RPKI (Resource Public Key Infrastructure)
Qu'est-ce que RPKI (Resource Public Key Infrastructure) ?
RPKI (Resource Public Key Infrastructure)A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
● Exemples
- 01
An ISP runs Routinator and configures its border routers to drop any BGP announcement that is RPKI-invalid, blocking accidental prefix-hijacks from misconfigured customers.
- 02
An enterprise publishes ROAs for its IP space so that a hijacker announcing a more-specific from a different ASN gets dropped by RPKI-validating transit providers.
● Questions fréquentes
Qu'est-ce que RPKI (Resource Public Key Infrastructure) ?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements. Cette notion relève de la catégorie Sécurité réseau en cybersécurité.
Que signifie RPKI (Resource Public Key Infrastructure) ?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
Comment fonctionne RPKI (Resource Public Key Infrastructure) ?
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
Comment se défendre contre RPKI (Resource Public Key Infrastructure) ?
Les défenses contre RPKI (Resource Public Key Infrastructure) combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.
Quels sont les autres noms de RPKI (Resource Public Key Infrastructure) ?
Noms alternatifs courants : Resource Public Key Infrastructure, RPKI ROA.
● Termes liés
- network-security№ 108
Detournement BGP
Attaque dans laquelle un systeme autonome annonce des prefixes IP qu'il ne possede pas legitimement, attirant et potentiellement interceptant du trafic Internet mondial.
- network-security№ 109
Fuite de routes BGP
Propagation BGP non intentionnelle ou un systeme autonome annonce des routes en dehors de la relation commerciale prevue, derivant souvent du trafic mondial vers le mauvais AS.
- network-security№ 174
Autorité de certification (CA)
Entité de confiance qui émet et signe des certificats numériques, liant des clés publiques à des identités vérifiées telles que des noms de domaine ou des organisations.
- network-security№ 981
Infrastructure à clé publique (PKI)
Ensemble de politiques, logiciels, matériels et autorités de confiance qui émettent, distribuent, valident et révoquent les certificats numériques liant identités et clés publiques.
- network-security№ 380
DNSSEC
Ensemble d'extensions du DNS qui utilise des signatures numériques pour permettre aux résolveurs de vérifier l'authenticité et l'intégrité des enregistrements DNS.
- network-security№ 1385
Certificat X.509
Structure standard de certificat numérique qui lie une clé publique à une identité au moyen de la signature d'une autorité de certification de confiance.