Provider Edge Routers Research Articles

Analysis of the vulnerability estimation and neighbor value prediction in autonomous systems.

The security within autonomous systems (AS)s is one of the important measures to keep network users safe and stable from the various type of Distributed Denial of Service (DDoS) attacks. Similar to the other existing attack types Internet control message protocol (ICMP) based attacks are remained open challenge on the Internet environment. In this study, we have proposed a method to estimate the vulnerability of 600 AS provider edge (PE) routers by sending ICMP packets and predicted AS neighbor values using least square regression (LSR) approach. The results of our study show that 265 AS PE routers are vulnerable due to ICMP flood attack from the 600 ASs which were analyzed. Additionally, we have predicted that about 60% of total AS neighbors will be reduced in the next 3 years. Our results indicate that some ASs still did not deploy the firewall system in the boundary of their networks. Similarly, we also observed that the majority of ASs which expected to have less neighbor values in the next 3 years is due to change their routing paths to find adjacent paths.

Analysis of BGP4 Peering Establishment Time on IPv6 Connection over 6PE and 6VPE

Nowadays, because of the exhaustion of IPv4 address space, IPv6 is increasingly being used on enterprise networks. Usually, an enterprise uses an MPLS network from a Service Provider to interconnect their IPv4 network sites. Although MPLS Service Providers mostly built their MPLS backbone based on IPv4, their MPLS backbone have the capability to transport IPv6 traffic of their customers. Two methods can be used by the MPLS Service Provider to connect its customer IPv6 network, which is 6PE (IPv6 Provider Edge Routers) and 6VPE (IPv6 VPN Provider Edge Router). Enterprises generally use a BGP routing protocol to interconnect their networks, and they need to use the best method that suits their requirement from their MPLS Service Provider to transport their IPv6 traffic (including the BGP protocol). The MPLS Service Providers need to consider the advantages and disadvantages of both methods. This paper illustrates the analysis of BGP4 (current BGP version) IPv6 peering establishment time over 6PE and 6VPE methods. The MPLS Service Providers can use the analysis results of this study to determine the suited method to interconnect its customers' IPv6 networks.

Analysis of BGP4 Peering Establishment Time on IPv6 Connection over 6PE and 6VPE

Nowadays, because of the exhaustion of IPv4 address space, IPv6 is increasingly being used on enterprise networks. Usually, an enterprise uses an MPLS network from a Service Provider to interconnect their IPv4 network sites. Although MPLS Service Providers mostly built their MPLS backbone based on IPv4, their MPLS backbone have the capability to transport IPv6 traffic of their customers. Two methods can be used by the MPLS Service Provider to connect its customer IPv6 network, which is 6PE (IPv6 Provider Edge Routers) and 6VPE (IPv6 VPN Provider Edge Router). Enterprises generally use a BGP routing protocol to interconnect their networks, and they need to use the best method that suits their requirement from their MPLS Service Provider to transport their IPv6 traffic (including the BGP protocol). The MPLS Service Providers need to consider the advantages and disadvantages of both methods. This paper illustrates the analysis of BGP4 (current BGP version) IPv6 peering establishment time over 6PE and 6VPE methods. The MPLS Service Providers can use the analysis results of this study to determine the suited method to interconnect its customers' IPv6 networks.

Design and analysis of optimization algorithms to minimize cryptographic processing in BGP security protocols

The Internet is subject to attacks due to vulnerabilities in its routing protocols. One proposed approach to attain greater security is to cryptographically protect network reachability announcements exchanged between Border Gateway Protocol (BGP) routers. This study proposes and evaluates the performance and efficiency of various optimization algorithms for validation of digitally signed BGP updates. In particular, this investigation focuses on the BGPSEC (BGP with SECurity extensions) protocol, currently under consideration for standardization in the Internet Engineering Task Force. We analyze three basic BGPSEC update processing algorithms: Unoptimized, Cache Common Segments (CCS) optimization, and Best Path Only (BPO) optimization. We further propose and study cache management schemes to be used in conjunction with the CCS and BPO algorithms. The performance metrics used in the analyses are: (1) routing table convergence time after BGPSEC peering reset or router reboot events and (2) peak-second signature verification workload. Both analytical modeling and detailed trace-driven simulation were performed. Results show that the BPO algorithm is 330% to 628% faster than the unoptimized algorithm for routing table convergence in a typical Internet core-facing provider edge router.

Core Backbone Convergence Mechanisms and Microloops Analysis

In this article we study approaches that can be used to minimise the convergence time, we also make a focus on microloops phenomenon, analysis and means to mitigate them. The convergence time reflects the time required by a network to react to a failure of a link or a router failure itself. When all nodes (routers) have updated their respective routing and forwarding databases, we can say the network has converged. This study will help in building real-time and resilient network infrastructure, the goal is to make any evenement in the core network, as transparent as possible to any sensitive and real-time flows. This study is also, a deepening of earlier works presented in (10) and (11). Keywords-component: FC(Fast-convergence); RSVP(ressource reservation protocol); LDP (Label Distribution Protocol); VPN(Virtual Private Network); LFA (loop free alternate); MPLS (Multiprotocol Label Switching); PIC(Protocol independent convergence); PE(Provider edge router); P(Provider core router ).

Scaling Virtual Private Networks

Many organizations purchase connectionless Virtual Private Network (VPN) services from a telecommunications service provider, who deploys a network of routers, interconnected by high bandwidth trunks, which serve thousands of customers. The nodes in a service provider network are Provider Edge routers (PEs), which store forwarding tables which dictate on which outgoing link to send an incoming packet addressed to a particular destination. In practice, router capacity may be limited by memory, bandwidth, or processing capacity for BGP (Border Gateway Protocol) sessions used to advertise addresses. We describe three techniques that help a service provider deploy a large-scale VPN service. The first technique shows how a service provider can deploy sets of routers, called “route reflector planes,” to advertise addresses when the number of addresses in the service provider network grows. The second technique, applicable when the number of BGP sessions is the limiting resource, is a method to enhance the network reliability at no additional cost, by having each customers forwarding table stored on only a small number of PEs. The third technique is a way to estimate the number of VPNs that can be handled by a PE, when memory is the limiting resource.

Scalability Considerations in BGP/MPLS IP VPNs

The scalability of the BGP/MPLS IP VPN solution is one of the main reasons for the wide deployment of this technology. This article first discusses the scaling properties of BGP/MPLS IP VPNs. Then, it explores more advanced topics, such as techniques for scaling the provider edge routers to support a large number of customers and enhancements for reducing the number of VPN route advertisements

The human heart

The Internet is subject to attacks due to vulnerabilities in its routing protocols. One proposed approach to attain greater security is to cryptographically protect network reachability announcements exchanged between Border Gateway Protocol (BGP) routers. This study proposes and evaluates the performance and efficiency of various optimization algorithms for validation of digitally signed BGP updates. In particular, this investigation focuses on the BGPSEC (BGP with SECurity extensions) protocol, currently under consideration for standardization in the Internet Engineering Task Force. We analyze three basic BGPSEC update processing algorithms: Unoptimized, Cache Common Segments (CCS) optimization, and Best Path Only (BPO) optimization. We further propose and study cache management schemes to be used in conjunction with the CCS and BPO algorithms. The performance metrics used in the analyses are: (1) routing table convergence time after BGPSEC peering reset or router reboot events and (2) peak-second signature verification workload. Both analytical modeling and detailed trace-driven simulation were performed. Results show that the BPO algorithm is 330% to 628% faster than the unoptimized algorithm for routing table convergence in a typical Internet core-facing provider edge router.