A Survey of BGP Security Issues and Solutions

Abstract

The Border Gateway Protocol (BGP) is the de facto interdomain routing protocol of the Internet. Although the performance of BGP has been historically acceptable, there are continuing concerns about its ability to meet the needs of the rapidly evolving Internet. A major limitation of BGP is its failure to adequately address security. Recent outages and security analyses clearly indicate that the Internet routing infrastructure is highly vulnerable. Moreover, the design and ubiquity of BGP has frustrated past efforts at securing interdomain routing. This paper considers the vulnerabilities currently existing within interdomain routing and surveys works relating to BGP security. The limitations and advantages of proposed solutions are explored, and the systemic and operational implications of their designs considered. We note that no current solution has yet found an adequate balance between comprehensive security and deployment cost. This work calls not only for the application of ideas described within this paper, but also for further investigation into the problems and solutions of BGP security.

Secure producer mobility in information-centric network

“…We compare our hash-based verification with the signaturebased verification adopted in most of the prefix attestation proposals [9]. We consider the protocol to be the same in both approaches (i.e., both issue an Interest Update that will be verified at each router).…”

“…Prefix attestation has also been proposed to prevent IP prefix hijacking in inter-domain [9,19,20,28,31] and intra-domain [25,29] IP routing. A widely used approach for achieving address attestation exploits digital signatures and certificates.…”

“…Retrieving the security context only adds a negligible time. In fact, the security context is stored together with the forwarding state in the corresponding table and it can be retrieve during the regular lookup for processing an interest 9 . Therefore, the time needed to verify the proof is the dominating factor in both the hash-based verification or the signature-based verification.…”

“…We compare our approach with a signature based mechanism adopted in most of the prefix attestation proposals [9,19,20,28,31,34]. Results show that our lightweight approach maintains more than 90% of the original goodput (i.e., without any security mechanism), while the signature approach drops it close to 0%.…”

How secure are secure interdomain routing protocols?

“…Attracting extra traffic enables the AS to increase revenue from customers, or drop, tamper, or snoop on the packets [1,2,3]. While the proposed extensions to BGP prevent many attacks (see [4] for a survey), even these secure protocols are susceptible to a strategic manipulator who deliberately exploits their weaknesses to attract large volumes of traffic to its network. Given the difficulty of upgrading the Internet to a new secure routing protocol, it is crucial to understand how well these protocols blunt the impact of traffic attraction attacks.…”