RPKI (Resource Public Key Infrastructure)
O que é RPKI (Resource Public Key Infrastructure)?
RPKI (Resource Public Key Infrastructure)A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
● Exemplos
- 01
An ISP runs Routinator and configures its border routers to drop any BGP announcement that is RPKI-invalid, blocking accidental prefix-hijacks from misconfigured customers.
- 02
An enterprise publishes ROAs for its IP space so that a hijacker announcing a more-specific from a different ASN gets dropped by RPKI-validating transit providers.
● Perguntas frequentes
O que é RPKI (Resource Public Key Infrastructure)?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements. Pertence à categoria Segurança de rede da cibersegurança.
O que significa RPKI (Resource Public Key Infrastructure)?
A cryptographic infrastructure standardized by the IETF that lets resource holders publish signed Route Origin Authorizations (ROAs) for their IP prefixes, so BGP routers can drop or deprioritize obviously invalid route announcements.
Como funciona RPKI (Resource Public Key Infrastructure)?
Resource Public Key Infrastructure (RPKI) is a hierarchical certificate-based infrastructure, standardized in RFCs 6480-onwards, that lets Internet number-resource holders cryptographically authorize which AS numbers may originate BGP routes for their IPv4 and IPv6 prefixes. Each Regional Internet Registry (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) anchors an RPKI hierarchy under which resource holders issue Route Origin Authorizations (ROAs) tying a prefix to an origin ASN and a maximum prefix length. ISPs and IXPs run RPKI validators (Routinator, rpki-client, Fort, RPKI-validator-3) that download and verify the global ROA tree and feed validated state to BGP routers via the RPKI-to-Router (RTR) protocol; routers then mark incoming announcements as VALID, INVALID, or NOT FOUND and apply policy (typically rejecting INVALID). RPKI deployment took years to gain traction but accelerated after high-profile BGP hijacks (YouTube/Pakistan, MyEtherWallet 2018, Telstra/Cloudflare incidents) and is now considered baseline operational hygiene for transit ASNs. Many large content networks (Cloudflare, Google, Amazon) reject RPKI-invalid routes by default.
Como se defender contra RPKI (Resource Public Key Infrastructure)?
As defesas contra RPKI (Resource Public Key Infrastructure) costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para RPKI (Resource Public Key Infrastructure)?
Nomes alternativos comuns: Resource Public Key Infrastructure, RPKI ROA.
● Termos relacionados
- network-security№ 108
Sequestro BGP
Ataque em que um sistema autonomo anuncia prefixos IP que nao sao legitimamente seus, atraindo e podendo interceptar trafego da Internet global.
- network-security№ 109
Vazamento de rotas BGP
Propagacao BGP nao intencional em que um sistema autonomo anuncia rotas fora da relacao comercial prevista, frequentemente desviando trafego global para o AS errado.
- network-security№ 174
Autoridade de certificação (CA)
Entidade de confiança que emite e assina certificados digitais, ligando chaves públicas a identidades verificadas, como nomes de domínio ou organizações.
- network-security№ 981
Infraestrutura de Chave Pública (PKI)
Conjunto de políticas, software, hardware e autoridades de confiança que emite, distribui, valida e revoga certificados digitais que ligam identidades a chaves públicas.
- network-security№ 380
DNSSEC
Conjunto de extensões do DNS que utiliza assinaturas digitais para permitir que os resolvedores verifiquem a autenticidade e a integridade dos registos DNS.
- network-security№ 1385
Certificado X.509
Estrutura padrão de certificado digital que liga uma chave pública a uma identidade através da assinatura de uma autoridade de certificação de confiança.