Skip to main content
SpringerLink
Log in

RPKI Deployment: Risks and Alternative Solutions

  • Conference paper
  • First Online:
Genetic and Evolutionary Computing

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 387))

Abstract

In order to cope with the BGP (Border Gateway Protocol) security defects, RPKI (Resource Public Key Infrastructure) was proposed in IETF (Internet Engineering Task Force) in order to authenticate the relationship between IP prefix and its origination. Since 2012, a series of RPKI-related protocols have been standardized in IETF and the community has launched its actual deployment. However, with the global deployment of RPKI, a lot of concerns from technical, economic and political aspects have been raised. In this paper, we attempt to collect and analyze the most critical risks appeared during the RPKI deployment, and summarize the alternative solutions which have been presented to address or mitigate these risks.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 129.00
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 169.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Rekhter, Y., Li, T., Hares, S.: A Border Gateway Protocol 4 (BGP-4). IETF RFC4271 (January 2006)

    Google Scholar 

  2. IP hijacking. http://en.wikipedia.org/wiki/IP_hijacking

  3. Zhang, Z., Zhang, Y., Hu, Y.C., Mao, Z.M.: Practical Defenses Against BGP Prefix Hijacking. ACM CoNext (December 2007)

    Google Scholar 

  4. Ballani, H., Francis, P., Zhang, X.: A Study of Prefix Hijacking and Interception in the Internet. ACM SIGCOMM (2007)

    Google Scholar 

  5. Huston, G., Michaelson, G.: Validation of Route Origination Using the Resource Certificate Public Key Infrastructure (PKI) and Route Origin Authorizations (ROAs). IETF RFC 6483 (February 2012)

    Google Scholar 

  6. Lepinski, M., Kent, S., Kong, D.: A Profile for Route Origin Authorizations (ROAs). IETF RFC 6482 (February 2012)

    Google Scholar 

  7. Austein, R., Huston, G., Kent, S., Lepinski, M.: Manifests for the Resource Public Key Infrastructure (RPKI). IETF RFC 6486 (February 2012)

    Google Scholar 

  8. Huston, G., Loomans, R., Michaelson, G.: A Profile for Resource Certficate Repository Structure. IETF RFC 6481 (February 2012)

    Google Scholar 

  9. Weiler, S., Ward, D., Housley, R.: The rsync URI Scheme. IETF RFC 5781 (February 2010)

    Google Scholar 

  10. Rcynic. http://trac.rpki.net/wiki/doc/RPKI/RP

  11. Bush, R., Austein, R.: The Resource Public Key Infrastructure (RPKI) to Router Protocol. IETF RFC6810 (January 2013)

    Google Scholar 

  12. Gagliano, R., Kent, S., Turner, S.: Algorithm Agility Procedure for the Resource Public Key Infrastructure (RPKI). IETF RFC6916 (April 2013)

    Google Scholar 

  13. Bush, R.: Origin Validation Operation Based on the Resource Public Key Infrastructure (RPKI). IETF RFC7115 (January 2014)

    Google Scholar 

  14. Bruijnzeels, T., Muravskiy, O., Weber, B., Austein, R., Mandelberg, D.: RPKI Repository Delta Protocol. draft-ietf-sidr-delta-protocol-00 (February 2015)

    Google Scholar 

  15. Kisteleki, R., Haberman, B.: Securing RPSL Objects with RPKI Signatures. draft-ietf-sidr-rpsl-sig-06.txt (November 2014)

    Google Scholar 

  16. Lepinski, M. (ed.): BGPsec Protocol Specification. draft-ietf-sidr-bgpsec-protocol-11 (January 2015)

    Google Scholar 

  17. RPKI Dashboard. http://rpki.surfnet.nl/global.html

  18. RIPE NCC. http://certification-stats.ripe.net/

  19. Housley, R., Ashmore, S., Wallace, C.: Trust Anchor Format. IETF RFC5914 (June 2010)

    Google Scholar 

  20. Lepinski, M., Kent, S.: An Infrastructure to Support Secure Internet Routing. IETF RFC 6480 (February 2012)

    Google Scholar 

  21. IAB statement on the RPKI. https://www.ietf.org/mail-archive/web/ietf-announce/current/msg07028.html

  22. Malhotra, A., Goldberg, S.: RPKI vs ROVER Comparing the Risks of BGP Security Solutions. ACM SIGCOMM (2014)

    Google Scholar 

  23. Cooper, D., Heilman, E., Brogley, K., Reyzin, L., Goldberg, S.: On the Risk of Misbehaving RPKI Authorities. ACM Hotnets (November 2013)

    Google Scholar 

  24. Heilman, E., Cooper, D., Reyzin, L., Goldberg, S.: From the Consent of the Routed-Improving the Transparency of the RPKI. ACM SIGCOMM (2014)

    Google Scholar 

  25. rsync web pages. https://rsync.samba.org/

  26. Oleg Muravskiy: RPKI Repository Analysis and Delta Protocol. http://www.ietf.org/proceedings/86/slides/slides-86-sidr-2.pdf

  27. rsync considered inefficient and harmful. https://www.ietf.org/proceedings/89/slides/slides-89-sidr-6.pdf

  28. Weber, B.: RPKI Repository Distribution Protocol(RRDP). https://www.ietf.org/mail-archive/web/sidr/current/msg05367.html

  29. George, W.: Adventures in RPKI (non)deployment. https://www.nanog.org/sites/default/files/wednesday_george_adventuresinrpki_62.9.pdf

  30. Huston, G., Michaelson, G., Loomans, R.: A Profile for X.509 PKIX Resource Certificates. IETF RFC6487 (February 2012)

    Google Scholar 

  31. Example: Configuring Origin Validation for BGP. https://www.juniper.net/documentation/en_US/junos12.2/topics/topic-map/bgp-origin-as-validation.html

  32. GTA testbed. https://myicann.org/plan/project/5283e47c0038d63c92a626c2f26a59f6

  33. Stoyanov, H.: Cryptographically secure detection of mirror worlds. http://web.mit.edu/rsi/2014/all/hristo.pdf.gz

  34. Bruijnzeels, T., Muravskiy, O., Weber, B.: RPKI Repository Analysis and Requirements. draft-tbruijnzeels-sidr-repo-analysis-00 (February 2013)

    Google Scholar 

  35. Wang, C., Yan, Z., Hu, A.: An Efficient Data Management Architecture for the Large-scale Deployment of Resource Public Key Infrastructure. IEEE CECNet (December 2014)

    Google Scholar 

  36. Gill, P., Schapira, M., Goldberg, S.: Let the Market Drive Deployment: A Strategy for Transitioning to BGP Security. ACM SIGCOMM (2011)

    Google Scholar 

  37. Resource Public Key Infrastructure (RPKI). http://www.slideshare.net/SienaPerry/introduction-to-rpki-rpki-my-nog20140821shortv2

Download references

Author information

Authors and Affiliations

  1. China Internet Network Information Center, Beijing, China

    Xiaowei Liu, Zhiwei Yan, Guanggang Geng & Xiaodong Lee

  2. National Engineering Laboratory for Naming and Addressing, Beijing, China

    Xiaowei Liu, Zhiwei Yan, Guanggang Geng & Xiaodong Lee

  3. Asia University, Taichung, Taiwan

    Shian-Shyong Tseng

  4. Taiwan Network Information Center, Taipei, Taiwan

    Ching-Heng Ku

Authors
  1. Xiaowei Liu
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Zhiwei Yan
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Guanggang Geng
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Xiaodong Lee
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Shian-Shyong Tseng
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Ching-Heng Ku
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Xiaowei Liu .

Editor information

Editors and Affiliations

  1. Faculty of Engineering, University of Miyazaki, Miyazaki, Japan

    Thi Thi Zin

  2. School of Computer Science and Tech..., Harbin Institute of Technology Shenzhen Graduate School, Shenzhen, China

    Jerry Chun-Wei Lin

  3. College of Information Science and Engg, Fujian University of Technology, Fuzhou, China

    Jeng-Shyang Pan

  4. Faculty of Engineering, University of Miyazaki, Miyazaki, Japan

    Pyke Tin

  5. Faculty of Engineering, University of Miyazaki, Miyazaki, Japan

    Mitsuhiro Yokota

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer International Publishing Switzerland

About this paper

Cite this paper

Liu, X., Yan, Z., Geng, G., Lee, X., Tseng, SS., Ku, CH. (2016). RPKI Deployment: Risks and Alternative Solutions. In: Zin, T., Lin, JW., Pan, JS., Tin, P., Yokota, M. (eds) Genetic and Evolutionary Computing. Advances in Intelligent Systems and Computing, vol 387. Springer, Cham. https://doi.org/10.1007/978-3-319-23204-1_30

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-23204-1_30

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-23203-4

  • Online ISBN: 978-3-319-23204-1

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

Search

Navigation