Applying attestation to BGP-LS

1. An apparatus of a Border Gateway Protocol-Link State (BGP-LS) environment, the apparatus comprising:

a crypto-processor;

one or more processors; and

one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions operable when executed by the one or more processors to cause the one or more processors to perform operations comprising:

receiving an attestation token generated by the crypto-processor;

generating a determination of whether the attestation token is valid;

computing a trust level for a first component based at least on the determination of whether the attestation token is valid;

encoding a Node Network Layer Reachability Information (NLRI) type, the trust level and the attestation token in a BGP-LS signaling message, wherein the trust level represents a level of trustworthiness of the NLRI type; and

sending the BGP-LS signaling message with the trust level and the encoded attestation token to a second component of the BGP-LS environment.

2. The apparatus of claim 1 , wherein:

the apparatus of the BGP-LS environment comprises a BGP-LS originator.

3. The apparatus of claim 1 , wherein encoding the attestation token in the BGP-LS signaling message comprises forming a Type-Length-Value (TLV) that is included in a BGP-LS attribute associated with a Node Network Layer Reachability Information (NLRI).

4. The apparatus of claim 1 , wherein encoding the attestation token in the BGP-LS signaling message comprises forming a TLV that is included in a BGP-LS attribute associated with a Link NLRI.

5. The apparatus of claim 1 , wherein the BGP-LS signaling message comprises a BGP Update message.

6. The apparatus of claim 1 , wherein the second component of the BGP-LS environment is a route reflector (RR).

7. The apparatus of claim 1 , wherein the attestation token further indicates whether or not the apparatus is running software with a valid chain of binary signatures.

8. The apparatus of claim 1 , the operations further comprising:

computing a trust level using the attestation token; and

encoding the trust level in the BGP-LS signaling message.

9. The apparatus of claim 1 , wherein:

the attestation token is encoded in a first TLV of the BGP-LS signaling message;

the trust level is encoded in a second TLV of the BGP-LS signaling message; and

the NLRI type of the BGP-LS signaling message represents:

a node;

a link;

an IPV4; or

an IPV6.

10. A method by an apparatus of a Border Gateway Protocol-Link State (BGP-LS) environment, the method comprising:

receiving an attestation token generated by the apparatus;

generating a determination of whether the attestation token is valid;

computing a trust level for a first component based at least on the determination of whether the attestation token is valid;

encoding a Node Network Layer Reachability Information (NLRI) type, the trust level and the attestation token in a BGP-LS signaling message, wherein the trust level represents a level of trustworthiness of the NLRI type; and

sending the BGP-LS signaling message with the trust level and the encoded attestation token to a second component of the BGP-LS environment.

11. The method of claim 10 , wherein:

the apparatus of the BGP-LS environment comprises a BGP-LS originator.

12. The method of claim 10 , wherein encoding the attestation token in the BGP-LS signaling message comprises forming a Type-Length-Value (TLV) that is included in a BGP-LS attribute associated with a Node Network Layer Reachability Information (NLRI).

13. The method of claim 10 , wherein encoding the attestation token in the BGP-LS signaling message comprises forming a TLV that is included in a BGP-LS attribute associated with a Link NLRI.

14. The method of claim 10 , wherein the BGP-LS signaling message comprises a BGP Update message.

15. The method of claim 10 , wherein the second component of the BGP-LS environment is a route reflector (RR).

16. One or more computer-readable non-transitory storage media embodying software that is operable when executed to cause an apparatus of a Border Gateway Protocol-Link State (BGP-LS) environment to:

receive an attestation token from a crypto-processor of the apparatus of the BGP-LS environment;

generate a determination of whether the attestation token is valid;

compute a trust level for a first component based at least on the determination of whether the attestation token is valid;

encode a Node Network Layer Reachability Information (NLRI) type, the trust level and the attestation token in a BGP-LS signaling message, wherein the trust level represents a level of trustworthiness of the NLRI type; and

send the BGP-LS signaling message with the trust level and the encoded attestation token to a second component of the BGP-LS environment.

17. The one or more computer-readable non-transitory storage media of claim 16 , wherein:

the apparatus of the BGP-LS environment comprises a BGP-LS originator.

18. The one or more computer-readable non-transitory storage media of claim 16 , wherein encoding the attestation token in the BGP-LS signaling message comprises forming a Type-Length-Value (TLV) that is included in a BGP-LS attribute associated with a Node Network Layer Reachability Information (NLRI).

19. The one or more computer-readable non-transitory storage media of claim 16 , wherein encoding the attestation token in the BGP-LS signaling message comprises forming a TLV that is included in a BGP-LS attribute associated with a Link NLRI.

20. The one or more computer-readable non-transitory storage media of claim 16 , wherein the BGP-LS signaling message comprises a BGP Update message.