{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,11]],"date-time":"2026-03-11T13:28:48Z","timestamp":1773235728668,"version":"3.50.1"},"reference-count":56,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2007,7,1]],"date-time":"2007-07-01T00:00:00Z","timestamp":1183248000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Inf. Syst. Secur."],"published-print":{"date-parts":[[2007,7]]},"abstract":"<jats:p>\n            It is well known that the Border Gateway Protocol (BGP), the IETF standard interdomain routing protocol, is vulnerable to a variety of attacks, and that a single misconfigured or malicious BGP speaker could result in large-scale service disruption. In this paper, we present\n            <jats:italic>Pretty Secure BGP (psBGP)<\/jats:italic>\n            ---a proposal for securing BGP, including an architectural overview, design details for significant aspects, and preliminary security and operational analysis. psBGP differs from other security proposals (e.g., S-BGP and soBGP) in that it makes use of a single-level PKI for AS number authentication, a decentralized trust model for verifying the propriety of IP prefix origin, and a rating-based stepwise approach for AS_PATH (integrity) verification. psBGP trades off the strong security guarantees of S-BGP for presumed-simpler operation, e.g., using a PKI with a simple structure, with a small number of certificate types, and of manageable size. psBGP is designed to successfully defend against various (nonmalicious and malicious) threats from uncoordinated BGP speakers, and to be incrementally deployed with incremental benefits.\n          <\/jats:p>","DOI":"10.1145\/1266977.1266980","type":"journal-article","created":{"date-parts":[[2007,9,14]],"date-time":"2007-09-14T13:44:55Z","timestamp":1189777495000},"page":"11","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":62,"title":["On interdomain routing security and pretty secure BGP (psBGP)"],"prefix":"10.1145","volume":"10","author":[{"given":"P.C. van","family":"Oorschot","sequence":"first","affiliation":[{"name":"Carleton University, Ottawa, Canada"}]},{"given":"Tao","family":"Wan","sequence":"additional","affiliation":[{"name":"Carleton University, Ottawa, Canada"}]},{"given":"Evangelos","family":"Kranakis","sequence":"additional","affiliation":[{"name":"Carleton University, Ottawa, Canada"}]}],"member":"320","published-online":{"date-parts":[[2007,7]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"Adams C. and Lloyd S. 2003. Understanding Public-Key Infrastructure 2nd Ed. Addison-Wesley Reading MA.   Adams C. and Lloyd S. 2003. Understanding Public-Key Infrastructure 2nd Ed. Addison-Wesley Reading MA."},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/948109.948133"},{"key":"e_1_2_1_3_1","unstructured":"Barbir A. Murphy S. and Yang Y. 2004. Generic threats to routing protocols. Internet Draft.  Barbir A. Murphy S. and Yang Y. 2004. Generic threats to routing protocols. Internet Draft."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/378444.378449"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2004.3"},{"key":"e_1_2_1_6_1","unstructured":"Bellovin S. and Gansner E. 2003. Using link cuts to attack internet routing. Unpublished manuscript.  Bellovin S. and Gansner E. 2003. Using link cuts to attack internet routing. Unpublished manuscript."},{"key":"e_1_2_1_7_1","volume-title":"DHS Secure Routing Workshop.","author":"Bellovin S.","unstructured":"Bellovin , S. , Ioannidis , J. , and Bush , R . 2005. Position paper: Operational requirements for secured BGP . In DHS Secure Routing Workshop. Bellovin, S., Ioannidis, J., and Bush, R. 2005. Position paper: Operational requirements for secured BGP. In DHS Secure Routing Workshop."},{"key":"e_1_2_1_8_1","volume-title":"Proceedings of Crypto","volume":"3152","author":"Boneh D.","year":"2004","unstructured":"Boneh , D. , Boyen , X. , and Shacham , H . 2004. Short group signatures . In Proceedings of Crypto 2004 . Vol. 3152 . 41--55. Boneh, D., Boyen, X., and Shacham, H. 2004. Short group signatures. In Proceedings of Crypto 2004. Vol. 3152. 41--55."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/77648.77649"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177698950"},{"key":"e_1_2_1_11_1","unstructured":"DHS. 2005. DHS secure routing workshop. Department of Homeland Security Washington D.C.  DHS. 2005. DHS secure routing workshop. Department of Homeland Security Washington D.C."},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF00196790"},{"key":"e_1_2_1_13_1","volume-title":"Inferring autonomous system relationships in the Internet","author":"Gao L.","unstructured":"Gao , L. 2000. Inferring autonomous system relationships in the Internet . In IEEE Global Internet . Gao, L. 2000. Inferring autonomous system relationships in the Internet. In IEEE Global Internet."},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of the Computer Security Foundations Workshop IV","author":"Gligor V.","unstructured":"Gligor , V. , Kailar , R. , Stubblebine , S. , and Gong , L . 1991. Logics for cryptographic protocols---virtues and limitations . In Proceedings of the Computer Security Foundations Workshop IV . Los Alamitos, CA. 219--226. Gligor, V., Kailar, R., Stubblebine, S., and Gong, L. 1991. Logics for cryptographic protocols---virtues and limitations. In Proceedings of the Computer Security Foundations Workshop IV. Los Alamitos, CA. 219--226."},{"key":"e_1_2_1_15_1","volume-title":"Proceedings of the 2003 ISOC Symposium on Network and Distributed Systems Security (NDSS'03)","author":"Goodell G.","unstructured":"Goodell , G. , Aiello , W. , Griffin , T. , Ioannidis , J. , McDaniel , P. , and Rubin , A . 2003. Working around BGP: An incremental approach to improving security and accuracy of interdomain routing . In Proceedings of the 2003 ISOC Symposium on Network and Distributed Systems Security (NDSS'03) . San Diego, CA. 75--85. Goodell, G., Aiello, W., Griffin, T., Ioannidis, J., McDaniel, P., and Rubin, A. 2003. Working around BGP: An incremental approach to improving security and accuracy of interdomain routing. In Proceedings of the 2003 ISOC Symposium on Network and Distributed Systems Security (NDSS'03). San Diego, CA. 75--85."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2004.41"},{"key":"e_1_2_1_17_1","doi-asserted-by":"crossref","unstructured":"Hedrick C. 1988. Routing information protocol. IETF RFC 1058.  Hedrick C. 1988. Routing information protocol. IETF RFC 1058.","DOI":"10.17487\/rfc1058"},{"key":"e_1_2_1_18_1","doi-asserted-by":"crossref","unstructured":"Heffernan A. 1998. Protection of BGP sessions via the TCP MD5 signature option. IETF RFC 2385.   Heffernan A. 1998. Protection of BGP sessions via the TCP MD5 signature option. IETF RFC 2385.","DOI":"10.17487\/rfc2385"},{"key":"e_1_2_1_19_1","doi-asserted-by":"crossref","unstructured":"Housley R. Ford W. Polk W. and Solo D. 1999. Internet X.509 public key infrastructure---certificate and CRL profile. IETF RFC 2459.   Housley R. Ford W. Polk W. and Solo D. 1999. Internet X.509 public key infrastructure---certificate and CRL profile. IETF RFC 2459.","DOI":"10.17487\/rfc2459"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1015467.1015488"},{"key":"e_1_2_1_21_1","unstructured":"IRR. 2005. Internet routing registry. http:\/\/www.irr.net.  IRR. 2005. Internet routing registry. http:\/\/www.irr.net."},{"key":"e_1_2_1_22_1","volume-title":"Proceedings of the 2nd Annual Conference on Adhoc Networks and Wireless (ADHOCNOW'03)","author":"Just M.","unstructured":"Just , M. , Kranakis , E. , and Wan , T . 2003. Resisting malicious packet dropping in wireless ad hoc networks . In Proceedings of the 2nd Annual Conference on Adhoc Networks and Wireless (ADHOCNOW'03) . Just, M., Kranakis, E., and Wan, T. 2003. Resisting malicious packet dropping in wireless ad hoc networks. In Proceedings of the 2nd Annual Conference on Adhoc Networks and Wireless (ADHOCNOW'03)."},{"key":"e_1_2_1_23_1","doi-asserted-by":"crossref","unstructured":"Kaufman C. 2005. The internet key exchange (IKEv2) protocol. IETF RFC 4306.  Kaufman C. 2005. The internet key exchange (IKEv2) protocol. IETF RFC 4306.","DOI":"10.17487\/rfc4306"},{"key":"e_1_2_1_24_1","doi-asserted-by":"crossref","unstructured":"Kent S. 2003. Securing the border gateway protocol: A status update. In Seventh IFIP TC-6 TC-11 Conference on Communications and Multimedia Security.  Kent S. 2003. Securing the border gateway protocol: A status update. In Seventh IFIP TC-6 TC-11 Conference on Communications and Multimedia Security.","DOI":"10.1007\/978-3-540-45184-6_4"},{"key":"e_1_2_1_25_1","doi-asserted-by":"crossref","unstructured":"Kent S. 2005. IP encapsulating security payload (ESP). IETF RFC 4303.  Kent S. 2005. IP encapsulating security payload (ESP). IETF RFC 4303.","DOI":"10.17487\/rfc4303"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/11774716_10"},{"key":"e_1_2_1_27_1","doi-asserted-by":"crossref","unstructured":"Kent S. and Atkinson P. 1998a. Security architecture for the Internet protocol. IETF RFC 2401.   Kent S. and Atkinson P. 1998a. Security architecture for the Internet protocol. IETF RFC 2401.","DOI":"10.17487\/rfc2401"},{"key":"e_1_2_1_28_1","doi-asserted-by":"crossref","unstructured":"Kent S. and Atkinson P. 1998b. IP encapsulating security payload (ESP). IETF RFC 2406.   Kent S. and Atkinson P. 1998b. IP encapsulating security payload (ESP). IETF RFC 2406.","DOI":"10.17487\/rfc2406"},{"key":"e_1_2_1_29_1","volume-title":"Proceedings of the 2000 ISOC Symposium on Network and Distributed Systems Security (NDSS'00)","author":"Kent S.","unstructured":"Kent , S. , Lynn , C. , Mikkelson , J. , and Seo , K . 2000. Secure border gateway protocol (S-BGP) real world performance and deployment issues . In Proceedings of the 2000 ISOC Symposium on Network and Distributed Systems Security (NDSS'00) . Kent, S., Lynn, C., Mikkelson, J., and Seo, K. 2000. Secure border gateway protocol (S-BGP) real world performance and deployment issues. In Proceedings of the 2000 ISOC Symposium on Network and Distributed Systems Security (NDSS'00)."},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/49.839934"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-005-0432-z"},{"key":"e_1_2_1_32_1","volume-title":"Proceedings of the 6th Symposium on Recent Advances in Intrusion Detection (RAID'03)","author":"Kruegel C.","unstructured":"Kruegel , C. , Mutz , D. , Robertson , W. , and Valeur , F . 2003. Topology-based detection of anomalous BGP messages . In Proceedings of the 6th Symposium on Recent Advances in Intrusion Detection (RAID'03) . Kruegel, C., Mutz, D., Robertson, W., and Valeur, F. 2003. Topology-based detection of anomalous BGP messages. In Proceedings of the 6th Symposium on Recent Advances in Intrusion Detection (RAID'03)."},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/165611.165615"},{"key":"e_1_2_1_34_1","doi-asserted-by":"crossref","unstructured":"Lynn C. Kent S. and Seo K. 2003. X.509 Extensions for IP Addresses and AS Identifiers. draft-ietf-pkix-x509-ipaddr-as-extn-02.txt.  Lynn C. Kent S. and Seo K. 2003. X.509 Extensions for IP Addresses and AS Identifiers. draft-ietf-pkix-x509-ipaddr-as-extn-02.txt.","DOI":"10.17487\/rfc3779"},{"key":"e_1_2_1_35_1","volume-title":"Proceeding of 15th USENIX Security Symposium.","author":"Ma C.","unstructured":"Ma , C. , Hu , N. , and Li , Y . 2006. On the release of CRLs in public key infrastructure . In Proceeding of 15th USENIX Security Symposium. Ma, C., Hu, N., and Li, Y. 2006. On the release of CRLs in public key infrastructure. In Proceeding of 15th USENIX Security Symposium."},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.5555\/646646.699185"},{"key":"e_1_2_1_37_1","unstructured":"Murphy S. 2002a. BGP Security Vulnerabilities Analysis. draft-murphy-bgp-vuln-00.txt.  Murphy S. 2002a. BGP Security Vulnerabilities Analysis. draft-murphy-bgp-vuln-00.txt."},{"key":"e_1_2_1_38_1","unstructured":"Murphy S. 2002b. BGP Security Protections. draft-murphy-bgp-protect-00.txt.  Murphy S. 2002b. BGP Security Protections. draft-murphy-bgp-protect-00.txt."},{"key":"e_1_2_1_39_1","doi-asserted-by":"crossref","unstructured":"Nicol D. Smith S. and Zhao M. 2004. Evaluation of efficient security for BGP route announcements using parallel simulation. Simulation Pratice and Theory Journal Special Issue on Modeling 187--216.  Nicol D. Smith S. and Zhao M. 2004. Evaluation of efficient security for BGP route announcements using parallel simulation. Simulation Pratice and Theory Journal Special Issue on Modeling 187--216.","DOI":"10.1016\/j.simpat.2003.10.003"},{"key":"e_1_2_1_41_1","volume-title":"Proceedings of 1997 IEEE Symposium on Security and Privacy. 10--20","author":"Reiter M.","unstructured":"Reiter , M. and Stubblebine , S . 1997. Toward acceptable metrics of authentication . In Proceedings of 1997 IEEE Symposium on Security and Privacy. 10--20 . Reiter, M. and Stubblebine, S. 1997. Toward acceptable metrics of authentication. In Proceedings of 1997 IEEE Symposium on Security and Privacy. 10--20."},{"key":"e_1_2_1_42_1","doi-asserted-by":"crossref","unstructured":"Rekhter Y. and Li T. 1995. A border gateway protocol 4 (BGP 4). IETF RFC 1771.   Rekhter Y. and Li T. 1995. A border gateway protocol 4 (BGP 4). IETF RFC 1771.","DOI":"10.17487\/rfc1771"},{"key":"e_1_2_1_43_1","unstructured":"Retana A. and White R. 2002. BGP Custom decision process. draft-retana-bgp-custom-decision-00.txt.  Retana A. and White R. 2002. BGP Custom decision process. draft-retana-bgp-custom-decision-00.txt."},{"key":"e_1_2_1_44_1","unstructured":"RouteViews. 2005. Route views project. http:\/\/www.routeviews.org.  RouteViews. 2005. Route views project. http:\/\/www.routeviews.org."},{"key":"e_1_2_1_45_1","volume-title":"IEEE DARPA Information Survivability Conference and Exposition II.","author":"Seo K.","unstructured":"Seo , K. , Lynn , C. , and Kent , S . 2001. Public-key infrastructure for the secure border gateway protocol (S-BGP) . In IEEE DARPA Information Survivability Conference and Exposition II. Seo, K., Lynn, C., and Kent, S. 2001. Public-key infrastructure for the secure border gateway protocol (S-BGP). In IEEE DARPA Information Survivability Conference and Exposition II."},{"key":"e_1_2_1_46_1","volume-title":"A Mathematical Theory of Evidence","author":"Shafer G.","unstructured":"Shafer , G. 1976. A Mathematical Theory of Evidence . Princeton University Press , Princeton, NJ . Shafer, G. 1976. A Mathematical Theory of Evidence. Princeton University Press, Princeton, NJ."},{"key":"e_1_2_1_47_1","volume-title":"Proceedings of the First Symposium on Networked Systems Design and Implementation (NSDI'04)","author":"Subramanian L.","unstructured":"Subramanian , L. , Roth , V. , Stoica , I. , Shenker , S. , and Katz , R . 2004. Listen and whisper: Security mechanisms for BGP . In Proceedings of the First Symposium on Networked Systems Design and Implementation (NSDI'04) , San Francisco, CA. Subramanian, L., Roth, V., Stoica, I., Shenker, S., and Katz, R. 2004. Listen and whisper: Security mechanisms for BGP. In Proceedings of the First Symposium on Networked Systems Design and Implementation (NSDI'04), San Francisco, CA."},{"key":"e_1_2_1_48_1","doi-asserted-by":"crossref","unstructured":"Villamizar C. Alaettinoglu C. Meyer D. and Murphy S. 1999. Routing policy system security. IETF RFC 2725.   Villamizar C. Alaettinoglu C. Meyer D. and Murphy S. 1999. Routing policy system security. IETF RFC 2725.","DOI":"10.17487\/rfc2725"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24852-1_8"},{"key":"e_1_2_1_51_1","volume-title":"Proceedings of the 2005 ISOC Symposium on Network and Distributed Systems Security (NDSS'05)","author":"Wan T.","year":"2005","unstructured":"Wan , T. , Kranakis , E. , and van Oorschot , P. 2005 . Pretty secure BGP (psBGP) . In Proceedings of the 2005 ISOC Symposium on Network and Distributed Systems Security (NDSS'05) . San Diego, CA. Wan, T., Kranakis, E., and van Oorschot, P. 2005. Pretty secure BGP (psBGP). In Proceedings of the 2005 ISOC Symposium on Network and Distributed Systems Security (NDSS'05). San Diego, CA."},{"key":"e_1_2_1_52_1","volume-title":"Proceedings of the NATO Advanced Studies Institute on Network Security and Intrusion Detection. Nork, Yerevan, Armenia. IOS Press (to appear","author":"Wan T.","year":"2007","unstructured":"Wan , T. , van Oorschot , P. , and Kranakis , E . 2007. A selective introduction to border gateway protocol (BGP) security issues . In Proceedings of the NATO Advanced Studies Institute on Network Security and Intrusion Detection. Nork, Yerevan, Armenia. IOS Press (to appear , 2007 ). Wan, T., van Oorschot, P., and Kranakis, E. 2007. A selective introduction to border gateway protocol (BGP) security issues. In Proceedings of the NATO Advanced Studies Institute on Network Security and Intrusion Detection. Nork, Yerevan, Armenia. IOS Press (to appear, 2007)."},{"key":"e_1_2_1_53_1","first-page":"15","article-title":"Securing BGP through secure origin BGP","volume":"6","author":"White R.","year":"2003","unstructured":"White , R. 2003 . Securing BGP through secure origin BGP . The Internet Protocol Journal 6 , 3, 15 -- 22 . White, R. 2003. Securing BGP through secure origin BGP. The Internet Protocol Journal 6, 3, 15--22.","journal-title":"The Internet Protocol Journal"},{"key":"e_1_2_1_54_1","unstructured":"White R. McPherson D. and Sangli S. 2004. Practical BGP. Addison-Wesley Reading MA.   White R. McPherson D. and Sangli S. 2004. Practical BGP. Addison-Wesley Reading MA."},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102139"},{"key":"e_1_2_1_56_1","volume-title":"Proceedings of 4th Annual PKI Research Workshop (PKI'05)","author":"Zhao M.","unstructured":"Zhao , M. , Smith , S. , and Nicol , D . 2005b. Evaluating the performance impact of PKI on BGP security . In Proceedings of 4th Annual PKI Research Workshop (PKI'05) . Gaithersburg, MD. Zhao, M., Smith, S., and Nicol, D. 2005b. Evaluating the performance impact of PKI on BGP security. In Proceedings of 4th Annual PKI Research Workshop (PKI'05). Gaithersburg, MD."},{"key":"e_1_2_1_57_1","volume-title":"The Official PGP User's Guide (second printing)","author":"Zimmermann P.","unstructured":"Zimmermann , P. 1995. The Official PGP User's Guide (second printing) . MIT Press , Cambridge, MA . Zimmermann, P. 1995. The Official PGP User's Guide (second printing). MIT Press, Cambridge, MA."},{"key":"e_1_2_1_58_1","doi-asserted-by":"crossref","unstructured":"Zsako J. 1999. PGP authentication for RIPE database updates. IETF RFC 2726.   Zsako J. 1999. PGP authentication for RIPE database updates. IETF RFC 2726.","DOI":"10.17487\/rfc2726"}],"container-title":["ACM Transactions on Information and System Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1266977.1266980","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1266977.1266980","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T14:52:14Z","timestamp":1750258334000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1266977.1266980"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2007,7]]},"references-count":56,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2007,7]]}},"alternative-id":["10.1145\/1266977.1266980"],"URL":"https:\/\/doi.org\/10.1145\/1266977.1266980","relation":{},"ISSN":["1094-9224","1557-7406"],"issn-type":[{"value":"1094-9224","type":"print"},{"value":"1557-7406","type":"electronic"}],"subject":[],"published":{"date-parts":[[2007,7]]},"assertion":[{"value":"2007-07-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}