Design and analysis of optimization algorithms to minimize cryptographic processing in BGP security protocols

Abstract

The Internet is subject to attacks due to vulnerabilities in its routing protocols. One proposed approach to attain greater security is to cryptographically protect network reachability announcements exchanged between Border Gateway Protocol (BGP) routers. This study proposes and evaluates the performance and efficiency of various optimization algorithms for validation of digitally signed BGP updates. In particular, this investigation focuses on the BGPSEC (BGP with SECurity extensions) protocol, currently under consideration for standardization in the Internet Engineering Task Force. We analyze three basic BGPSEC update processing algorithms: Unoptimized, Cache Common Segments (CCS) optimization, and Best Path Only (BPO) optimization. We further propose and study cache management schemes to be used in conjunction with the CCS and BPO algorithms. The performance metrics used in the analyses are: (1) routing table convergence time after BGPSEC peering reset or router reboot events and (2) peak-second signature verification workload. Both analytical modeling and detailed trace-driven simulation were performed. Results show that the BPO algorithm is 330% to 628% faster than the unoptimized algorithm for routing table convergence in a typical Internet core-facing provider edge router.

BGP secure routing extension (BGP-SRx) :

“…Other BGPsec performance optimization techniques such as caching already computed AS path segments and their BGPsec signature validation results have been studied [36]. These techniques may be considered in future enhancements of NIST BGPsec implementation.…”

Resilient Interdomain Traffic Exchange

“…BGPsec update processing are available [Adalier1] [Adalier2] [NIST-SRx]. Optimization 964 algorithms for BGPsec update processing are proposed and analyzed in [Sriram2]. 965…”

The state of affairs in BGP security: A survey of attacks and defenses

“…These are believed to be the most promising solutions, due to the extensive security they offer. Although intuitive optimizations to these proposals have been discussed, e.g., using additional hardware [76] or caching update messages to reduce the number of signature verification operations [76,77,90,91], their expensive cryptographic operations remain a major obstacle to their adoption.…”