Robust Inter-Domain Routing

Size: px

Start display at page:

Download "Robust Inter-Domain Routing"

Juliet Garrison
5 years ago
Views:

1 Establishing the Technical Basis for Trustworthy Networking Robust Inter-Domain Routing Addressing Systemic Vulnerabilities in BGP Doug Montgomery Manager, Internet and Scalable Systems Research

com/story/how-a-tiny-error-shut-off-the-internet-for-parts-of-the-us/

2 Systemic Vulnerabilities Faults / Accidents WIRED: HOW A TINY ERROR SHUT OFF THE INTERNET FOR PARTS OF THE US Attacks Targeted Internet Traffic Misdirection 2

Broad Range of Threats and Motivations Financially motivated attacks Other

com/research/bgp-hijacking-forcryptocurrency-profit https://arstechnica.

3 Broad Range of Threats and Motivations Financially motivated attacks Other motivations

com/amazon-route-53-dns-and-bgp-hijack/ https://www.csoonline.

4 Broad Range of Risks Attacks to leverage other vulnerabilities Attacks to Disable Infrastructure 4

data to flow via the attacker Route leaks Announces routes in violation of ISP policy.

5 BGP Systemic Vulnerabilities Threats Route hijacks Steers traffic away from legitimate servers Address squatting Hijacks a not-in-service prefix and sets up spam servers Route detours Modifies path causing data to flow via the attacker Route leaks Announces routes in violation of ISP policy. Ramifications Exploitations commonly result in outages, spam, misrouting of data traffic, eavesdropping on user data, DDoS, etc. 5

6 Route Hijacks Pakistan Telecom Hijack of YouTube

Hijack of Routes to Critical Infrastructure April, 2018

7 Hijack of Routes to Critical Infrastructure April,

8 Route Leaks Violations of Implicit Policy Hathway / Airtel Route Leaks of Google Prefixes March Incident analysis: 8

Scale of Problem Space Global Routing System Recurring Threats https://blog.apnic.net/2018/01/10/bgp-in-2017/ https://securityintelligence.

9 Scale of Problem Space Global Routing System Recurring Threats Solution Constraints Behavioral Impacts Installed base Economic Incentives Business / trust models 9

10 State of the Solutions Space BGP Origin Validation (BGP-OV) Global public key infrastructure and protocol elements to enable BGP routers to verify that the origin AS in a BGP update, was authorized by the prefix owner to announce that route. BGP Path Validation (BGP-PV) Leverages the same PKI to enable each AS to digitally sign a BGP update, proving that each AS in the PATH authorized the route announcement to its next hop. BGP Route Leak Detection / Mitigation BGP protocol modifications to allow networks to detect that a BGP routed path violates typical customer-provider-peer policies for route redistribution. 10

11 BGP Origin Validation (BGP-OV) BGP Origin Validation (BGP-OV) Core specifications are complete IETF SIDR Working Group - IETF SIDR Ops WG - Commercial implementations and production services exists. All 5 RIRs operate production RPKI services Commercial and opensource routers support RPKI-based origin validation. Initial pilot and operational deployments are emerging. New specifications and implementations are emerging for: Deployment optimizations and implementation clarifications Extensions to support additional security services. 11

12 BGP Origin Validation Components 12

13 Resource Public Key Infrastructure Two Sides of RPKI Certification Securing routes to your addresses Get certificates for your address space Sign and publish ROAs 13

14 Two Sides of RPKI Origin Validation (Securing your routes to others addresses) Retrieve ROAs from other CA repositories Validate received routes against the RPKI data 14

certificates. ROAs signed by certificate holders.

15 RPKI Resource Certificates RPKI Certificate Hierarchy Rooted trust anchors at each RIR Sub allocations represented by CA certificates. ROAs signed by certificate holders. RPKI Objects published in repository. Hosted Model All RPKI operations hosted by RIR. 15

16 RPKI Resource Certificates Delegated Model Up / Down protocol to register resources. Users operate their own RPKI Certificate Authorities. Publication protocol to publish RPKI objects Operates own RPKI repository or uses public aggregator. 16

Caches do all crypto / PKI validation operations.

17 RPKI Origin Validation Validation in single AS Local RPKI validating caches synchronize with global repositories. Caches do all crypto / PKI validation operations. Routers only receive a digested lists of ROA data. No crypto on the router! 17

18 Regional RPKI Services Production RPKI services in RIRs: AFRINIC: APNIC: ARIN LACNIC: RIPE NCC: 18

509 validation on the objects, and then provides a highly summarized version to ebgp speaking routers.

19 RPKI Validating Caches To use RPKI data for BGP origin validation, you will want to deploy one or more validating caches. These tools collect and cache global RPKI data, perform X.509 validation on the objects, and then provides a highly summarized version to ebgp speaking routers. The RPKI-to-RTR protocol enables ebgp routers to download this processed data for route filtering. Multiple open source validating cache implementations are available! 19

. Match incoming BGP updates against the list of authorized origins.

20 RPKI Router Implementations RPKI Origin Validation requires a router that can: Interface with a RPKI validating cache to download lists of authorized origins: <prefix, max_length, origin_as>,.. Match incoming BGP updates against the list of authorized origins. Enforce local policies based upon on the results of these matches: Valid, Invalid, Unknown Major router vendors support these capabilities in shipping products today! 20

Implementations & Tools Establishing the Technical Basis for Trustworthy Networking RPKI Infrastructure RIPE validator 2 https://www.ripe.

com/ripe-ncc/rpki-validator-3/wiki Routinator - Open source Relying Party - NLnet Labs https://github.com/nlnetlabs/routinator RPKI.

net/projects/rpstir/ Router Implementations Cisco https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ iproute_bgp/command/irg-cr-book/bgpm1.html#wp3677719851 Juniper https://www.juniper.

21 Implementations & Tools Establishing the Technical Basis for Trustworthy Networking RPKI Infrastructure RIPE validator 2 RIPE validator 3 Routinator - Open source Relying Party - NLnet Labs RPKI.net Open Source Implementation of RPKI Tools RPSTIR - BBN Validation Tool Router Implementations Cisco iproute_bgp/command/irg-cr-book/bgpm1.html#wp Juniper junos12.2/topics/topic-map/bgp-origin-as-validation.html Nokia dbaccessfilename.cgi/ _V1_7750%20SR%20OS%20Router%20C onfiguration%20guide% r4.pdf Quagga / FRR, BIRD Go BGP 21

22 RPKI Based Origin Validation Trends Establishing the Technical Basis for Trustworthy Networking Significant Deployments RIPE p=2&s=0 Implementation of RPKI and IRR filtering on the AMS-IX platform ripe-ncc-educa/presentations/usecases-stavros-konstantaras.pdf Cloudflare Ongoing BGP-OV Specifications SIDROPs WG documents Autonomous System Provider Authorization Drop Invalid if Still Routable Cloudflare GoRTR 22

23 BGP Path Validation (BGP-PV) Establishing the Technical Basis for Trustworthy Networking BGPSec (BGP-PV) Core specifications are complete IETF SIDR Working Group - IETF SIDR Ops WG - RFC 8205 BGPsec Protocol Specification RFC 8208 BGPsec Cryptographic Algorithms RFC 8206 Operational BCP RFC 8374 BGPsec design rationale / discussion Commercial implementations and production services are lagging. Two open source reference implementations exist. Ongoing Research in Performance Optimizations and Deployment Architectures. 23

BGPSec Design Establishing the Technical Basis for Trustworthy

Keys. Validating Cache s provide public keys to routers.

path. BGPsec Protocol Specification, IETF RFC 8205.

24 BGPSec Design Establishing the Technical Basis for Trustworthy Networking BGP Path Validation (BGP-PV) RPKI Support for Router Keys. Validating Cache s provide public keys to routers. BGP-PV routers digitally sign and validate each hop in the BGP path. BGPsec Protocol Specification, IETF RFC "BGPsec Algorithms, Key Formats, and Signature Formats", IETF RFC Crypto on the router! 24

BGP-Secure Routing extension (BGP-SRx) Open Source

extensions for: RPKI/RTR protocol, maintenance ROA

Full support of BGPSec path validation Designed to

configurations of SRx and RPKI components and

BGP-SRx Status SRx Server SRx API Quagga SRx

25 BGP-Secure Routing extension (BGP-SRx) Open Source Reference Implementation Software router with extensions for: RPKI/RTR protocol, maintenance ROA distilled data, ROV and RPKI-aware BGP route policies. Full support of BGPSec path validation Designed to support experimentation with different architectural configurations of SRx and RPKI components and different trade-offs performance and router impact. BGP-SRx Status SRx Server SRx API Quagga SRx (integrates SRx API into Quagga router) src & yum repository: 25

BGPsec Performance Optimization Establishing the Technical Basis for Trustworthy Networking Protocol Optimizations "

Operations per second 50,000 45,000 40,000 35,000 30,000 25,000 20,000 15

26 BGPsec Performance Optimization Establishing the Technical Basis for Trustworthy Networking Protocol Optimizations " Design and analysis of optimization algorithms to minimize cryptographic processing in BGP security protocols.", Computer Communications. Cryptographic Optimizations " High Performance BGP Security: Algorithms and Architectures(link is external)",nanog69. Operations per second 50,000 45,000 40,000 35,000 30,000 25,000 20,000 15,000 10,000 5,000 0 OpenSSL1.1.0 taraeccrypt-3 SignP256 VerifyP256 SignP384 VerifyP384 Updates Processed per Second Workload in the Peak-Second of each Minute during a Two-Hour Time Period Number of Verifications during Peak Second 100,000 10,000 12,000 10,000 8,000 6,000 4,000 2,000 Unoptimized CCS-EC BPO-EC Time (minutes) 40,000 24,649 12,325 Xeon CPU E v4 3.5GHz Sign only Verify only , AS Path Length (#Sigs in BGPsec Update) 26

27 BGP Route Leak Detection Establishing the Technical Basis for Trustworthy Networking IETF IDR and Grow WG 27

28 General Principles of Design C: Solution Using BGP Communities Considering Community based encoding of RLP info for faster adoption Wish to limit the number of RLP entries so that they can be accommodated in 1 or 2 Community attributes per update. Reason: Avoid having a long string of Community attributes per BGP update because the more they are, the lesser the chance that they will all make it through. If some get dropped, then the rest become useless. Also, save memory, simplify processing, and improve robustness. Based on the analysis and knowledge we have so far about RLP/eOTC, independent of encoding (Attribute or Community), at the minimum the RLP info must include: Ø ASN of the RLP aware AS that most recently asserted that it sent update to a customer or peer; let us call this DO = Down Only indication Ø Leak warning: L = Leak indication Ø L = ASN of the first RLP aware AS in the path that is forwarding route from customer or lateral peer in spite of detecting a leak AS in question is avoiding unreachability (absence of alternative route) Note: RLP = Route Leak Protection; DO and L together constitute RLP

29 Illustration of Down Only (DO) and Leak (L) indications 1 of 2 Once a route is tainted with L = X, it remains tainted with the same (L = X) when it propagates. This is stickiness of L. Legend: n AS does not participate in RLP and starts/ restarts a leak q 1 P2C or p2p [DO = 1] 2 No alternative route for q C2P Note: RLP = Route Leak Protection; DO alone or DO and L together constitute RLP 3 [DO = 1] P2C 6 4 C2P C2P [DO = 1, L = 3] p2p [DO = 3, L = 3] [DO = 3, L = 3] P2C 5 [DO = 1, L = 3] 8 [DO = 6, L = 3] 7 [DO = 8, L = 3] P2C 9

30 Illustration of Down Only (DO) and Leak (L) indications 2 of 2 q n 1 Legend: P2C AS does not participate in RLP and starts/ restarts a leak [DO = 1] 2 p2p [DO = 1] C2P No alternative route for q 3 [DO = 3, L = 3] P2C 5 P2C [DO = 5] 4 q C2P 1 2 C2P p2p [DO = 2] 3 No alternative route for q p2p [DO = 2] [DO = 6] 4 P2C 6 [DO = 4, L = 4] P2C 5 Note: RLP = Route Leak Protection; DO alone or DO and L together constitute RLP

31 Relevant RFCs: Encoding RLP in BGP Communities RFC 4360: BGP Extended Communities Attribute RFC 7153: IANA Registries for BGP Extended Communities RFC 8092: BGP Large Communities Attribute

Secure Routing with RPKI. APNIC44 Security Workshop

Secure Routing with RPKI. APNIC44 Security Workshop Secure Routing with RPKI APNIC44 Security Workshop Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services