engineering

Resource Public Key Infrastructure

Resource Public Key Infrastructure is a engineering topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Resource Public Key Infrastructure rather than just read about it. In short: Resource Public Key Infrastructure (RPKI), also known as Resource Certification, is a specialized public key infrastructure (PKI) framework to support improved security for the Internet's BGP routing infrastructure. RPKI provides a way to connect Internet number resource information (such as Autonomous System numbers and IP addresses) to a trust anchor.

Key takeaways

Resource Public Key Infrastructure belongs to engineering; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Resource Public Key Infrastructure to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Resource Public Key Infrastructure from memory before moving on to harder problems.

Reference excerpt

Resource Public Key Infrastructure (RPKI), also known as Resource Certification, is a specialized public key infrastructure (PKI) framework to support improved security for the Internet's BGP routing infrastructure. RPKI provides a way to connect Internet number resource information (such as Autonomous System numbers and IP addresses) to a trust anchor. The certificate structure mirrors the way in which Internet number resources are distributed. That is, resources are initially distributed by the IANA to the regional Internet registries (RIRs), who in turn distribute them to local Internet registries (LIRs), who then distribute the resources to their customers. RPKI can be used by the legitimate holders of the resources to control the operation of Internet routing protocols to prevent route hijacking and other attacks. In particular, RPKI is used to secure the Border Gateway Protocol (BGP) through BGP Route Origin Validation (ROV) and Autonomous System Provider Authorization (ASPA), as well as Neighbor Discovery Protocol (ND) for IPv6 through the Secure Neighbor Discovery protocol (SEND). The RPKI architecture is documented in RFC 6480. The RPKI specification is documented in a spread out series of RFCs: RFC 6481, RFC 6484, RFC 6485, RFC 6486, RFC 6487, RFC 6488, RFC 6489, RFC 6490, RFC 6491, RFC 6492, and RFC 6493. ROV is documented in RFC 6482 and RFC 6483, and SEND in RFC 6494 and RFC 6495. These RFCs are a product of the IETF's SIDR ("Secure Inter-Domain Routing") working group, and are based on a threat analysis which was documented in RFC 4593. Several implementations for prefix origin validation already exist.

Resource Certificates and child objects RPKI uses X.509 PKI certificates (RFC 5280) with extensions for IP addresses and AS identifiers (RFC 3779). It allows the members of regional Internet registries, known as local Internet registries (LIRs), to obtain a resource certificate listing the Internet number resources they hold. This offers them validatable proof of holdership, though the certificate does not contain identity information. Using the resource certificate, LIRs can create cryptographic attestations about the route announcements they authorise to be made with the prefixes and ASNs they hold. These attestations are described below.

Route Origin Authorizations A Route Origin Authorization (ROA) states which autonomous system (AS) is authorised to originate certain IP prefixes, used for Route Origin Validation (ROV). In addition, it can enforce the maximum length of the prefix that the AS is authorised to advertise. An ROA that was cryptographically verified is referred to as a Validated ROA Payload (VRP), which is then typically transferred to a router to perform route filtering.

Maximum prefix length The maximum prefix length is an optional field. When not defined, the AS is only authorised to advertise exactly the prefix specified. Any more specific announcement of the prefix will be considered invalid. This is a way to enforce aggregation and prevent hijacking through the announcement of a more specific prefix. When present, this specifies the length of the most specific IP prefix that the AS is authorised to advertise. For example, if the IP address prefix is 10.0.0.0/16 and the maximum length is 22, the AS is authorised to advertise any prefix under 10.0.0.0/16, as long as it is no more specific than /22. So, in this example, the AS would be authorised to advertise 10.0.0.0/16, 10.0.128.0/20 or 10.0.252.0/22, but not 10.0.255.0/24.

RPKI route announcement validity When a ROA is created for a certain combination of origin AS and prefix, this will have an effect on the RPKI validity of one or more route announcements. They can be:

VALID The route announcement is covered by at least one ROA INVALID The prefix is announced from an unauthorised AS. This means: There is a ROA for this prefix for another AS, but no ROA authorising this AS; or This could be a hijacking attempt The announcement is more specific than is allowed by the maximum length set in a ROA that matches the prefix and AS UNKNOWN The prefix in this announcement is not covered (or only partially covered) by an existing ROA Note that invalid BGP updates may also be due to incorrectly configured ROAs.

Autonomous System Provider Authorizations An Autonomous System Provider Authorization (ASPA) states which networks are permitted to appear as direct upstream adjacencies of an autonomous system in BGP AS_PATHs. This provides a simpler way of BGP path validation compared to BGPsec described below. AS operators publish attestations specifying which other ASNs may appear as an upstream in any AS_PATH received through BGP. There are two variants of ASPA validation, depending on where the BGP announcement was received from:

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Resource Public Key Infrastructure

Start with the simplest possible case. Write down what Resource Public Key Infrastructure claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In engineering, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Resource Public Key Infrastructure before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Resource Public Key Infrastructure ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Resource Public Key Infrastructure

In research: Resource Public Key Infrastructure appears in engineering research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Resource Public Key Infrastructure in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Resource Public Key Infrastructure is common in secondary-school and first-year university syllabi. It links to neighbouring topics Internet architecture, Public-key cryptography, Routing protocols, so understanding it makes those chapters shorter.
In everyday life: Look for Resource Public Key Infrastructure outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Resource Public Key Infrastructure in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Resource Public Key Infrastructure means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Resource Public Key Infrastructure out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Resource Public Key Infrastructure in simple terms?

Why does Resource Public Key Infrastructure matter?

Because it connects several engineering ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Resource Public Key Infrastructure?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Resource Public Key Infrastructure.