The services that make up the Internet are underpinned by a vast digital infrastructure that transfers and routes the data flows around the globe. Robust operation of this infrastructure is crucial as any disruption can lead to data misdirection, outages, or security breaches affecting millions of users. Without proper safeguards, attackers can exploit vulnerabilities to hijack routes, leak sensitive data, or cause widespread denial of service.
Researching routing security means understanding the evolving threat landscape, analyzing whether the currently deployed technologies are adequate, and developing new ideas for improving resilience.
RPKI Research
In the Internet, routing information is exchanged via the Border Gateway Protocol (BGP). Autonomous System (AS) peers advertise their routes to each other: which IP prefixes are reachable through which AS paths. However, BGP was designed with simplicity and efficiency in mind. BGP updates carry no authentication, leaving routers vulnerable to attacks such as prefix hijacks.
To improve security, the Resource Public Key Infrastructure (RPKI) serves as a source of trusted information to enable routers to validate announcements. Internet resources such as IP prefixes and AS numbers are delegated via certificates and CAs can issue authorization objects for the resources they control. For instance, so-called Route Origin Authorizations (ROAs) state which AS is authorized to originate specific IP prefixes. With this information, routers perform Route Origin Validation (ROV), identifying announcements whose prefix is covered by ROAs and filtering bogus announcements where the origin AS does not match the ROA information.
Architecture
RPKI consists of a globally distributed repository rooted in the Regional Internet Registries (RIRs): AFRINIC, APNIC, ARIN, LACNIC, and RIPE NCC. Logically, each CA operates its own Publication Point (PP) that is hosted at a repository server. CAs can then delegate their resources to child CAs by issuing certificates in their PP that point to another PP, possibly located on a different server. RPKI defines the objects that make up this structure and how the carried information is to be validated. So-called Relying Party validators (RPs) periodically crawls and verify the RPKI data and make it available to routers. Secure and stable operation of the repositories and the RPs is a necessity for RPKI to be effective.
Publications on the state of RPKI
Research Projects
Vulnerabilities in RP Implementations
Through our work, we have uncovered fundamental vulnerabilities in the design and implementation of RP software.
While RPs imposes strict validation procedures, availability could be threatened without breaking the underlying cryptographic primitives. In Stalloris, we identified a novel attack vector through drip-feeding data to RPs. This forced RPs to continuously retrieve data from the attacker repository server causing extended stalling.
In later work, we developed approaches to systematically identify weaknesses in RP input processing through fuzzing. With CURE, we introduced a novel platform for evaluating RP implementations, identifying a slate of vulnerabilities in RP software. Continuous improvements to CURE expanded it to become more efficient and effective.
The Future of RPKI
The current specification and deployment of RPKI faces several major questions regarding its scalability and resilience. We have published work aiming to provide possible paths forward in providing algorithm agility, reducing operational overhead and assessing the system maturity.