S-BGP (Secure BGP)
A proposed specification aimed at increasing the security of BGP.
Begun in 1996 by BBN, S-BGP establishes a public-key infrastructure to stymie IP address spoofing. However, it is still a work in progress and has yet to be implemented in Internet routers. Router memory constraints, processing overhead concerns and the downtrodden state of the telecom economy are cited as reasons why.
"The state of security in BGP is pretty minimal," says Alex Zinin, area director of the routing and sub-IP working groups in the Internet Engineering Task Force (IETF). "As it is deployed today, there is no mechanism to authenticate and identify the authorization of a specific [routing information] announcement."
Secure BGP is intended to address a "fundamental problem" with BGP: the authenticity of routing update information, according to Steve Kent, BBN chief scientist for information security.
"What makes security for BGP tricky is that generally, this update information is transitive," he says. "One ISP is saying to another, 'I received this routing information from one of my neighbors with regard to this chunk of address space. If you want to send traffic for this chunk of address space to me, this is the path it would take.' Today, there's just no security for that. There's no way for the receiver to tell whether the update that's received is authentic."
S-BGP seeks to establish a public-key infrastructure that uses digital certificates to authenticate two pieces of data: which chunks of address space have been allocated to them and what autonomous system numbers have been allocated to them.
But S-BGP inhibits an ISP's ability to establish policy for its routers, says Cisco Fellow Fred Baker, whose company, along with ISPs such as Genuity, have written an alternative called Secure Origin BGP.
"[With S-BGP, the] downstream service provider cannot apply a policy that says, 'I'm going to accept this prefix from you but not that one,'" Baker says. "It fundamentally breaks BGP's ability to be used in a policy system where you might redivide the information. S-BGP is the right concept, but it's put together in a way that an ISP can't really effectively use."
The soBGP proposal is an effort to let ISPs authenticate route advertisements and implement policy on them. But according to Kent, soBGP provides too many ways to do certain things, which when implemented differently, hamper interoperability.
From Fortifying BGP: No quick fix, Network World, 10/06/03.
Additional resources
Secure BGP Project
Overview and links to relevant papers, IETF drafts and presentations.
Router and switch research center
Latest router news, analysis and links from Network World Fusion.
Add a comment
Network World on Twitter: Get our tweets and stay plugged in to networking news
