Abstract: The border gateway protocol (BGP) is currently the de facto interdomain routing standard in the Internet, with its security based on the authenticity and integrity of autonomous systems (AS) identities and paths. However, BGP itself lacks intrinsic security mechanisms, and its security issues have garnered significant attention. Blockchain, as an innovative technology for building a new generation of information infrastructure, can establish a distributed multi-party trust system in an open Internet environment. It offers technical solutions to the issues and challenges encountered in traditional BGP security enhancement. According to technology development and security iteration, this paper categorizes the BGP security enhancement into three progressive stages: the theoretical exploration stage represented by secure border gateway protocol (S-BGP), the practical application stage with resource public key infrastructure (RPKI) as the security foundation, and the innovative development stage with the blockchain technology. Firstly, this paper analyzes the vulnerabilities in BGP routing propagation methods and routing policies, along with three typical security threats: prefix hijacking, path spoofing, and route leaks. Next, traditional BGP security enhancement techniques and research context are reviewed, with a particular focus on proactive defense and anomaly detection mechanisms to counter erroneous route announcement attacks. Then, following a brief introduction to the fundamental principles of blockchain technology, the paper explores the implementation concepts, paths, and methods of blockchain-based BGP security enhancements, utilizing the blockchain’s characteristics of decentralization, tamper resistance, traceability, and distributed deployment. Finally, the challenges faced in BGP security enhancement with blockchain technology are discussed, and future research directions are outlined.

Key words: border gateway protocol, security enhancement, blockchain, resource public key infrastructure, route attestation

摘要： 边界网关协议（BGP）是目前互联网中事实上的域间路由标准，其安全性建立在自治系统（AS）身份及路径真实完整基础上，但BGP自身缺乏相应的安全保障机制，其安全问题备受关注。区块链作为构建新一代信息基础设施的创新技术，支撑在开放互联网环境中构建分布式多方信任体系，为当前传统BGP安全增强中遇到的问题和挑战提供了技术应对。根据技术发展和安全迭代，将BGP安全增强划分为3个递进阶段：以安全边界网关协议（S-BGP）为代表的理论创新阶段，以资源公钥基础设施（RPKI）为安全基础的应用实践阶段，以及基于区块链技术的创新发展阶段。分析BGP路由传播方式和路由策略的脆弱性，以及前缀劫持、路径伪造和路由泄露3类典型的安全威胁方式；梳理传统BGP安全增强技术路线和研究脉络，重点从主动防御和异常检测两个方面讨论针对错误路由宣告攻击的应对机制；在简要介绍区块链技术基本原理的基础上，利用区块链的去中心化、防篡改、可溯源、分布式部署等特性，重点探讨基于区块链的BGP安全增强技术的实现思想、路径和方法；主要结合区块链技术的应用，讨论BGP安全增强中面临的挑战，并对未来研究方向进行展望。

关键词: 边界网关协议, 安全增强, 区块链, 资源公钥基础设施, 路由认证