A Revocation Detection Mechanism in RPKI Based on Behavior Transparency

doi:10.11871/jfdc.issn.2096-742X.2022.03.007

Abstract

Abstract:

[Objective] In response to the issue of resource failure caused by the unilateral revocation in the current Resource Public Key Infrastructure (RPKI), this paper proposes a novel scheme based on Behavior Transparency (BT) to detect unilateral revocations, and demonstrates its effect and performance via extensive experiments. [Methods] This paper first analyzes in detail the issue of unilateral revocation, as well as the risk of resource failures resulting from it, and then proposes to monitor and handle unilateral revocations with the help of a log server that records issuance behaviors of CAs. [Results] According to the experimental results, the efficiency of the proposed scheme satisfies the performance demand posed by the current RPKI system, and its accuracy in detecting unilateral revocations can reach 100% as long as a credible and fully controllable log server is deployed. Moreover, additional transmission overhead resulting from communicating with the log server is negligible. [Limitations] The accuracy, performance, and scalability of the proposed scheme need to be further evaluated in large-scale RPKI systems to verify its value in case that RPKI is fully or near-fully deployed in the future. [Conclusions] In the current RPKI systems, the proposed scheme can effectively detect unilateral revocations with negligible overhead, enabling CAs to monitor the effectiveness of their resources and the revocations to the issuances.

Key words: IP address, AS number, secure inter-domain routing, resource public key infrastructure, transparency

ZOU Hui,LI Yanbiao,YU Chenhui,MA Di,MAO Wei. A Revocation Detection Mechanism in RPKI Based on Behavior Transparency[J]. Frontiers of Data and Computing, 2022, 4(3): 90-109, https://cstr.cn/32002.14.jfdc.CN10-1649/TP.2022.03.007.

Figures/Tables 16

Table 1

Fig.1

Fig.2

Fig.3

Fig.4

Fig.5

Fig.6

Fig.7

Fig.8

Fig.9

Fig.10

Table 2

Fig. 11

Table 3

Fig.12

Fig. 13

References 24

[1]	RFC 6480. An Infrastructure to Support Secure Internet Routing[S].
[2]	Cooper D, Heilman E, Brogle K, et al. On the risk of misbehaving RPKI authorities[C]// In Proceedings of the Twelfth ACM Workshop on Hot Topics in Networks.Co-llege Park, MD, USA: ACM, 2013: 1-7.
[3]	Brogle K, Cooper D, Goldberg S, et al. Impacting IP prefix reachability via RPKI manipulations[R]. USAUSA: Com-puter Science Department, Boston University, 2013.
[4]	RFC8211. Adverse Actions by a Certification Authority (CA) or Repository Manager in the Resource Public Key Infrastructure (RPKI)[S].
[5]	Kuerbis B, Mueller M. Negotiating a new governance hierarchy: An analysis of the conflicting incentives to se-cure internet routing[J]. Communications and Strate-gies, 2011(81):125-142.
[6]	Heilman E, Cooper D, Reyzin L, et al. From the Consent of the Routed: Improving the Transparency of the RPKI[C]// In Proceedings of the 2014 ACM conference on SI-GCOMM.Chicago, IL, USA: ACM, 2014: 51-62.
[7]	draft-kent-sidr-suspenders-01. Suspenders: A Fail-safe Mechanism for the RPKI[S].
[8]	Shrishak K, Shulman H. Limiting the power of RPKI authorities[C]// In Proceedings of the Applied Network-ing Research Workshop.Online (Meetecho), Spain: ACM, 2020:12-18.
[9]	draft-ietf-sidr-ltamgmt-08. Local Trust Anchor Manag-ement for the Resource Public Key Infrastructure[S].
[10]	RFC 8416. Simplified Local Internet Number Resource Management with the RPKI (SLURM)[S].
[11]	Xing Q, Wang B, Wang X. Bgpcoin: Blockchain-based internet number resource authority and bgp security solu-tion[J]. Symmetry, 2018, 10(9):408. doi: 10.3390/sym10090408
[12]	Paillisse J, Ferriol M, Garcia E, et al. IPchain: Securing IP prefix allocation and delegation with blockchain[C]// 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communica-tions (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (Smart-Data), IEEE, 2018: 1236-1243.
[13]	García-Martínez A, Angieri S, Liu B, et al. Design and Implementation of InBlock-A Distributed IP Add-ress Registration System[J]. IEEE Systems Journal, 2021, 15(3): 3528-3539. doi: 10.1109/JSYST.2020.3003526
[14]	RFC 6962. Certificate Transparency[S].
[15]	RFC 6481. A Profile for Resource Certificate Repository Structure[S].
[16]	RFC 6486. Manifests for the Resource Public Key Infra-structure (RPKI)[S].
[17]	draft-ietf-sidrops-6486bis-06. Manifests for the Resource Public Key Infrastructure (RPKI)[S].
[18]	RFC 8210. The Resource Public Key Infrastructure (RPKI) to Router Protocol, Version 1[S].
[19]	draft-michaelson-rpki-rta-02. A profile for Resource Tag-ged Attestations (RTAs)[S].
[20]	NLnet Labs. Krill[CP/OL]. [2021. 09. 25]. https://github.com/NLnetLabs/krill.
[21]	NLnet Labs. Routinator[CP/OL]. [2021. 09. 25]. .
[22]	dotCloud Docker[CP/OL]. [2021. 09. 25]. https://github.com/docker.
[23]	RFC 8183. An Out-of-Band Setup Protocol for Resource Public Key Infrastructure (RPKI) Production Services[S].
[24]	RFC 6492. A Protocol for Provisioning Resource Certifi-cates[S].

针对资源证书的操作类型		表现形式
删除		✧ Manifest ✧ CRL ✧ PP
撤销	撤销一张资源证书（撤销所有资源）	✧ Manifest ♦ CRL ✧ PP
撤销	修改一张资源证书（撤销部分资源）	✧ Manifest ♦ CRL ✧ PP
延迟		✧ Manifest ✧ CRL ♦ PP

实体类型	硬件平台			软件实现
实体类型	CPU	内存/GB	操作系统	软件实现
CA	AMD EPYC 7742 64-Core Processor	629	CentOS Linux release 7.8.2003 (Core)	Krill^[20]
RP	AMD EPYC 7742 64-Core Processor	629	CentOS Linux release 7.8.2003 (Core)	Routinator^[21]
Log	Intel(R) Xeon(R) Platinum 8255C CPU @2.50GHz	4	Ubuntu 20.04 LTS	N/A

CA 类型	CA 数量	子CA的数量	自持有资源证书的数量	签发的资源证书的数量
level-1 CA	1	10	1	10
level-2 CA	10	10	1	100
level-3 CA	100	0	10	0