Internet Routing Security: Progress and Challenges

The backbone of the internet relies on the Border Gateway Protocol (BGP), which directs data traffic between autonomous networks. However, vulnerabilities in BGP have long exposed the internet to disruptions, from accidental misconfigurations to deliberate attacks. Recent years have witnessed encouraging developments in safeguarding this critical infrastructure, yet the journey toward a fully secure routing ecosystem remains incomplete.

Understanding BGP Vulnerabilities

BGP operates without inherent authentication mechanisms, allowing any network to announce routes for IP address blocks it does not own. This trust-based model, effective in the internet’s early days, now invites risks such as route hijacks—where attackers redirect traffic to malicious destinations—and route leaks, where incorrect announcements flood global tables, causing outages.

These issues can lead to widespread blackouts, data interception, or service degradation. For instance, a single hijack can siphon user data through unauthorized paths, compromising privacy and security.

Positive Trends in Incident Reduction

Data from recent analyses indicate a decline in routing-related disruptions. Total incidents dropped by nearly 10%, with affected autonomous systems (ASes) decreasing proportionally. Fewer networks are perpetrating these events, signaling improved operational practices.

• Overall incidents reduced by 9.6%.
• Victim ASes fell by 12%.
• Perpetrator networks dropped 17%.

This progress suggests that awareness campaigns and technical implementations are yielding results, though the proportion of security incidents versus general outages holds steady.

The Role of Industry Initiatives like MANRS

The Mutually Agreed Norms for Routing Security (MANRS), backed by the Internet Society, establishes voluntary standards for operators. By committing to specific actions, participants enhance collective resilience.

Core MANRS actions include:

• Precise Filtering: Verify outbound route announcements and scrutinize inbound ones from peers using prefix and path details.
• Source Validation: Block spoofed traffic from non-originating sources, especially for edge customers.
• Communication Protocols: Publish accurate contact details for rapid incident response.
• Transparency Tools: Share routing policies in public registries like IRRs or RPKI for peer validation.

These steps address root causes: filters curb leaks, validation prevents hijacks, and coordination speeds resolutions.

Expanding Protections to Internet Exchange Points

Internet Exchange Points (IXPs) amplify risks by aggregating routes. MANRS for IXPs mandates route server filtering using IRR and RPKI data, blocking invalid announcements at the source. IXPs must also advocate MANRS adoption among members, fostering a secure peering environment.

Technological Pillars: RPKI and ROAs

Resource Public Key Infrastructure (RPKI) introduces cryptographic validation. Route Origin Authorizations (ROAs) digitally sign prefix ownership, allowing operators to reject unauthorized announcements. Major players like AWS have achieved near-100% coverage, dropping invalid routes globally.

The U.S. government’s 2024 roadmap endorses RPKI, urging widespread ROA creation and validation. Future extensions like BGPsec and AS Path Authorizations promise path verification, closing remaining gaps.

Quantifying the Gains

Statistics underscore momentum:

• 4.4% of ASes impacted annually, down 1%.
• IXP filter checks now monitor compliance worldwide.
• MANRS participants growing, pulling in more adopters.

Despite this, incidents persist, affecting thousands of networks and underscoring the need for universal adoption.

Obstacles to Full Deployment

Challenges include operational complexity, legacy equipment, and inertia among smaller operators. Resource constraints hinder RPKI setup, while inconsistent IRR data undermines filtering. Geopolitical tensions also spur state-sponsored hijacks.

Government mandates, like the White House roadmap, aim to accelerate progress through incentives and standards.

Best Practices for Operators

To contribute:

1. Deploy RPKI: Generate ROAs and enable validation.
2. Implement Filters: Use max-prefix limits and customer IRR checks.
3. Join MANRS: Publicly commit and verify compliance.
4. Monitor Actively: Leverage tools like Oracle’s IXP checks.

Future Horizons in Routing Security

Emerging standards like BGPsec will authenticate full paths, while automation via SIDR enhances scalability. Community events like APRICOT reinforce collaboration, as seen in 2019 promotions.

Sustained investment promises a more robust internet, resilient to evolving threats.

Frequently Asked Questions (FAQs)

What is a BGP route hijack?

A route hijack occurs when a malicious actor announces false routes, diverting traffic from legitimate paths.

How does RPKI improve security?

RPKI uses digital signatures to verify route origins, preventing unauthorized announcements.

Why join MANRS?

It standardizes practices, reducing incidents and enhancing reputation among peers.

Are there tools for monitoring?

Yes, services like Internet Society’s Deploy360 and IXP filter checks provide visibility.

What’s the status of global adoption?

Progressing, with leaders like AWS at 99% ROA coverage, but broader uptake needed.

Similar Articles

MANRS: Building Routing Security Leaders

MANRS: Securing Internet Routing for Network Operators

Strengthening Internet Routing Through IXP Security

BGP: Internet’s Routing Backbone

Securing Internet Routing: IXPs as Key Defenders

MANRS Milestone: One Year On with IIJ’s Entry

Author

medha deb

 

Medha Deb is an editor with a master's degree in Applied Linguistics from the University of Hyderabad. She believes that her qualification has helped her develop a deep understanding of language and its application in various contexts.

Read full bio of medha deb