An optimized node selection method based on a BGP-iSec protocol partial deployment scene

Abstract

The application discloses an optimization node selection method based on a BGP-iSec protocol partial deployment scene, and comprises the following steps: in the first stage, three static topology features of nodes are calculated according to a key node selection algorithm, the three static topology features and AS node levels are proportionally weighted, the mixed weight of the nodes is calculated, and the candidate nodes are preliminarily determined; in the second stage, a greedy algorithm is adopted, the nodes with the maximum path coverage gain are selected from the candidate nodes according to the priority and added to a tentative deployment set, and the process is continued until the path coverage is stable or the number of nodes reaches the specified deployment cost. The application realizes the optimization of the defense effect of the path manipulation / prefix hijacking attack under the limited deployment cost by formulating the key AS node selection strategy.

Description

Technical Field

[0001] This invention belongs to the field of network security, and in particular relates to an optimized node selection method in a partial deployment scenario based on the BGP-iSec protocol. Background Technology

[0002] Border Gateway Protocol (BGP), as the core protocol for inter-domain routing on the Internet, has long faced various security threats such as path hijacking, route leakage, and attribute manipulation due to its lack of security considerations in its initial design.

[0003] The root causes of such BGP security issues mainly fall into three categories: 1. Security flaws at the BGP protocol layer: Traditional BGP protocols lack mechanisms for verifying the authenticity and integrity of routing information. 2. Routing data trustworthiness issues: Inconsistencies between the Internet Routing Registry (IRR) and Resource Key Infrastructure (RPKI) severely weaken defense effectiveness. 72% of entries in the IRR database are outdated, and RPKI deployment rates are insufficient and vary significantly by region. As of 2024, only 12.3%-30% of Autonomous Systems (AS) globally had fully deployed Route Origin Verification (ROV). 3. Single point of failure in the RPKI architecture: RPKI relies on a centralized repository and dependent parties to implement route origin verification, but the existing architecture has a single point of failure issue, which has limited certificate update throughput.

[0004] While the BGPsec protocol, proposed to address protocol-layer vulnerabilities, can protect autonomous system paths through digital signatures, its high computational requirements and need for network-wide deployment limit its actual defensive effectiveness. Furthermore, it does not support protection against route leakage and path / attribute manipulation. With the gradual deployment of ROV, attackers are shifting towards new post-ROV-era attacks (such as origin spoofing and first ASN stripping attacks). Existing BGP protocol protection systems (such as RPKI and BGPsec) are hampered by technological fragmentation, centralized architecture flaws, and protocol-layer vulnerabilities, making them ill-equipped to counter the attackers' continuously evolving tactics.

[0005] To address the two major deployment obstacles of BGPsec—high computational requirements and limited defensive effectiveness—Cameron Morris et al. proposed BGP-iSec, an improved protocol for BGPsec, in their paper "BGP-iSec: Improved Security of Internet Routing Against Post-ROV Attacks." As a next-generation protocol, BGP-iSec significantly improves security in certain deployment scenarios through mechanisms such as transitive signatures and integrity protection attributes.

[0006] Although BGP-iSec has made significant progress in protocol design, there are still research gaps in its optimization strategies for some deployment scenarios: existing studies all default to random deployment strategies for node selection, without considering the heterogeneity of network topology and node influence, and lack optimized deployment algorithms that balance deployment cost and defense performance.

[0007] Meanwhile, existing key node identification algorithms in the field of network security (such as betweenness centrality and PageRank) are mostly used in other scenarios (such as social networks or malware propagation suppression) and have not yet been deeply integrated with the protocol characteristics of BGP-iSec. Summary of the Invention

[0008] This invention provides an optimized node selection method for partial deployment scenarios based on the BGP-iSec protocol. By formulating a key AS node selection strategy, it achieves the best defense effect against path manipulation / prefix hijacking attacks with limited deployment costs.

[0009] An optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol includes the following steps: In the first stage, the three static topological features of the nodes are calculated according to the key node selection algorithm, and the three static topological features are weighted proportionally with the AS node level to calculate the mixed weight of the nodes and preliminarily determine the candidate nodes. In the second phase, a greedy algorithm is used to select the node with the greatest benefit to the current path coverage from the candidate nodes in order of priority and add it to the set to be deployed until the path coverage is stable or the number of nodes reaches the specified deployment cost.

[0010] Furthermore, the three static topological features include degree centrality, betweenness centrality, and compact centrality; Degree centrality measures a node's importance by calculating the number of its direct connections; betweenness centrality identifies bridge nodes in the network by calculating the frequency of a node's appearance in all shortest paths; and compact centrality reflects the closeness of a node to other nodes in the network by measuring the reciprocal of the average shortest path length from a node to all other nodes.

[0011] Furthermore, the AS node hierarchy is an inherent attribute type of AS nodes, including Tier-1, Tier-2, and Tier-3, which reflects the number and importance of this type of node in the network.

[0012] The weight parameters in the hybrid weight formula can be adjusted by the operator as needed, such as prioritizing the protection of Tier-1 nodes.

[0013] Furthermore, the specific process of the second phase is as follows: The calculation results of the first stage mixed weights are sorted in descending order, and the top n nodes are selected as candidate nodes and stored in the priority queue. Calculate the path coverage rate by determining the proportion of the length of protected paths to all paths in the overall topology map. Each loop proceeds sequentially: select k points, calculate path coverage, and add the best point to the set; until the number of nodes reaches the specified deployment cost, or adding more nodes does not further improve path coverage.

[0014] Furthermore, if the number of nodes to be deployed has not yet reached the deployment cost after the first two stages are completed, a post-processing optimization stage will be performed, specifically as follows: Divide the network topology into communities, identify boundary nodes, and gradually add boundary nodes according to their importance until the number of nodes reaches the deployment cost.

[0015] Furthermore, the network topology is divided into communities based on the Louvain community detection algorithm. The introduction of the community detection algorithm enhances the comprehensiveness of the defense, enabling it to cover cross-community attack paths and block the propagation of attacks between regions.

[0016] Furthermore, a boundary node is defined as a node that connects different communities, satisfying the following conditions: it has at least one edge pointing to other community nodes, and it has high betweenness centrality in the inter-community path.

[0017] Furthermore, when adding boundary nodes step by step according to importance, the boundary node that connects the most communities is selected first, followed by the node with the higher betweenness number within the community.

[0018] Compared with the prior art, the present invention has the following beneficial effects: In the first stage, this invention calculates three static topological features of nodes based on a key node selection algorithm, demonstrating a certain level of efficiency. In the second stage, a greedy algorithm is used to continuously approximate the global optimum, achieving theoretical optimality. Furthermore, each iteration dynamically adjusts the strategy based on the current coverage state, avoiding redundant deployments and exhibiting high adaptability. Experiments using real network topology data from CAIDA have verified that this optimized deployment algorithm significantly outperforms the random deployment algorithm in intercepting path manipulation / prefix hijacking attacks at deployment costs of 20% and 50%. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating an optimized node selection method in a partial deployment scenario based on the BGP-iSec protocol, according to an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of dynamic greedy iteration in an embodiment of the present invention. Detailed Implementation

[0021] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not constitute any limitation thereof.

[0022] This invention proposes an optimized node selection method for partial deployment scenarios based on the BGP-iSec protocol. The method is a three-stage optimized deployment algorithm based on static topology feature analysis (such as degree and betweenness centrality), dynamic greedy iterative strategy, and community detection algorithm. By quantifying the trade-off between attack interception rate and deployment cost, the method ultimately maximizes defense efficiency.

[0023] The method of this invention takes as input a directed graph of the AS node network topology and a specified maximum deployment cost (given as a percentage), and outputs a set of AS nodes to be deployed with the BGP-iSec protocol.

[0024] The design of the method of this invention is based on the following premises: 1. The BGP-iSec protocol relies on the public key (KAPK) assumption: its security depends on the proper functioning of the RPKI system. Similar to the RPKI deployment mechanism, AS nodes deploying BGP-iSec periodically download updated certificates and route authorization data (such as ROAs) from the RPKI repository. This mechanism ensures that each AS node deploying BGP-iSec can obtain the public key information and protocol support status of other deployed nodes in real time after enabling the protocol. Therefore, this invention is based on the following assumption: Global public key visibility: All AS nodes that deploy BGP-iSec and their public key information can be obtained by other nodes in a timely manner through the RPKI repository, and the public key distribution process is not affected by tampering or delay.

[0025] Key validity: The private key of the AS node was not leaked within its validity period, and the key rotation mechanism can resist long-term key cracking attacks. 3. Repository availability: The availability of the RPKI repository meets the real-time verification requirements of BGP-iSec.

[0026] 2. AS Node Path Selection Strategy: The path selection strategy under the BGP-iSec protocol must balance routing efficiency and security. Its decision logic is based on the following hierarchical priority: 1. Prefix Matching Priority: Follow the BGP longest prefix matching principle to ensure accurate routing of the destination IP address. 2. Business Relationship Priority: Among multiple paths matching the same prefix, prioritize the path from the customer (based on the Gao-Rexford model), then the peer, and lastly the path from the provider. 3. Path Length Second-Best: If multiple paths have the same business relationship, select the path with the shortest AS path length. 4. Security Policy Selection: The third priority has two options: security-never and security-third. security-never means no additional selection strategy is added at the security performance level, relying only on the first two layers, which simplifies the complexity of routing decisions. security-third means that when business relationships and path lengths are the same, the path with full BGP-iSec deployment is prioritized. Although this strategy can further improve security, its actual benefits are limited (the difference in defense effect between security-never and security-third is less than 5%), and it increases the risk of route oscillation. Since the critical node algorithm to be introduced later has already ensured the priority deployment of high-influence nodes through topology optimization, its path naturally has a higher security coverage. Therefore, security-never is used as the default strategy for real-time path selection.

[0027] 3. Attacker Models: To accurately evaluate the defensive effectiveness of the BGP-iSec deployment strategy, it is necessary to clearly define the attacker's capability boundaries. Common attacker models in the field of cyberspace security include global attackers, full attackers, and man-in-the-middle attackers. A global attacker can monitor or interfere with the entire network's communication, possessing the ability to listen to all network traffic and disrupt or manipulate any communication link. However, in real-world scenarios, such capabilities are limited by physical deployment and encrypted communication. A full attacker is defined as the strongest hypothetical attacker with unlimited computing resources and protocol knowledge. As a theoretical limit model, it is often used for theoretical analysis. Its capabilities can break any encryption and are typically used to prove the security of cryptographic schemes. A man-in-the-middle attacker is defined as an attacker who secretly intercepts or tampers with data between communicating parties. Its capabilities include: eavesdropping and tampering—intercepting BGP announcements passing through the node, tampering with AS paths, attributes (such as OTC), or prefix information; traffic hijacking—inducing downstream nodes to choose malicious paths by forging shorter paths or removing signatures; limited topology knowledge: knowing only the local network structure (such as directly connected neighbor relationships), rather than the entire network topology (distinguishing it from a global attacker). Since man-in-the-middle attacks are the primary means of implementing path manipulation and prefix hijacking, and are more closely aligned with post-ROV attack scenarios, this invention employs a man-in-the-middle attacker model to simulate path manipulation / prefix hijacking attacks in real-world scenarios. This means the attacker can control an intermediate node between the sender and the victim, and eavesdrop on and tamper with messages, as well as hijack traffic. Simultaneously, the limitations include: 1. The attacker cannot crack the RPKI certificate or the BGP-iSec signature algorithm (EdDSA), conforming to realistic cryptographic security assumptions. 2. The number of AS nodes controlled by the attacker is limited (single-node or multi-node collusion), and their influence is constrained by the deployment location (e.g., hub status).

[0028] The design principle of the method of this invention is closely integrated with the protocol mechanism of transitive signature. The following is a brief analysis of the protocol characteristics: Traditional BGPsec protocols protect the integrity of the AS path through hop-by-hop digital signatures. Its core process includes: Signature generation: When ASX i To the neighbor ASX i+1 When sending BGP route advertisements or packets, the following is signed using its unique private key: AS path sequence (X1, X2, ..., X i Next jump AS (X) i+1 ), prefix (p), upstream signature chain (σ) 1→2 ,…, σ i-1→i The signature result is denoted as σ. i→i+1 And append it to the data packet.

[0029] Signature verification: Recipient ASX i+1The validity of all upstream signatures needs to be verified, as well as whether the origin of prefix p, AS X1, is authorized by RPKI / ROV.

[0030] Non-transitivity limitation: Signatures are only transmitted between adjacent AS nodes that have both deployed the BGPsec protocol. That is, when a data packet flows through a node that has not deployed the BGPsec protocol, this node cannot perceive the signature field of the upstream node and cannot add an encrypted signature to the next path segment. Macroscopically, this means the signature is "discarded" when passing through this node. Therefore, regardless of whether the data packet flows through a node without BGPsec deployment or an attacker, the signature field will be lost, and the receiving end cannot determine whether the data packet may have been attacked based on the signature integrity. This degradation attack allows attackers to induce traffic hijacking by forging shorter paths, leading to traffic interception, attribute / content tampering, or man-in-the-middle attacks, directly reducing the BGPsec protocol's defense capabilities against path manipulation attacks.

[0031] In contrast, the BGP-iSec protocol employs a mandatory transitive signature mechanism. Its core principle is that when a data packet flows through a node that has not deployed BGP-iSec, although that node cannot add a signature to the next segment of the path, it can still fully preserve the upstream signature and continue to transmit it downstream. Therefore, data packets flowing through undeployed nodes and attackers have completely different effects. The receiving end can determine whether the received data packet is likely to be attacked by checking whether the signatures of all known nodes with BGP-iSec deployed along the path have been transmitted, thus successfully avoiding downgrade attacks.

[0032] By analyzing the above scenarios, this transitivity is projected onto a specific path manipulation attack scenario. In a path manipulation attack scenario, when an attacker hijacks traffic and maliciously tampers with attributes or content, the receiving end can detect whether all nodes along the entire path that have deployed BGP-iSec have signed their data packets, thereby deciding whether to drop or accept the data packets.

[0033] This leads to the conclusion that the core characteristic of the BGP-iSec protocol at the target algorithm level is that, ideally, all downstream nodes of the currently deployed BGP-iSec node should carry digital signatures. In practical applications, Cameron Morris et al. proposed in their paper that, based on measurements, approximately 2% of AS nodes not deployed with BGP-iSec will discard transitive signatures with unknown properties. This scenario was simulated using a random algorithm in subsequent experimental verification. Based on this characteristic, and considering the business relationships among AS nodes in the network topology, the target algorithm should cover as many downstream AS nodes as possible while minimizing deployment costs.

[0034] like Figure 1As shown, the implementation process of the method of the present invention is divided into three stages: static topological feature screening stage, dynamic greedy iteration stage, and post-processing optimization stage based on community detection.

[0035] The static topology feature screening stage initially determines candidate nodes based on three common key node selection algorithms in network security and graph theory, as well as the mixed weights of nodes calculated at the AS node level. The dynamic greedy iteration stage adopts a greedy algorithm to gradually select the nodes that contribute the most to the current defense performance from the candidate nodes according to priority and add them to the deployment set until the defense performance is basically stable or the number of nodes reaches the specified deployment cost. The post-processing optimization stage based on community detection is an optional stage. When the number of nodes to be deployed has not yet reached the deployment cost after the completion of the first two stages, the network topology graph is divided into communities, boundary nodes are identified and added gradually according to importance until the number of nodes reaches the deployment cost.

[0036] Phase 1 involves static topology feature selection, which uses three common static topology features in graph theory and the AS node level to calculate the mixed weights of nodes.

[0037] Degree centrality: This measure of a node's importance is determined by the number of its direct connections. Its core characteristic is that it reflects a node's local influence. It is computationally simple and suitable for quickly identifying highly connected nodes. Its mathematical definition is as follows: ; in, For nodes The number of neighbors, This represents the total number of network nodes. High-level nodes are typically located in the network core, controlling a large number of direct-connect paths; their failure can trigger cascading failures.

[0038] Betweenness centrality: Identifies "bridge nodes" in a network by calculating the frequency of a node's occurrence in all shortest paths. Its core characteristic is a focus on the global control exerted by a node. Its mathematical definition is as follows: ; in, For nodes arrive The total number of shortest paths, For the process The number of paths. High betweenness nodes are usually the "bridges" that cross-regional traffic must pass through.

[0039] Tight centrality: This measure is the reciprocal of the average shortest path length from a given node to all other nodes in a network, reflecting the degree of "tightness" between that node and the other nodes in the network. Its mathematical definition is as follows: ; in, The total number of network nodes. Represents a node arrive The shortest path length, where the denominator represents the node. The sum of the shortest paths to all other nodes.

[0040] AS node hierarchy: This refers to the inherent attribute type of AS nodes, including Tier-1, Tier-2, and Tier-3, which can reflect the number and importance of this type of node in the network.

[0041] The above four indicators are weighted proportionally to obtain the mixed weight. In specific applications, the proportion of each indicator can be adjusted according to network requirements. The formula for calculating the mixed weight is as follows: .

[0042] Phase two involves dynamic greedy iteration. This phase aims to dynamically select the AS node that contributes the most to improving transitive signature coverage. Its core idea is as follows: Figure 2 As shown: In each round, the node that maximizes the current defense coverage (defined as the proportion of paths protected by signature) is selected, and the global optimal solution is approximated through local optimal selection. Figure 2 In the diagram, the circular area represents nodes that can be considered "secure" according to the signature transmission mechanism.

[0043] This phase fully utilizes the signature transmission feature of BGP-iSec, meaning that the deployed nodes can protect their downstream paths. Specific steps include: Step 1: Initialize the candidate node priority queue. Sort the calculation results of the phase 1 mixed weights in descending order, and select the top n nodes as candidate nodes to store in the priority queue.

[0044] Step 2: Iteratively select the optimal node. Define a function for calculating path coverage: the proportion of the length of protected paths (ideally, the downstream of the deployed node is considered safe) to all paths in the overall topology. Each loop proceeds sequentially: select k nodes, calculate path coverage, add the optimal node to the set, until the number of nodes reaches the specified deployment cost, or adding more nodes provides no further benefit to path coverage. The iteration terminates when the number of selected nodes reaches the budget (deployedNodes.size() >= budget * totalNodes) or the queue is empty. In each round of the loop, the k candidate nodes with the highest weights are retrieved from the queue (e.g., k=20). Next, calculate the coverage gain—simulating adding candidate node u to the current deployment set deployedNodes, calculating the new coverage newCoverage. Gain = newCoverage - currentCoverage. Record the node with the largest gain in the current round, bestNode, and add it to the deployment set.

[0045] Phase three involves post-processing optimization based on community detection. After the greedy iterative selection of key nodes, if the given deployment cost is still greater than the number of nodes already added to the set, then Phase three post-processing begins. The goal of Phase three is to further optimize the deployment strategy through community structure analysis, addressing the following issues: insufficient coverage of attack paths between communities (i.e., the greedy algorithm may ignore bridge nodes connecting different communities, resulting in inadequate protection of cross-community attack paths); and missing local path redundancy (i.e., key paths within the same community may not be fully covered, requiring supplementary deployment to improve local defense robustness).

[0046] Step 1: Community Detection (Louvain Algorithm). This function takes a directed graph G(V,E) as input, where edge weights can be based on business relationships (customer-provider / peer) or flow patterns between ASs. The Louvain algorithm (based on maximizing modularity) is used to divide the network into multiple communities {C1, C2, ..., Ck}. The function output is the community partitioning results, for example: Community 1: {AS1, AS2, AS3}; Community 2: {AS4, AS5}.

[0047] Step 2: Identify community boundary nodes. A boundary node is defined as a node connecting different communities that satisfies the following conditions: it has at least one edge pointing to other community nodes, and it has high betweenness centrality in the inter-community paths. Boundary nodes are selected based on this logic and the results of the previous step.

[0048] Step 3: Replenish border nodes. When the number of nodes selected by the greedy algorithm does not reach the budget, prioritize replenishing border nodes. First, select the border node that connects the most communities, and then select the node with the higher betweenness within the community.

[0049] This stage is optional. Since community detection takes more time than algorithms such as degree and betweenness centrality, it is set as the third stage to supplement and post-process the first two stages. The code in this stage will be executed only if the number of nodes in the candidate set still does not reach the given deployment cost after the first two stages are completed.

[0050] The embodiments described above provide a detailed explanation of the technical solutions and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for optimizing node selection in a partial deployment scenario based on the BGP-iSec protocol, characterized in that, Includes the following steps: In the first stage, the three static topological features of the nodes are calculated according to the key node selection algorithm, and the three static topological features are weighted proportionally with the AS node level to calculate the mixed weight of the nodes and preliminarily determine the candidate nodes. In the second phase, a greedy algorithm is used to select the node with the greatest benefit to the current path coverage from the candidate nodes in order of priority and add it to the set to be deployed until the path coverage is stable or the number of nodes reaches the specified deployment cost.

2. The optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol as described in claim 1, characterized in that, The three static topological features include degree centrality, betweenness centrality, and compact centrality; Degree centrality measures a node's importance by calculating the number of its direct connections; betweenness centrality identifies bridge nodes in the network by calculating the frequency of a node's appearance in all shortest paths; and compact centrality reflects the closeness of a node to other nodes in the network by measuring the reciprocal of the average shortest path length from a node to all other nodes.

3. The optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol as described in claim 1, characterized in that, AS node hierarchy is an inherent attribute type of AS node, including Tier-1, Tier-2, and Tier-3, which reflects the number and importance of nodes of this type in the network.

4. The optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol as described in claim 1, characterized in that, The specific process of the second stage is as follows: The calculation results of the first stage mixed weights are sorted in descending order, and the top n nodes are selected as candidate nodes and stored in the priority queue. Calculate the path coverage rate by determining the proportion of the length of protected paths to all paths in the overall topology map. Each loop proceeds sequentially: select k points, calculate path coverage, and add the best point to the set; until the number of nodes reaches the specified deployment cost, or adding more nodes does not further improve path coverage.

5. The optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol as described in claim 1, characterized in that, If, after the first two phases are completed, the number of nodes to be deployed has not yet reached the deployment cost, a post-processing optimization phase will be performed, specifically: Divide the network topology into communities, identify boundary nodes, and gradually add boundary nodes according to their importance until the number of nodes reaches the deployment cost.

6. The optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol as described in claim 5, characterized in that, The Louvain algorithm for community detection is used to divide the network topology graph into communities.

7. The optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol as described in claim 5, characterized in that, A boundary node is defined as a node that connects different communities and satisfies the following conditions: it has at least one edge pointing to other community nodes and has high betweenness centrality in the inter-community path.

8. The optimized node selection method for a partial deployment scenario based on the BGP-iSec protocol as described in claim 5, characterized in that, When adding boundary nodes step by step according to importance, first select the boundary node that connects the most communities, and then select the node with the higher betweenness within the community.

Images