Subject: [Sidrops] Off loading origin (and path) validation

From: "Montgomery, Douglas (Fed)" <[email-masked]>
Date: Mon, 16 Jul 2018 18:37:48 +0000

Just an FYI.  

The NIST prototype of BGP origin validation and path validation has always used an external validation engine and a simple protocol to send prefix / path information to the validation server and receive validation results.

The protocol we use is here: 
https://bgpsrx.antd.nist.gov/bgpsrx/documents/srx-server-protocol-1-0.txt.pdf.  

We thought about using route reflectors for this, but chose the approach above instead.   

It is a new protocol, but it avoids the complexity of trying to overload this function on existing protocols.   It does supports both e-bgp and i-bgp processing before RIB-IN (or at least that is how we use it).  There is some complexity in the protocol to support lazy evaluation (i.e., validation result may asynchronously notify router of validation result change - either from lazy evaluation, or RPKI change in the background).  Clearly if you did not want asynchronous notifications, or path validation from the server, the protocol could be much simpler.  

I am just providing this pointer as information as some at the mic suggested that an out of band protocol might be an alternative approach to off-loading validation.    If you are interested in these ideas, the spec above and the running code at: https://www.nist.gov/services-resources/software/bgp-secure-routing-extension-bgp-srx-prototype is one approach to doing this.    Actually the running code has improvements on the spec above based upon scaling tests, etc.  If there is interest we could update the specs.

I am not proposing the above as an ID, just providing some food for thought if folks are interested in other approaches to off-loading all BGP OV / PV computation.    

dougm
--  
Doug Montgomery, Manager Internet & Scalable Systems Research @ NIST