BGPsec

BGPsec
Name	BGPsec
Status	Internet Standard proposal
Initial publication	2011
Primary authors	IETF SIDR Working Group
Related protocols	Border Gateway Protocol, Resource Public Key Infrastructure

BGPsec BGPsec is a security extension to the Border Gateway Protocol designed to provide path validation for Internet inter-domain routing. It augments routing announcements with cryptographic signatures intended to ensure route origin authentication and AS_PATH integrity across Autonomous Systems such as AT&T, Level 3 Communications, Verizon Communications, NTT Communications, and Orange S.A.. The specification was developed within the Internet Engineering Task Force by the SIDR Working Group to work with the Resource Public Key Infrastructure managed processes like those of IANA and regional registries such as ARIN, RIPE NCC, APNIC, LACNIC, and AfriNIC.

Overview

BGPsec extends Border Gateway Protocol operations by attaching signed path information to route advertisements. It leverages public key infrastructure principles defined in RFC 6480 and interacts with the RPKI certificate hierarchy used by regional Internet registries like ARIN and RIPE NCC. The design aims to prevent well-known events such as route hijacks similar to incidents affecting networks of YouTube, Pakistan Telecom, Hondutel, China Telecom, and MCI WorldCom. By providing cryptographic verification, it complements existing mechanisms referenced in IETF documents authored by figures such as Stephen Kent and groups including the IETF Routing Area.

Technical Design

BGPsec introduces a new path attribute carrying a sequence of digital signatures created by Autonomous System operators using keys provisioned through RPKI certificates issued by registries like APNIC and LACNIC. Each AS along the path appends a signature that covers the preceding hop and NLRI, enabling downstream routers to validate the chain. The approach relies on algorithms and protocols standardized by bodies like the Internet Society and implemented in router platforms from vendors such as Cisco Systems, Juniper Networks, Arista Networks, Huawei, and Nokia (company). Key management and certificate distribution are tied to practices used by IANA and regional registries; operational tooling often integrates with software projects and organizations including RIPE Atlas, OpenBGPd, Quagga, FRRouting, and commercial network management suites from SolarWinds.

Deployment and Operational Considerations

Rolling out BGPsec requires coordination among operators, certificate issuers, and router vendors. Operators in major transit networks like CenturyLink, Cogent Communications, T-Mobile, Sprint Corporation, and content networks such as Akamai Technologies face decisions about CPU load, key lifecycle, and interaction with existing filters used by exchanges like LINX, DE-CIX, AMS-IX, and IX.br. Interactions with traffic engineering practices from organizations like Netflix and Google necessitate careful planning to preserve routing flexibility. Interoperability testing has been pursued in IETF-inspired events and by organizations like the Internet Society and the RIPE NCC.

Security Benefits and Limitations

When fully deployed, BGPsec can provide cryptographic assurance that a routing announcement traversed the claimed sequence of Autonomous Systems, mitigating classes of attacks exemplified by incidents involving Pakistan Telecom and YouTube or deliberate misconfigurations affecting providers like China Telecom. However, limitations arise from operational realities: partial deployment leaves unprotected segments, and trust in RPKI roots concentrates authority in entities such as IANA and the regional registries. Attack models involving compromised private keys, misissued certificates comparable to controversies around certificate authorities like DigiNotar, or deliberate policy manipulation expose residual risk. The protocol also does not address some threats historically discussed in forums featuring researchers like Dan Kaminsky and organizations like CERT/CC.

Performance and Scalability

BGPsec increases computational and bandwidth requirements: routers must perform signature verification for every UPDATE and store signed path attributes, impacting platforms produced by vendors such as Cisco Systems, Juniper Networks, Arista Networks, Huawei, and Nokia (company). Scaling challenges parallel concerns raised during adoption of IPv6 and MPLS by carriers including Verizon Communications and AT&T. Various optimization strategies—batch verification, hardware acceleration using ASICs and NPUs from suppliers like Broadcom and Intel Corporation, or selective validation policies used by operators like NTT Communications—can mitigate overhead. Nonetheless, full global deployment implies substantial resource commitments and careful engineering analogous to large-scale rollouts carried out by cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform.

Adoption and Real-World Implementations

Adoption has proceeded cautiously with pilot deployments, lab testing, and partial RPKI adoption by registries and operators including ARIN, RIPE NCC, APNIC, LACNIC, AfriNIC, Hurricane Electric, and research networks such as SURFnet and Internet2. Router vendors have implemented prototype or production features in platforms used by enterprises like IBM and universities that participate in exchanges such as GEANT and CANARIE. Interoperability events and demonstrations have been organized by the IETF, Internet Society, and regional registries to validate practical operations. Ongoing debates in forums like the IETF SIDR Working Group and operator communities at conferences such as RIPE Meetings, NANOG meetings, and APRICOT continue to shape deployment trajectories.

Category:Internet protocols