IOPS is a group of commercial ISPs that work together to coordinate engineering and operations efforts among its members.
There have been problems caused by bad routing information being injected into the Internet Routing System. This has caused outages to occur.
The basic problem is caused by a lack of verification of the routing information being injected into the routing system. That means that the routing system is vunerable to attack (or mistakes) by bad information.
The IOPs working group suggested that at various points in the Internet, there needs to be some "routing checkpoints" to do the verification. The model should include dense filtering at untrusted boundaries and sparse filtering at trusted boundaries. In this case, dense filtering would be prefix-based. Sparse filtering would be AS-based.
A trusted boundary would be those where everyone is doing dense filtering with untrusted peers. Untriusted peers includes direct customers and peers that do not participate in this model.
Any ISP can do dense filtering with everybody if they desire. It's a lot of work.
However, implementing this model would significantly benefit everyone by reducing the possibility of attacks spreading beyond a dense filtering boundary.
The more ISPs that do this, the more sparse filtering can be done. The fewer, the more dense filtering has to be done.
How is this done? IOPs recommends that the information be found out from the peers themselves. Another mechanism is to include this as part of the bilateral peering agreement.
What tools are available?
Using these types of tools along with other information, the filtering policy can be generated from these tools.
The IOPS membership have agreed to implement this model. However, it is important that everyone implement it.
Jessica's comments are in this font. --Ed.
See http://www.iops.org/Documents/routing.html for the details on the proposal.
Bill asks: Where will this routing policy information be available?
The routing model only requires the peers to work with each other. Some may not feel comfortable making this information public.
Bill askes: What about limitations in the router vendors ability to do prefix filtering?
This is a problem. However, it is getting better.
Sean asks: I notice that this appears to be defined around inbound filtering. What about addressing outbound filtering?
Doing outbound filtering is a good idea.
Someone asks: Will the model that she is prposing stop denial of service attacks?
It will stop bad routing information from being injected, which may help prevent certain classes of attacks, but it would not affect smurfing or other simliar types of attacks.