Measuring the Adoption of Route Origin Validation and Filtering - - PowerPoint PPT Presentation

▶
measuring the adoption of route origin validation and
SMART_READER_LITE
LIVE PREVIEW

Measuring the Adoption of Route Origin Validation and Filtering - - PowerPoint PPT Presentation

Oct 17, 2022 1.02k likes •1.56k views

Measuring the Adoption of Route Origin Validation and Filtering Andreas Reuter (andreas.reuter@fu-berlin.de) Joint work with Randy Bush, Ethan Katz-Bassett, Italo Cunha, Thomas C. Schmidt, and Matthias Whlisch PEERING The BGP Testbed The BGP

slide-1
SLIDE 1

Measuring the Adoption of Route Origin Validation and Filtering

PEERING

The BGP Testbed

Andreas Reuter (andreas.reuter@fu-berlin.de) Joint work with Randy Bush, Ethan Katz-Bassett, Italo Cunha, Thomas C. Schmidt, and Matthias Wählisch

slide-2
SLIDE 2

AS C AS B AS D AS A

The BGP Problem…

P P P

2

slide-3
SLIDE 3

AS C AS B AS D AS A

The BGP Problem…

P P P

Attacker Legitimate Origin

3

slide-4
SLIDE 4

AS C AS B AS D AS A

P P P

…and the (partial) solution: RPKI

4

slide-5
SLIDE 5

AS C AS B AS D AS A

P P P

…and the (partial) solution: RPKI

Prefix: P Legitimate Origin: AS A

Owner of P

5

slide-6
SLIDE 6

AS C AS B AS D AS A

P P P

…and the (partial) solution: RPKI

Prefix: P Legitimate Origin: AS A

Owner of P

6

slide-7
SLIDE 7

AS C AS B AS D AS A

P P P

…and the (partial) solution: RPKI

Prefix: P Legitimate Origin: AS A

Owner of P

7

slide-8
SLIDE 8

Prefix owner authorizes AS to legitimately announce the prefix

ROA and ROV

8

Route Orig igin Authoriz ization (ROA)

slide-9
SLIDE 9

Route Orig igin Authoriz ization (ROA) Prefix owner authorizes AS to legitimately announce the prefix Route Orig igin Vali lidation (ROV) BGP router validates received routes using ROA information

ROA and ROV

9

slide-10
SLIDE 10

Research Problem

10

Goal: Are any ASes using ROV-based filtering policies?

slide-11
SLIDE 11

Research Problem

11

Goal: Are any ASes using ROV-based filtering policies? Assess current state of deployment Track deployment over time Create an incentive to deploy

slide-12
SLIDE 12

Research Problem

12

Goal: Are any ASes using ROV-based filtering policies? Assess current state of deployment Track deployment over time Create an incentive to deploy Challenge: Private router configurations must be inferred.

slide-13
SLIDE 13

Route Collectors & Vantage Points

AS A AS B

Route Collector

P P

Vantage Point (VP)

BGP Router that exports BGP Updates to a Route Collector

13

Route Collector (RC)

BGP Router that dumps received BGP Updates

slide-14
SLIDE 14

Measuring ROV: Approaches

Description Property

14

slide-15
SLIDE 15

Measuring ROV: Approaches

Uncontrolled

Description Property Analyzing existing BGP data and ROAs, trying to infer who is filtering Fast Needs Existing Data

15

slide-16
SLIDE 16

Measuring ROV: Approaches

Uncontrolled

Description Property Analyzing existing BGP data and ROAs, trying to infer who is filtering Fast Needs Existing Data

Controlled

Actively inject routes and dynamically create ROAs Analyze resulting data to infer who is filtering Slow Needs own AS & Prefixes

16

slide-17
SLIDE 17

Controlled Experiments

17

Goal: Find AS that filter invalid routes

slide-18
SLIDE 18

Controlled Experiments

18

Goal: Find AS that filter invalid routes

BGP

Announce prefixes PA (Anchor) and PE (Experiment)  Same RIR DB route object  Same prefix length  Announced at the same time  Announced to same peers  Announced from same origin AS

slide-19
SLIDE 19

Controlled Experiments

19

Goal: Find AS that filter invalid routes

BGP

Announce prefixes PA (Anchor) and PE (Experiment)  Same RIR DB route object  Same prefix length  Announced at the same time  Announced to same peers  Announced from same origin AS

RPKI

Issue ROAs for both prefixes PA announcement is always val alid id. Periodically change ROA for PE :

  • Flips announcement from

val alid id to in inva valid lid to val alid id daily.

slide-20
SLIDE 20

Controlled Experiments

AS47065

PEERING*

*https://peering.usc.edu/

AS A PA PE

Initial Situation: Origin AS and vantage point AS peer directly

20

Vantage Point

slide-21
SLIDE 21

Controlled Experiments

AS47065

PEERING*

AS A PA PE

21

*https://peering.usc.edu/

Initial Situation: Origin AS and vantage point AS peer directly

Vantage Point

slide-22
SLIDE 22

Controlled Experiments

AS47065

PEERING*

AS A PA

Observation 1: Vantage point exports no route for PE

Vantage Point

22

*https://peering.usc.edu/

slide-23
SLIDE 23

Controlled Experiments

AS47065

PEERING*

AS A PA

Observation 1: Vantage point exports no route for PE

Vantage Point

23

*https://peering.usc.edu/

Conclusion: Vantage point is using ROV-based filtering

slide-24
SLIDE 24

Controlled Experiments

AS47065

PEERING*

AS A PA AS X PE PE

24

*https://peering.usc.edu/

Observation 2: Vantage point exports alternate route for PE

Vantage Point

slide-25
SLIDE 25

Controlled Experiments

AS47065

PEERING*

AS A PA AS X PE PE

25

*https://peering.usc.edu/

Observation 2: Vantage point exports alternate route for PE Conclusion: Vantage point is using ROV-based filtering selectively.

Vantage Point

slide-26
SLIDE 26

Controlled Experiments

AS47065

PEERING*

*https://peering.usc.edu/

AS A PA PE

Situation: Origin AS and vantage point AS do not peer directly

26

Vantage Point

AS X PA PE

slide-27
SLIDE 27

Controlled Experiments

AS47065

PEERING*

*https://peering.usc.edu/

AS A PA PE

Situation: Origin AS and vantage point AS do not peer directly

27

Vantage Point

AS X PA PE

slide-28
SLIDE 28

Controlled Experiments

AS47065

PEERING*

*https://peering.usc.edu/

AS A PA

28

Vantage Point

AS X PA

Observation 1: Vantage point exports no route for PE

slide-29
SLIDE 29

Controlled Experiments

AS47065

PEERING*

*https://peering.usc.edu/

AS A PA

29

Vantage Point

AS X PA

Observation 2: Vantage point exports different route for PE

AS Y PE PE

slide-30
SLIDE 30

Controlled Experiments

30

Measuring vantage point AS that is not direct peer introduces ambiguity: Is the vantage point AS filtering or an intermediate AS?

Problem

slide-31
SLIDE 31

Controlled Experiments

31

Measuring vantage point AS that is not direct peer introduces ambiguity: Is the vantage point AS filtering or an intermediate AS?

Problem

Establishing direct peering with vantage point AS

  • r

Check if intermediate ASes have vantage points

Solution

slide-32
SLIDE 32

Controlled Experiments Results

Before October 20th 2017:

  • Three AS drop invalid routes

October 20th 2017:

  • AMS-IX Route Server changes ROV based filtering to ‘opt-out’
  • 50+ ASes “drop” invalid routes

Caveat: Technically, using Route Server filtering isn’t “deploying ROV”!

32

slide-33
SLIDE 33

ROV Deployment Monitor

Idea

Give the networking community means to assess state of deployment

Launched rov.rpki.net

33

slide-34
SLIDE 34

ROV Deployment Monitor

https://rov.rpki.net

34

Implements our measurement methodology. Table with AS that have deployed ROV. Updated daily.

slide-35
SLIDE 35

Details show vantage points of AS

35

ROV Deployment Monitor

https://rov.rpki.net

slide-36
SLIDE 36

Data Plane

Idea: Complementary Measurements

Using RIPE Atlas, traceroute towards prefixes P

A and PE

36

slide-37
SLIDE 37

Idea: Complementary Measurements

Using RIPE Atlas, traceroute towards prefixes P

A and PE

Unsuccessful traceroute to PE when routes are invalid

Data Plane

Successful traceroute to PA +

37

slide-38
SLIDE 38

Idea: Complementary Measurements

Using RIPE Atlas, traceroute towards prefixes P

A and PE

Unsuccessful traceroute to PE when routes are invalid

Data Plane

Successful traceroute to PA +

38

= Some AS on path is using ROV!

slide-39
SLIDE 39

Idea: Complementary Measurements

Using RIPE Atlas, traceroute towards prefixes P

A and PE

Unsuccessful traceroute to PE when routes are invalid

Data Plane

Successful traceroute to PA +

39

= Some AS on path is using ROV! Note: Fals lse negativ ives are possib ible le because of f default lt routes!

slide-40
SLIDE 40

Conclusion

40

slide-41
SLIDE 41

Conclusion

  • Controlled experiments are crucial to measuring adoption of ROV-

based filtering policies

41

slide-42
SLIDE 42

Conclusion

  • Controlled experiments are crucial to measuring adoption of ROV-

based filtering policies

  • There are ASes that do ROV-based filtering.

Before Oct. 2017: At least 3 AS drop invalids After Oct. 2017: 50+ AS drop invalids via Route Server@AMSIX

42

slide-43
SLIDE 43

Conclusion

  • Controlled experiments are crucial to measuring adoption of ROV-

based filtering policies

  • There are ASes that do ROV-based filtering.

Before Oct. 2017: At least 3 AS drop invalids After Oct. 2017: 50+ AS drop invalids via Route Server@AMSIX

  • IXP offering ROV at Route Servers can boost deployment

43

slide-44
SLIDE 44

Conclusion

44

Please peer with PEERING* and Route Collectors! Questions?

*https://peering.usc.edu/ ROV Deployment Monitor: rov.rpki.net More details about methodology: ACM CCR 48(1)

slide-45
SLIDE 45

Reference

Andreas Reuter, Randy Bush, Italo Cunha, Ethan Katz-Bassett, Thomas C. Schmidt, Matthias Wählisch, Towards a Rigorous Methodology for Measuring Adoption of RPKI Route Validation and Filtering, ACM SIGCOMM Computer Communication Review, Vol. 48, No. 1, pp. 19-27, Jan. 2018.

45

slide-46
SLIDE 46

Backup

46

slide-47
SLIDE 47

47

Uncontrolled Experiments

Don’t know origin AS policy Can’t distinguish between ROV- filtering and other filtering Limited Control Incomplete data can lead to misclassification Limited Visibility No Reproducibility

slide-48
SLIDE 48

48

Controlled: Advantages

Control origin AS policy, can announce own routes Can distinguish ROV-filtering by changing route RPKI state Limited Control Less of an issue: Only care about our routes Limited Visibility Yes Reproducibility

slide-49
SLIDE 49

Uncontrolled Experiments

49

P1 P2

AS E AS C AS A AS B

P1 P2 Vantage Point

slide-50
SLIDE 50

Does AS C filter P2 because it’s announcement is invalid?

50

P1 P2

AS E AS C AS A AS B

P1 P2 Vantage Point E

Uncontrolled Experiments

slide-51
SLIDE 51

51

P1 P2

AS D AS C AS A AS B

P1 P2 Vantage Point D

Uncontrolled Experiments

Probably not!

slide-52
SLIDE 52

Router operation to validate BGP Updates based on ROA data

Research Problem

Goal: Measure the adoption of ROV-based filtering policies

Which AS is allowed to announce an IP prefix

ROA

Public Repository Private Configuration

Decide handling

  • f invalid BGP

routes (Drop?) (De-preference?)

Challenge: Private policies must be inferred from measurements

52

ROV Local Policy