Border Gateway Protocol Speakers Research Articles

N‐BGP: An efficient BGP routing protocol adaptation for named data networking

SummaryNamed data networking (NDN) is gaining momentum as a future Internet architecture. NDN is a type of information‐centric networking (ICN) that attempts to change the current Internet architecture from host/location‐centric to content‐centric, where data retrieving is done by the names of the contents irrespective of the location of the data. A mechanism to advertise the name‐based prefixes between different domains is necessary to accelerate the NDN deployment. In IP‐based routing, border gateway protocol (BGP) is the de facto inter‐domain routing protocol that plays a vital role in Internet communication by enabling different Internet domains to exchange routing information. In its current form, BGP can advertise and process IP‐based prefixes, but it cannot advertise or process NDN name‐based prefixes. Accordingly, BGP needs to be extended to support NDN technology. This paper proposes an NDN extension for BGP, referred to as N‐BGP, that offers a solution to exchange name‐based routes in the current BGP networks. This proposed extension modifies the traditional BGP speaker into a hybrid one. This hybrid speaker is qualified to understand, advertise, receive, process, and store both IP‐based and name‐based routes simultaneously and efficiently, without disturbing or breaking the current Internet operation; that is, it can coexist along with traditional speakers. We also validate and evaluate our proposed solution in a hybrid environment, and the results show that N‐BGP has the capability to exchange and process both Name and IP‐based routes efficiently.

A Novel Approach for Secure Routing Through BGP Using Symmetric Key

The Border Gateway Protocol (BGP) is the path vector routing protocol that connects different autonomous systems.. These ASes have unique integer numbers which assign by IANA organization. The traditional BGP protocol is not sufficient to provide security and authentication for AS path and verification of AS number ownership as well as network IP prefix. The BGP remains vulnerable to various types of misconfiguration by users and attacks. Many secure BGP algorithms have been proposed but complexity of algorithm and attack on that models still remain open problem. In this paper, we propose an efficient model for SBGP; initially establish trust relationship between BGP peers. In this process BGP use TCP protocol for reliable communication. The BGP routers will attempt to create secure BGP session by exchanging BGP Open messages. During this Open messages master BGP router generate private key with help of cyclic shifting of ASCII of password called cyclic shift algorithm. Then hash of this private key send towards neighbour. Instead of key exchange, we use hashing algorithm, we generate hash of only key through SHA-1. This hash code for private key sent with Open messages during session establishment. When this Open messages receive by neighbor BGP routers, first it generate key using same password with same algorithm & generate hash code for same and then compare both hash code. If it matches then establish secure session with master BGP router & accept the Autonomous system number which is sent by master router during Open Messages. In this manner both BGP speakers make trust relationship between each other & then exchange route UPDATE within secure channel. If hash code at receiver end does not match then simply receiving BGP router discard Open messages and does not make connection with unauthorized AS number. If malicious router wants to inject false route or false ip prefix then it does not create secure session by lack of secure private key. So malicious router does not participate in above BGP routing process.

Keychain-Based Signatures for Securing BGP

As a major component of Internet routing infrastructure, the Border Gateway Protocol (BGP) is vulnerable to malicious attacks. While Secure BGP (S-BGP) provides a comprehensive framework to secure BGP, its high computational cost and low incremental deployment benefits seriously impede its wide usage in practice. Using a lightweight symmetric signature scheme, SPV is much faster than S-BGP. However, the speed boost comes at the price of prohibitively large signatures. Aggregated path authentication reduces the overhead of securing BGP in terms of both time and space, but the speed improvement is still limited by public key computation. In this paper, we propose a keychain-based signature scheme called KC-x. It has low CPU and memory overheads and provides strong incentive for incremental deployment on the Internet. As a generic framework, KC-x has the flexibility of using different signature algorithms, which can even co-exist in a hybrid deployment. We investigate two implementations of KC-x: KC-RSA based on RSA and KC-MT based on Merkle hash tree. Using real BGP workloads, our experimental results show that KC-RSA is as efficient as SAS-V (the most efficient software approach for aggregated path authentication), and KC-MT is even three times faster than SPV with 40% smaller signatures. Through the hybrid deployment of KC-MT and KC-RSA, KC-x can achieve both small signature and high processing rate for BGP speakers.

Time Window Mechanism to Improve BGP Routing Convergence

PDF HTML阅读 XML下载 导出引用 引用提醒 改善BGP路由收敛的时间窗口机制 DOI: 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: Supported by the National Natural Science Foundation of China under Grant No.60473082 (国家自然科学基金); the National Basic Research Program of China under Grant No.2003CB314801 (国家重点基础研究发展计划(973)) Time Window Mechanism to Improve BGP Routing Convergence Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:提出了一种时间窗口机制,能够基于路由抖动抑制中路由惩罚值的变化改善BGP(border gateway protocol)路由收敛.这种新机制把来自不同邻居的路由变化情况结合起来,利用BGP路由传播过程形成的路由相关性判断路由在网络中的稳定情况.时间窗口机制使BGP路由器能够更早地发现不稳定路由,优先将稳定路由选择为最优路由,终止路径搜索过程.模拟实验的结果表明,通过选择适当的参数,时间窗口机制能够大大缩短BGP路由收敛延时,减小收敛过程中的通信开销.而且,这种方法不需要在BGP的路由消息中增加额外的信息,因此容易在实际网络中逐步部署. Abstract:In this paper, a time window mechanism based on the penalty value of route flap damping is designed to improve routing convergence. This mechanism judges the route stability in the network from BGP (border gateway protocol) routes correlation by observing multiple routes received from different peers jointly. Then BGP speaker can find instable routes earlier and makes stable routes get the chance to be selected earlier in route selection, thus curtail path exploration. Simulation results prove that with proper parameters this method can reduce convergence delay and communication overhead obviously. Furthermore, without addition information in BGP Update message, time window mechanism is a practical method to be deployed in the Internet. 参考文献 相似文献 引证文献

On interdomain routing security and pretty secure BGP (psBGP)

It is well known that the Border Gateway Protocol (BGP), the IETF standard interdomain routing protocol, is vulnerable to a variety of attacks, and that a single misconfigured or malicious BGP speaker could result in large-scale service disruption. In this paper, we present Pretty Secure BGP (psBGP) ---a proposal for securing BGP, including an architectural overview, design details for significant aspects, and preliminary security and operational analysis. psBGP differs from other security proposals (e.g., S-BGP and soBGP) in that it makes use of a single-level PKI for AS number authentication, a decentralized trust model for verifying the propriety of IP prefix origin, and a rating-based stepwise approach for AS_PATH (integrity) verification. psBGP trades off the strong security guarantees of S-BGP for presumed-simpler operation, e.g., using a PKI with a simple structure, with a small number of certificate types, and of manageable size. psBGP is designed to successfully defend against various (nonmalicious and malicious) threats from uncoordinated BGP speakers, and to be incrementally deployed with incremental benefits.

Evaluation of efficient security for BGP route announcements using parallel simulation

The Border Gateway Protocol (BGP) determines how Internet traffic is routed throughout the entire world; malicious behavior by one or more BGP speakers could create serious security issues. Since the protocol depends on a speaker honestly reporting path information sent by previous speakers and involves a large number of independent speakers, the Secure BGP (S-BGP) approach uses public-key cryptography to ensure that a malicious speaker cannot fabricate this information. However, such public-key cryptography is expensive: S-BGP requires a digital signature operation on each announcement sent to each peer, and a linear (in the length of the path) number of verifications on each receipt. We use simulation of AS models derived from the Internet to evaluate the impact that the processing costs of cryptography have on BGP convergence time. As the size of these models grows, inherent memory requirements grow beyond what is normally available in serial computers, motivating us to use distributed memory cluster computers, just to hold the model state. We find that under heavy load the convergence time using ordinary S-BGP is significantly larger than BGP. We examine the impact of highly aggressive caching and pre-computation optimizations for S-BGP, and find that convergence time is much closer to BGP. However, these optimizations may be unrealistic, and are certainly expensive of memory. We consequently use the structure of BGP processing to design optimizations that reduce cryptographic overhead by amortizing the cost of private-key signatures over many messages. We call this method Signature-Amortization (S-A). We find that S-A provides as good or better convergence times as the highly optimized S-BGP, but without the cost and complications of caching and pre-computation. These experiments––whose memory demands easily exceed 10Gb––are made possible using parallel simulation. They show that it is is possible therefore to minimize the impact route validation has on convergence, by being careful with signatures, rather than consumptive of memory.