Beware of BGP Attacks -- Paper Critique
B06902035 資工三 王靖傑
Summary:
BGP (Border Gateway Protocol) is an important protocol of Internet infrastructure, but
it does have some vulnerability. The threat model is a hacker who compromises and take
complete control of one or more BGP routers in the Internet. There are four attack objectives:
Blackholing, Redirection, Subversion and Instability. Two countermeasures were proposed:
“BGP TTL Security Hack” and “Unicast Reverse Path Filtering”, but they are not able to deal
with compromised BGP router. Filtering seems to be a good method, but it needs a up-to-date
centralized database which knows the complete topology of the network. Secure BGP (SBGP) is a preferable solution for its security guarantees using PKI infrastructure. Each
UPDATEs in S-BGP is signed by the owner to prevent fake UPDATE messages.
Strengths:
1. S-BGP is better than filtering and it doesn’t require Internet Routing Registries (IRRs).
IRRs is criticized by its
2. Instead of using an entirely different Internet protocol, S-BGP is based on the original
BGP protocol, making it much easier to be adopted by ISPs.
Weaknesses:
1. S-BGP requires PKI infrastructure, so it needs a distribution system which is trusted by all
routers. And public-key cryptography is very costly (in terms of processing time and
memory space).
2. Daisy-chained RAs (route attestation) may be too long for a long routing path, thus
reducing the scalability of S-BGP.
3. Due to the “heavy weight” of S-BGP, the convergence latency becomes larger.
Reflections:
Reading this paper let me realize that there’re so many BGP attacks in the real world.
Instead of “how it works”, “what are some potential vulnerability” is also a big problem. The
main concern of ISPs to not adopt S-BGP is the overhead of public cryptography.
Alternatively, we can use something like TESLA (a symmetric cryptography signature
algorithm) or other efficient method to provide secure signature. The highly connective
network of ISPs makes it a good place to deploy TESLA protocol. On the other hand, the
main reason why BGP is vulnerable is that someone does not completely follow the
protocol. Zero-knowledge proof is a good way to force each entity to completely follow the
protocol while keeping confidentiality (we know that ISPs are not willing to share their
secret).