Border gateway protocol (BGP) hijacks prefix signing using public/private keys

1. A method for accomplishing distributed prefix signing Border Gateway Protocol (BGP) security, comprising:

generating a signature for a new prefix announcement by a processor in a first peer component of a network;

including, by the processor, the signature in a transitive BGP attribute of the new prefix announcement; and

sending, by the processor, the new prefix announcement that includes the transitive BGP attribute that includes the signature to a second peer component of the network.

2. The method of claim 1 , further comprising:

publishing a public key in a Domain Name System (DNS) text record; and

using a private origination key to generate the signature.

3. The method of claim 2 , wherein publishing the public key in the DNS text record comprises publishing multiple public keys in multiple DNS text records.

4. The method of claim 2 , further comprising revoking the public key by updating the DNS text record.

5. A computing device operating as a first peer in a network, comprising:

a processor in the first peer component of the network, the processor configured with processor-executable software instructions to:

generate a signature for a new prefix announcement;

include the signature in a transitive Border Gateway Protocol (BGP) attribute of the new prefix announcement; and

send the new prefix announcement that includes the transitive BGP attribute that includes the signature to a second peer component of the network.

6. The computing device of claim 5 , wherein the processor is further configured to:

publish a public key in a Domain Name System (DNS) text record; and

use a private origination key to generate the signature.

7. The computing device of claim 6 , wherein the processor is configured to publish the public key in the DNS text record by publishing multiple public keys in multiple DNS text records.

8. The computing device of claim 6 , wherein the processor is configured with processor-executable software instructions to revoke the public key by updating the DNS text record.

9. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in a computing device operating as a first peer in a network to perform operations comprising:

generating, by the first peer component of the network, a signature for a new prefix announcement;

including the signature in a transitive Border Gateway Protocol (BGP) attribute of the new prefix announcement; and

sending the new prefix announcement that includes the transitive BGP attribute that includes the signature to a second peer component of the network.

10. The non-transitory computer readable storage medium of claim 9 , wherein the stored processor-executable software instructions are configured to cause the processor in the computing device to perform operations further comprising:

publishing a public key in a Domain Name System (DNS) text record; and

using a private origination key to generate the signature.

11. The non-transitory computer readable storage medium of claim 10 , wherein the stored processor-executable software instructions are configured to cause the processor in the computing device to perform operations such that publishing the public key in the DNS text record comprises publishing multiple public keys in multiple DNS text records.

12. The non-transitory computer readable storage medium of claim 10 , wherein the stored processor-executable software instructions are configured to cause the processor in the computing device to perform operations further comprising revoking the public key by updating the DNS text record.

13. A computing device operating as a first peer in a network, comprising:

means for generating, by the first peer component of the network, a signature for a new prefix announcement;

means for including the signature in a transitive Border Gateway Protocol (BGP) attribute of the new prefix announcement; and

means for sending the new prefix announcement that includes the transitive BGP attribute that includes the signature to a second peer component of the network.

14. The computing device of claim 13 , further comprising:

means for publishing a public key in a Domain Name System (DNS) text record; and

means for using a private origination key to generate the signature.

15. The computing device of claim 14 , wherein the means for publishing the public key in the DNS text record comprises means for publishing multiple public keys in multiple DNS text records.

16. The computing device of claim 14 , further comprising means for revoking the public key by updating the DNS text record.

17. A distributed prefix signing Border Gateway Protocol (BGP) security method, comprising:

receiving, by a processor in a second peer component of a network, a prefix announcement from a first peer component of the network that includes a transitive BGP attribute that includes a signature for the prefix announcement that was generated by the first peer component of the network; and

ignoring, by the processor, the prefix announcement in response to determining that the signature included in the transitive BGP attribute of the received prefix announcement is not valid.

18. A computing device, comprising:

a processor of a second peer component of a network, the processor configured with processor-executable software instructions to:

receive, from a first peer component of the network, a prefix announcement that includes a transitive BGP attribute that includes a signature for the prefix announcement that was generated by the first peer component of the network; and

ignore the prefix announcement in response to determining that the signature included in the transitive BGP attribute of the received prefix announcement is not valid.

19. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor in a computing device to perform operations comprising:

receiving, by a second peer component in a network from a first peer component in the network, a prefix announcement that includes a transitive BGP attribute that includes a signature for the prefix announcement that was generated by the first peer component in the network; and

ignoring the prefix announcement in response to determining that the signature included in the transitive BGP attribute of the received prefix announcement is not valid.

20. A computing device, comprising:

means for receiving, by a second peer component in a network from a first peer component in the network, a prefix announcement that includes a transitive BGP attribute that includes a signature for the prefix announcement that was generated by the first peer component of the network; and

means for ignoring the prefix announcement in response to determining that the signature included in the transitive BGP attribute of the received prefix announcement is not valid.

21. A system, comprising:

a sender computing device comprising a sender processor, wherein the sender computing device is a first peer component of a network; and

a receiver computing device comprising a receiver processor, wherein the receiver computing device is a second peer component of the network,

wherein the sender processor is configured with processor-executable software instructions to:

generate a signature for a new prefix announcement;

include the signature in a transitive Border Gateway Protocol (BGP) attribute of the new prefix announcement; and

send the new prefix announcement that includes the transitive BGP attribute that includes the signature to the receiver computing device, and

wherein the receiver processor is configured with processor-executable software instructions to:

receive the new prefix announcement that includes the transitive BGP attribute that includes the signature from the sender computing device; and

ignore the new prefix announcement in response to determining that the signature included in the transitive BGP attribute of the received prefix announcement is not valid.

22. The system of claim 21 , wherein the sender processor is further configured to:

publish a public key in a Domain Name System (DNS) text record; and

use a private origination key to generate the signature.

23. The system of claim 22 , wherein the sender processor is configured to publish the public key in the DNS text record by publishing multiple public keys in multiple DNS text records.

24. The system of claim 22 , wherein the sender processor is configured with processor-executable software instructions to revoke the public key by updating the DNS text record.

25. The system of claim 21 , wherein the sender computing device is a route origination entity in an autonomous network.