To Filter or Not to Filter: Measuring the Benefits of Registering in the RPKI Today

Abstract

Securing the Internet’s inter-domain routing system against illicit prefix advertisements by third-party networks remains a great concern for the research, standardization, and operator communities. After many unsuccessful attempts to deploy additional security mechanisms for BGP, we now witness increasing adoption of the RPKI (Resource Public Key Infrastructure). Backed by strong cryptography, the RPKI allows network operators to register their BGP prefixes together with the legitimate Autonomous System (AS) number that may originate them via BGP. Recent research shows an encouraging trend: an increasing number of networks around the globe start to register their prefixes in the RPKI. While encouraging, the actual benefit of registering prefixes in the RPKI eventually depends on whether transit providers in the Internet enforce the RPKI’s content, i.e., configure their routers to validate prefix announcements and filter invalid BGP announcements. In this work, we present a broad empirical study tackling the question: To what degree does registration in the RPKI protect a network from illicit announcements of their prefixes, such as prefix hijacks? To this end, we first present a longitudinal study of filtering behavior of transit providers in the Internet, and second we carry out a detailed study of the visibility of legitimate and illegitimate prefix announcements in the global routing table, contrasting prefixes registered in the RPKI with those not registered. We find that an increasing number of transit and access providers indeed do enforce RPKI filtering, which translates to a direct benefit for the networks using the RPKI in the case of illicit announcements of their address space. Our findings bode well for further RPKI adoption and for increasing routing security in the Internet.

Appendix: IPv6 Results

Detecting RPKI-Filtering in IPv6: We apply the method described in Sect. 3.1, setting equivalent thresholds to those used for IPv4. In September 2019, out of 402 ASes peering with collectors for IPv6, we consider 232 to be full-feeders, and of those 232 we infer 18 are filtering RPKI-invalid announcements (Fig. 6).

Fig. 6.

Count of RPKI-invalid IPv6 prefix-origin pairs and total count of prefix-origin pairs by feeder AS to BGP collectors on Sept. $1^{st}$, 2019.

Fig. 7.

CDF of IPv6 prefix-origin pairs by visibility during September 2019 for different RPKI states.

Tracking Visibility in the Global IPv6 Routing Table: Using the methodology described in Sect. 4.1, we build prefix-origin timelines for IPv6 prefixes⁵. Table 2 shows the properties of our resulting dataset.

Overall IPv6 Prefix-Origin Visibility by RPKI State: Figure 7 shows CDFs of the visibility of prefix-origin timelines, which show very similar behavior to the ones described in Sect. 4.1 for IPv4. In IPv6, there are even fewer RPKI-valid prefix-origins with low visibility compared to IPv4: less than 10% IPv6 prefix-origins have less than 80% visibility compared to 20% for IPv4.

Table 2. Properties of our IPv6 prefix-origin timelines and their respective RPKI validity state.

Fig. 8.

Visibility of RPKI covered IPv6 prefix-origin pairs during MOAS conflicts.

Fig. 9.

Impact of RPKI registration in subMOAS and subprefix conflicts.

Visibility of Multiple Origin AS (MOAS) IPv6 Prefixes: In total, we find about 41,000 instances of MOAS prefix-origin pairs in September 2019 for IPv6, of which some 133 are cases in which at least one prefix-origin is RPKI-valid while others are not. Figure 8 shows the distribution of the maximum visibility of prefix-origin timelines during MOAS conflicts.

Visibility of IPv6 Subprefix Announcements: We find 575 subMOAS prefix conflicting with 102 covering prefixes (Fig. 9a) and 1,903 subprefixes conflicting with 235 covering prefixes (Fig. 9b).

Issuing RPKI records for IPv6 prefixes also benefit networks in the case of conflicting (and potentially malicious) announcements.