IRR Hygiene in the RPKI Era

Du, Ben; Akiwate, Gautam; Krenc, Thomas; Testart, Cecilia; Marder, Alexander; Huffaker, Bradley; Snoeren, Alex C.; claffy, kc

doi:10.1007/978-3-030-98785-5_14

Cited by 7 publications

(6 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As a final remark, our goal is not to propose a new interdomain routing model, or infer more accurately the routing policies in the Internet, but to pinpoint the intersections and disparities of the results our replication effort against the findings and insights of the original work [63]. Finally, we believe that our results can aid in the understanding of a variety of interdomain routing applications, such as the measurement of the RPKI adoption [17,49], fine-grained interdomain policy learning [62,67], interdomain routing verification [10], privacy-preserving routing [13], discovering caching policies in the wild [18,34] and studying routing attacks [56].…”

Section: Introductionmentioning

confidence: 83%

Replication: 20 Years of Inferring Interdomain Routing Policies

Kastanakis,

Giotsas,

Livadariu

et al. 2023

Proceedings of the 2023 ACM on Internet Measurement Conference

View full text Add to dashboard Cite

In 2003, Wang and Gao [63] presented an algorithm to infer and characterize routing policies as this knowledge could be valuable in predicting and debugging routing paths. They used their algorithm to measure the phenomenon of selectively announced prefixes, in which, ASes would announce their prefixes to specific providers to manipulate incoming traffic. Since 2003, the Internet has evolved from a hierarchical graph, to a flat and dense structure. Despite 20 years of extensive research since that seminal work, the impact of these topological changes on routing policies is still blurred.In this paper we conduct a replicability study of the Wang and Gao paper [63], to shed light on the evolution and the current state of selectively announced prefixes. We show that selective announcements are persistent, not only across time, but also across networks. Moreover, we observe that neighbors of different AS relationships may be assigned with the same local preference values, and path selection is not as heavily dependent on AS relationships as it used to be. Our results highlight the need for BGP policy inference to be conducted as a high-periodicity process to account for the dynamic nature of AS connectivity and the derived policies.

show abstract

Section: Introductionmentioning

confidence: 83%

Replication: 20 Years of Inferring Interdomain Routing Policies

Kastanakis,

Giotsas,

Livadariu

et al. 2023

Proceedings of the 2023 ACM on Internet Measurement Conference

View full text Add to dashboard Cite

show abstract

“…It is also recommended by network governance organizations such as MANRS [48] because of its extensive coverage and expressiveness. However, the issues of IRR regarding its staleness have been raised multiple times [41], [34], [50], [18]. For example, Du et al [18] quantifies the consistency between Route and ROA objects using IRR databases collected a monthly granularity and reported that 20% of Route in RADb are covered by ROA objects and only 38% of them are consistent with ROA objects as of October 2021 14 .…”

Section: B Efforts To Sanitize Interdomain Routing Informationmentioning

confidence: 99%

“…However, the issues of IRR regarding its staleness have been raised multiple times [41], [34], [50], [18]. For example, Du et al [18] quantifies the consistency between Route and ROA objects using IRR databases collected a monthly granularity and reported that 20% of Route in RADb are covered by ROA objects and only 38% of them are consistent with ROA objects as of October 2021 14 . Some studies focused on improving the security by suggesting incentives for network operators to maintain the objects up to date [34] and by removing IRR objects once they have not been updated longer than a year [20].…”

Section: B Efforts To Sanitize Interdomain Routing Informationmentioning

confidence: 99%

IRRedicator: Pruning IRR with RPKI-Valid BGP Insights

Kang,

Li,

van Rijswijk-Deij

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Border Gateway Protocol (BGP) provides a way of exchanging routing information to help routers construct their routing tables. However, due to the lack of security considerations, BGP has been suffering from vulnerabilities such as BGP hijacking attacks. To mitigate these issues, two data sources have been used, Internet Routing Registry (IRR) and Resource Public Key Infrastructure (RPKI), to provide reliable mappings between IP prefixes and their authorized Autonomous Systems (ASes). Each of the data sources, however, has its own limitations. IRR has been well-known for its stale Route objects with outdated AS information since network operators do not have enough incentives to keep them up to date, and RPKI has been slowly deployed due to its operational complexities. In this paper, we measure the prevalent inconsistencies between Route objects in IRR and ROA objects in RPKI. We next characterize inconsistent and consistent Route objects, respectively, by focusing on their BGP announcement patterns. Based on this insight, we develop a technique that identifies stale Route objects by leveraging a machine learning algorithm and evaluate its performance. From real trace-based experiments, we show that our technique can offer advantages against the status quo by reducing the percentage of potentially stale Route objects from 72% to 40% (of the whole IRR Route objects). In this way, we achieve 93% of the accuracy of validating BGP announcements while covering 87% of BGP announcements.

show abstract

“…Operators create prefix filters based on the IRR to increase inter-domain routing security and prevent hijacks and route leaks. This data, however, is not cryptographically secured and is known to contain incorrect information [41]. To bind ASes to prefixes in a cryptographically secure manner, several approaches have been proposed [42], [43].…”

Section: A Origin Validationmentioning

confidence: 99%

“…Comparison of RPKI and IRR deployment. As prefix space covered by ROAs has been constantly increasing during the past years, a recent study showed a comparison between IRR and RPKI and found datasets to be inconsistent in 27.4% and 61.4% of cases for Réseaux IP Européens (RIPE) IRR and Routing Assets Database (RADB), respectively [41]. The findings highlight the need for the RPKI as a cryptographically proven database with accurate information.…”

Section: A Origin Validationmentioning

confidence: 99%

The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future Prospects

Rodday,

Cunha,

Bush

et al. 2024

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

The adoption of the Resource Public Key Infrastructure (RPKI) is increasing. To better understand and improve RPKI deployment, measuring route origin authorization (ROA) objects, RPKI route origin validation (ROV), and RPKI resilience is essential. In this paper, we survey RPKI-related research that aims to understand RPKI deployment. Additionally, we enrich our survey with many industry and IETF-related contributions.Our work provides an in-depth analysis of the many ideas and challenges discussed in studies of the RPKI ecosystem and includes lessons from mistakes made in the past, which we should avoid in the future.

show abstract

IRR Hygiene in the RPKI Era

Cited by 7 publications

References 25 publications

Replication: 20 Years of Inferring Interdomain Routing Policies

Replication: 20 Years of Inferring Interdomain Routing Policies

IRRedicator: Pruning IRR with RPKI-Valid BGP Insights

The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future Prospects

Contact Info

Product

Resources

About