kemi RPKI + ROA \u2014 mekanizmi i n\u00ebnshkrimit t\u00eb hap\u00ebsir\u00ebs adresore. Le t\u00eb krijojm\u00eb nj\u00eb atribut t\u00eb ve\u00e7ant\u00eb BGP dhe ta quajm\u00eb BGPSec Path. \u00c7do router do t\u00eb n\u00ebnshkruaj\u00eb me n\u00ebnshkrimin e tij shpalljet q\u00eb ai shpall fqinj\u00ebve. K\u00ebshtu do t\u00eb arrijm\u00eb nj\u00eb rrug\u00eb t\u00eb besueshme nga zinxhiri i shpalljeve t\u00eb n\u00ebnshkruara dhe do ta verifikojm\u00eb at\u00eb.<\/i><\/p>\n

Teoria duket e mir\u00eb, por n\u00eb praktik\u00eb ka shum\u00eb probleme. BGPSec prish shum\u00eb mekanizma ekzistues BGP p\u00ebr zgjedhjen e next-hop dhe menaxhimin e trafikut hyr\u00ebs\/dal\u00ebs direkt n\u00eb router. BGPSec nuk funksionon derisa ta zbatojn\u00eb 95% e pjes\u00ebmarr\u00ebsve n\u00eb gjith\u00eb tregun, q\u00eb vet\u00eb \u00ebsht\u00eb nj\u00eb utopi.<\/p>\n

BGPSec ka probleme t\u00eb m\u00ebdha me performanc\u00ebn. N\u00eb pajisjet aktuale, shpejt\u00ebsia e verifikimit t\u00eb shpalljeve \u00ebsht\u00eb rreth 50 prefikse n\u00eb sekond\u00eb. P\u00ebr krahasim, tabela aktuale e internetit me 700,000 prefikse do t\u00eb mbushet p\u00ebr 5 or\u00eb, gjat\u00eb t\u00eb cilave do t\u00eb ndodhin edhe 10 ndryshime.<\/p>\n

BGP Open Policy (BGP i bazuar n\u00eb role)<\/b>. Nj\u00eb propozim i ri bazuar n\u00eb modelin Gao-Rexford<\/b>. K\u00ebta jan\u00eb dy shkenc\u00ebtar\u00eb q\u00eb merren me studimin e BGP.<\/p>\n

Modeli Gao-Rexford p\u00ebrmbledhhet si n\u00eb vijim. N\u00ebse e p\u00ebrmbledhim, n\u00eb rastin e BGP, ekzistojn\u00eb nj\u00eb num\u00ebr i vog\u00ebl llojsh q\u00ebndrojn\u00eb nd\u00ebrveprime,<\/p>\n