Cryptographics Acceleration for Border Gateway Protocol Security (CaBGPSEC)

Current Border Gateway System (GBP) does not include provisions for security features and is vulnerable to malicious attacks targeting the control plane. The Internet Engineering Taskforce is developing BGPSEC (BGP with Security) to provide path security for BGP route advertisements. The extension is meant to provide resiliency against route hijacks and Autonomous System (AS) path modifications. Given the large size of the global Internet BGP routing table and strict requirement for re-convergence time following router reboots, the security requirement causes a major adoption challenge since most currently deployed router control plane hardware does not have the processing power to handle BGPSEC’s cryptographic-intensive computations. NIST is closely involved in BGPSEC protocol design and has developed a prototype implementation: BGP-SRx. Antara Teknik will modify NIST BGP-SRx and develop an optimal API with appropriate OS hooks to completely off-load all cryptographic operations to an off-board cryptographic accelerator incorporated to a PC-router platform. Antara Teknik will perform component level, system level, and algorithmic optimizations to architect and design a low-power, low-cost, efficient, and highly secure router. The proposed router will be commercially deployable in the near future and accelerate the adoption of BGPSEC to secure a key component of the Internet critical infrastructure.