DeepAI AI Chat
Log In Sign Up

Keep Your Friends Close, but Your Routeservers Closer: Insights into RPKI Validation in the Internet

by   Tomas Hlavacek, et al.

IP prefix hijacks allow adversaries to redirect and intercept traffic, posing a threat to the stability and security of the Internet. To prevent prefix hijacks, networks should deploy RPKI and filter bogus BGP announcements with invalid routes. In this work we evaluate the impact of RPKI deployments on the security and resilience of the Internet. We aim to understand which networks filter invalid routes and how effective that filtering is in blocking prefix hijacks. We extend previous data acquisition and analysis methodologies to obtain more accurate identification of networks that filter invalid routes with RPKI. We find that more than 27 first time that deployments follow the business incentives of inter-domain routing: providers have an increased motivation to filter in order to avoid losing customers' traffic. Analyzing the effectiveness of RPKI, we find that the current trend to deploy RPKI on routeservers of Internet Exchange Points (IXPs) only provides a localized protection against hijacks but has negligible impact on preventing their spread globally. In contrast, we show that RPKI filtering in Tier-1 providers greatly benefits the security of the Internet as it limits the spread of hijacks to a localized scope. Based on our observations, we provide recommendations on the future roadmap of RPKI deployment. We make our datasets available for public use [].


page 1

page 2

page 3

page 4


From IP to transport and beyond: cross-layer attacks against applications

We perform the first analysis of methodologies for launching DNS cache p...

Estimating the Impact of BGP Prefix Hijacking

BGP prefix hijacking is a critical threat to the resilience and security...

Defending Tor from Network Adversaries: A Case Study of Network Path Prediction

The Tor anonymity network has been shown vulnerable to traffic analysis ...

Peerlock: Flexsealing BGP

BGP route leaks frequently precipitate serious disruptions to interdomai...

Don't Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic

This paper concerns the problem of the absence of ingress filtering at t...

On the classification and false alarm of invalid prefixes in RPKI based BGP route origin validation

BGP is the default inter-domain routing protocol in today's Internet, bu...

A Review on Impact of Bloom Filter on Named Data Networking: The Future Internet Architecture

Today is the era of smart devices. Through the smart devices, people rem...