Resource Public Key Infrastructure for Secure Border Gateway Protocol

Size: px

Start display at page:

Download "Resource Public Key Infrastructure for Secure Border Gateway Protocol"

Thomasine McGee
5 years ago
Views:

1 Resource Public Key Ifrastructure for Secure Border Gateway Protocol George Chag, Majid Ariaezhad, ad Ljiljaa Trajković Commuicatio Networks Laboratory Simo Fraser Uiversity, Vacouver British Columbia, Caada

2 Roadmap Itroductio Securig the Iteret Testbed: cofiguratio of a router betwee SFU ad BCNET Simulatio sceario ad results Coclusio ad refereces CCECE 2016, Vacouver, British Columbia, Caada 2

3 Border Gateway Protocol (BGP) Security issues: message isertio, message deletio, ad modificatio to the routes or packets Ma-i-the-middle attack Deial of Service (DoS) Distributed Deial of Service (DDoS) BGP lacks protectio ad verificatio mechaisms for ivalid route advertisemets CCECE 2016, Vacouver, British Columbia, Caada 3

4 2008 YouTube Icidet Cause: Pakista Telecom (AS 17557) re-routed most of YouTube s traffic to itself due to uauthorized advertisemet of a more specific route Cosequece: YouTube etwork was brought dow globally for more tha two hours o Feb. 24 th 2008 CCECE 2016, Vacouver, British Columbia, Caada 4

5 Securig BGP Resource Public Key Ifrastructure (RPKI): utilizes the Public Key Ifrastructure (PKI) to secure resources (routes) for advertisemets uses public ad private keys to ecrypt the certificate that proves route validity implemets guards agaist uauthorized advertisemet of routes ad resources to eighbourig peers esures accurate iter-autoomous System (AS) route advertisemet CCECE 2016, Vacouver, British Columbia, Caada 5

6 Keys ad Certificates RPKI uses the well developed public key cryptographic techology The public ad private keys are geerated from the Regioal Iteret Registry (RIRs) for idividual resource holders RPKI uses X.509 v3 stadard ad format specificatio that is adopted for PKI CCECE 2016, Vacouver, British Columbia, Caada 6

7 RPKI Participats Certificate Authorities (CA) Autheticatio built i a hierarchical system: IANA à RIR à ISP à Customers IANA: Iteret Assiged Numbers Authority RIR: Regioal Iteret Registry ISP: Iteret Service Provider CCECE 2016, Vacouver, British Columbia, Caada 7

RPKI Hierarchy Structure https://www.ripe.

8 RPKI Hierarchy Structure CCECE 2016, Vacouver, British Columbia, Caada 8

9 RPKI Tools RIPE ad ARIN provide validatio tools to the RPKI data repository: web iterface cache validator verified routes data automatic queuig of validated ROAs or resources RIPE: Réseaux IP Europées ARIN: America Registry for Iteret Numbers ROA: Route Origi Authorizatio CCECE 2016, Vacouver, British Columbia, Caada 9

10 Routig Rules Routig decisios are made by the etwork admiistrator based o RPKI validity states Each route is assiged oe of the three validity states: valid: authorized aoucemet ivalid: uauthorized aoucemet ot foud: ot assiged or ot backed by ROA CCECE 2016, Vacouver, British Columbia, Caada 10

11 Testbed Architecture Two routers were coected via secure tuelig betwee two ASes: BCNET (AS 271) SFU (AS 11105) Both routers/ases were coected to the RPKI cache validator obtaied from RIPE Default RIR was selected as a trust achor to validate BGP aoucemets (ARIN) CCECE 2016, Vacouver, British Columbia, Caada 11

12 Testbed Specificatios Two logical routers were istatiated betwee SFU ad BCNET usig Juiper JuOS Ubutu virtual machie was used as the local cache validator hosted o a PC UNIX based system ruig Oracle JDK 7, rsyc, ad RIPE s validator package 1 GB of memory allocated SFU ad BCNET obtaied IP resources from ARIN used for route validatio CCECE 2016, Vacouver, British Columbia, Caada 12

13 Testbed Topology CCECE 2016, Vacouver, British Columbia, Caada 13

14 Decisio Makig via Route Validatio Verificatio of the applied routig policy: valid, ivalid, ad ot foud statemets were set to 110, 90, ad 100, respectively decisios are made based o these values chose by the admiistrator durig router setup A rouge test router was itroduced to deliberately advertise false iformatio advertisig false route to BCNET, if accepted, would reroute traffic from SFU CCECE 2016, Vacouver, British Columbia, Caada 14

15 Results: Valid States show route protocol bgp validatiostate valid iet.0: 13 destiatios, 14 routes (13 active, 0 holddow, 0 hidde) + = Active Route, - = Last Active, * = Both /24 *[BGP/170] 3w6d 05:23:33, localpref 110 AS path: I, validatio-state: valid > to via lt-0/2/10.69 CCECE 2016, Vacouver, British Columbia, Caada 15

16 Results: Ivalid States show route protocol bgp validatiostate ivalid iet.0: 13 destiatios, 14 routes (13 active, 0 holddow, 0 hidde) + = Active Route, - = Last Active, * = Both /24 [BGP/170] 3d 08:00:09, localpref 90 AS path: 4476 I, validatio-state: ivalid > to via lt-0/3/10.65 CCECE 2016, Vacouver, British Columbia, Caada 16

17 Route Validity show route iet.0: 13 destiatios, 14 routes (13 active, 0 holddow, 0 hidde) + = Active Route, - = Last Active, * = Both /24 *[BGP/170] 3w6d 05:27:15, localpref 110 AS path: I, validatio-state: valid > to via lt-0/2/10.69 [BGP/170] 3d 08:03:15, localpref 90 AS path: 4476 I, validatio-state: ivalid > to via lt-0/3/10.65 CCECE 2016, Vacouver, British Columbia, Caada 17

18 Testbed Summary We implemeted the testbed usig physical routers ad the RPKI local cache server Validatio states were received for the advertised routes A falsified route was ijected ad verified that the route is idetified as ivalid by the validator CCECE 2016, Vacouver, British Columbia, Caada 18

19 Simulatio Goals Implemet the RIPE RPKI Validator as a etwork admiistrator: use the TAL received from the local RIR to fetch route data verify that the validator is reliably stable over log periods ad remais olie durig simulatio Fetch validated productio routes from the validator implemeted i the simulator TAL: Trust Achor Locator RAR: Regioal Iteret Registry CCECE 2016, Vacouver, British Columbia, Caada 19

20 Simulatio: Network Cofiguratio CCECE 2016, Vacouver, British Columbia, Caada 20

21 Trust Achor Locator: TAL All the verified routes from ARIN for North America were dowloaded by addig the TAL file for ARIN ARIN routes as of Aug. 17, 2015: 950 valid routes 1 ot foud route 0 ivalid routes I total, 17,432 verified routes were dowloaded to the RPKI validator CCECE 2016, Vacouver, British Columbia, Caada 21

22 RPKI Validator Web UI: Trust Achors Page CCECE 2016, Vacouver, British Columbia, Caada 22

23 Validated Productio Routes Dowloaded to the Router CCECE 2016, Vacouver, British Columbia, Caada 23

24 Advertisemet Results Usig the rpki-loc-pref, each idividual state was set ad a preferece umber was assiged to each advertised route: route-map rpki-loc-pref permit 10 match rpki ivalid set local-preferece 90! route-map rpki-loc-pref permit 20 match rpki ot-foud set local-preferece 100! route-map rpki-loc-pref permit 30 match rpki valid set local-preferece 110 CCECE 2016, Vacouver, British Columbia, Caada 24

25 Decisio Makig Network admiistrators may: use the local-prefereces value to help make routig decisios accept routes that are ukow or ot foud desig rules to hadle the validity iformatio via assiged local prefereces CCECE 2016, Vacouver, British Columbia, Caada 25

Advertisemet Results: valid Route 206.12.7.

26 Advertisemet Results: valid Route was advertised to router R2 (AS 271) This origial route was advertised by R1 (AS 11105) Router R2 idetified that the route was valid ad a localpref of 110 was set: CCECE 2016, Vacouver, British Columbia, Caada 26

27 Advertisemet Results: ivalid A ivalid route was advertised to R1 (AS 11105) from R2 (AS 271) Router R1 idetified that the route was ivalid ad a localpref of 90 was set: CCECE 2016, Vacouver, British Columbia, Caada 27

28 Advertisemet Results: ot foud A ot foud route was advertised to R2 (AS 271) from R1 (AS 11105) Router R2 idetified that the route was ot foud ad a localpref of 100 was set: CCECE 2016, Vacouver, British Columbia, Caada 28

29 Simulatio Summary Two stad-aloe virtual productio routers were coected to a Virtualbox Ubutu router ruig the RPKI Validator tool The validator was coected to the Iteret to dowload the latest route iformatio from RIRs The route validity states were dowloaded to the router ad verified with the advertised route Routig decisios may be made based o the state ad its localpref value CCECE 2016, Vacouver, British Columbia, Caada 29

30 Coclusio RPKI is becomig a widely accepted techology It calls for additioal participats to validate their routes The validatio tool is user friedly: easy to implemet easily maitaied limited resources are required to moitor the system, which automatically updates local data The experimetal results idicate that RPKI may provide protectio agaist route origi hijacks CCECE 2016, Vacouver, British Columbia, Caada 30

31 Refereces Y. Rekhter ad T. Li, A Border Gateway Protocol 4 (BGP-4), IETF RFC 1771, Mar S. Murphy, BGP Security Vulerabilities Aalysis, IETF RFC 4272, Ja Pakista hijacks [Olie]. Available: YouTube A. Heffera, Protectio of BGP Sessios via the TCP MD5 Sigature Optio, IETF RFC 2385, Aug M. Lepiski ad S. Ket, A Ifrastructure to Support Secure Iteret Routig, IETF RFC 6480, Feb G. Husto ad G. Michaelso, Validatio of Route Origiatio Usig the Resource Certificate Public Key Ifrastructure (PKI) ad Route Origi Authorizatios (ROAs), IETF RFC 6482, Feb R. Bush ad R. Austei, The Resource Public Key Ifrastructure (RPKI) to Router Protocol, IETF RFC 6810, Ja Resource Public Key Ifrastructure (RPKI) [Olie]. Available: rpki/idex.html. M. Lepiski, S. Ket, ad D. Kog, A Profile for Route Origi Authorizatios (ROAs), IETF RFC 6482, Feb CCECE 2016, Vacouver, British Columbia, Caada 31

BGP Attributes and Path Selection. ISP Training Workshops

BGP Attributes and Path Selection. ISP Training Workshops BGP Attributes ad Path Selectio ISP Traiig Workshops 1 BGP Attributes The tools available for the job 2 What Is a Attribute?... Next Hop AS Path MED...... p Part of a BGP Update p Describes the characteristics