ASBR Inter-AS Link Label Spoofing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Inter-autonomous system (AS) links in MPLS VPNs are vulnerable to label spoofing, which compromises data plane security, especially when provider edge routers from different ASs exchange labeled routes using exterior BGP.
Innovation Solution
Autonomous system boundary routers (ASBRs) maintain separate forwarding tables for inter-provider links and core-facing interfaces, verifying the origin of labels to prevent spoofing by checking if the label was previously distributed, and only installing or forwarding packets if the label is valid within the corresponding forwarding table.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ASBRs use exterior BGP to exchange labeled routes between different autonomous systems, then inter-AS MPLS VPN connectivity is enabled, but the system becomes vulnerable to label spoofing attacks
Solution Approach 1:
The patent segments the forwarding table into multiple interface-specific forwarding tables, where each table stores labels distributed on a particular interface. This segmentation allows the ASBR to verify whether a received label was legitimately distributed on the receiving interface, preventing spoofed labels from other interfaces from being accepted. The segmentation creates isolated verification contexts for each interface while maintaining overall system connectivity.
2Device complexity
If a single forwarding table is used for all interfaces, then device complexity is reduced, but label spoofing cannot be detected
Solution Approach 1:
The patent applies local quality by making each forwarding table interface-specific, where each table has the specialized property of storing only labels distributed on its associated interface. This local differentiation enables the system to detect label spoofing by checking whether a label exists in the appropriate interface-specific table, while the overall device complexity remains manageable through the structured organization of multiple tables.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one example, an autonomous system boundary router (ASBR) forms part of a first autonomous system (AS). The ASBR is between a first provider edge (PE) router of the first AS and a second PE router of a second, different AS. The first PE router and the second PE router form a Multiprotocol Label Switching (MPLS) path. The ASBR includes an interface communicatively coupled to a routing device external to the first AS, a memory configured to store a forwarding table associated with the interface, and one or more processing units configured to receive a packet via the interface, determine that the packet is encapsulated by an MPLS label, select a forwarding table based on the interface by which the packet was received, and forward the packet according to forwarding information of the forwarding table when the forwarding table includes the MPLS label.