What are the current trends and developments in BGP origin validation with RPKI?

1 What is RPKI and how does it work?

RPKI is a cryptographic framework that allows ASes to create and publish digital certificates and statements that associate IP address blocks and AS numbers with their rightful owners. These certificates and statements are called Route Origin Authorizations (ROAs), and they can be used to verify the legitimacy of the origin AS of a BGP route. RPKI relies on a hierarchical structure of trust anchors, certificate authorities, and repositories, which are responsible for issuing, validating, and storing the RPKI data.

2 How does BGP origin validation with RPKI work?

BGP origin validation with RPKI is a process that involves two steps: first, a network operator configures a router or a server to act as a Relying Party (RP), which downloads and validates the RPKI data from the repositories. Second, the RP communicates with the BGP speakers in the network, and provides them with the validation status of the routes they receive from their peers. The validation status can be either valid, invalid, or unknown, depending on whether the route matches, contradicts, or has no corresponding ROA. The BGP speakers can then use this information to apply local policies and preferences to accept, reject, or modify the routes.

3 What are the benefits of BGP origin validation with RPKI?

BGP origin validation with RPKI can provide several benefits for network operators and the Internet community at large. First, it can improve the security and stability of the Internet routing system, by preventing or mitigating the impact of route hijacking or misconfiguration, which can cause traffic disruption, performance degradation, or data leakage. Second, it can increase the transparency and accountability of the routing system, by enabling network operators to verify and audit the origin of the routes they receive and announce. Third, it can foster the adoption of best practices and standards for IP address management and routing policy, by creating incentives and mechanisms for ASes to register and maintain their RPKI data.

4 What are the challenges and limitations of BGP origin validation with RPKI?

BGP origin validation with RPKI is not a silver bullet, and it also faces some challenges and limitations that need to be addressed. First, it requires the cooperation and participation of ASes to create and update their ROAs, and to configure their routers or servers to perform the validation and apply the policies. However, not all ASes have the resources, incentives, or awareness to do so, which can result in incomplete or inaccurate RPKI data, or low coverage or adoption of the validation process. Second, it depends on the availability and integrity of the RPKI infrastructure, which can be affected by technical failures, operational errors, or malicious attacks. Therefore, network operators need to monitor and secure their RPKI components, and implement backup or fallback mechanisms in case of problems. Third, it only addresses the origin AS of a route, and not the entire AS path or the destination prefix. Therefore, it cannot prevent or detect other types of BGP attacks or anomalies, such as path spoofing or prefix subverting.

5 How can you implement BGP origin validation with RPKI in your network?

If you want to implement BGP origin validation with RPKI in your network, you need to follow some steps and recommendations. First, you need to obtain and register your IP address blocks and AS numbers with your Regional Internet Registry (RIR), and create your ROAs using their online portal or API. You should also review and update your ROAs regularly, and ensure that they match your routing policy and announcements. Second, you need to choose and deploy a RP software or service that can download and validate the RPKI data from the repositories, and communicate with your BGP speakers. You should also configure your RP to use multiple trust anchors, repositories, and validation algorithms, and to monitor and report any errors or inconsistencies in the RPKI data. Third, you need to configure your BGP speakers to receive and process the validation status from your RP, and to apply your local policies and preferences based on the status. You should also test and verify your configuration and policy before applying it in production, and monitor and troubleshoot any issues or anomalies in your BGP routing table.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?