Introduction to RPKI by Sheryl (Shane) Hermoso

773
-1

Published on

Published in: Internet
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
773
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
18
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Introduction to RPKI by Sheryl (Shane) Hermoso

  1. 1. Issue Date: Revision: Resource Public Key Infrastructure (RPKI) MyNOG 4 Conference 2014 2014/08 2
  2. 2. Overview •  Routing “incidents” •  RPKI Technical Details •  RPKI and BGPsec •  Components and Implementation •  Deployment Status in the RIRs •  APNIC Resource Certification 2
  3. 3. Misdirection / Hijacking Incidents •  YouTube Incident –  Occurred 24 Feb 2008 (for about 2 hours) –  Pakistan Telecom announced YT block •  Google (AS15169) services downed –  Occurred 5 Nov 2012 (for 30 minutes) –  Moratel Indonesia (AS23947) 3 How frequent do these hijacking incidents happen?
  4. 4. How we address this… •  A network should only originate his own prefix –  How do we verify? –  How do we avoid false advertisement? •  A provider should filter prefixes they propagate from customers –  Check the legitimacy of address (LoA) –  Transitive trust; BGP is a trust-based system 4
  5. 5. WHOIS DB – Legitimacy of Address 5
  6. 6. What is RPKI? •  Resource Public Key Infrastructure (RPKI) •  A robust security framework for verifying the association between resource holder and their Internet resources •  Created to address the issues in RFC 4593 “Generic Threats to Routing Protocols” •  Helps to secure Internet routing by validating routes –  Proof that prefix announcements are coming from the legitimate holder of the resource RFC 6480 – An Infrastructure to Support Secure Internet Routing (Feb 2012) 6
  7. 7. Benefits of RPKI - Routing •  Prevents route hijacking –  A prefix originated by an AS without authorization –  Reason: malicious intent •  Prevents mis-origination –  A prefix that is mistakenly originated by an AS which does not own it –  Also route leakage –  Reason: configuration mistake / fat finger 7
  8. 8. BGP Security (BGPsec) •  Extension to BGP that provides improved security for BGP routing •  Currently an IETF Internet draft •  Implemented via a new optional non-transitive BGP path attribute that contains a digital signature •  Two things: –  BGP Prefix Origin Validation (using RPKI) –  BGP Path Validation •  Similar efforts in the early days – IDR working group, S- BGP 8
  9. 9. “Right” to Resources •  ISP gets their resources from the RIR •  ISP notifies its upstream of the prefixes to be announced •  Upstream must check the WHOIS database if resource has been delegated to customer ISP We need to be able to authoritatively prove who owns an IP Prefix and what AS(s) may announce it. 9
  10. 10. RPKI Infrastructure •  A system to manage the creation and storage of digital certificates and the associated Route Origin Authorization documents •  Main Components: –  Certificate Authority (CA) –  Relying Party (RP) –  Routers with RPKI support 10
  11. 11. Issuing Party •  Internet Registries (RIR, NIR, Large LIRs) •  Acts as a Certificate Authority and issues certificates for customers •  Provides a web interface to issue ROAs for customer prefixes •  Publishes the ROA records APNIC RPKI Engine publication MyAPNIC GUI rpki.apnic.net Repository 11
  12. 12. Route Origin Authorization (ROA) •  A digital object that contains a list of address prefixes and one AS number •  It is an authority created by a prefix holder to authorize an AS Number to originate one or more specific route advertisements •  Publish an ROA using MyAPNIC 12
  13. 13. X.509 Certificate with 3779 Extension •  Resource certificates are based on the X.509 v3 certificate format (RFC 5280) •  Extended by RFC 3779 – binds a list of resources (IP, ASN) to the subject of the certificate •  SIA – Subject Information Access; contains a URI that references the directory X.509 Certificate RFC 3779 Extension SIA Owner's Public Key 13
  14. 14. Relying Party (RP) IANA Repo APNIC Repo RIPE Repo LIR Repo LIR Repo RP Cache (gather) Validated Cache RPKI-Rtr Protocol rpki.ripe.net Software which gathers data from CAs Also called RP cache or validator 14
  15. 15. RPKI Components 15 Trust Anchor RP CACHE Trust Anchor RPKI-Rtr Protocol APNIC RPKI Engine Trust Anchor publicationMyAPNIC GUI rpki.apnic.net ca0.rpki.net rpki.ripe.net
  16. 16. Router Origin Validation •  Router must support RPKI •  Checks an RP cache / validator •  Validation returns 3 states: –  Valid = when authorization is found for prefix X –  Invalid = when authorization is found for prefix X but not from ASN Y –  Unknown = when no authorization data is found •  Vendor support: –  Cisco IOS – solid in 15.2 –  Cisco IOS/XR – shipped in 4.3.2 –  Juniper – shipped in 12.2 –  Alcatel Lucent – in development 16
  17. 17. RIR Statistics 17 Ref: http://rpki.surfnet.nl/perrir.html Based on RIS Database dumps from RIPE-NCC
  18. 18. RPKI Monitor 18 Ref: NIST RPKI Monitor
  19. 19. APNIC RPKI Service •  Enhancement to the RIRs –  Offers verifiable proof of resource holdings •  Resource certification is an opt-in service –  Resource holders choose to request a certificate and profice their public key to be certified •  APNIC has integrated the RPKI management service into MyAPNIC for APNIC Member use 19
  20. 20. What you need to know •  You are encouraged to experiment, test, play and develop •  RPKI standards are still being developed, and the operating environment for RPKI use is still fragile •  It’s ready for testing and prototyping, but is probably not ready for production use just yet •  Please tell us what you find but don’t rely on it in your network yet 20
  21. 21. What You Can Do Now? •  Create ROA records in MyAPNIC •  Build an RP cache •  Configure your router to use the cache (or a public one) •  Create BGP policies Best to do it in a test environment for now! J 21
  22. 22. Build an RP Cache •  Download and install from rpki.net –  Instructions here: https://trac.rpki.net/wiki/doc/RPKI/Installation/ UbuntuPackages 22 The RP cache has a web interface
  23. 23. Configure Router to Use Cache router bgp 651nn … bgp rpki server tcp 10.0.0.3 port 43779 refresh 60 bgp rpki server tcp 147.28.0.84 port 93920 refresh 60 … 23 RPKI Lab – Randy Bush
  24. 24. BGP Table r0.sea#sh ip bgp Network Next Hop Metric LocPrf Weight Path * i I198.180.150.0 144.232.9.61 100 0 1239 3927 i *> I 199.238.113.9 0 2914 3927 i * I 129.250.11.41 0 2914 3927 i *> V198.180.152.0 199.238.113.9 0 2914 4128 i * V 129.250.11.41 0 2914 4128 i *> N198.180.155.0 199.238.113.9 0 2914 22773 i * N 129.250.11.41 0 2914 22773 i *> N198.180.160.0 199.238.113.9 0 2914 23308 13408 5752 i * N 129.250.11.41 0 2914 23308 13408 5752 i RPKI Lab – Randy Bush 24
  25. 25. More References •  Securing BGP –  The Internet Protocol Journal, Volume 14, No. 2 •  An Infrastructure to Support Secure Internet Routing –  RFC6480 •  A Reappraisal of Validation in the RPKI –  Labs.apnic.net/blabs •  An Introduction to Routing Security (and RPKI Tools) •  MyAPNIC Resource Certification Guide 25
  26. 26. Questions 26
  27. 27. You’re Invited! •  APNIC 38: Brisbane, Australia, 9-19 Sep 2014 •  APRICOT 2015: Fukuoka, Japan, 24 Feb-6 Mar 2015 27
  28. 28. THANK YOU www.facebook.com/APNIC www.twitter.com/apnic www.youtube.com/apnicmultimedia www.flickr.com/apnic www.weibo.com/APNICrir 28

×