Securing BGP
0 likes62 views
The document discusses resource public key infrastructure (RPKI) and its role in securing the Border Gateway Protocol (BGP). It describes how RPKI allows IP address holders to create digitally signed statements about their BGP routing intentions. This allows network operators to make more informed routing decisions by verifying the origin of BGP announcements. The RIPE NCC hosts an RPKI solution that involves repositories of route origin authorizations (ROAs) and certificates that are validated to determine whether a BGP announcement is authorized. Tools are provided for interacting with and monitoring the RPKI system.
Securing BGP
- 1. One Hop At A Time Securing BGP Nathalie Trenaman | 21 October | Cybersprint Office
- 2. Nathalie Trenaman | Cybersprint | 21 October 2021 RIPE NCC • Not-for-profit, membership based (vereniging) • Funded by membership fees • Based in Amsterdam • Established in 1992 • ~160 employees 2
- 3. Nathalie Trenaman | Cybersprint | 21 October 2021 What We Do • Distributing IPv6, IPv4, AS numbers to 24.000 members in 76 countries • Operating the largest internet measurement platform (ATLAS) • RIPE Database • RPKI • K-root 3
- 4. Nathalie Trenaman | Cybersprint | 21 October 2021 Interesting Times! 4
- 5. Nathalie Trenaman | Cybersprint | 21 October 2021 Administrative Trends… 5 • Source: https://ipv4marketgroup.com/ipv4-pricing/
- 6. BGP A More Technical Part
- 7. Nathalie Trenaman | Cybersprint | 21 October 2021 Routing on the Internet 7 “BGP protocol” Can I trust B? Routing table 194.x.x.x = B Routing table 193.x.x.x = A Is A correct? A 193.x.x.x B 194.x.x.x B: “I have 194.x.x.x” A: “I have 193.x.x.x”
- 8. Nathalie Trenaman | Cybersprint | 21 October 2021 Routing on the Internet 8 Can I trust B? Routing table 194.x.x.x = B Routing table 193.x.x.x = A Is A correct? A 193.x.x.x B 194.x.x.x B: “I have 194.x.x.x” A: “I have 193.x.x.x” RIPE Database “Internet Routing Registry”
- 9. Nathalie Trenaman | Cybersprint | 21 October 2021 Accidents Happen • Fat Fingers - 2 and 3 are really close on our keyboards…. • Policy Violations (leaks) - Oops, we did not want this to go on the public Internet • Incidents attract media attention nowadays - Facebook, anyone? 9
- 10. Nathalie Trenaman | Cybersprint | 21 October 2021 Or Worse…. • April 2018 - BGP and DNS Hijack - Targeting MyEtherWallet - Unnoticed for two hours 10
- 11. Nathalie Trenaman | Cybersprint | 21 October 2021 Incidents Are Common • 2020 Routing Security Review - 2477 BGP hijack events - 1396 Route Leaks 11 Source: https://www.manrs.org/2021/02/bgp-rpki-and-manrs-2020-in-review/
- 12. Nathalie Trenaman | Cybersprint | 21 October 2021 Internet Routing Registry • Many exist, most widely used - RIPE Database - RADB • Verification of holdership over resources - RIPE Database for RIPE Region resources only - RADB allows paying customers to create any object - Lots of the other IRRs do not formally verify holdership 12
- 13. Nathalie Trenaman | Cybersprint | 21 October 2021 Problem Statement • Some IRR data cannot be fully trusted - Accuracy - Incomplete data - Lack of maintenance • Not every RIR has an IRR - Third party databases need to be used (RADB, Operators) - No verification of who holds IPs/ASNs 13
- 14. Nathalie Trenaman | Cybersprint | 21 October 2021 • 14
- 15. Nathalie Trenaman | Cybersprint | 21 October 2021 Resource Public Key Infrastructure • Developed by the IETF, standardised in 2011 • Ties IP addresses and ASNs to public keys • Follows the hierarchy of the registries • Authorised statements from resource holders - “ASN X is authorised to announce my Prefix Y” - Signed, holder of Y • X.509 certificates with extensions for IP address and ASN 15
- 16. Nathalie Trenaman | Cybersprint | 21 October 2021 What It Does • Allows IP address holders to create digitally signed (and verifiable) statements about their BGP routing intentions • Allows network operators to make more informed (and trusted) routing decisions 16
- 17. Nathalie Trenaman | Cybersprint | 21 October 2021 RPKI Certificate Structure Certificate hierarchy follows allocation hierarchy 17 Member Member Member ROA ROA ROA ARIN APNIC RIPE LACNIC AFRINIC
- 18. Nathalie Trenaman | Cybersprint | 21 October 2021 Two elements of RPKI 18 Signing Create ROAs Validating Verifying others
- 19. Nathalie Trenaman | Cybersprint | 21 October 2021 RIPE NCC Hosted Solution 19
- 20. Nathalie Trenaman | Cybersprint | 21 October 2021 How It Works 20 Repository Repository Repository Repository Repository List of ROAs Certi fi cates RIPE NCC ARIN APNIC AFRINIC LACNIC Validator • Location of RIR repositorie s • Root’s public key
- 21. Nathalie Trenaman | Cybersprint | 21 October 2021 21
- 22. Nathalie Trenaman | Cybersprint | 21 October 2021 22
- 23. Nathalie Trenaman | Cybersprint | 21 October 2021 Two elements of RPKI 23 Signing Create your ROAs Validating Verifying others
- 24. Nathalie Trenaman | Cybersprint | 21 October 2021 RPKI Validation • Verifying the information provided by the others • Goal is to validate the “origin of BGP announcements” • Known as Route Origin Validation (ROV) • :-( : You only can verify the origin • :-): It does prevent most typos to spread 24
- 25. Nathalie Trenaman | Cybersprint | 21 October 2021 Relying Party 25 AS111 10.0.7.30/22 AS222 10.0.6.10/24 AS333 10.4.17.5/20 AS111 10.0.7.30/22 AS111 10.0.7.30/22 AS111 10.0.7.30/22 BGP Announcements BETTER ROUTING DECISIONS Repositories List of ROAs Certi fi cates Validator
- 26. Nathalie Trenaman | Cybersprint | 21 October 2021 Routing on the Internet 26 Is A correct? A 192.0.2.0/24 B 193.0.24.0/21 A: “I have 192.0.2.0/24” 1. Create route authorisation record (ROA) 2. Validate route RPKI Repository A is authorised to announce 192.0.2.0/24 BGP
- 27. Nathalie Trenaman | Cybersprint | 21 October 2021 What’s Next? • Full AS Path validation! • All IETF drafts/standards are building blocks on RPKI - BGPSec - ASPA - AS-Cones - Blockchain (just kidding!) 27
- 28. Nathalie Trenaman | Cybersprint | 21 October 2021 Very Useful Tools • https://rpki-validator.ripe.net/ui/ - A public user interface for a validator (Routinator) • https://ihr.iijlab.net/ihr/en-us/ - To see RPKI invalid BGP routes per country (and a lot of other cool stuff) • https://ring.nlnog.net/ - Shell access (ping, trace route) from 479 networks in 55 countries • https://atlas.ripe.net/ - Largest free internet measurement platform, 11838 vantage points 28
- 29. Nathalie Trenaman | Cybersprint | 21 October 2021 How To Get Started? • Read up! This is a great starting point: - https://rpki.readthedocs.io/en/latest/ •Tons of help & troubleshooting BGP on IRC (yeah..) - https://nlnog.net/irc/ #NLNOG on IRCnet • Global RPKI “helpline” (350+ experts) on Discord - https://discord.com/invite/WaPgs8vEKy • Drop me an e-mail :) nathalie@ripe.net 29
- 30. Questions ?