What is BGPSEC and what security problem does it address?

• A. BGPSEC provides cryptographic validation of the BGP path (per-hop signatures) to prevent AS_PATH spoofing and hijacking.
• B. BGPSEC is a new routing protocol replacing BGP.
• C. BGPSEC encrypts whole BGP updates to protect privacy.
• D. BGPSEC is a firewall feature unrelated to routing.

Answer: (D)

BGPSEC provides cryptographic validation of the BGP path, allowing routers to verify that the AS_PATH and the announced route truly reflect the path traffic would take. Each AS along the path signs its portion of the path, so a receiving router can confirm that the path information is authentic and has not been altered. This directly addresses AS_PATH spoofing and route hijacking, where a malicious actor tries to advertise a prefix with a false or manipulated path to misroute traffic.

It’s not a replacement for BGP, nor does it encrypt whole updates for privacy, and it isn’t a firewall feature. The security gain comes from authenticating the path data in announcements, which requires a PKI and key management across ASes and introduces additional computational and operational overhead.