BGP Route Authentication via Digital Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Border Gateway Protocol (BGP) implementations lack mechanisms to authenticate route advertisements, making them vulnerable to malicious spoofing, which can lead to data breaches and loss of confidential information due to inherent trust between autonomous systems.
Innovation Solution
A trusted entity, such as the Internet Assigned Numbers Authority (IANA), provides digital signatures and certificates to autonomous systems, allowing them to authenticate route advertisements by including digital signatures and certificates within the advertisements, ensuring the authenticity of routing information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital signatures and certificates are integrated into BGP route advertisements, then security and authenticity verification are improved, but protocol complexity and processing overhead increase
Solution Approach 1:
The patent introduces digital certificates and signatures as intermediary elements between autonomous systems to establish trust. Instead of direct trust relationships between all ASes, a certificate authority structure mediates the verification process, allowing routers to verify route advertisements through cryptographic signatures attached to BGP updates.
Solution Approach 2:
The patent implements preliminary authentication by requiring digital signatures to be attached to route advertisements before transmission. The verification process is performed proactively at the receiving end before routing decisions are made, ensuring that only authenticated routes are accepted into the routing table.
2Reliability
If digital certificates are attached to route advertisements, then authentication capability is improved, but data transmission volume and network overhead increase
Solution Approach 1:
The patent extracts the authentication mechanism from separate communication channels and integrates it directly into the BGP update packets themselves. By embedding digital signatures within the existing BGP protocol structure rather than using separate authentication channels, the solution avoids additional communication overhead while maintaining security.
Solution Approach 2:
The patent merges the routing information and authentication data into a single BGP update message. Instead of transmitting route information and authentication credentials separately, the digital signature is combined with the route advertisement in one protocol message, reducing total data transmission volume.
Data Source
AI summary
Embodiments of the present invention provide systems, methods, and computer storage media directed to propagating and authenticating border gateway protocol route advertisements. A trusted authority device stores and distributes routing information for various autonomous systems. The trusted authority device also issues and maintains digital certificates that are each assigned to one of the autonomous systems. The digital certificate can be utilized by autonomous systems to verify the authenticity of routing information advertised by another autonomous system. Each autonomous system can employ a routing device that can generate a route advertisement based on routing information received from the trusted authority device. The route advertisement can include a digital signature, a digital certificate, and a time-to-live value, among other things, each of which can be utilized by routing devices of other autonomous systems to determine the authenticity and validity of received routing information.