The Multiple Benefits of a Secure Transport for BGP

Thomas Wirtgen, Nicolas Rybowski, Cristel Pelsser, and Olivier Bonaventure. 2024. The Multiple Benefits of a Secure Transport for BGP. In Proceedings of the ACM on Networking. Association for Computing Machinery, New York, NY, USA. https://doi.org/10.1145/3696406

@article{Wirtgen2024,
	title        = {The Multiple Benefits of a Secure Transport for BGP},
	author       = {Wirtgen, Thomas and Rybowski, Nicolas and Pelsser, Cristel and Bonaventure, Olivier},
	year         = 2024,
	month        = nov,
	journal      = {Proceedings of the ACM on Networking},
	publisher    = {Association for Computing Machinery},
	address      = {New York, NY, USA},
	volume       = 2,
	number       = {CoNEXT4},
	doi          = {10.1145/3696406},
	url          = {https://doi.org/10.1145/3696406},
	abstract     = {BGP distributes prefixes advertised by Autonomous Systems (ASes) and computes the best paths between them. It is the only routing protocol used to exchange interdomain routes on the Internet. Since its original definition in the late 1980s, BGP uses TCP. To prevent attacks, BGP has been extended with features such as TCP-MD5, TCP-AO, GTSM and data-plane filters. However, these ad hoc solutions were introduced gradually as the Internet grew. In parallel, TLS was standardized to secure end-to-end data-plane communications. Today, a large proportion of the Internet traffic is secured using TLS. Surprisingly, BGP still does not use TLS despite its adequate security features to establish BGP sessions. In this paper, we make the case for using a secure transport with BGP. This can be achieved with TLS combined with TCP-AO or by replacing TCP by QUIC. This protects the BGP stream using established secure transport protocols. In addition, we show that a secure transport using X.509 certificates enables BGP routers to be securely and automatically configured from these certificates. We extend the open-source BIRD BGP daemon to support TLS with TCP-AO and QUIC, to handle such certificates and demonstrate several use cases that benefit from the secure and automated capabilities enabled by our proposal.},
	articleno    = 36,
	groups       = {International Journals and Magazines},
	issue_date   = {December 2024},
	keywords     = {bgp, certificates, network automation, quic, tls, x.509 certificates},
	numpages     = 23
}