BGP Update Verification via AS Path Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current BGP protocols lack mechanisms to verify the authenticity of prefix and AS_PATH information, leading to security vulnerabilities such as routing holes and Denial of Service attacks, and existing security frameworks like SBGP and SoBGP impose a significant CPU burden due to extensive verification processes.
Innovation Solution
Implement a method where an Autonomous System (AS) verifies update information, including AS_PATH and prefix, within a predetermined maximum time, thereby limiting CPU load and ensuring network convergence speed, and introduce a flag to indicate prefix verification status to optimize resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If extensive verification processes are implemented to verify prefix and AS_PATH authenticity, then security reliability is improved, but CPU load increases significantly
Solution Approach 1:
The patent applies preliminary action by having AS path verification performed in advance during route establishment. The verification result is cached and reused for subsequent update messages, avoiding repeated verification computations. This resolves the contradiction by performing the computationally intensive verification work beforehand, ensuring security reliability while reducing ongoing CPU load during normal operations.
Solution Approach 2:
The patent implements local quality by applying verification selectively rather than uniformly to all update messages. Verification is performed based on local conditions such as whether the update message contains modified AS path information or originates from untrusted sources. This resolves the contradiction by concentrating verification resources on specific cases that require enhanced security, thereby maintaining reliability while reducing overall CPU load compared to universal verification.
2Reliability
If extensive verification processes are implemented to verify prefix and AS_PATH authenticity, then security reliability is improved, but network convergence speed decreases
Solution Approach 1:
By performing AS path verification in advance and caching the results, the patent ensures that subsequent update message processing can proceed quickly without repeated verification. This resolves the contradiction by separating the security verification function (performed preliminarily) from the route update propagation function (performed at high speed), thereby maintaining both security reliability and network convergence speed.
Solution Approach 2:
The patent applies partial verification action by verifying only the necessary portions of update messages based on local conditions. Rather than verifying every update message in full, the system performs verification selectively on messages that require it, allowing most normal updates to propagate quickly without verification overhead. This resolves the contradiction by providing sufficient security verification where needed while maintaining fast convergence for routine operations.
3Reliability
If verification mechanisms are added to BGP protocols, then security against malicious attacks is improved, but protocol complexity increases
Solution Approach 1:
The patent introduces an intermediary verification mechanism that mediates between the BGP update message and the routing decision. The verification module acts as an intermediary layer that checks AS path authenticity using cached verification results, isolating the complexity of security verification from the core BGP protocol logic. This resolves the contradiction by containing protocol complexity within a dedicated verification intermediary while maintaining security against malicious attacks.
Solution Approach 2:
By performing verification preliminarily and caching results, the patent reduces the complexity of real-time verification processing. The preliminary verification establishes a trusted baseline that simplifies subsequent decision-making, reducing the computational and protocol complexity required during normal operation while maintaining strong security guarantees.
4Reliability
If verification is performed on every update message, then security is improved, but processing time increases
Solution Approach 1:
The patent performs verification preliminarily and caches the results for reuse. When an update message arrives, the system checks whether verification has already been performed for the relevant AS path rather than verifying from scratch. This resolves the contradiction by performing the time-consuming verification work once in advance, ensuring security while dramatically reducing processing time for subsequent messages that can reuse the cached verification results.
Solution Approach 2:
The verification system implements feedback by using previous verification results to inform subsequent verification decisions. When an update message is received, the system feedbacks from the cached verification state to determine whether full verification is needed or if the cached result suffices. This resolves the contradiction by using feedback from prior verification to avoid redundant processing, thereby maintaining security while reducing overall processing time.
Data Source
AI summary
A method for verifying update information in Border Gateway Protocol (BGP), includes: upon receipt of an update message, verifying, by an Autonomous System (AS), the update message according to a determined maximum time of verifications; and trusting the update message if the verifications are successful. The update message may be AS_PATH and/or prefix. In the invention, upon receipt of an update message, the AS verifies the update information according to the maximum time of verifications, which ensures that the time of verifications will not exceed the maximum time of verifications when the AS verifies the update information. Accordingly, load on CPU is decreased during verification of the update information and hence the network convergence speed is improved.