Analysis of impact of trust on Secure Border Gateway Protocol

Abstract

Secure Border Gateway Protocol (S-BGP) mandates that upon reception of a BGP UPDATE message, an S-BGP speaker must verify nested signatures of all nodes in the traversed path; and the router should verify the Address Attestation to check if the source has the right to announce the address prefix. Due to several digital signatures required in each UPDATE, there is a high CPU overhead associated with S-BGP. In this paper, we propose a new approach that reduces the burden of validating the AS-path and the address prefix origination. We define a control layer of trusted nodes that is comprised of major Autonomous Systems (ASes) in the network. In this environment, an AS has to verify only the signatures of intermediate ASes between itself and the last trusted node in the AS-path. Similarly, the address prefix is validated only if it was not previously validated by a trusted AS.Using an original analytical model as well as a simulation model, we measured performance metrics of the new proposal. We show that even with small ratio of trusted nodes, the new scheme can significantly reduce the number of verifications required to validate the ASpath and IP prefixes and the number of public keys required by S-BGP.

Security analysis of C-BGP: A light alternative to S-BGP

“…The computation requirements of the protocol dramatically slow down the network convergence. In [1] the authors proposed Credible BGP (C-BGP), a lightweight protocol that we proved can be a good alternative to secure BGP. The main design goal of C-BGP is to reduce the burden of validating the AS-PATH and the address prefix origination.…”

“…As discussed in [1], there are significant savings in terms of number of signature verifications as they are reduced significantly when a limited number of trusted ASes are present in the network.…”

“…This UPDATE message must not have any trusted AS in the AS-PATH, else the UPDATE message would be dropped by the trusted AS in the AS-PATH. This quantity, , is similar to the average number of keys calculated in [1]. It can be written as:…”

“…However, it presents significant challenges in terms of number of signature verifications and deployment considerations. In [1] we proposed a new approach, called Credible BGP (C-BGP), which attempts to address some of the concerns associated with S-BGP and demonstrated significant improvements in the number of overall signature processing requirements. In this paper we present security analysis of C-BGP.…”

A Novel Approach for Secure Routing Through BGP Using Symmetric Key

“…As well as they use both algorithm for key distribution central key distribution and distributed key distribution. The paper "Analysis of Impact of Trust on Secure Borde Gateway Protocol" [8] shows that only 20% of trusted nodes in the network can reduce the number of AS-path verifications by almost 50%. Similarly, the average number of IP prefix validations is reduced by 80% when 20% of the ASes are trusted.…”