Securing BGP AS path with hash chain and digital signature - Bibera, Wyndell Love M.
The Border Gateway Protocol (BGP) is the most widely deployed interdomain routing protocol of the Internet. Its ability to scale well with the growth of the Internet is a defining factor for its popularity, but it is very limited when it comes to security. Real world incidents in forms of an attack or misconfiguration further reinforce the idea that the routing protocol is indeed lacking the aspect of security. With all the proposals presented to secure the protocol, S-BGP is deemed the most secure, with ongoing effort to include it as a feature in the next version of BGP, and standardize it as BGPSec. BGPSec secures the messages between ASes by (1) providing a means of verifying ownership of AS number and prefixes and (2) implementating a scheme to prevent the AS PATH from being tampered during transition across ASes. However, there is high computational overhead associated with implementing BGPSec, particularly in (2), making global scale implementation a challenge. This paper proposes to use hash chain and sequential aggregated signature as an alternative to the layered signature offered by S-BGP to protect AS path from being tampered. Our proposal requires significantly less computational overhead than its counterpart in S-BGP and FS-BGP. We show that the level of security need not be compromised in exchange for a faster and more efficient method of protecting the AS path.