A five-layer hardware-integrated architecture for securing inter-domain routing — discussion paper, v2.2 (August 2026)
The Border Gateway Protocol was sketched at the 12th IETF meeting in 1989 for a small community of mutually trusting researchers. RFC 1105 through RFC 4271 contain no cryptographic authentication of route announcements. Today more than 75,000 autonomous systems carry critical infrastructure traffic over that trust model, and RFC 4272 has documented its three structural weaknesses since 2006.
RPKI origin validation and ASPA path plausibility checking address operational threats — misconfiguration, route leaks, opportunistic hijacks. They were not designed for nation-state adversaries, compromised firmware, or Byzantine faults in the routing platform itself.
SRI is a vendor-agnostic architecture that complements RPKI rather than replacing it, adding five layers:
- Hardware root of trust — TPM-based platform attestation (building on RFC 9683/9684, RATS WG)
- Microkernel isolation — formally verified separation of routing functions
- Secure enclave route computation — route decisions inside a trusted execution environment
- Distributed consensus for routing authority — deliberately decoupled from route validation, so consensus latency never gates BGP convergence (the failure mode that helped kill BGPsec)
- BGP protocol extensions — an SRI path attribute carrying attestation evidence in RATS EAT format
Instead of binary valid/invalid, routers express trust tiers: a hardware-attested path can be preferred over a merely RPKI-valid one, with full backward compatibility and graceful degradation for legacy routes.
- Adoption is the binding constraint, not architecture. BGPsec, S-BGP and soBGP were all standardised or published and achieved essentially zero deployment. The paper includes a section on why, and its own fragility assessment scores governance coordination as the highest risk at 90%.
- Hardware dependency means a 10–12 year adoption curve tied to router refresh cycles.
- The cost figures are illustrative. The CapEx and NPV analysis is derived from published pricing and public refresh-cycle norms, not from operator data, and requires validation against real fleet economics before it carries weight.
- No operators, vendors, or standards participants have been consulted in preparing this document. It is published so that they can be.
See SRI-Discussion-Paper-v2_2.pdf for the full paper: threat model, standards analysis, architecture, quantitative performance analysis, validator governance, protocol specification, deployment economics, operational workflows, security considerations, legal framework, and research agenda.
Particularly on: whether the authority/validation decoupling actually survives contact with real convergence behaviour; validator governance and liability structure; the consensus protocol design; and the deployment economics. Open an issue, or write directly.
Corrects an unresolved citation marker, removes internal review-process references from the abstract and metadata, marks the financial analysis explicitly as illustrative, and removes two statements that implied operator consultation which never took place.
MIT License — see LICENSE.
Aaron Garcia [email protected]