Optimized node selection method based on BGP-iSec protocol partial deployment scene

Abstract

The invention discloses an optimized node selection method based on a BGP-iSec protocol partial deployment scene, which comprises the following steps of: in a first stage, calculating three static topological characteristics of nodes according to a key node selection algorithm, weighting the three static topological characteristics and AS node levels in proportion, calculating a mixed weight of the nodes, and selecting the three static topological characteristics according to the mixed weight; preliminarily determining candidate nodes; and in the second stage, a greedy algorithm is adopted, the node with the maximum gain for the current path coverage rate is gradually selected from the candidate nodes according to the priority and added into the to-be-deployed set until the path coverage rate is stable or the number of the nodes reaches the specified deployment cost. According to the method, the key AS node selection strategy is formulated, so that the defense effect of the path manipulation / prefix hijacking attack is optimized under the limited deployment cost.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to an optimized node selection method based on a BGP-iSec protocol partial deployment scenario. Background Art

[0002] The Border Gateway Protocol (BGP), as the core protocol for inter-domain routing on the Internet, has long faced various security threats such as path hijacking, route leakage, and attribute manipulation due to the lack of security considerations at its initial design.

[0003] The root causes of BGP security issues such as these are mainly concentrated in the following three aspects: 1. Security flaws in the BGP protocol layer: The traditional BGP protocol lacks a verification mechanism for the authenticity and integrity of routing information. 2. Routing data credibility issues: The inconsistency between the Internet Routing Registry (IRR) and the Resource Public Key Infrastructure (RPKI) seriously weakens the defense effect. 72% of the entries in the IRR database are outdated, the RPKI deployment rate is insufficient and there are significant regional differences. As of 2024, only 12.3%-30% of Internet Autonomous Systems (AS) worldwide will have fully deployed Route Origin Verification (ROV). 3. Single point of failure in the RPKI architecture: RPKI relies on centralized repositories and relying parties to implement route origin verification, but the existing architecture has a single point of failure problem that has limited the certificate renewal throughput.

[0004] While BGPsec, proposed to address protocol-layer vulnerabilities, can protect autonomous system paths through digital signatures, its high computational requirements and network-wide deployment limit its effectiveness. Furthermore, it lacks protection against route leaks and path / attribute manipulation. With the gradual deployment of ROVs, attackers are turning to new post-ROV attacks (such as forged origin hijacking and first ASN stripping). Existing BGP protection systems (such as RPKI and BGPsec) are limited by technological fragmentation, centralized architecture flaws, and protocol-layer vulnerabilities, making them incapable of countering attackers' evolving tactics.

[0005] To address the two major deployment obstacles of BGPsec: its high computational requirements and limited defensive effectiveness, Cameron Morris et al. proposed BGP-iSec, an improved version of BGPsec, in "BGP-iSec: Improved Security of Internet Routing Against Post-ROV Attacks." As a next-generation protocol, BGP-iSec significantly improves security in certain deployment scenarios through mechanisms such as transitive signatures and integrity protection attributes.

[0006] Although BGP-iSec has made significant progress in protocol design, there are still research gaps in its optimization strategies for some deployment scenarios: existing studies all default to using a random deployment strategy for node selection, without considering the heterogeneity of network topology and node influence, and lack an optimized deployment algorithm that balances deployment cost and defense performance.

[0007] At the same time, existing key node identification algorithms in the field of network security (such as betweenness centrality and PageRank) are mostly used in other scenarios (such as social networks or malware propagation suppression) and have not yet been deeply integrated with the protocol characteristics of BGP-iSec. Summary of the Invention

[0008] The present invention provides an optimized node selection method based on a partial deployment scenario of the BGP-iSec protocol, which optimizes the defense effect against path manipulation / prefix hijacking attacks under limited deployment costs by formulating a key AS node selection strategy.

[0009] A method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol includes the following steps: In the first stage, the three static topological features of the nodes are calculated according to the key node selection algorithm. The three static topological features are proportionally weighted with the AS node level to calculate the node's mixed weight and preliminarily determine the candidate nodes. In the second stage, a greedy algorithm is used to gradually select the nodes with the largest gain in current path coverage from the candidate nodes according to priority and add them to the proposed deployment set until the path coverage is stable or the number of nodes reaches the specified deployment cost.

[0010] Furthermore, the three static topological features include degree centrality, betweenness centrality, and closeness centrality; Among them, degree centrality measures the importance of a node by calculating the number of direct connections of the node; betweenness centrality identifies bridge nodes in the network by calculating the frequency of occurrence of the node in all shortest paths; closeness centrality reflects the closeness of a node with other nodes in the network by measuring the inverse of the average shortest path length from a node to all other nodes in the network.

[0011] Furthermore, the AS node level is an inherent attribute type of the AS node, including Tier-1, Tier-2, and Tier-3, which is used to reflect the number and importance of this type of node in the network.

[0012] The weight parameters in the hybrid weight formula can be adjusted by operators as needed, such as prioritizing the protection of Tier-1 nodes.

[0013] Furthermore, the specific process of the second stage is: Arrange the calculation results of the first stage mixed weight in descending order, select the first n nodes as candidate nodes and store them in the priority queue; Calculate the ratio of protected path length to all paths in the overall topology map and calculate the path coverage. Each loop is performed in sequence: k points are selected, path coverage is calculated, and the best one is added to the set; until the number of nodes reaches the specified deployment cost, or continuing to add nodes does not further improve the path coverage.

[0014] Furthermore, after the first two phases are completed, if the number of nodes to be deployed has not yet reached the deployment cost, the post-processing optimization phase is carried out, specifically: Perform community division on the network topology graph, identify boundary nodes, and gradually add boundary nodes according to their importance until the number of nodes reaches the deployment cost.

[0015] Furthermore, the network topology is divided into communities based on the Louvain community detection algorithm. The introduction of the community detection algorithm enhances the comprehensiveness of the defense, enabling it to cover cross-community attack paths and block the spread of attacks between regions.

[0016] Furthermore, boundary nodes are defined as nodes connecting different communities, which satisfy the following requirements: there is at least one edge pointing to other community nodes and they have high betweenness centrality in the inter-community paths.

[0017] Furthermore, when adding boundary nodes step by step according to their importance, the boundary nodes that connect the most communities are selected first, and then the nodes with higher betweenness within the community are selected.

[0018] Compared with the prior art, the present invention has the following beneficial effects: In the first phase, the present invention calculates three static topological characteristics of nodes based on a key node selection algorithm, achieving a certain degree of efficiency. In the second phase, a greedy algorithm is used to continuously approximate the global optimal solution, achieving theoretical optimality. Each iteration dynamically adjusts the strategy based on the current coverage status, avoiding redundant deployment and demonstrating high adaptability. Experimental verification using CAIDA real-world network topology data demonstrates that the optimized deployment algorithm significantly outperforms the random deployment algorithm in intercepting path manipulation / prefix hijacking attacks at both 20% and 50% deployment costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of a method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to an embodiment of the present invention.

[0020] Figure 2 Schematic diagram of dynamic greedy iteration in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The present invention will be described in further detail below with reference to the accompanying drawings and examples. It should be noted that the following examples are intended to facilitate understanding of the present invention and do not have any limiting effect on the present invention.

[0022] The embodiment of the present invention proposes an optimized node selection method for partial deployment scenarios of the BGP-iSec protocol. This method uses a three-stage optimized deployment algorithm based on static topology feature analysis (such as degree and betweenness centrality), a dynamic greedy iteration strategy, and a community detection algorithm. By quantifying the trade-off between attack interception rate and deployment cost, it ultimately maximizes defense efficiency.

[0023] The input of the method of the present invention is a directed graph of the AS node network topology and a specified maximum deployment cost (given in percentage form), and the output is a set of AS nodes where the BGP-iSec protocol is to be deployed.

[0024] The design of the method of the present invention is based on the following assumptions: 1. Known Public Key (KAPK) Assumption: The security of the BGP-iSec protocol relies on the proper functioning of the RPKI system. Similar to the RPKI deployment mechanism, AS nodes deploying BGP-iSec periodically download updated certificates and routing authorization data (such as ROA) from the RPKI repository. This mechanism ensures that each AS node deploying BGP-iSec can obtain the public key information and protocol support status of other AS nodes in real time after the protocol is enabled. Therefore, this invention is based on the following assumptions: Global public key visibility: All AS nodes deploying BGP-iSec and their public key information can be promptly obtained by other nodes through the RPKI repository, and the public key distribution process is not affected by tampering or delay.

[0025] Key validity: The AS node's private key has not been leaked within its validity period, and the key rotation mechanism is able to resist long-term key cracking attacks. 3. Repository availability: The availability of the RPKI repository meets the real-time verification requirements of BGP-iSec.

[0026] 2. AS Node Path Selection Strategy: The path selection strategy under the BGP-iSec protocol must balance routing efficiency and security. Its decision-making logic is based on the following hierarchical priorities: 1. Prefix Match Priority: This adheres to the BGP longest prefix match principle to ensure accurate routing to the destination IP address. 2. Business Relationship Priority: Among multiple paths matching the same prefix, the path from the customer is prioritized (according to the Gao-Rexford model), followed by the path from the peer, and finally the path from the provider. 3. Path Length Secondary Priority: If multiple paths have the same business relationship, the path with the shortest AS path length is selected. 4. Security Policy Selection: The third priority has two options: security-never and security-third. security-never eliminates additional security performance and relies solely on the first two layers, simplifying routing decision complexity. security-third prioritizes paths with BGP-iSec deployed throughout the entire path when both the business relationship and path length are the same. While this strategy can further improve security, its actual benefits are limited (the difference in protection effectiveness compared to security-never is less than 5%) and it increases the risk of route flapping. Because the key node algorithm to be introduced later uses topology optimization to prioritize the deployment of high-impact nodes, their paths naturally have higher security coverage. Therefore, security-never is used as the default policy for real-time path selection.

[0027] 3. Attacker Model: To accurately evaluate the defensive effectiveness of BGP-iSec partial deployment strategies, it is necessary to clearly define the attacker's capabilities. Common attacker models in cyberspace security include global attackers, complete attackers, and man-in-the-middle attackers. A global attacker can monitor or disrupt communications across the entire network, possessing the ability to eavesdrop on all network traffic and disrupt or manipulate any communication link. However, in real-world scenarios, such capabilities are limited by physical deployment and encrypted communications. A complete attacker is defined as the strongest hypothetical attacker with unlimited computing resources and protocol knowledge. This theoretical limit model is often used in theoretical analysis, capable of breaking any encryption and often used to prove the security of cryptographic schemes. A man-in-the-middle attacker is defined as an attacker who secretly intercepts or tampers with data between communicating parties. Capabilities include: eavesdropping and tampering—intercepting BGP advertisements passing through a node and manipulating AS paths, attributes (such as OTC), or prefix information; traffic hijacking—forging shorter paths or removing signatures to induce downstream nodes to choose malicious paths; and limited topology knowledge: only knowing the local network structure (such as directly connected neighbor relationships) rather than the entire network topology (distinguishing from a global attacker). Because man-in-the-middle attacks are the primary means of path manipulation and prefix hijacking, and are more relevant to post-ROV attack scenarios, this paper employs a man-in-the-middle attacker model to simulate real-world path manipulation / prefix hijacking attacks. Specifically, the attacker is able to control an intermediate node between the sender and the victim, allowing them to eavesdrop on and tamper with messages, as well as hijack traffic. Furthermore, these attacks are subject to the following constraints: 1. RPKI certificates or the BGP-iSec signature algorithm (EdDSA) cannot be cracked, conforming to real-world cryptographic security assumptions. 2. The attacker's control over a limited number of AS nodes (either a single node or colluding with multiple nodes) limits their influence by their deployment location (e.g., centrality).

[0028] The design principle of the method of the present invention is closely integrated with the protocol mechanism of transitive signature. The following is a brief analysis of the protocol characteristics: Traditional BGPsec protects the integrity of AS paths through hop-by-hop digital signatures. Its core process includes: Signature generation: When AS X i To the neighbor AS X i+1 When sending BGP route advertisements or data packets, the user uses its unique private key to sign the following: AS path sequence (X1, X2, ..., X i ), next hop AS (X i+1 ), prefix (p), upstream signature chain (σ 1→2 ,…, σ i-1→i ). The signature result is recorded as σ i→i+1 , and appended to the data packet.

[0029] Signature verification: Receiver AS X i+1The validity of all upstream signatures needs to be verified, and whether the origin AS X1 of prefix p is authorized by RPKI / ROV.

[0030] Non-transitive restriction: Signatures are only transmitted between adjacent AS nodes that have both deployed the BGPsec protocol. That is, when a data packet flows through a node that has not deployed the BGPsec protocol, the node cannot perceive the signature field of the upstream node and cannot add an encrypted signature to the next segment of the path. The macro manifestation is that the signature is "discarded" when passing through the node. Therefore, whether the data packet flows through an undeployed node or an attacker, the signature field will be lost, and the receiving end cannot determine whether the data packet may have been attacked based on the signature integrity. This downgrade attack allows attackers to induce traffic hijacking by forging a shorter path, resulting in traffic interception, attribute / content tampering, or man-in-the-middle attacks, which directly reduces the BGPsec protocol's defense capabilities against attacks such as path manipulation.

[0031] In contrast, BGP-iSec uses a mandatory transitive signature mechanism. The core principle is that when a packet passes through a node without BGP-iSec, while that node cannot add a signature to the next segment of the path, it can still retain the upstream signature and pass it downstream. Therefore, packets passing through undeployed nodes and attackers produce completely different effects. The receiving end can determine whether the received packet is vulnerable to attack by checking whether the signatures of all known BGP-iSec nodes along the path have been passed down, thus successfully preventing downgrade attacks.

[0032] Through analysis of the above scenarios, this transitivity is applied to specific path manipulation attack scenarios. In these scenarios, when an attacker hijacks traffic and maliciously tampers with attributes or content, the receiver can detect whether all nodes along the entire path that have deployed BGP-iSec have signed the signature, thereby deciding whether to discard or accept the data packet.

[0033] This summarizes the core characteristic of the BGP-iSec protocol at the target algorithm level: starting from the currently deployed BGP-iSec node, ideally, all downstream nodes can carry digital signatures. In real-world applications, Cameron Morris et al. reported in their paper that, based on measurements, approximately 2% of AS nodes not deployed with BGP-iSec discard these transitive signatures with unknown attributes. This situation was simulated using a randomized algorithm in subsequent experimental verification. Based on this characteristic and considering the business relationships between AS nodes in the network topology, the target algorithm should cover as many downstream AS nodes as possible while minimizing deployment costs.

[0034] like Figure 1As shown in FIG, the implementation process of the method of the present invention is divided into three stages: a static topology feature screening stage, a dynamic greedy iteration stage, and a post-processing optimization stage based on community detection.

[0035] In the static topology feature screening phase, candidate nodes are preliminarily determined based on three common key node selection algorithms in the fields of network security and graph theory, as well as the mixed weights of AS node-level computation nodes. In the dynamic greedy iteration phase, a greedy algorithm is used to gradually select nodes that contribute most to the current defense performance from the candidate nodes according to their priority and add them to the set of nodes to be deployed until the defense performance is basically stable or the number of nodes reaches the specified deployment cost. The post-processing optimization phase based on community detection is optional. When the first two phases are completed and the number of nodes to be deployed has not yet reached the deployment cost, the network topology graph is divided into communities, boundary nodes are identified, and they are gradually added according to their importance until the number of nodes reaches the deployment cost.

[0036] Phase 1 is the static topology feature screening, which uses the following three common static topology features in the field of graph theory and the mixed weights of the AS node level calculation nodes.

[0037] Degree centrality: measures the importance of a node by calculating the number of direct connections it has. Its core feature is that it can reflect the local influence of a node. It is simple to calculate and is suitable for quickly identifying highly connected nodes. Its mathematical definition is as follows: ; in, For nodes The number of neighbors, is the total number of network nodes. Nodes with high degrees of probability are usually located in the core of the network, controlling a large number of direct paths. Their failure may cause cascading failures.

[0038] Betweenness centrality: This method identifies “bridge nodes” in a network by calculating the frequency of a node’s appearance in all shortest paths. Its core characteristic is that it focuses more on the node’s global control power. Its mathematical definition is as follows: ; in, For nodes arrive The total number of shortest paths, For passing Nodes with high betweenness are usually the “bridges” that cross-region traffic must pass through.

[0039] Closeness centrality: It reflects the "closeness" of a node to other nodes in the network by measuring the inverse of the average shortest path length from a node to all other nodes in the network. Its mathematical definition is as follows: ; in, is the total number of network nodes, Representation node arrive The shortest path length, the denominator represents the node The sum of the shortest paths to all other nodes.

[0040] AS node level: This is an inherent attribute type of an AS node, including Tier-1, Tier-2, and Tier-3, which can reflect the number and importance of this type of node in the network.

[0041] The above four indicators are weighted proportionally to obtain the hybrid weight. In specific applications, the proportion of each indicator can be adjusted according to network requirements. The hybrid weight calculation formula is as follows: .

[0042] Phase 2 is dynamic greedy iteration. This phase aims to dynamically select the AS node that contributes most to improving the coverage of transitive signatures. Its core idea is as follows: Figure 2 As shown: In each round, the node that maximizes the current defense coverage (defined as the proportion of paths protected by signatures) is selected, and the global optimal solution is approached through local optimal selection. Figure 2 In the figure, the circle range indicates that the nodes within the range can be considered "safe" according to the transfer signature mechanism.

[0043] This phase fully utilizes the transfer signature feature of BGP-iSec, which means that the deployed node can protect its downstream path. The specific steps include: Step 1: Initialize the candidate node priority queue. Arrange the results of the mixed weight calculation in stage 1 in descending order, select the first n nodes as candidate nodes and store them in the priority queue.

[0044] Step 2: Iteratively select the optimal node. Set a function for calculating path coverage: that is, calculate the ratio of protected path lengths (ideally, paths downstream of the deployed node are considered safe) to all paths in the entire topology. Each loop proceeds sequentially: select k nodes, calculate path coverage, and add the optimal node to the set until the number of nodes reaches the specified deployment cost or further node additions do not improve path coverage. The iteration terminates when the number of selected nodes reaches the budget (deployedNodes.size() >= budget * totalNodes) or the queue is empty. Each round in the loop, select the k candidate nodes with the highest weights from the queue (for example, k = 20). Next, calculate the coverage gain for each node—simulating adding candidate node u to the current deployed set deployedNodes and calculating the new coverage newCoverage. Gain gain = newCoverage - currentCoverage. Record the node with the highest gain in the current round, bestNode, and add it to the deployed set.

[0045] Phase three involves post-processing optimization based on community detection. After greedy iterative selection of key nodes, if the given deployment cost is still greater than the number of nodes already added to the set, the system enters phase three post-processing. The goal of phase three is to further optimize the deployment strategy through community structure analysis to address issues such as insufficient coverage of inter-community attack paths (the greedy algorithm may ignore bridge nodes connecting different communities, resulting in inadequate protection of cross-community attack paths); and lack of local path redundancy (the critical paths within the same community may not be fully covered, requiring additional deployment to improve local defense robustness).

[0046] Step 1: Community Detection (Louvain Algorithm). This function takes as input a directed AS graph G(V,E), where edge weights can be based on inter-AS business relationships (customer-provider / peer) or traffic patterns. Using the Louvain algorithm (based on maximizing modularity), the network is partitioned into multiple communities {C1, C2, ..., Ck}. The function outputs the resulting community partitioning, for example: Community 1: {AS1, AS2, AS3}; Community 2: {AS4, AS5}.

[0047] Step 2: Identify community boundary nodes. A boundary node is defined as a node connecting different communities. It must have at least one edge pointing to another community node and have high betweenness centrality in the inter-community paths. Filter out boundary nodes based on this logic and the results of the previous step.

[0048] Step 3: Deploy additional border nodes. If the number of nodes selected by the greedy algorithm does not meet the budget, prioritize adding border nodes. First, select border nodes that connect to the most communities, followed by nodes with higher betweenness within the community.

[0049] This stage is optional. Since community detection is more time-consuming than degree, betweenness centrality and other algorithms, the third stage in its setting is used to supplement and post-process the first two stages. The code of this stage will be executed only if the number of nodes in the candidate set still does not reach the given deployment cost after the first two stages.

[0050] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol, characterized in that: The following steps are involved: In the first stage, the three static topological features of the nodes are calculated according to the key node selection algorithm. The three static topological features are proportionally weighted with the AS node level to calculate the node's mixed weight and preliminarily determine the candidate nodes. In the second stage, a greedy algorithm is used to gradually select the nodes with the largest gain in current path coverage from the candidate nodes according to priority and add them to the proposed deployment set until the path coverage is stable or the number of nodes reaches the specified deployment cost.

2. The method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to claim 1, characterized in that: The three static topological features include degree centrality, betweenness centrality, and closeness centrality; Among them, degree centrality measures the importance of a node by calculating the number of direct connections of the node; betweenness centrality identifies bridge nodes in the network by calculating the frequency of occurrence of the node in all shortest paths; closeness centrality reflects the closeness of a node with other nodes in the network by measuring the inverse of the average shortest path length from a node to all other nodes in the network.

3. The method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to claim 1, characterized in that: AS node levels are inherent attribute types of AS nodes, including Tier-1, Tier-2, and Tier-3, and are used to reflect the number and importance of this type of node in the network.

4. The method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to claim 1, characterized in that: The specific process of the second stage is: Arrange the calculation results of the first stage mixed weight in descending order, select the first n nodes as candidate nodes and store them in the priority queue; Calculate the ratio of protected path length to all paths in the overall topology map and calculate the path coverage. Each loop is performed in sequence: k points are selected, path coverage is calculated, and the best one is added to the set; until the number of nodes reaches the specified deployment cost, or continuing to add nodes does not further improve the path coverage.

5. The method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to claim 1, characterized in that: After the first two phases are completed, if the number of nodes to be deployed has not yet reached the deployment cost, the post-processing optimization phase is carried out, specifically: Perform community division on the network topology graph, identify boundary nodes, and gradually add boundary nodes according to their importance until the number of nodes reaches the deployment cost.

6. The method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to claim 5, characterized in that: The network topology graph is divided into communities based on the Louvain community detection algorithm.

7. The method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to claim 5, characterized in that: Boundary nodes are defined as nodes connecting different communities, satisfying the following conditions: there is at least one edge pointing to other community nodes and they have high betweenness centrality in the inter-community paths.

8. The method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol according to claim 5, characterized in that: When adding boundary nodes step by step according to their importance, the boundary nodes that connect the most communities are selected first, and the nodes with higher betweenness within the community are selected secondly.

Images