In order to prevent malicious traffic flows, how does BGPsec protect prefix advertisement?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
BGPsec (Border Gateway Protocol Security) is an extension of BGP (Border Gateway Protocol), designed to provide security for inter-domain routing by protecting BGP routes against various types of attacks, such as prefix hijacking, prefix impersonation, and route leaks.
BGPsec achieves this by providing a mechanism for routers to cryptographically sign and verify BGP route announcements, ensuring the authenticity and integrity of the routes. Specifically, BGPsec uses digital signatures to protect the BGP routes, making it resistant to attacks from various sources, including rogue ASes, routers, or attackers.
To protect prefix advertisement, BGPsec validates the AS path attribute of a BGP route. The AS path attribute contains a list of ASes that the route has traversed, starting with the originating AS and ending with the AS that advertised the route to the receiving BGP speaker. By verifying the AS path attribute, BGPsec can detect and prevent prefix hijacking attacks, where a malicious AS advertises a route to a legitimate AS, claiming to be the origin of the prefix.
BGPsec also protects against other types of attacks, such as route leaks, by ensuring that only legitimate ASes can advertise a prefix. It achieves this by validating the originating AS of a BGP route, in addition to the AS path attribute. This prevents rogue ASes from advertising prefixes that do not belong to them, or from hijacking prefixes from other legitimate ASes.
In summary, BGPsec protects prefix advertisement by validating the AS path attribute and the originating AS of a BGP route. By ensuring the authenticity and integrity of BGP routes, BGPsec helps prevent various types of attacks and makes the Internet more secure and resilient.