1. SECURE ORIGIN BGP (soBGP) draft-ng-sobgp-bgp-extensions-00 Editor: James Ng (jamng@cisco.com)

2. Goals of soBGP Verify the origin of advertisements
Prevent the advertisement of unauthorized prefixes
Sanity check the path of an update

3. Design Constraints
Signaling mechanism to provide security information should be as flexible as possible
Must be incrementally deployable
Should provide security benefit without the participation of every AS

4. Design Constraints
Should not rely on routing to secure routing (No external database connection on system initialization is required)
Flexibility should be provided to allow operators to configure the level of security vs. overhead and convergence speed
Minimize impact to current optimizations in the implementation of the BGP protocol

5. soBGP Doesn’t Protect Inter-AS (peer to peer) Connections
BGP Attribute authentication
The full validity of the AS_PATH; while an AS_PATH can be checked for correctness, soBGP does not verify that the AS_PATH of any given route has not been modified in transit

6. Topology Map
AS1
AS2
AS3
AS4
If AS3 cuts AS2 out of the path, this would be caught by the proposed construction of a topology map
The topology map is verified using a two way connectivity check
Gaps in the topology map also limit the ability to validate/sanity check the AS_PATH

7. The Security Message New BGP message type 7
Used to carry security information within the protocol (security info can also be transported outside of BGP)
Transmits 3 types of certificates and a request
Negotiated at session startup

8. Certificate Types Entity Certificate (Entitycert)
Policy Certificate (Policycert)
Authorization Certificate (Authcert)

9. Entitycert function Entity Certificate Distributes the public keys
Used to authenticate other security messages
Provides a way to change keys/authentication info without causing routing disruption

10. Who Signs the Entity Certificates
Authority which issued the AS number
Commercial authority
Any universally known and trusted party in the Internet domain
Web of trust model
Private keys are never transmitted inside or outside the AS

11. Policycert function Policy Certificate Specifies security options
Communicates level of security requested by Originating AS (Allows Flexibility)
Lists attached AS’ for AS_Path sanity checking
Also provides a non-disruptive way to invalidate old security information

12. Authentication Certificate
Authcert function
Used to authorize an AS to advertise a prefix block
Information is used to build a database the BGP speaker can use to verify the origin of a prefix

13. soBGP Operation
Manually
Entered
Entity
Certificate
(Entitycert)
Begin with a small set of manually configured Entitycerts for well-known parties

14. soBGP Operation
Manually
Entered
Entity
Certificate
(Entitycert)
Entitycerts transmitted in BGP are signed using the private key of a third party AS and are authenticated using the manually configured entitycerts, or previously authenticated entitycerts
verifies
Entity
Certificate
(Entitycert)

15. soBGP Operation
Manually
Entered
Entity
Certificate
(Entitycert)
Policy
Certificate
(Policycert)
Public key inside Entitycerts then verifies Policycerts and Authcerts
verifies
verifies
Authentication
Certificate
(Authcert)
Entity
Certificate
(Entitycert)

16. soBGP Operation Prefix Block – A, B, C
Authorization
Certificate
(Authcert)
Prefix Block – A, B, C
Authcert contains a list of AS’ authorized to originate an address block
Each prefix is then checked against the Authcert database to verify the correct origin AS

17. soBGP Operation A attached to (X, Y, Z)
Policy
Certificate
(Policycert)
A attached to (X, Y, Z)
Policycert contains a list of attached AS’ and security policy options
Each AS_PATH can then be sanity checked against the Policycert database
Placing policies in a certificate allows us to expand and change policy options in the future

18. Certificate Advertisement
Advertisement of certificates is not restricted to the Originating AS
Once an AS generates a certificate, it may be advertised by another AS or third party

19. Request Security messages may be filtered for various reasons
The Request message provides the ability to readvertise all security information or just a subset

20. Aggregation
Aggregation is a problem for any mechanism that uses the AS_PATH to authenticate information
The problem can be avoided by restricting AS’ to only aggregate for prefixes that they are authorized to originate

21. Next Steps
Modify the WG charter to include BGP Security as a work item.
Wait for requirements document from RPsec.
Possibly form a subgroup to look at BGP security solutions (?).

22. For Further Discussion
ftp://ftp-eng.cisco.com/sobgp/index.html
Mailing List:
Send request