The Internet inter-domain routing system is vulnerable. On the control plane, the de facto Border Gateway Protocol (BGP) does not have built-in mechanisms to authenticate routing announcements, so an adversary can announce virtually arbitrary paths to hijack network traffic; on the data plane, it is difficult to ensure that actual forwarding path complies with the control plane decisions. The community has proposed significant research to secure the routing system. Yet, existing secure BGP protocols (e.g., BGPsec) are not incrementally deployable, and existing path authorization protocols are not compatible with the current Internet routing infrastructure. In this paper, we propose FC-BGP, the first secure Internet inter-domain routing system that can simultaneously authenticate BGP announcements and validate data plane forwarding in an efficient and incrementally-deployable manner. FC-BGP is built upon a novel primitive, name Forwarding Commitment, to certify an AS's routing intent on its directly connected hops. We analyze the security benefits of FC-BGP in the Internet at different deployment rates. Further, we implement a prototype of FC-BGP and extensively evaluate it over a large-scale overlay network with 100 virtual machines deployed globally. The results demonstrate that FC-BGP saves roughly 55% of the overhead required to validate BGP announcements compared with BGPsec, and meanwhile FC-BGP introduces a small overhead for building a globally-consistent view on the desirable forwarding paths.

翻译：互联网域间路由系统存在安全隐患。在控制层面，实际采用的边界网关协议（BGP）缺乏内置机制来验证路由通告的真实性，因此攻击者可宣告几乎任意路径来劫持网络流量；在数据层面，难以确保实际转发路径与控制层决策保持一致。学术界已提出大量研究来保障路由系统安全，然而现有安全BGP协议（如BGPsec）无法增量部署，现有路径授权协议也与当前互联网路由基础设施不兼容。本文提出FC-BGP——首个能同时高效且可增量部署地验证BGP通告与数据平面转发的安全互联网域间路由系统。FC-BGP基于名为"转发承诺"的新型原语构建，用于认证自治系统对其直连邻居的路由意图。我们分析了不同部署率下FC-BGP在互联网中的安全收益，并在由全球部署的100台虚拟机组成的大规模覆盖网络上实现FC-BGP原型系统并开展全面评估。结果表明，相较于BGPsec，FC-BGP可节省约55%的BGP通告验证开销，同时在构建期望转发路径的全局一致性视图方面仅引入微小开销。