BGP security and the future

A meta-analysis of BGP threats and security to provide a new direction for practical BGP security

Master thesis (2020)

Authors

T.R. van Rossum Electrical Engineering, Mathematics and Computer Science

Contributors

Christian Doerr Hasso Plattner Institute (supervisor 1)
S. Picek Cyber Security - EEMCS (supervisor 2)
K.A. Hildebrandt Computer Graphics and Visualisation - EEMCS (supervisor 2)
Faculty
Electrical Engineering, Mathematics and Computer Science
Copyright: © 2020 Tim van Rossum
More Info
expand_more

Published Date

15-10-2020

Language

English

Reuse Rights

Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.

Faculty

Electrical Engineering, Mathematics and Computer Science

Abstract

The Internet consists of many subnetworks, which are connected to each other. These subnetworks are the autonomous systems (ASes) that make up the Internet: each hosts a part of it. In order to successfully determine routes from one of these ASes to the other, the Border Gateway Protocol (BGP) is used. This protocol has several security flaws however, and exploitation of them has lead to parts of the Internet being temporarily unreachable. In order to combat these flaws, several security solutions have been developed already. However, none of these have been deployed on a wide scale yet. As such, this thesis focuses on the question: why not, and what can be done to protect BGP in the future? This thesis includes an analysis of the BGP threat landscape, to find which threats are most relevant, and to find out whether or not solutions have adapted to the threat landscape. It also includes a comparison of solutions on different practical security aspects. From this comparison, I found that no solution is able to prevent attacks if only one autonomous system deploys it. Due to this, I suggest to shift attention to detective security. This thesis also includes an analysis of some detective security schemes, to see which properties of these schemes can be used for a new scheme. This new scheme is designed to comply with a list of requirements, and it uses properties from three other schemes. Development of this scheme is left as future work. Altogether, this thesis should provide a new direction for the future of BGP security.