RPKI (Resource Public Key Infrastructure)
Was ist RPKI (Resource Public Key Infrastructure)?
RPKI (Resource Public Key Infrastructure)A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
● Beispiele
- 01
An ISP runs Routinator and configures its border routers to drop any BGP announcement that is RPKI-invalid, blocking accidental prefix-hijacks from misconfigured customers.
- 02
An enterprise publishes ROAs for its IP space so that a hijacker announcing a more-specific from a different ASN gets dropped by RPKI-validating transit providers.
● Häufige Fragen
Was ist RPKI (Resource Public Key Infrastructure)?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements. Es gehört zur Kategorie Netzwerksicherheit der Cybersicherheit.
Was bedeutet RPKI (Resource Public Key Infrastructure)?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
Wie funktioniert RPKI (Resource Public Key Infrastructure)?
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
Wie schützt man sich gegen RPKI (Resource Public Key Infrastructure)?
Schutzmaßnahmen gegen RPKI (Resource Public Key Infrastructure) kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für RPKI (Resource Public Key Infrastructure)?
Übliche alternative Bezeichnungen: Resource Public Key Infrastructure, RPKI ROA.
● Verwandte Begriffe
- network-security№ 108
BGP-Hijacking
Angriff, bei dem ein autonomes System IP-Prafixe ankundigt, die ihm nicht legitim gehoren, und so weltweiten Internetverkehr anzieht und moglicherweise abfangt.
- network-security№ 109
BGP-Route-Leak
Unbeabsichtigte BGP-Propagation, bei der ein autonomes System Routen ausserhalb der vorgesehenen Geschaftsbeziehung ankundigt und damit oft globalen Verkehr in das falsche AS lenkt.
- network-security№ 174
Zertifizierungsstelle (CA)
Vertrauenswürdige Instanz, die digitale Zertifikate ausstellt und signiert und damit kryptografische öffentliche Schlüssel mit geprüften Identitäten wie Domains oder Organisationen verknüpft.
- network-security№ 981
Public-Key-Infrastruktur (PKI)
Gesamtsystem aus Richtlinien, Software, Hardware und vertrauenswürdigen Instanzen, das digitale Zertifikate ausstellt, verteilt, prüft und widerruft, die Identitäten mit öffentlichen Schlüsseln verknüpfen.
- network-security№ 380
DNSSEC
Eine Reihe von DNS-Erweiterungen, die digitale Signaturen verwenden, damit Resolver die Echtheit und Integrität von DNS-Einträgen überprüfen können.
- network-security№ 1385
X.509-Zertifikat
Standardstruktur eines digitalen Zertifikats, das einen öffentlichen Schlüssel über die Signatur einer vertrauenswürdigen CA mit einer Identität verbindet.