RPKI (Resource Public Key Infrastructure)
¿Qué es RPKI (Resource Public Key Infrastructure)?
RPKI (Resource Public Key Infrastructure)A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
● Ejemplos
- 01
An ISP runs Routinator and configures its border routers to drop any BGP announcement that is RPKI-invalid, blocking accidental prefix-hijacks from misconfigured customers.
- 02
An enterprise publishes ROAs for its IP space so that a hijacker announcing a more-specific from a different ASN gets dropped by RPKI-validating transit providers.
● Preguntas frecuentes
¿Qué es RPKI (Resource Public Key Infrastructure)?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements. Pertenece a la categoría de Seguridad de red en ciberseguridad.
¿Qué significa RPKI (Resource Public Key Infrastructure)?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
¿Cómo funciona RPKI (Resource Public Key Infrastructure)?
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
¿Cómo defenderse de RPKI (Resource Public Key Infrastructure)?
Las defensas contra RPKI (Resource Public Key Infrastructure) combinan habitualmente controles técnicos y prácticas operativas, como se detalla en la definición.
¿Cuáles son otros nombres para RPKI (Resource Public Key Infrastructure)?
Nombres alternativos comunes: Resource Public Key Infrastructure, RPKI ROA.
● Términos relacionados
- network-security№ 108
Secuestro BGP
Ataque en el que un sistema autónomo anuncia prefijos IP que no le pertenecen legítimamente, atrayendo y, potencialmente, interceptando tráfico global de Internet.
- network-security№ 109
Fuga de rutas BGP
Propagación no intencionada de BGP en la que un sistema autónomo anuncia rutas fuera de la relación comercial prevista, desviando a menudo tráfico global hacia el AS equivocado.
- network-security№ 174
Autoridad de certificación (CA)
Entidad de confianza que emite y firma certificados digitales, vinculando claves públicas a identidades verificadas como dominios u organizaciones.
- network-security№ 981
Infraestructura de clave pública (PKI)
Conjunto de políticas, software, hardware y autoridades de confianza que emite, distribuye, valida y revoca certificados digitales que asocian identidades con claves públicas.
- network-security№ 380
DNSSEC
Conjunto de extensiones del DNS que usa firmas digitales para que los resolutores verifiquen la autenticidad e integridad de los registros DNS.
- network-security№ 1385
Certificado X.509
Estructura estándar de certificado digital que vincula una clave pública con una identidad mediante la firma de una autoridad de certificación de confianza.