Home › M3AAWG Blog › How Resource Public Key Infrastructure (RPKI) Can Help Make Internet Routing More Secure
April 05, 2022

Author: Names and Numbers Committee

 

RPKI can be an effective anti-abuse tool by helping to not only clean up Internet routing, but to make it more secure by working to prevent leaks and route hijacks. These were some of the topics covered by a panel at the most recent Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) meeting in San Francisco. The panel, titled “Implementing RPKI,” stemmed from an open-round table discussion at a previous M3AAWG meeting: “How to Encourage Adoption of RPKI to Help Stop Abuse of Internet Number Resources.” This RPKI session was chaired by the Names and Numbers Committee and featured Brad Gorman from ARIN and Rich Compton from Charter Communications, each presenting different perspectives on RPKI. The topics covered included a high-level overview of routing security, and a more in-depth look at RPKI, and how it can be an effective anti-abuse tool in helping to prevent route hijacks. The discussion also highlighted the three current options for RPKI deployment — hosted, delegated, and hybrid and covered the components of each. Also included in the discussion was an implementer's experience with deploying RPKI into their company network, the steps they took to deploy it, and the lessons they learned.

What is RPKI?

RPKI stands for Resource Public Key Infrastructure and its purpose is to be one of the main building blocks behind routing security on the Internet. Using cryptographically verifiable certificates, RPKI allows IP address holders to create public statements specifying which Autonomous Systems are authorized to originate their IP address prefixes. These statements, known as Route Origin Authorizations (ROAs), allow network operators to make informed routing decisions, and help secure Internet routing in general.

Why use it?

Internet routing is dependent upon many chains of relationships that are based on mutual trust. Each party trusts that the route used to transmit information is safe, accurate, and will not be maliciously altered. This was sufficient in the early stages of Internet development but has become increasingly vulnerable to attack as the Internet’s resources have seen a massive increase in usage. As IPv4 address space continues to deplete, it’s increasingly important to strengthen your routing security. RPKI helps to ensure that Internet number resource holders are certifiably linked to those resources, and reliable routing origin data is available to help determine routing decisions.

Here are a few examples of when RPKI could have prevented disaster:

Internet routing today is vulnerable to attack and hijacking, and the provisioning/use of certificates is one of the steps required to make routing more secure. Widespread RPKI adoption will help simplify IP address holder verification and routing decision-making globally.

For more information from each Regional Internet Registry (RIR) on how to deploy RPKI see:

Additional email, messaging and online abuse best practices from M3AAWG are available here, https://www.m3aawg.org/published-documents.

Tags: 
RPKI

The views expressed in DM3Z are those of the individual authors and do not necessarily reflect M3AAWG policy.