2013/07/10 by Robert Lychev, Lychev, Robert, Sharon Goldberg +3 · 1 voice
Computer Science · #Internet Traffic Analysis and Secure E-voting #Network Packet Processing and Optimization #Network Security and Intrusion Detection #cs.CR #cs.DC #cs.NI
paper · pdf · doi:10.48550/arxiv.1307.2690
openalex publication_date 2013/07/10 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
As the rollout of secure route origin authentication with the RPKI slowly gains traction among network operators, there is a push to standardize secure path validation for BGP (i.e., S*BGP: S-BGP, soBGP, BGPSEC, etc.). Origin authentication already does much to improve routing security. Moreover, the transition to S*BGP is expected to be long and slow, with S*BGP coexisting in "partial deployment" alongside BGP for a long time. We therefore use theoretical and experimental approach to study the security benefits provided by partially-deployed S*BGP, vis-a-vis those already provided by origin authentication. Because routing policies have a profound impact on routing security, we use a survey of 100 network operators to find the policies that are likely to be most popular during partial S*BGP deployment. We find that S*BGP provides only meagre benefits over origin authentication when these popular policies are used. We also study the security benefits of other routing policies, provide prescriptive guidelines for partially-deployed S*BGP, and show how interactions between S*BGP and BGP can introduce new vulnerabilities into the routing system.