Blockchain-Based AS Route Verification for BGP Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current route advertisement between autonomous systems (AS) in the Internet lacks security threat identification, making it vulnerable to path tampering attacks and route leakage.
Innovation Solution
A secure route identification method using a blockchain to verify the neighboring relationships between AS nodes, identifying potential security threats by comparing the advertised path with stored neighbor information, and discarding malicious messages to prevent network vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If route advertisement is performed using traditional BGP update messages, then route information can be transmitted between AS nodes, but security threats such as path tampering attacks and route leakage cannot be identified
Solution Approach 1:
The patent applies preliminary action by pre-storing legitimate neighbor relationship information in the blockchain before route advertisement occurs. When a BGP update message is received, the system can immediately verify the path against the pre-stored neighbor information in the blockchain, enabling security verification without adding complex real-time analysis mechanisms.
Solution Approach 2:
The patent introduces a blockchain as an intermediary layer between AS nodes for route verification. The blockchain stores and manages the neighbor relationship information, acting as a trusted mediator that both sending and receiving AS nodes can query to verify route legitimacy, thereby simplifying the verification system architecture.
2Reliability
If neighbor information is stored in a blockchain for verification, then security threats can be identified, but system complexity and verification overhead increase
Solution Approach 1:
The patent makes the blockchain serve multiple functions: it stores neighbor relationship information for verification, provides a decentralized trusted storage mechanism, and enables security verification across the entire BGP route advertisement process. This multi-functionality reduces the need for separate security infrastructure.
Solution Approach 2:
The system implements self-service by having AS nodes automatically query and verify route information against the blockchain without requiring manual security configuration or external security appliances. The blockchain itself maintains and provides the verification data, reducing operational complexity.
3Reliability
If all neighboring relationships are verified against the blockchain, then path tampering attacks can be detected, but calculation overheads increase
Solution Approach 1:
The patent applies partial action by verifying only the critical neighbor relationships that are stored in the blockchain against the received route path. Rather than performing exhaustive verification of all possible relationships, the system checks specifically against the pre-stored legitimate relationships in the blockchain, balancing detection accuracy with verification efficiency.
Data Source
AI summary
This application provides a secure route identification method and an apparatus. A first AS node receives a first message. The first message is used to indicate a target path for reaching a first route prefix, and the target path is used to indicate a first neighboring relationship between AS nodes on the target path. Then, the first AS node determines, based on the first neighboring relationship and neighbor information of an AS node on the target path that is stored in a blockchain, whether a security threat exists on the target path. The neighbor information of the AS node on the target path includes a second neighboring relationship between the AS node on the target path and another AS node.