Problem. BGP is a rumour mill.
|
|
|
- Magnus Flowers
- 5 years ago
- Views:
Transcription
1 Problem BGP is a rumour mill.
2 We want to give it a bit more authorita
3 We think we have a model
4
5 AusNOG IP ADDRESS AND ASN CERTIFICATION TO IMPROVE ROUTING SECURITY George Michaelson APNIC R&D
6 Overview The problem with Internet routing security What is Resource Certification? Definition How it works Potential use How Resource Certificates can be used to secure routing Signing routing attestations Digital signature validation with resource certificates Conclusion Q & A
7 INTERNET ROUTING SECURITY PROBLEM
8 Why is routing security important to you? Routing was built on 'trust' models My network trusts your network to exchange traffic Not much verification/validation other than checking whois and routing registries Corrupting the routers' forwarding tables can result in Misdirecting traffic (subversion, denial of service, traffic inspection, passing off) Dropping traffic/network isolation Adding false addresses into the routing system You have a responsibility Business now conduct more and more transactions online Your clients need your protection
9
10 The Problem How do you check that use of Internet resources is legitimate? I m multi-homed. Please advertise my /24 A spammer has hijacked /23. Please null route them. That s funny, I didn t think that YouTube was based in Pakistan Should AS123 be allowed to advertise their prefix?
11 Address and Routing Security The (very) basic routing security questions that need to be answered are: Is this a valid address prefix? Valid: That the prefix has been allocated through the address distribution framework, and that this allocation sequence can be demonstrated and validated
12 Address and Routing Security The (very) basic routing security questions that need to be answered are: Is this a valid address prefix? Who advertised this address prefix into the network? Who: The route originator, identified by the origin AS of the corresponding route object. The originating AS also should be valid.
13 Address and Routing Security The (very) basic routing security questions that need to be answered are: Is this a valid address prefix? Who advertised this address prefix into the network? Did they have the necessary credentials to advertise this address prefix? Credentials: Can a link be established between the address holder and the route originator such that the address holder has explicitly authorized the originating AS?
14 Address and Routing Security The (very) basic routing security questions that need to be answered are: Is this a valid address prefix? Who advertised this address prefix into the network? Did they have the necessary credentials to advertise this address prefix? Is the advertised path authentic? An authentic path: A sequence of valid ASs that represents a transit path from the current location to the prefix and/or A sequence of valid ASs that represents the path of the routing update message
15 RESOURCE CERTIFICATION
16 Resource Certificates X.509 certificates with IP Address and AS Number extensions (RFC3779) This changes the semantics of a certificate from the conventional notion of an identifying document (such as a passport) into a rights holder (such as a bearer bond)
17 A Resource Certificate The holder of the corresponding private key has a right-of-use over the resources listed in this certificate CA Certificate: The right-of-use holder can issue subordinate certificates (i.e. act as a local number registry and issue right-of-use certificates) EE Certificate The right-of-use holder can generate digital signatures but cannot issue subordinate certificates (i.e. end user)
18 Validating Resource Certificates Same validation task as conventional certificates, with one additional validation check: The resources listed in a certificate must be a subset of the resources listed in the certificate referenced in the certificate s AIA field Change in validation semantics From: Is this the key of the entity named X To: Is this the key of the entity who holds the current right-of-use for IP address X
19 Resource Certificate PKI Intended for Public Use IP resources Hierarchical PKI Precisely follows the resource allocation framework Each registry in the allocation hierarchy is a CA Each resource allocation is described in a Resource Certificate Trust Anchor is under discussion Relying party to choose
20 Resource Certificates Resource Allocation Hierarchy IANA AFRINIC APNIC ARIN RIPE NCC LACNIC LIR1 LIR2 ISP ISP ISP ISP ISP ISP ISP
21 Resource Certificates Resource Allocation Hierarchy IANA AFRINIC RIPE NCC ARIN APNIC LACNIC Issued Certificates match allocation actions NIR1 NIR2 ISP ISP ISP ISP ISP ISP ISP
22 Resource Certificates Resource Allocation Hierarchy IANA Issuer: APNIC Subject: AFRINIC NIR2 RIPE NCC ARIN APNIC LACNIC Resources: /16 Key Info: <nir2-key-pub> Signed: <apnic-key-priv> NIR1 NIR2 Issued Certificates ISP ISP ISP ISP4 ISP ISP ISP
23 Resource Certificates Resource Allocation Hierarchy IANA Issuer: APNIC Subject: AFRINIC NIR2 RIPE NCC ARIN APNIC LACNIC Resources: /16 Key Info: <nir2-key-pub> Signed: <apnic-key-priv> Issuer: NIR2 NIR1 NIR2 Subject: ISP4 Resources: /24 Key Info: <isp4-key-pub> Signed: <nir2-key-priv> Issued Certificates ISP ISP ISP ISP4 ISP ISP ISP
24 Resource Certificates Resource Allocation Hierarchy IANA Issuer: APNIC Subject: AFRINIC NIR2 RIPE NCC ARIN APNIC LACNIC Resources: /16 Key Info: <nir2-key-pub> Signed: <apnic-key-priv> Issuer: NIR2 NIR1 NIR2 Subject: ISP4 Resources: /24 Key Info: <isp4-key-pub> Signed: Issuer: <nir2-key-priv> ISP4 Subject: ISP4-EE ISP ISP Resources: /24 ISP ISP4 ISP ISP ISP Key Info: <isp4-ee-key> Signed: <isp4-key-priv> Issued Certificates
25 Potential Uses of Resource Certificates Securing Whois objects Securing Internet Routing Registry objects Secure Routing Facilitating Resource Transfer functions Source address validation mechanism
26 HOW RESOURCE CERTIFICATES CAN BE USED TO SECURE ROUTING
27 Use it to sign routing attestations Route Origin Authorizations (ROA) I allow AS123 to announce prefix /8, signed the holder of /8 Bogon Origin Attestation (BOA) I attest that /24 and AS456 should never be announced, signed the holder of /24 and AS456 AS Adjacency Attestation Objects (AAO) I attest that AS456 is adjacent to AS123 and AS789, signed the holder of AS456 Other signed data
28 Route Origination Authority Resource Allocation Hierarchy document IANA AFRINIC RIPE NCC ARIN APNIC LACNIC Issued Certificates NIR1 NIR2 Route Origination Authority ISP4 permits AS65000 to originate a route for the prefix /24 ISP ISP ISP ISP4 ISP ISP ISP
29 Signed Objects Resource Allocation Hierarchy IANA AFRINIC RIPE NCC ARIN APNIC LACNIC Route Origination Authority ISP4 permits AS65000 to LIR1 originate a route for the prefix /24 Attachment: <isp4-ee-cert> NIR2 Issued Certificates Signed, ISP ISP ISP ISP4 ISP ISP ISP ISP4 <isp4-ee-key-priv>
30 Signed Object Validation Resource Allocation Hierarchy IANA AFRINIC RIPE NCC ARIN APNIC LACNIC Route Origination Authority ISP4 permits AS65000 to LIR1 originate a route for the prefix /24 Attachment: <isp4-ee-cert> NIR2 Issued Certificates Signed, ISP 1. Did ISP the matching ISP ISP4 private ISP key ISP sign this ISP text? ISP4 <isp4-ee-key-priv>
31 Signed Object Validation Resource Allocation Hierarchy IANA AFRINIC RIPE NCC ARIN APNIC LACNIC Route Origination Authority ISP4 permits AS65000 to LIR1 originate a route for the prefix /24 Attachment: <isp4-ee-cert> NIR2 Issued Certificates 2. Signed, Is this certificate valid? ISP ISP ISP ISP4 ISP ISP ISP ISP4 <isp4-ee-key-priv>
32 Signed Object Validation Resource Allocation Hierarchy IANA APNIC Trust Anchor AFRINIC RIPE NCC ARIN APNIC LACNIC Route Origination Authority ISP4 permits AS65000 to LIR1 originate a route for the prefix /24 Attachment: <isp4-ee-cert> NIR2 Issued Certificates Signed, ISP ISP ISP ISP4 ISP ISP ISP ISP4 <isp4-ee-key-priv> 3. Is there a valid certificate path from a Trust Anchor to this certificate?
33 Signed Object Validation Resource Allocation IANA Validation Outcomes Hierarchy RIPE NCC Trust Anchor 1. ISP4 authorized this Authority AFRINIC RIPE NCC document ARIN /24 RIPE NCC is a valid LACNIC address, derived from an APNIC allocation Issued Certificates Route Origination Authority 3. ISP4 holds a current right-of-use of ISP4 permits AS65000 to /24 LIR1 LIR2 originate a route for the prefix 4. A route object, where AS /24 originates an advertisement for the address prefix /24, has Attachment: <isp4-ee-cert> the explicit authority of ISP4, who is the current holder of this address Signed, ISP ISP prefix ISP ISP4 ISP ISP ISP ISP4 <isp4-ee-key-priv>
34 Conclusion Certification of IP Addresses and ASNs could help improve routing security by: Mapping the delegation hierarchy to a Public Key Infrastructure hierarchy Enabling routing instructions to be signed and validated by cryptographically secure processes.
35 APNIC ResCert Services Available through MyAPNIC
36 Questions? BGP incidents/attack article Resource certification information available at IETF work Secured Inter-domain routing working group (sidr-wg)
37 Questions/Comments?
Update on Resource Certification. Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008
Update on Resource Certification Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008 Address and Routing Security What we have had for many years is a relatively insecure interdomain routing system
RPKI Trust Anchor. Geoff Huston APNIC
RPKI Trust Anchor Geoff Huston APNIC Public Keys How can you trust a digital signature?? What if you have never met the signer and have no knowledge of them or their keys? One approach is transitive trust
Using Resource Certificates Progress Report on the Trial of Resource Certification
Using Resource Certificates Progress Report on the Trial of Resource Certification October 2006 Geoff Huston APNIC From the RIPE Address Policy Mail List 22 25 Sept 06, address-policy-wg@lists.ripe.net
ISP 1 AS 1 Prefix P peer ISP 2 AS 2 Route leak (P) propagates Prefix P update Route update P Route leak (P) to upstream 2 AS 3 Customer BGP Update messages Route update A ISP A Prefix A ISP B B leaks
Using Resource Certificates Progress Report on the Trial of Resource Certification
Using Resource Certificates Progress Report on the Trial of Resource Certification October 2006 Geoff Huston APNIC Sound Familiar? 4:30 pm Mail: Geoff, mate, I ve been dealing with your phone people and
Facilitating Secure Internet Infrastructure
Facilitating Secure Internet Infrastructure RIPE NCC http://www.ripe.net About the RIPE NCC RIPE Network Coordination Centre Bottom-up, self-regulated, membership association, notfor-profit Regional Internet
APNIC Trial of Certification of IP Addresses and ASes
APNIC Trial of Certification of IP Addresses and ASes ARIN XVII Open Policy Meeting George Michaelson Geoff Huston Motivation: Address and Routing Security What we have today is a relatively insecure system
APNIC Trial of Certification of IP Addresses and ASes
APNIC Trial of Certification of IP Addresses and ASes RIPE 52 Plenary George Michaelson Geoff Huston Motivation: Address and Routing Security What we have today is a relatively insecure system that is
RPKI deployment at AFRINIC Status Update. Alain P. AINA RPKI Project Manager
RPKI deployment at AFRINIC Status Update Alain P. AINA RPKI Project Manager What is Resource Certifcation? Resource Certifcation is a security framework for verifying the association between resource holders
A PKI For IDR Public Key Infrastructure and Number Resource Certification
A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC If You wanted to be Bad on the Internet And you wanted to: Hijack a site Inspect
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN. Mark Kosters CTO
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN Mark Kosters CTO What is RPKI? Resource Public Key Infrastructure Attaches digital certificates to network resources AS Numbers
Securing BGP: The current state of RPKI. Geoff Huston Chief Scientist, APNIC
Securing BGP: The current state of RPKI Geoff Huston Chief Scientist, APNIC Incidents What happens when I announce your addresses in BGP? All the traffic that used to go to you will now come to me I can
Overview of the Resource PKI (RPKI) Dr. Stephen Kent VP & Chief Scientist BBN Technologies
Overview of the Resource PKI (RPKI) Dr. Stephen Kent VP & Chief Scientist BBN Technologies Presentation Outline The BGP security problem RPKI overiew Address & AS number allocation system Certificates
Securing Routing: RPKI Overview. Mark Kosters Chief Technology Officer
Securing Routing: RPKI Overview Mark Kosters Chief Technology Officer Why are DNSSEC and RPKI important? Two of the most critical resources DNS Routing Hard to tell when resource is compromised Focus of
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC Target Audience Knowledge of Internet Routing(specially BGP) Fair idea on Routing Policy No need to know Cryptography Basic knowledge
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
RPKI. Resource Pubic Key Infrastructure
RPKI Resource Pubic Key Infrastructure Purpose of RPKI RPKI replaces IRR or lives side by side? Side by side: different advantages Security, almost real time, simple interface: RPKI Purpose of RPKI Is
Secure Routing with RPKI. APNIC44 Security Workshop
Secure Routing with RPKI APNIC44 Security Workshop Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
Introducción al RPKI (Resource Public Key Infrastructure)
Introducción al RPKI (Resource Public Key Infrastructure) Roque Gagliano rogaglia@cisco.com 4 Septiembre 2013 Quito, Equator 2011 Cisco and/or its affiliates. All rights reserved. 1 Review of problem to
PKI-An Operational Perspective. NANOG 38 ARIN XVIII October 10, 2006
PKI-An Operational Perspective NANOG 38 ARIN XVIII October 10, 2006 Briefing Contents PKI Usage Benefits Constituency Acceptance Specific Discussion of Requirements Certificate Policy Certificate Policy
Misdirection / Hijacking Incidents
Security Tutorial @ TWNOG SECURE ROUTING WITH RPKI 1 Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
Deploying RPKI An Intro to the RPKI Infrastructure
Deploying RPKI An Intro to the RPKI Infrastructure VNIX-NOG 24 November 2016 Hanoi, Vietnam Issue Date: Revision: Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours)
Life After IPv4 Depletion
1 Life After IPv4 Depletion Jon Worley Analyst Securing Core Internet Functions Resource Certification, RPKI Mark Kosters Chief Technology Officer 2 Core Internet Functions: Routing & DNS The Internet
Resource Certification
Resource Certification CISSP, science group manager RIPE NCC robert@ripe.net 1 Contents Motivation for Resource Certification (RPKI) Architecture overview Participating in RPKI Most importantly: use cases
APNIC RPKI Report. George Michaelson
APNIC RPKI Report George Michaelson APNIC RPKI Current Activities The RPKI TA Framework APNIC s TA Changes Provisioning Protocol Services The RPKI TA Framework The RPKI TA Framework Managing TAs is an
Resource PKI. NetSec Tutorial. NZNOG Queenstown. 24 Jan 2018
Resource PKI NetSec Tutorial NZNOG2018 - Queenstown 24 Jan 2018 1 Fat-finger/Hijacks/Leaks Bharti (AS9498) originates 103.0.0.0/10 Dec 2017 (~ 2 days) No damage more than 8K specific routes! Google brings
APNIC s role in stability and security. Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013
APNIC s role in stability and security Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013 Overview Introducing APNIC Working with LEAs The APNIC Whois Database
RPKI Introduction. APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By:
RPKI Introduction APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By: 1 Content Why do we need RPKI What is RPKI How to deploy RPKI Configuration case Misdirection / Hijacking Incidents
Some Lessons Learned from Designing the Resource PKI
Some Lessons Learned from Designing the Resource PKI Geoff Huston Chief Scientist, APNIC May 2007 Address and Routing Security The basic security questions that need to be answered are: Is this a valid
BGP Origin Validation
BGP Origin Validation ISP Workshops These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/) Last updated
Securing the Internet s Foundations: Addresses and Routing
Securing the Internet s Foundations: Addresses and Routing AUSCERT 2011 Geoff Huston Chief Scientist, APNIC On the Internet there are many ways to be bad! An Ascending Scale of Badness Port Scan for known
Internet Engineering Task Force (IETF) Category: Informational ISSN: February 2012
Internet Engineering Task Force (IETF) G. Huston Request for Comments: 6483 G. Michaelson Category: Informational APNIC ISSN: 2070-1721 February 2012 Abstract Validation of Route Origination Using the
Decentralized Internet Resource Trust Infrastructure
Decentralized Internet Resource Trust Infrastructure Bingyang Liu, Fei Yang, Marcelo Bagnulo, Zhiwei Yan, and Qiong Sun Huawei UC3M CNNIC China Telecom 1 Critical Internet Trust Infrastructures are Centralized
Securing Core Internet Functions Resource Certification, RPKI. Mark Kosters ARIN CTO
Securing Core Internet Functions Resource Certification, RPKI Mark Kosters ARIN CTO Core Internet Functions: Routing & DNS The Internet relies on two critical resources DNS: Translates domain names to
Resource Certification. Alex Band, Product Manager DENIC Technical Meeting
Resource Certification Alex Band, Product Manager DENIC Technical Meeting Internet Routing Routing is non-hierarchical, open and free Freedom comes at a price: - You can announce any address block on your
Resource Certification A Public Key Infrastructure for IP Addresses and AS's
Resource Certification A Public Key Infrastructure for IP Addresses and AS's Geoff Huston, George Michaelson Asia Pacific Network Information Centre {gih, ggm}@apnic.net DRAFT - November 2008 Abstract
Resource Public Key Infrastructure
Resource Public Key Infrastructure A pilot for the Internet2 Community to secure the global route table Andrew Gallo The Basics The Internet is a self organizing network of networks. How do you find your
Local TA Management. In principle, every RP should be able to locally control the set of TAs that it will employ
Local TA Management In principle, every RP should be able to locally control the set of TAs that it will employ In practice, most PKI applications do not provide good, local TA management capabilities
RPKI and Internet Routing Security ~ The regional ISP operator view ~
RPKI and Internet Routing Security ~ The regional ISP operator view ~ APNIC 29/APRICOT 2010 NEC BIGLOBE, Ltd. (AS2518) Seiichi Kawamura 1 Agenda Routing practices of the regional ISP today How this may
Securing BGP - RPKI. ThaiNOG Bangkok. 21 May Tashi Phuntsho
Securing BGP - RPKI ThaiNOG2018 - Bangkok 21 May 2018 Tashi Phuntsho (tashi@apnic.net) 1 Fat-finger/Hijacks/Leaks Amazon (AS16509) Route53 hijack April2018 AS10279 (enet) announced/originated more specifics
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
Robust Inter-Domain Routing
Establishing the Technical Basis for Trustworthy Networking Robust Inter-Domain Routing Addressing Systemic Vulnerabilities in BGP Doug Montgomery (dougm@nist.gov) Manager, Internet and Scalable Systems
Madison, Wisconsin 9 September14
1 Madison, Wisconsin 9 September14 2 Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN Engineering 3 Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard
BGP Origin Validation (RPKI)
University of Amsterdam System & Network Engineering BGP Origin Validation (RPKI) July 5, 2013 Authors: Remy de Boer Javy de Koning Supervisors: Jac Kloots
Auto-Detecting Hijacked Prefixes?
Auto-Detecting Hijacked Prefixes? Geoff Huston APNIC @RIPE 50 May 2005 1 Address Hijacking Is the unauthorized use of an address prefix as an advertised route object on the Internet It s not a bogon the
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI RIPE 56 / Berlin 2008.05.07 Randy Bush http://rip.psg.com/~randy/080507.ripe-v4-trad-rpki.pdf 2008.05.07 RIPE v4 Trade RPKI 2 Internet Initiative Japan
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI MENOG 3 / Salmiya 2008.04.15 Randy Bush http://rip.psg.com/~randy/080415.menog-v4-trad-rpki.pdf 2008.04.15 MENOG v4 Trade RPKI 2 Internet Initiative
An Operational Perspective on Routing Security
An Operational Perspective on Routing Security Geoff Huston Chief Scientist, APNIC On the Internet there are many ways to be bad! there are many ways to be bad! Enlist a bot army and mount mul0- gigabit
Security in inter-domain routing
DD2491 p2 2011 Security in inter-domain routing Olof Hagsand KTH CSC 1 Literature Practical BGP pages Chapter 9 See reading instructions Beware of BGP Attacks (Nordström, Dovrolis) Examples of attacks
An Operational ISP & RIR PKI
An Operational ISP & RIR PKI EOF / Istanbul 2006.04.25 Randy Bush Quicksand Unknown quality of whois data Unknown quality of IRR data No formal
HD Ratio for IPv4. RIPE 48 May 2004 Amsterdam
HD Ratio for IPv4 RIPE 48 May 2004 Amsterdam 1 Current status APNIC Informational presentation at APNIC 16 Well supported, pending presentation at other RIRs ARIN Similar proposal made at ARIN XIII Not
Internet Resource Certification and Inter- Domain Routing Security! Eric Osterweil!
Internet Resource Certification and Inter- Domain Routing Security! Eric Osterweil! Who is allowed to do what?! BGP (the Internet s inter-domain routing protocol) runs by rumor Participants assert reachability
RPKI and Routing Security
Presentation September 2015 Yerevan Regional Meeting Routing Security 2 Routing Registry route objects RPKI (Resource Public Key Infrastructure) ROAs (Route Origin Authorisation) What is the Purpose of
An Operational ISP & RIR PKI
An Operational ISP & RIR PKI ARIN / Montreal 2006.04.10 Randy Bush Quicksand Unknown quality of whois data Unknown quality of IRR data No formal
FIRMS: a Future InteRnet Mapping System
Institute of Computer Science Department of Distributed Systems Prof. Dr.-Ing. P. Tran-Gia FIRMS: a Future InteRnet Mapping System Michael Menth, Matthias Hartmann, Michael Höfling Overview The FIRMS architecture
Attacks on routing: IP hijacks
Attacks on routing: IP hijacks How Internet number resources are managed IANA ARIN LACNIC APNIC RIPE NCC AfriNIC ISP NIC.br NIC.MX ISP #1 LIRs/ISPs LIRs/ISPs End users ISP mx How Internet number resources
Internet Number Resources
Internet Number Resources 1 Internet Number Resources Key Internet resources IPv6 addresses Autonomous System number IPv4 addresses Internet Fully Qualified Domain Name Internet Number Resources The IP
IPv4 Address Report. This report generated at 12-Mar :24 UTC. IANA Unallocated Address Pool Exhaustion: 03-Feb-2011
IPv4 Address Report This report generated at 12-Mar-2018 08:24 UTC. IANA Unallocated Address Pool Exhaustion: 03-Feb-2011 Projected RIR Address Pool Exhaustion Dates: RIR Projected Exhaustion Remaining
IPv4/IPv6 BGP Routing Workshop. Organized by:
IPv4/IPv6 BGP Routing Workshop Organized by: Agenda Multihoming & BGP path control APNIC multihoming resource policy 2 ISP Hierarchy Default free zone Made of Tier-1 ISPs who have explicit routes to every
IETF81 Secure IDR Rollup TREX Workshop David Freedman, Claranet
IETF81 Secure IDR Rollup TREX Workshop 2011 David Freedman, Claranet Introduction to Secure IDR (SIDR) You are in a darkened room at the IETF. You are surrounded by vendors. A lone operator stands quietly
Progress Report on APNIC Trial of Certification of IP Addresses and ASes
Progress Report on APNIC Trial of Certification of IP Addresses and ASes APNIC 22 September 2006 Geoff Huston Motivation: Address and Routing Security What we have today is a relatively insecure system
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
Just give me a button!
Just give me a button! The challenges of routing security RIPE NCC Members organisation founded in 1992 Manages IP and ASN allocations in Europe, Middle East and former Soviet Union - Ensure unique holdership
RPKI MIRO & RTRlib. Andreas Reuter, Matthias Wählisch Freie Universität Berlin
RPKI MIRO & RTRlib RIPE 74, Budapest Andreas Reuter, Matthias Wählisch Freie Universität Berlin {andreas.reuter,m.waehlisch}@fu-berlin.de Thomas Schmidt HAW Hamburg t.schmidt@haw-hamburg.de RPKI Overview
Some Thoughts on Integrity in Routing
Some Thoughts on Integrity in Routing Geoff Huston Chief Scientist, APNIC What we want We want the routing system to advertise the correct reachability information for legitimately connected prefixes at
Internet-Draft Intended status: Standards Track July 4, 2014 Expires: January 5, 2015
Network Working Group M. Lepinski, Ed. Internet-Draft BBN Intended status: Standards Track July 4, 2014 Expires: January 5, 2015 Abstract BGPSEC Protocol Specification draft-ietf-sidr-bgpsec-protocol-09
Feedback from RIPE NCC Registration Services. Alex Le Heux - RIPE NCC RIPE62, May 2011, Amsterdam
Feedback from RIPE NCC Registration Services Alex Le Heux - RIPE NCC RIPE62, May 2011, Amsterdam Outline ASN32 success, a competitive disadvantage? Last /8 implementation detail Upgrade of /32 IPv6 allocations
IPv6 Allocation and Policy Update. Global IPv6 Summit in China 2007 April 12, 2007 Guangliang Pan
IPv6 Allocation and Policy Update Global IPv6 Summit in China 2007 April 12, 2007 Guangliang Pan 1 Overview IPv6 allocation status update Global IPv6 allocations APNIC allocation and assignment details
Policy Proposal Capturing AS Originations In Templates
Policy Proposal 2006-3 Capturing AS Originations In Templates Sandra Murphy sandy@sparta.com, sandy@tislabs.com 11 April 2006 ARIN XVII Montreal, QC, CA 1 Securing Routing Infrastructure Important problem,
The RPKI and BGP Origin Validation
The RPKI and BGP Origin Validation APRICOT / New Delhi 2012.02.27 Randy Bush Rob Austein Steve Bellovin And a cast of thousands! Well, dozens :) 2012.02.27
APNIC allocation and policy update. JPNIC OPM July 17, Tokyo, Japan Guangliang Pan
APNIC allocation and policy update JPNIC OPM July 17, 2007 - Tokyo, Japan Guangliang Pan 1 Overview Internet registry structure Number resource allocation statistics APNIC recent policy implementations
Networking 101 ISP/IXP Workshops
Networking 101 ISP/IXP Workshops 1 Network Topology and Definitions Definitions and icons Network topologies PoP topologies Interconnections and IXPs IP Addressing Gluing it all together 2 Topologies and
Network Working Group. Intended status: Informational Expires: January 9, 2014 July 8, 2013
Network Working Group G. Huston Internet-Draft G. Michaelson Intended status: Informational APNIC Expires: January 9, 2014 July 8, 2013 Abstract RPKI Validation Reconsidered draft-huston-rpki-validation-00.txt
BGP Routing Security and Deployment Strategies
Bachelor Informatica Informatica Universiteit van Amsterdam BGP Routing Security and Deployment Strategies Bryan Eikema June 17, 2015 Supervisor(s): Benno Overeinder (NLnet Labs), Stavros Konstantaras
A Policy Story - IPv4 Transfer. TWNIC OPM 26, Taipei 14 December 2016 George Kuo, Services Director
A Policy Story - Transfer TWNIC OPM 26, Taipei 14 December 2016 George Kuo, Services Director 1 About APNIC Membership-based, not-for-profit, Regional Internet Registry (RIR) Delegates and registers IP
Route Security for Inter-domain Routing
Route Security for Inter-domain Routing Alvaro Retana (aretana@cisco.com) Distinguished Engineer, Cisco Services 3 This could happen to YOUR network 4 This could happen be happening to YOUR network 5 Agenda
32-bit ASNs. Philip Smith. AfNOG rd April 1st May Abuja, Nigeria
32-bit ASNs Philip Smith AfNOG 2007 23rd April 1st May Abuja, Nigeria Autonomous System (AS) AS 100 Collection of networks with same routing policy Single routing protocol Usually under single ownership,
<36 th APNIC Meeting, XIAN CHINA> KISA(KRNIC) UPDATE. YOUNGSUN LA Korea Internet & Security Agency
KISA(KRNIC) UPDATE YOUNGSUN LA (rays@kisa.or.kr) Korea Internet & Security Agency 1 Contents IPv6 Verified NSDs R&D WHOIS User Analysis & Statistics RPKI Testbed 2 IPv6
The RPKI & Origin Validation
The RPKI & Origin Validation RIPE / Praha 2010.05.03 Randy Bush Rob Austein Steve Bellovin And a cast of thousands! Well, dozens :) 2010.05.03 RIPE RPKI
Secure Inter-domain Routing with RPKI
Secure Inter-domain Routing with RPKI Srinivas (Sunny) Chendi VNIX-NOG 2018, Da Nang sunny@apnic.net Xin chào và chào buổi sáng 1 3 4 What is the fundamental Problem? An underlying problem in routing
The RPKI & Origin Validation
The RPKI & Origin Validation NANOG / Denver 2011.06.12 Randy Bush Rob Austein Steve Bellovin Michael Elkins And a cast of thousands!
APNIC & Internet Address Policy in the Asia Pacific
APNIC & Internet Address Policy in the Asia Pacific NZ Internet Industry Forum Auckland, 29 November 2001 Anne Lord, APNIC Overview Introduction to APNIC Policy Development Address Management APNIC Update
Whois & Data Accuracy Across the RIRs
Whois & Data Accuracy Across the RIRs Terms ISP An Internet Service Provider is allocated address space by an RIR for the purpose of providing connectivity and address space to their downstream customer
Prop-083v003. Alterna(ve criteria for subsequent IPv6 alloca(ons. APNIC 31, Hong Kong. Skeeve Stevens
Prop-083v003 Alterna(ve criteria for subsequent IPv6 alloca(ons Skeeve Stevens APNIC 31, Hong Kong Introduc(on This is a proposal to enable current APNIC account holders with exis9ng IPv6 alloca9ons to
9/6/2015. COMP 535 Lecture 6: Routing Security. Agenda. In the News. September 3, 2015 Andrew Chi
COMP 535 Lecture 6: Routing Security September 3, 2015 Andrew Chi Includes content used with permission by Angelos Keromytis (Columbia), Philip Smith (APNIC), and Steve Kent (BBN) Agenda
An Operational Perspective on BGP Security. Geoff Huston February 2005
An Operational Perspective on BGP Security Geoff Huston February 2005 Disclaimer This is not a description of the approach taken by any particular service provider in securing their network. It is intended
Joint Whois / CRISP. Shane Kerr, RIPE NCC Engin Gündüz, RIPE NCC. Shane Kerr & Engin Gündüz. RIPE 47, January 2004, Amsterdam.
Joint Whois / CRISP Shane Kerr, RIPE NCC Engin Gündüz, RIPE NCC Outline Introduction / Problem Statement Joint Whois Possible Approaches Proposed Solution Limitations CRISP What is CRISP Problems and solvers
Introduction to Networking. Topologies and Definitions. Network Topology and Definitions. Some Icons. Network Topologies. Network Topologies
Network Topology and Definitions Definitions and icons Network topologies PoP topologies Introduction to Networking Interconnections and s ISP/ IP Addressing Gluing it all together 1 2 Some Icons Router
Resource Certification
Resource Certification Guide to Resource Certification in MyAPNIC Registration Guide for MyAPNIC Page 1 of 11 Table of Contents 1 Guide to Resource Certification in MyAPNIC... 3 1.1 Access to Resource
Current Policy Topics
Current Policy Topics with World Wide View 1 Overview RIPE Policy Update World Wide View - IPv4, IPv6, Transfers Promotional slides 2 RIPE Policy Update - Accepted Run Out Fairly (2009-03) - Accepted in
News from RIPE and RIPE NCC
News from RIPE and RIPE NCC FRNOG, Paris 11 December 2009 Vesna Manojlovic RIPE / RIPE NCC RIPE Operators community Develops addressing policies Working group mailing lists 2010 meetings: Prague 3-7 May
BGP Configuration Automation on Edge Routers
BGP Configuration Automation on Edge Routers System and Network Engineering Msc. Research Project Stella Vouteva & Tarcan Turgut Supervisor: Stavros Konstantaras, NLNetLabs Introduction Big Internet Depletion
RIR Update. A Joint Presentation Prepared By APNIC, ARIN, RIPE NCC. 17 March 2002 IEPG - Minneapolis
RIR Update A Joint Presentation Prepared By APNIC, ARIN, RIPE NCC Overview Joint Efforts RIR Specific Statistics Questions RIR Co-ordination IPv6 policy development Joint tutorial & presentation at AfNOG
IPv6 Deployment and Distribution in the RIPE NCC Service Region. Marco Schmidt IP Resource Analyst Monday, 23 April 2012
IPv6 Deployment and Distribution in the RIPE NCC Service Region Marco Schmidt IP Resource Analyst Monday, 23 April 2012 Topics: RIPE NCC IPv4 - review and last /8 IPv6 - current status How to get IPv6
Multi-Lateral Peering Agreement
Version 1.1 July 10, 2002 Multi-Lateral Peering Agreement Parties Definitions Obligations Rules Rights Exclusions Best effort basis Establishment procedure Term and renewal Change procedure Termination
Internet Network Protocols IPv4/ IPv6
Internet Network Protocols IPv4/ IPv6 Prof. Anja Feldmann, Ph.D. anja@inet.tu-berlin.de TCP/IP Illustrated, Volume 1, W. Richard Stevens http://www.kohala.com/start 1 IP Interfaces IP address: identifier
IPv4 depletion & IPv6 deployment in the RIPE NCC service region. Kjell Leknes - June 2010
IPv4 depletion & IPv6 deployment in the RIPE NCC service region Kjell Leknes - June 2010 Outline About RIPE and RIPE NCC IPv4 depletion IPv6 deployment Engaging the community - RIPE NCC and the RIPE community
Internet Addressing and the RIR system (part 2)
Internet Addressing and the RIR system (part 2) 12 February 2004 Phnom Penh, Cambodia Paul Wilson, APNIC Overview Part 2 Allocation statistics Asia Pacific Internet Resource statistics Global Internet
BORDER GATEWAY PROTOCOL (BGP) SECURITY. Nurudeen K. Abdulsalam. Supervisor: Dr. Olaf Maennel
ICNS A910002 BORDER GATEWAY PROTOCOL (BGP) SECURITY By Nurudeen K. Abdulsalam Supervisor: Dr. Olaf Maennel A Master's by Course Dissertation Submitted in partial fulfilment of the requirements for the
IPv6 HD Ratio. ARIN Public Policy Meeting April Geoff Huston APNIC
IPv6 HD Ratio ARIN Public Policy Meeting April 2005 Geoff Huston APNIC 1 Background Current IPv6 Address Allocation policies refer to the use of the Host Density Ratio as a metric for acceptable utilization