APVAS: Reducing the Memory Requirement of AS_PATH Validation by Introducing Aggregate Signatures into BGPsec

摘要

The BGPsec protocol, which is an extension of the bordergateway protocol (BGP) for Internet routing known as BGPsec, uses digitalsignatures to guarantee the validity of routing information. However, theuse of digital signatures in routing information on BGPsec causes a lack ofmemory in BGP routers, creating a gaping security hole in today’s Internet.This problem hinders the practical realization and implementation ofBGPsec. In this paper, we present APVAS (AS path validation based on aggregatesignatures), a new protocol that reduces the memory consumptionof routers running BGPsec when validating paths in routing information.APVAS relies on a novel aggregate signature scheme that compresses individuallygenerated signatures into a single signature. Furthermore, weimplement a prototype of APVAS on BIRD Internet Routing Daemon anddemonstrate its efficiency on actual BGP connections. Our results showthat the routing tables of the routers running BGPsec with APVAS have20% lower memory consumption than those running the conventional BGPsec.We also confirm the effectiveness of APVAS in the real world byusing 800,000 routes, which are equivalent to the full route information ona global scale.