RPKI is Coming of Age: A Longitudinal Study of RPKI Deployment and Invalid Route Origins

Taejoong Chung, Emile Aben, Tim Bruijnzeels, Balakrishnan Chandrasekaran, David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove, Roland van Rijswijk-Deij, John Rula, Nick Sullivan

Research output: Chapter in Book / Report / Conference proceedingConference contributionAcademicpeer-review

Abstract

Despite its critical role in Internet connectivity, the Border Gateway Protocol (BGP) remains highly vulnerable to attacks such as prefix hijacking, where an Autonomous System (AS) announces routes for IP space it does not control. To address this issue, the Resource Public Key Infrastructure (RPKI) was developed starting in 2008, with deployment beginning in 2011. This paper performs the first comprehensive, longitudinal study of the deployment, coverage, and quality of RPKI.We use a unique dataset containing all RPKI Route Origin Authorizations (ROAs) from the moment RPKI was first deployed, more than 8 years ago. We combine this dataset with BGP announcements from more than 3,300 BGP collectors worldwide. Our analysis shows the after a gradual start, RPKI has seen a rapid increase in adoption over the past two years. We also show that although misconfigurations were rampant when RPKI was first deployed (causing many announcements to appear as invalid) they are quite rare today. We develop a taxonomy of invalid RPKI announcements, then quantify their prevalence. We further identify suspicious announcements indicative of prefix hijacking and present case studies of likely hijacks.Overall, we conclude that while misconfigurations still do occur, RPKI is "ready for the big screen," and routing security can be increased by dropping invalid announcements. To foster reproducibility and further studies, we release all RPKI data and the tools we used to analyze it into the public domain.
Original languageEnglish
Title of host publicationProceedings of the Internet Measurement Conference
Place of PublicationNew York, NY, USA
PublisherAssociation for Computing Machinery
Pages406–419
ISBN (Electronic)9781450369480
ISBN (Print)9781450369480
DOIs
Publication statusPublished - 2019

Publication series

NameIMC '19
PublisherAssociation for Computing Machinery

Funding

We thank the anonymous reviewers and our shepherd, Olaf Maen-nel, for their helpful comments. This research was supported in part by NSF grants CNS-1850465, CNS-1564143, CNS-1901325, CNS-1900879, CNS-1563320, CNS-1901090, CNS-1901047 and EC H2020 Project CONCORDIA GA 830927, and made possible by Akamai Technologies and Cloudflare.

FundersFunder number
Akamai Technologies and Cloudflare
EC H2020 Project CONCORDIA GA 830927CONCORDIA GA 830927
National Sleep FoundationCNS-1901047, CNS-1563320, CNS-1901090, CNS-1901325, CNS-1564143, CNS-1900879, CNS-1850465, EC
Horizon 2020 Framework Programme830927

    Fingerprint

    Dive into the research topics of 'RPKI is Coming of Age: A Longitudinal Study of RPKI Deployment and Invalid Route Origins'. Together they form a unique fingerprint.

    Cite this