APNIC's Resource Certification Service
•
0 likes•1,721 views
The document discusses resource public key infrastructure (RPKI) and APNIC's RPKI service. It provides 3 key points: 1) RPKI uses a PKI architecture to securely associate IP address resources to their holders through cryptographically verified certificates. This improves security of internet routing. 2) APNIC offers an optional RPKI certification service through MyAPNIC where members can generate and manage certificates for their address blocks. 3) The RPKI system is still being developed and tested but offers a way to experiment with generating route origination authorizations (ROAs) to authorize routing of specific address prefixes.
![Issue Date:
Revision:
APNIC Resource
Certification Service
Tuan Nguyen
[31 May 2014]
[4]](https://cdn.sessionspy.com:443/index.php?https://image.slidesharecdn.com/apnicrcssanog24tuanfinal-140801001710-phpapp01/85/APNIC-s-Resource-Certification-Service-1-320.jpg)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to APNIC's Resource Certification Service
Similar to APNIC's Resource Certification Service (20)
More from APNIC
More from APNIC (20)
Recently uploaded
Recently uploaded (20)
APNIC's Resource Certification Service
- 1. Issue Date: Revision: APNIC Resource Certification Service Tuan Nguyen [31 May 2014] [4]
- 2. Internet Routing Security • Routing security is essential to integrity of the Internet – Need to improve security of inter-domain routing • Who has the authority to advertise information into the routing system? • The majority of network relationships are based on system of mutual trust – Each party trusts that routes used to transmit information are safe • The trust model is increasingly open to potential abuse and attack 2
- 3. About RPKI • An architecture to support improved security of Internet routing using PKI infrastructure • A robust security framework for verifying the association between resource holders and their Internet resources – “Cryptographically verifiable attestations” for IP address delegations and their use • This architecture is called Resource Public Key Infrastructure (RPKI) 3
- 4. Resource Delegation Hierarchy IANA AFRINIC RIPE NCC ARIN APNIC LACNIC NIR1 NIR2 ISP ISP ISP ISP ISP ISP ISP
- 5. About RPKI • “Trustable authority” mirrors the administrative resource allocation hierarchy with certificates that match current resource delegations • A resource holder operating a sub-delegation registry (for example, an LIR) may use an RPKI system to generate certificates that correspond to these delegations – Grant a unique “right-of-use” for the associated set of IP resources 5
- 6. About RPKI • These certificates are called resource certificates and they conform to X.509 PKIX standards • RPKI is not used to validate attestations of an individual’s identity or that individual’s role, but as a means to validate that person’s authority to use IP address resources • An RPKI resource certificate is required to enable a resource holder to issue “Route Origination Authorizations” (ROAs) 6
- 7. What is a ROA? • It is a digital object that contains a list of address prefixes and one AS number • It is an authority created by a prefix holder to authorize an AS number to originate one or more specific route advertisements • It does not contain any routing policy information, nor does it convey whether or not the AS holder has even consented to actually announce the prefix(es) into the routing system
- 8. APNIC’s RPKI Service • Enhancement to the RIRs – Offers verifiable proof of resources holdings • Resource certification is an opt-in service – Resource holders choose to request a certificate and provide their public key to be certified • APNIC has integrated the RPKI management service into MyAPNIC for APNIC Member use 8
- 9. What you need to know • You are encouraged to experiment, test, play and develop – For example, you can create your ROAs • RPKI standards are still being developed, and the operating environment for RPKI use is still fragile • It’s ready for testing and prototyping, but is probably not ready for production use just yet • Please tell us what you find but don’t rely on it in your network yet
- 10. MyAPNIC - Resource Certification Service
- 17. More RPKI Information • Securing BGP – The Internet Protocol Journal, Volume 14, No. 2 • An Infrastructure to Support Secure Internet Routing – RFC6480 • A Reappraisal of Validation in the RPKI – labs.apnic.net/blabs • An Introduction to Routing Security (and RPKI tools) – labs.apnic.net/presentations/store/2013-05-13-rpki.pdf • MyAPNIC Resource Certification Guide – www.apnic.net/myapnic 17