Design and analysis of the Secure Border Gateway Protocol (S-BGP)

Abstract

The Border Gateway Protocol (BGP), which is used to distribute routing information between autonomous systems (ASes), is a critical component of the Internet's routing infrastructure. It is highly vulnerable to a variety of malicious attacks, due to the lack of a secure means of verifying the authenticity and legitimacy of BGP control traffic. This document describes a secure, scalable, deployable architecture, S-BGP, for a system that addresses most of the security problems associated with BGP. The paper discusses the vulnerabilities and security requirements associated with BGP, describes the S-BGP countermeasures, and explains how they address these vulnerabilities and requirements. The paper also provides a comparison of this architecture with other approaches that have been proposed, analyzes the performance implications of the proposed countermeasures, and reports on prototype implementation experience.

A High Performance Software Architecture for a Secure Internet Routing PKI

“…These proposals have not been adopted due to the changes required to routers and the expensive infrastructure requirements that would thereby be imposed. The most recent proposal for creating the requisite infrastructure is described in [1], an approach based on a new, digitally signed object, the Route Origination Authorization (ROA), together with a PKI to validate, manage and process such objects. Relying party software for use with this "Resource" PKI (RPKI) was first implemented by BBN in 2007, and is described in [12].…”

“…

A PKI in support of secure Internet routing was first proposed in [1] and refined in later papers, e.g., [2]. In this "Resource" PKI (RPKI) the resources managed are IP address allocations and Autonomous System number (AS #) assignments.

…”

Are BGP Routers Open to Attack? An Experiment

“…One of these proposals is S-BGP ( [11]), which adds multiple layers of security to the current BGP specifications. S-BGP allows a BGP router to validate the authenticity and integrity of each path received from a peer.…”

“…For example S-BGP ( [11]), soBGP ( [10]), and IRV ( [8]) are BGP extensions aimed at authenticating prefix origins and updates. However, most of the proposed solutions imply a heavier load on the CPU and memory of routers in order to perform cryptographic operations.…”

A Systematic Approach to Evaluating the Trustworthiness of the Internet Inter-Domain Routing Information

“…There are a plethora of proposed countermeasures [8]- [11] addressing inter-domain routing security problems. However, these mechanisms are limited by their further deployment since they need to change the routing protocol.…”