What seems to be fluent and easy for most users of the internet, the technology that works to provide the World Wide Web is a lot more sophisticated that what most people think.
Among the many that works behind the background, is the Border Gateway Protocol.
Also called the 'BGP', it is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the Internet.
The last version at this time, is version 4 (BGP4), which corrected errors, clarified ambiguities and updated the specification with common industry practices. The version also introduced enhancement for Classless Inter-Domain Routing (CIDR) and the use of route aggregation to decrease the size of routing tables.
The update also allows BGP4 to carry a wide range of IPv4 and IPv6 "address families".
Fast forward to 2020, the web has changed tremendously.
When compared to 2006, the web has included a whole networks of networks that consist of websites, web apps and anything in between. It has an increasing number of mobile apps, and other services that run on top of it.
BGP is often likened to the postal service of the internet that enables infrastructure players to swiftly and automatically determine which routes are the fastest and the most effective for sending and receiving data across the complex digital topography.
Just like any other services and products, BGP also has flaws. Fortunately, the flaws won't cause problems to the web's operations, but unfortunately, the flaws can cause some bottlenecks that may lead to occasional online disruptions.
This is why heavy hitters like Google, Facebook and some others can often experience glitches, no matter how much resources they spent to keep their systems operational and running.
One of the main causes of this, is from the design weaknesses in the BGP itself.
One of the largest problems faced by BGP, is tied to the internet infrastructure as a whole. If the global routing table grows to the point where some older and less capable routers cannot cope with the memory requirements or the CPU load of maintaining the routing table, these routers will cease to be effective gateways between the parts of the Internet they connect.
Because of this, inevitably, traffic congestion can happen. And when this happens, entities like internet service providers can inadvertently advertise a bad route, which will then send data to oblivion.
What's more, the times when web titans go down because of BGP issues, the moments can attract bad actors to reroute user data to networks they control for interception.
This practice is known as "BGP hijacking" and has been used by hackers around the world, including for espionage and data theft.
Among some other reasons, and also after years of slow progress of implementing improvements and safeguards, a coalition of internet infrastructure partners is suggesting to make BGP more secure.
The group known as 'Mutually Agreed Norms for Routing Security' or MANRS, has announced a task force specifically dedicated to helping cloud services to adopt the filters and cryptographic checks needed to secure BGP.
In the past, MANRS has formed task forces for network operators and on internet exchange points, as well as on the physical hardware infrastructure where internet service providers (ISPs) and content delivery networks (CDNs) are exchanging data.
And this time, MANRS is expanding its task forces to also help cloud services secure BGP.
Following MANRS' announcement, organizations like Google and Cloudflare are showing their eagerness.
"I spent 20 years in financial services doing cybersecurity for big banks, but a little over two years ago I joined Google, because you start to see that the societal dependence on this infrastructure is so great," says Royal Hansen, vice president of security engineering for Google Cloud.
"My leverage was going to be so much bigger at a Google than it would ever be in one enterprise."
Aftab Siddiqui, the MANRS project lead and a senior manager of internet technology at the Internet Society, said that:
One of the main BGP safeguards MANRS promotes, is called the 'RPKI'.
Also called the "Routing Public Key Infrastructure," it's a public database of routes that have been cryptographically signed to ensure their validity. Since it was first introduced, a number of companies have started using it, and it gained further momentum when ISPs like AT&T, Telia, NTT and Cogent also came on board.
In November 2020, European network service provider RETN announced that it has implemented RPKI. Also in November, Google said that it completed RPKI registration for more than 99% of its routes.
"There is quite a bit of work that is involved in implementing all of this," said Bikash Koley, vice president of global networking at Google Cloud.
"And once you have all of that information you have to create ways of utilizing it to apply to your BGP policies in the form of filters etc. It takes significant engineering work and if you do it wrong then you actually can significantly impact users. So with MANRS we're trying to make this as easy a lift as possible for organizations."
"I feel that there is a common awareness and urgency that is forming across the internet," added Koley. "And we are definitely moving very fast on this, because we need to."
