Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key...
Transcript of Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key...
![Page 1: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/1.jpg)
Towards a Framework for Evaluating BGP Security
Olaf Maennel, Iain Phillips, Debbie Perouli,Randy Bush, Rob Austein, Askar Jaboldinov
CSET
August 6, 2012
1
![Page 2: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/2.jpg)
Resource Public Key Infrastructure (RPKI)
Security was not a concern in the first days of the Internet.
Things have changed...
2006 - 2008: RPKI Design, done mostly outside the IETF
2008 - present: RPKI in IETF sidr working group
Detect and prevent mis-origination:
a prefix is originated by an AS which does not own it.
2
![Page 3: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/3.jpg)
Large Scale TestingImplementations of the RPKI exist. Some initial tests have beenperformed.
The code is deployed by some RIRs and ISPs.
Not enough evidence that deployment will scale to the Internet of2020.
Propagation times of the RPKI objects (like certificates) critical forthe success of the system; could vary based on scale.
How do times change with more tiers of ASes, more layers ofcaches per AS, more load per certification/publication point orcache, ...?
TestBed experiments needed to answer the question:
does the proposed framework for AS origin validation scale?
3
![Page 4: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/4.jpg)
RPKI High Level View
CertificationWho is the legitimate owner of a prefix?
Who is authorized to announce it in BGP?
PublicationWho publishes, and how, the Route Origin Authorizations (ROAs)?
VerificationHow do the relying parties know which announcements to trust?
4
![Page 5: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/5.jpg)
Our Challenges
1 How do we deploy a testbed of hundreds of machines with RPKIconfigurations?
2 Interested in testing real vendor code (routers) and infrastructuresoftware (rpki).
3 There are many separate but coordinated device configurationsthat need to be created; a time consuming, repetitive and errorprone task.
5
![Page 6: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/6.jpg)
StarBED: ∼1000 Physical Machines
6
![Page 7: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/7.jpg)
Experiment Setup
Machine resources:
I StarBED VMs hosting caches and Certification Authorities (CAs)
I Junosphere for routers (currently ∼50 virtual routers)
Configuration:
Extend AutoNetkit to generate automatic configurations not onlyfor routers but also RPKI servers and caches
Design the abstractions needed for RPKI.
7
![Page 8: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/8.jpg)
Reduce the Load to the Publication Points
8
![Page 9: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/9.jpg)
What does a Tier 1 AS look like?
9
![Page 10: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/10.jpg)
What is Propagation?
The time from when a CA publishes an object (Cert or ROA) towhen a Relying Party receives it.
A Relying Party is a validated cache or a router via the rpki-rtrprotocol.
Measured by caches and routers logging every received object.
10
![Page 11: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/11.jpg)
What do Current Topologies look like?
11
![Page 12: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/12.jpg)
Early Results
0 20 40 60 80 100
0.0
0.2
0.4
0.6
0.8
1.0
pubd−to−caches
time (min)
cum
ulat
ive
dens
ity
12
![Page 13: Towards a Framework for Evaluating BGP Security · 2019-12-18 · Resource Public Key Infrastructure (RPKI) Security was not a concern in the first days of the Internet. Things have](https://reader034.fdocuments.in/reader034/viewer/2022050612/5fb2dd585156a9574317d0b6/html5/thumbnails/13.jpg)
Conclusion
BGP security is a concern. The RPKI is a solution.
We have designed the abstractions needed for RPKI to be testedin large experiments.
We have automated the configuration of the machines runningRPKI code.
We are performing large scale experiments.
13