IETF 101: Building Resilient Internet Foundations
Discover key IETF 101 advancements in securing routing, managing DDoS threats, and strengthening global Internet infrastructure for enduring reliability.
The Internet Engineering Task Force (IETF) meeting numbered 101, held in London in March 2018, marked a significant milestone in the ongoing quest to fortify the Internet’s backbone. With over a thousand engineers convening, the focus sharpened on infrastructure resilience—a critical theme as cyber threats, hardware failures, and scalability challenges intensify. This gathering highlighted collaborative efforts to enhance routing security, deploy cryptographic validations, and counter massive distributed denial-of-service (DDoS) attacks. These initiatives underscore the IETF’s role in evolving standards that keep the Internet operational under duress.
Core Pillars of Internet Resilience
Resilience in Internet infrastructure encompasses multiple layers, starting with physical connectivity and extending to sophisticated security protocols. At its heart, a resilient network maintains service quality despite faults, attacks, or overloads. Key pillars include:
- Physical Backbone: Diverse routing paths, redundant cabling, and widespread access points prevent single points of failure.
- Protocol Security: Mechanisms to validate routing announcements and detect anomalies in data flows.
- Threat Mitigation: Automated signaling for rapid response to volumetric attacks that overwhelm networks.
- Operational Best Practices: Guidelines for deploying emerging technologies without disrupting legacy systems.
These elements were central to IETF 101 sessions, where working groups presented mature drafts and operational insights. The discussions emphasized practical deployment over theoretical models, reflecting real-world pressures on service providers and enterprises.
Securing BGP: From SIDR to BGPsec Completion
Border Gateway Protocol (BGP) remains the linchpin of inter-domain routing, directing traffic across autonomous systems worldwide. However, its vulnerability to hijacks—where malicious actors advertise false paths—has long plagued the network. The Secure Inter-Domain Routing (SIDR) working group addressed this through BGPsec, an extension authenticating the entire path of routing updates.
By IETF 101, SIDR achieved a landmark: RFC 8205, the BGPsec Protocol Specification, advanced to standards track status. This document, alongside companions like RFC 8206 on AS migration and RFC 8207 on operations, forms a comprehensive suite. BGPsec employs cryptographic signatures, leveraging Resource Public Key Infrastructure (RPKI) certificates to verify origins and paths.
Deployment challenges persist, including key management and performance overhead. Yet, progress was evident, with operators sharing pilot experiences. Transition mechanisms allow gradual adoption, signaling via Object Identifiers in X.509 extensions per RFC 3779 and policies in RFC 6484.
Operationalizing RPKI: SIDROPS Takes the Helm
With SIDR’s core tech stabilized, the SIDR Operations (SIDROPS) working group shifted focus to real-world integration. RPKI, validating IP address and AS number ownership, underpins BGPsec. SIDROPS develops deployment guides, ensuring networks can validate Route Origin Authorizations (ROAs) efficiently.
Key outputs at IETF 101 included drafts on relying party requirements and validation processes. These specify how validators fetch, cache, and assess certificates, minimizing trust-on-first-use risks. Discussions tackled scalability: with millions of ROAs, systems must handle revocation lists without latency spikes.
A table illustrates RPKI components:
| Component | Function | RFC Reference |
|---|---|---|
| ROA | Authorizes prefixes per AS | RFC 6482 |
| Certificate | Binds resources to keys | RFC 3779 |
| Manifest | Tracks issued objects | RFC 6486 |
| CRL | Handles revocations | RFC 5280 |
This framework empowers networks to drop invalid routes, curbing hijacks that could reroute traffic to eavesdroppers or blackholes.
Countering DDoS: DOTS Protocol Advances
DDoS attacks, flooding links with junk traffic, threaten availability. The DDoS Open Threat Signaling (DOTS) working group at IETF 101 progressed a protocol for inter-domain signaling. DOTS enables clients (attack victims) to request mitigation from servers (upstream providers), sharing telemetry for coordinated defense.
Maturing specs covered architecture (draft-ietf-dots-architecture), use cases, and requirements. The protocol uses CoAP over UDP/TCP for low overhead, supporting signals like attack scope, mitigation status, and confidence levels. Sessions debated telemetry formats, ensuring compatibility with existing telemetry like IPFIX.
Real-world applicability shone through: during attacks peaking at terabits per second, DOTS could orchestrate blackholing, scrubbing, or rate-limiting across providers. This programmatic approach scales beyond manual phone calls, vital as IoT botnets amplify threats.
Enhancing IXP Reliability and Route Server Logic
Internet Exchange Points (IXPs) aggregate traffic efficiently, but route servers—centralizing BGP sessions—introduce control-data plane mismatches. If data links fail undetected, blackholing occurs. The IDR working group refined drafts like “Route Servers Awareness of Data Link Failures,” integrating BFD for sub-second failure detection.
Operators debated necessity: some peers prefer bilateral sessions. Yet, for large IXPs, route servers reduce peering complexity. IETF 101 refined signaling to propagate failures back, enhancing convergence.
Additionally, BGP import/export damping via explicit policies (draft-ietf-idr-default-ebgp-rp-behavior) prevents route leaks from misconfigurations, a common resilience gap.
Broader Implications for Global Connectivity
IETF 101’s resilience work extends beyond protocols to policy and measurement. The Internet Society’s Pulse platform, measuring outages and IXP growth, complements these efforts. Recent undersea cable cuts in Africa demonstrated peering and caching’s value, routing local traffic seamlessly.
Challenges ahead: incentivizing adoption amid capex constraints, international coordination for subsea protections, and IPv6 integration. Yet, momentum builds—BGPsec pilots, RPKI at 30%+ validation rates in some regions, and DOTS trials signal progress.
FAQs on Internet Infrastructure Resilience
What makes BGP vulnerable?
BGP trusts peer announcements without inherent validation, enabling prefix hijacks.
How does RPKI mitigate this?
It issues digital certificates proving prefix ownership, rejected if mismatched.
What’s new with DOTS?
A standards-based protocol for automated DDoS signaling across domains.
Why focus on IXPs?
They boost local traffic efficiency; resilient route servers prevent hidden failures.
Is resilience improving globally?
Yes, via metrics like the Internet Resilience Index tracking infrastructure, security, and performance.
Future Directions Post-IETF 101
Post-101, working groups accelerated: SIDROPS published more ops guides, DOTS neared RFCs, and IDR integrated feedback. By 2026, expect widespread BGPsec and DOTS in production, bolstering resilience against evolving threats like quantum risks and supply chain attacks. Collaboration with bodies like ITU reinforces standards harmonization.
This IETF chapter exemplifies engineering pragmatism—iterative, evidence-based evolution safeguarding the Internet as a utility.
References
- Internet Society Pulse: Internet Resilience Index Methodology — Internet Society. 2025-08-01. https://www.internetsociety.org/blog/2025/08/what-is-internet-resilience/
- RFC 8205: BGPsec Protocol Specification — IETF (draft-ietf-sidr-bgpsec-protocol). 2017-09-01. https://www.rfc-editor.org/info/rfc8205
- Internet Resilience in Practice: African Cable Cuts — Internet Society Foundation. 2025-10-01. https://www.isocfoundation.org/2025/10/ever-wondered-how-the-internet-stays-on-its-all-about-resilience/
- RFC 3779: X.509 Extensions for IP Addresses and AS Identifiers — IETF. 2004-06-01. https://www.rfc-editor.org/info/rfc3779
- IETF 101 Event Overview — Internet Society. 2018-03-23. https://www.internetsociety.org/events/ietf/ietf-101/
Similar Articles
Read full bio of Sneha Tete
