ROA Bitmap Encoding for Secure and Scalable Prefix Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Border Gateway Protocol (BGP) is vulnerable to forged-origin sub-prefix hijacking attacks due to the flexibility in authorizing IP prefixes in advance, leading to increased computational and transmission overheads, and reducing the scalability of the Resource Public Key Infrastructure (RPKI) deployment.
Innovation Solution
A bitmap-based encoding scheme for Route Origin Authorizations (ROAs) using an IP address trie to divide IP prefixes into non-overlapping sub-tree blocks, encoded as tuples (identifier, bitmap), with a Sub-Tree Map (STM) for maintenance, enhancing security and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the minimal ROA principle is adopted to enhance security by only encoding prefixes actually authorized to advertise with BGP, then security against forged-origin sub-prefix hijacking attacks is improved, but the number and size of ROAs increase, leading to higher computational, transmission, and validation overheads
Solution Approach 1:
The patent segments the IP address space into hierarchical blocks using the IP address trie structure. Instead of creating individual ROAs for each prefix, the encoding method groups multiple prefixes under common ancestor nodes in the trie, dividing the large set of ROAs into smaller hierarchical units that can be processed more efficiently.
Solution Approach 2:
The patent merges multiple prefixes that share common ancestors in the IP address trie into single ROA entries. By combining prefixes under the same ancestor node and using bitmap encoding to represent multiple authorized prefixes within one ROA structure, the total number of ROAs is reduced while maintaining security.
2Adaptability or versatility
If IP prefixes are authorized in advance with flexible maxLength settings, then the CA gains flexibility in authorizing IP prefixes and sub-prefixes can be deployed without temporary authorization, but attackers can exploit this vulnerability to launch forged-origin sub-prefix hijacking attacks
Solution Approach 1:
The patent applies local quality by setting different maxLength values for different nodes in the IP address trie based on actual authorization needs. Each ancestor node's maxLength is precisely configured to match the specific sub-prefix requirements, providing localized flexibility rather than uniform authorization across the entire address space.
Solution Approach 2:
The patent performs preliminary action by pre-configuring maxLength values in the ROA encoding structure for future sub-prefix deployments. The bitmap encoding allows the system to prepare authorization structures in advance for potential future needs while maintaining security through proper maxLength constraints at each node.
3Reliability
If the number of ROAs increases to maintain minimal ROA principle, then security is enhanced, but computational overhead for processing RTR Protocol Data Units increases at high speed, reducing the scalability of RPKI
Solution Approach 1:
The patent segments the ROA processing workload by organizing prefixes hierarchically in the IP address trie. This segmentation allows RPs to process ROAs in smaller hierarchical units rather than handling every individual prefix separately, reducing computational overhead and improving scalability.
Solution Approach 2:
The patent merges multiple prefixes into single ROA entries using bitmap encoding, which significantly reduces the total number of ROAs that need to be processed. This merging approach maintains security by preserving individual prefix authorization information while reducing processing overhead through consolidated ROA structures.
Data Source
AI summary
Described are an encoding method and system for ROAs. The encoding method includes the following steps: given a set of authorized IP prefixes an AS which are maintained with an IP address trie. By specifying a sequence of hanging levels on the IP address trie, it is divided into a set of non-overlapping sub-trees, each rooted at a hanging level. A node on a hanging level uniquely defines a sub-tree rooted at it, whose prefix can be encoded as the identifier of this sub-tree. All authorized prefixes covered by a sub-tree can be encoded into a bitmap of 2h bits, where h is the height of this sub-tree. Thus, the set of authorized IP prefixes of an AS is encoded into several tuples (identifier, bitmap).