Network Node Signature Trust for BGPsec Processing Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The validation of every link in a signature chain for route update messages is processor-intensive, which can reduce the adoption of security processes like BGPsec and lead to significant processing loads at the edge of networks, thereby compromising network security and efficiency.
Innovation Solution
Implementing selective validation of signatures based on whether a trusted node or node group has previously validated them, and selective signing of route update messages based on the recipient's authorization, to conserve processor resources and improve network security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If every signature in the signature chain is validated by each network node, then network security is improved, but processor resources are excessively consumed and processing load increases
Solution Approach 1:
The patent applies preliminary action by having the first network node validate signatures in advance before forwarding the route update message to the second node. The validation result is then cached and reused by subsequent nodes, eliminating the need for each node to independently validate all signatures in the chain. This pre-validation approach significantly reduces processor resource consumption while maintaining security.
Solution Approach 2:
The patent extracts the signature validation function from each individual network node and centralizes it at the first node in the path. By removing the redundant validation requirement from intermediate nodes and relying instead on the validation performed by the first node, the system reduces overall processing load while preserving security guarantees.
2Productivity
If selective validation is implemented based on trusted node status, then processor resources are conserved, but the complexity of determining trust relationships increases
Solution Approach 1:
The patent applies universality by making the first network node serve multiple functions: it acts as both a regular routing node that forwards messages and as a validation node that verifies signature chains. This multi-functionality eliminates the need for separate validation infrastructure while reducing overall system complexity. The first node's dual role simplifies trust relationship management compared to requiring each node to independently establish trust.
3Reliability
If all nodes validate all signatures, then signature chain integrity is ensured, but network congestion increases due to repeated processing
Solution Approach 1:
The patent applies copying by having the first network node create a copy of the validation result and attach it to the route update message before forwarding to the second node. The second node then uses this copied validation information instead of performing independent validation, significantly reducing processing time and eliminating network congestion caused by repeated validation operations while maintaining integrity through the cached validation proof.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A network node may include one or more processors. The one or more processors may receive a message that is associated with one or more signatures and one or more second signatures. The one or more signatures may have been validated by a particular node. The one or more processors may determine that the particular node is a trusted node. The network node may be configured not to validate signatures that have been validated by a trusted node. The one or more processors may determine that the one or more signatures have been validated by the particular node. The one or more processors may sign or provide the message, without validating the one or more signatures, based on determining that the one or more signatures have been validated by the particular node.