Resource Public Key Infrastructure (RPKI)
0 likes836 views
The document provides an overview of the Resource Public Key Infrastructure (RPKI) which aims to address routing incidents like hijacking and misdirection. It discusses how RPKI uses digital certificates and Route Origin Authorizations (ROAs) to validate that an Autonomous System is authorized to originate routes for specific IP address blocks. The key components of RPKI include Certificate Authorities, Relying Parties, and routers configured with RPKI support to filter routes based on validation of origin AS authorization. Deployment status at the Regional Internet Registries and an APNIC RPKI service are also covered.
Resource Public Key Infrastructure (RPKI)
- 1. Issue Date: Revision: Resource Public Key Infrastructure (RPKI) As part of bdNOG 2 Conference 11 November 2014 2014/11 2
- 2. Overview • Routing “incidents” • RPKI Technical Details • RPKI and BGPsec • Components and Implementation • Deployment Status in the RIRs • APNIC Resource Certification 2
- 3. Misdirection / Hijacking Incidents • YouTube Incident – Occurred 24 Feb 2008 (for about 2 hours) – Pakistan Telecom announced YT block • Google (AS15169) services downed – Occurred 5 Nov 2012 (for 30 minutes) – Moratel Indonesia (AS23947) 3 How frequent do these hijacking incidents happen?
- 4. How we address this… • A network should only originate his own prefix – How do we verify? – How do we avoid false advertisement? • A provider should filter prefixes they propagate from customers – Check the legitimacy of address (LoA) – Transitive trust; BGP is a trust-based system 4
- 5. WHOIS DB – Legitimacy of Address 5
- 6. What is RPKI? • Resource Public Key Infrastructure (RPKI) • A robust security framework for verifying the association between resource holder and their Internet resources • Created to address the issues in RFC 4593 “Generic Threats to Routing Protocols” • Helps to secure Internet routing by validating routes – Proof that prefix announcements are coming from the legitimate holder of the resource RFC 6480 – An Infrastructure to Support Secure Internet Routing (Feb 2012) 6
- 7. Benefits of RPKI - Routing • Prevents route hijacking – A prefix originated by an AS without authorization – Reason: malicious intent • Prevents mis-origination – A prefix that is mistakenly originated by an AS which does not own it – Also route leakage – Reason: configuration mistake / fat finger 7
- 8. BGP Security (BGPsec) • Extension to BGP that provides improved security for BGP routing • Currently an IETF Internet draft • Implemented via a new optional non-transitive BGP path attribute that contains a digital signature • Two things: – BGP Prefix Origin Validation (using RPKI) – BGP Path Validation • Similar efforts in the early days – IDR working group, S- BGP 8
- 9. “Right” to Resources • ISP gets their resources from the RIR • ISP notifies its upstream of the prefixes to be announced • Upstream must check the WHOIS database if resource has been delegated to customer ISP We need to be able to authoritatively prove who owns an IP Prefix and what AS(s) may announce it. 9
- 10. RPKI Infrastructure • A system to manage the creation and storage of digital certificates and the associated Route Origin Authorization documents • Main Components: – Certificate Authority (CA) – Relying Party (RP) – Routers with RPKI support 10
- 11. Issuing Party • Internet Registries (RIR, NIR, Large LIRs) • Acts as a Certificate Authority and issues certificates for customers • Provides a web interface to issue ROAs for customer prefixes • Publishes the ROA records APNIC RPKI Engine publication MyAPNIC GUI rpki.apnic.net Repository 11
- 12. Route Origin Authorization (ROA) • A digital object that contains a list of address prefixes and one AS number • It is an authority created by a prefix holder to authorize an AS Number to originate one or more specific route advertisements • Publish an ROA using MyAPNIC 12
- 13. X.509 Certificate with 3779 Extension • Resource certificates are based on the X.509 v3 certificate format (RFC 5280) • Extended by RFC 3779 – binds a list of resources (IP, ASN) to the subject of the certificate • SIA – Subject Information Access; contains a URI that references the directory X.509 Certificate RFC 3779 Extension SIA Owner's Public Key 13
- 14. Relying Party (RP) IANA Repo APNIC Repo RIPE Repo LIR Repo LIR Repo RP Cache (gather) Validated Cache RPKI-Rtr Protocol rpki.ripe.net Software which gathers data from CAs Also called RP cache or validator 14
- 15. RPKI Components 15 Trust Anchor RP CACHE Trust Anchor RPKI-Rtr Protocol APNIC RPKI Engine Trust Anchor publicationMyAPNIC GUI rpki.apnic.net ca0.rpki.net rpki.ripe.net
- 16. Router Origin Validation • Router must support RPKI • Checks an RP cache / validator • Validation returns 3 states: – Valid = when authorization is found for prefix X – Invalid = when authorization is found for prefix X but not from ASN Y – Unknown = when no authorization data is found • Vendor support: – Cisco IOS – solid in 15.2 – Cisco IOS/XR – shipped in 4.3.2 – Juniper – shipped in 12.2 – Alcatel Lucent – in development 16
- 17. RIR Statistics 17 Ref: http://rpki.surfnet.nl/perrir.html Based on RIS Database dumps from RIPE-NCC
- 18. RPKI Monitor 18 Ref: NIST RPKI Monitor
- 19. APNIC RPKI Service • Enhancement to the RIRs – Offers verifiable proof of resource holdings • Resource certification is an opt-in service – Resource holders choose to request a certificate and profice their public key to be certified • APNIC has integrated the RPKI management service into MyAPNIC for APNIC Member use 19
- 20. What you need to know • You are encouraged to experiment, test, play and develop • RPKI standards are still being developed, and the operating environment for RPKI use is still fragile • It’s ready for testing and prototyping, but is probably not ready for production use just yet • Please tell us what you find but don’t rely on it in your network yet 20
- 21. What You Can Do Now? • Create ROA records in MyAPNIC • Build an RP cache • Configure your router to use the cache (or a public one) • Create BGP policies Best to do it in a test environment for now! ☺ 21
- 22. Build an RP Cache • Download and install from rpki.net – Instructions here: https://trac.rpki.net/wiki/doc/RPKI/Installation/ UbuntuPackages 22 The RP cache has a web interface
- 23. Configure Router to Use Cache router bgp 651nn … bgp rpki server tcp 10.0.0.3 port 43779 refresh 60 bgp rpki server tcp 147.28.0.84 port 93920 refresh 60 … 23 RPKI Lab – Randy Bush
- 24. BGP Table r0.sea#sh ip bgp Network Next Hop Metric LocPrf Weight Path * i I198.180.150.0 144.232.9.61 100 0 1239 3927 i *> I 199.238.113.9 0 2914 3927 i * I 129.250.11.41 0 2914 3927 i *> V198.180.152.0 199.238.113.9 0 2914 4128 i * V 129.250.11.41 0 2914 4128 i *> N198.180.155.0 199.238.113.9 0 2914 22773 i * N 129.250.11.41 0 2914 22773 i *> N198.180.160.0 199.238.113.9 0 2914 23308 13408 5752 i * N 129.250.11.41 0 2914 23308 13408 5752 i RPKI Lab – Randy Bush 24
- 25. More References • Securing BGP – The Internet Protocol Journal, Volume 14, No. 2 • An Infrastructure to Support Secure Internet Routing – RFC6480 • A Reappraisal of Validation in the RPKI – Labs.apnic.net/blabs • An Introduction to Routing Security (and RPKI Tools) • MyAPNIC Resource Certification Guide 25
- 26. Questions 26