The BGPsec framework is designed to secure the AS path information in BGP updates. It uses digital signatures to validate the AS path and prevent unauthorized route manipulation. Here are the key points related to BGPsec:
Securing AS Path:
BGPsec ensures the integrity of the AS path by allowing routers to sign BGP updates using their private keys.
When a router originates a BGP route, it signs the AS path information with its private key.
Other routers can verify the signature using the corresponding public key.
This prevents malicious AS path modifications and ensures the authenticity of the advertised route.
Private Keys and Router Key Pair:
BGPsec relies on cryptographic keys for signing and verifying BGP updates.
Each router has a router key pair consisting of a private key and a corresponding public key.
The private key is kept confidential and is used for signing route updates.
The public key is distributed to other routers for verification.
Expiration Time:
Unlike regular BGP updates, BGPsec does not assign an expiration time (TTL) to route advertisements.
The absence of an expiration time ensures that the signed AS path remains valid until explicitly withdrawn.
In summary, BGPsec enhances BGP security by securing the AS path using digital signatures and private keys. It does not rely on IPsec tunnels for security1.
Reference:
Cisco. (2021). Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.0. Cisco Learning Services.
Cisco. (2021). Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) v1.1. Cisco Learning Network Store.
Cisco. (2021). BGPsec Overview. Link