Autorisation til routing (RPKI)
RPKI stands for Resource Public Key Infrastructure. In short, it is a security technology that acts as a "digital ID card" for the internet's signposts. It is used to secure the core infrastructure behind the internet (specifically the BGP protocol) so that data traffic doesn't end up in the wrong places. Here is a simple explanation of how it works and why it matters:
The Problem: BGP Hijacking
The internet consists of thousands of smaller networks (called Autonomous Systems or ASes) that communicate via BGP (Border Gateway Protocol). BGP was originally designed in the early days of the internet and is built on pure trust. If a network accidentally (or with malicious intent) tells the rest of the world: "Hey, I own the IP addresses for Google/your bank!", the internet will believe it. This is called a BGP hijacking, and it can lead to:
- Large parts of the internet going down.
- Malicious actors monitoring or stealing your data.
The Solution: How RPKI Helps
RPKI introduces cryptographic validation. It is the equivalent of an independent authority issuing a signed certificate that proves who actually owns which IP addresses.
- Issuance of certificates (ROA): The owner of a network creates a ROA (Route Origin Authorization). This is a digital document stating in black and white: "Only network AS1234 is allowed to route traffic to these IP addresses."
- Cryptographic check: When other routers on the internet receive routes, they check them against the RPKI database.
- Rejection of fake routes: If a router sees a message from an impostor claiming to own the addresses, the router can see that it doesn't match the ROA certificate and reject the traffic immediately.
Why Does It Matter to You?
Even though you don't see RPKI in your everyday life, it is one of the most important technologies for making the internet more resilient against cyberattacks and human typos. In recent years, major tech giants (like Cloudflare, Google, and Microsoft) and large internet service providers worldwide have been rolling out RPKI on a massive scale to ensure your data lands in the right place.
Why
- Examples of BGP Hijacks in RPKI Documentation
- Examples of Routing Incidents in SAC121 / SSAC Briefing on Routing Security (chapter 2)
- RFC 7908: Problem Definition and Classification of BGP Route Leaks
Usage statistics
- Pulse RPKI ROV metric and RPKI ROA metric by Internet Society
- Route Origin Authorisation (ROA) statistics by MANRS
- .nl statistics for Route Origin Authorisation (ROA) by SIDN Labs
- Route Origin Validation (ROV) statistics by APNIC
- RIPEstat - RPKI by country by RIPE NCC
Background information
- RPKI Documentation by the RPKI team at NLnet Labs and the RPKI community
- Mutually Agreed Norms for Routing Security (MANRS)
