APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsec

Ouyang JUNJIE; Naoto YANAI; Tatsuya TAKEMURA; Masayuki OKADA; Shingo OKAMURA; Jason Paul CRUZ

doi:10.1587/transfun.2022CIP0024

APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsec

Ouyang JUNJIE, Naoto YANAI, Tatsuya TAKEMURA, Masayuki OKADA, Shingo OKAMURA, Jason Paul CRUZ

Full Text Views

3

Cite this

Summary :

The BGPsec protocol, which is an extension of the border gateway protocol (BGP) for Internet routing known as BGPsec, uses digital signatures to guarantee the validity of routing information. However, the use of digital signatures in routing information on BGPsec causes a lack of memory in BGP routers, creating a gaping security hole in today's Internet. This problem hinders the practical realization and implementation of BGPsec. In this paper, we present APVAS (AS path validation based on aggregate signatures), a new protocol that reduces the memory consumption of routers running BGPsec when validating paths in routing information. APVAS relies on a novel aggregate signature scheme that compresses individually generated signatures into a single signature. Furthermore, we implement a prototype of APVAS on BIRD Internet Routing Daemon and demonstrate its efficiency on actual BGP connections. Our results show that the routing tables of the routers running BGPsec with APVAS have 20% lower memory consumption than those running the conventional BGPsec. We also confirm the effectiveness of APVAS in the real world by using 800,000 routes, which are equivalent to the full route information on a global scale.

Publication: IEICE TRANSACTIONS on Fundamentals Vol.E106-A No.3 pp.170-184

Publication Date: 2023/03/01

Publicized: 2023/01/11

Online ISSN: 1745-1337

DOI: 10.1587/transfun.2022CIP0024

Type of Manuscript: Special Section PAPER (Special Section on Cryptography and Information Security)

Category

Authors

Ouyang JUNJIE
  Osaka University
Naoto YANAI
  Osaka University
Tatsuya TAKEMURA
  Osaka University
Masayuki OKADA
  University of Nagasaki
Shingo OKAMURA
  Nara College
Jason Paul CRUZ
  Osaka University

Keyword

BGPsec, path validation, aggregate signatures, internet routing, memory consumption

Cite this

Copy

Ouyang JUNJIE, Naoto YANAI, Tatsuya TAKEMURA, Masayuki OKADA, Shingo OKAMURA, Jason Paul CRUZ, "APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsec" in IEICE TRANSACTIONS on Fundamentals, vol. E106-A, no. 3, pp. 170-184, March 2023, doi: 10.1587/transfun.2022CIP0024.
Abstract: The BGPsec protocol, which is an extension of the border gateway protocol (BGP) for Internet routing known as BGPsec, uses digital signatures to guarantee the validity of routing information. However, the use of digital signatures in routing information on BGPsec causes a lack of memory in BGP routers, creating a gaping security hole in today's Internet. This problem hinders the practical realization and implementation of BGPsec. In this paper, we present APVAS (AS path validation based on aggregate signatures), a new protocol that reduces the memory consumption of routers running BGPsec when validating paths in routing information. APVAS relies on a novel aggregate signature scheme that compresses individually generated signatures into a single signature. Furthermore, we implement a prototype of APVAS on BIRD Internet Routing Daemon and demonstrate its efficiency on actual BGP connections. Our results show that the routing tables of the routers running BGPsec with APVAS have 20% lower memory consumption than those running the conventional BGPsec. We also confirm the effectiveness of APVAS in the real world by using 800,000 routes, which are equivalent to the full route information on a global scale.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1587/transfun.2022CIP0024/_p

Copy

@ARTICLE{e106-a_3_170,
author={Ouyang JUNJIE, Naoto YANAI, Tatsuya TAKEMURA, Masayuki OKADA, Shingo OKAMURA, Jason Paul CRUZ, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsec},
year={2023},
volume={E106-A},
number={3},
pages={170-184},
abstract={The BGPsec protocol, which is an extension of the border gateway protocol (BGP) for Internet routing known as BGPsec, uses digital signatures to guarantee the validity of routing information. However, the use of digital signatures in routing information on BGPsec causes a lack of memory in BGP routers, creating a gaping security hole in today's Internet. This problem hinders the practical realization and implementation of BGPsec. In this paper, we present APVAS (AS path validation based on aggregate signatures), a new protocol that reduces the memory consumption of routers running BGPsec when validating paths in routing information. APVAS relies on a novel aggregate signature scheme that compresses individually generated signatures into a single signature. Furthermore, we implement a prototype of APVAS on BIRD Internet Routing Daemon and demonstrate its efficiency on actual BGP connections. Our results show that the routing tables of the routers running BGPsec with APVAS have 20% lower memory consumption than those running the conventional BGPsec. We also confirm the effectiveness of APVAS in the real world by using 800,000 routes, which are equivalent to the full route information on a global scale.},
keywords={},
doi={10.1587/transfun.2022CIP0024},
ISSN={1745-1337},
month={March},}

Copy

TY - JOUR
TI - APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsec
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 170
EP - 184
AU - Ouyang JUNJIE
AU - Naoto YANAI
AU - Tatsuya TAKEMURA
AU - Masayuki OKADA
AU - Shingo OKAMURA
AU - Jason Paul CRUZ
PY - 2023
DO - 10.1587/transfun.2022CIP0024
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E106-A
IS - 3
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - March 2023
AB - The BGPsec protocol, which is an extension of the border gateway protocol (BGP) for Internet routing known as BGPsec, uses digital signatures to guarantee the validity of routing information. However, the use of digital signatures in routing information on BGPsec causes a lack of memory in BGP routers, creating a gaping security hole in today's Internet. This problem hinders the practical realization and implementation of BGPsec. In this paper, we present APVAS (AS path validation based on aggregate signatures), a new protocol that reduces the memory consumption of routers running BGPsec when validating paths in routing information. APVAS relies on a novel aggregate signature scheme that compresses individually generated signatures into a single signature. Furthermore, we implement a prototype of APVAS on BIRD Internet Routing Daemon and demonstrate its efficiency on actual BGP connections. Our results show that the routing tables of the routers running BGPsec with APVAS have 20% lower memory consumption than those running the conventional BGPsec. We also confirm the effectiveness of APVAS in the real world by using 800,000 routes, which are equivalent to the full route information on a global scale.
ER -