It Bends But Would It Break? Topological Analysis of BGP Infrastructures in Europe

Abstract

Abstract-The Internet is often thought to be a model of resilience, due to a decentralised, organically-grown architecture. This paper puts this perception into perspective through the results of a security analysis of the Border Gateway Protocol (BGP) routing infrastructure. BGP is a fundamental Internet protocol and its intrinsic fragilities have been highlighted extensively in the literature. A seldom studied aspect is how robust the BGP infrastructure actually is as a result of nearly three decades of perpetual growth. Although global black-outs seem unlikely, local security events raise growing concerns on the robustness of the backbone. In order to better protect this critical infrastructure, it is crucial to understand its topology in the context of the weaknesses of BGP and to identify possible security scenarios. Firstly, we establish a comprehensive threat model that classifies main attack vectors, including but non limited to BGP vulnerabilities. We then construct maps of the European BGP backbone based on publicly available routing data. We analyse the topology of the backbone and establish several disruption scenarios that highlight the possible consequences of different types of attacks, for different attack capabilities. We also discuss existing mitigation and recovery strategies, and we propose improvements to enhance the robustness and resilience of the backbone. To our knowledge, this study is the first to combine a comprehensive threat analysis of BGP infrastructures with advanced network topology considerations. We find that the BGP infrastructure is at higher risk than already understood, due to topologies that remain vulnerable to certain targeted attacks as a result of organic deployment over the years. Significant parts of the system are still uncharted territory, which warrants further investigation in this direction.

On the Soundness of Infrastructure Adversaries

“…Presumably, this was due to the problem size associated with large-scale infrastructures like the Internet. Frey et al [22] conducted one of the first Internet-scale infrastructure assessments in terms of security evaluation. They investigated the Border Gateway Protocol deployment looking into potential threats and vulnerabilities.…”

The state of affairs in BGP security: A survey of attacks and defenses

“…BGP threats are caused by three fundamental vulnerabilities. First, BGP infrastructure is susceptible to physical attacks by outsiders, e.g., damage to hardware or cables between ASs [3]. Such attacks fall into the field of physical and logical security and are out of scope of this work.…”

“…Subprefix hijack: Another way the attacker can prevent a MOAS conflict is by advertising a subnetwork of 3 https://bgpmon.net/large-scale-bgp-hijack-out-of-india/ an existing prefix which does not belong to the attacker (Figure 1(b)). This event is also known as de-aggregation attack 4 .…”

“…ASs set up routes via BGP based on their local policies. Despite its critical role on the Internet, BGP is not designed to provide any security guarantees and, thus, remains vulnerable to attacks [2,3] and misconfigurations [4], causing instabilities in the routing system or severe reachability problems. As well as frequent routing incidents [5,6], BGP threats are exploited for country-level censorship [7,8], damage to cryptocurrencies [9], and tracking users of anonymization networks [10].…”

Improvement of Border Gateway Protocol Against Failure on Autonomous Systems

“…BGP [1,2,3,4,5,6] unlike the other routing protocols is an exterior gateway protocol used between autonomous systems and is a path vector routing protocol. After you enable BGP on your router you need to advertise your routes in the routing protocol to be handled in the routing table to be exchanged with others (injection/advertisement).…”