Understanding Route Origin Validation (ROV) Deployment in the Real World and Why MANRS Action 1 Is Not Followed

Understanding Route Origin Validation (ROV) Deployment in the Real World and Why MANRS Action 1 Is Not Followed

Speakers: Lancheng Qin

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=xqKJ4X9MSuw

Overview

BGP hijacking remains a persistent and critical threat to the stability and security of the global Internet routing system. In 2021 alone, BGPStream reported a staggering 775 hijacking incidents, some with severe consequences, such as AS 212046 hijacking 3,786 prefixes, impacting 972 Autonomous Systems (ASes) across 42 countries. To counter this pervasive issue, Route Origin Validation (ROV) has emerged as the industry's best current practice for enhancing BGP security. The Mutually Agreed Norms for Routing Security (MANRS), an initiative championed by the Internet Society, actively promotes the adoption of ROV among network operators. Specifically, MANRS Action 1 mandates that operators validate and filter illegitimate announcements received from their customers.

However, despite these recommendations and the clear security benefits, recent research, including the work presented by Lancheng Qin at the NDSS Symposium, indicates a significant disconnect between MANRS guidelines and real-world ROV deployment. A substantial number of networks, including prominent Tier-1 ASes such as AT&T (AS 7018), either do not fully deploy ROV or exhibit selective filtering practices, often failing to prioritize customer interfaces as MANRS suggests. Instead, many selectively filter RPKI-invalid prefixes based on interface type, leading to a fragmented and less effective security posture.

This comprehensive study by Lancheng Qin aims to dissect the intricacies of real-world ROV deployment strategies, meticulously investigate the underlying reasons for network operators' non-compliance with MANRS Action 1, and ultimately propose more effective and economically viable deployment strategies. By combining large-scale measurements, a novel notification experiment, in-depth operator surveys, and extensive simulations, the research offers critical insights into the challenges and opportunities for improving global routing security.

Background

▶ Watch: Introduction: BGP hijacking, ROV, and MANRS Action 1 challenges. (0:00)

The Internet's foundational routing protocol, the Border Gateway Protocol (BGP), is inherently trust-based and lacks robust built-in security mechanisms, making it susceptible to various forms of hijacking. BGP hijacking occurs when an AS maliciously announces prefixes (blocks of IP addresses) that it does not legitimately own, or announces paths that are not valid. This can lead to traffic diversion for purposes ranging from denial-of-service (DDoS) attacks and eavesdropping to cryptocurrency theft. Prefix origin hijacking, where an AS announces a prefix belonging to another network, is particularly common and devastating, capable of polluting up to 90% of the Internet's routing tables in under two minutes.

To mitigate this vulnerability, the Resource Public Key Infrastructure (RPKI) has become the leading security framework. RPKI establishes a hierarchical Public Key Infrastructure that uses cryptographically signed objects called Route Origin Authorizations (ROAs). A ROA cryptographically binds an IP address space to the Autonomous System Number (ASN) that is authorized to originate routes for that space, optionally specifying a maximum prefix length. The ROV process is straightforward:

• If a prefix has no covering ROA, it is classified as unknown.
• If a ROA exists but the origin ASN or max-length attribute does not match the announced prefix, it is classified as invalid.
• If a ROA exists and all attributes match, the prefix is valid.

RPKI-invalid filtering involves discarding these invalid BGP announcements. ROV is generally preferred over older Internet Routing Registry (IRR)-based filtering due to its cryptographic validation and offers a lower computational overhead compared to more comprehensive but complex solutions like BGPsec.

The MANRS initiative, launched in 2014, outlines four key actions for network operators to improve routing security. Action 1, which is mandatory, specifically requires operators to prevent the propagation of illegitimate BGP announcements from their customers. This action is predicated on the assumption that filtering customer routes effectively constrains illegitimate routes to the customer's immediate cone, preventing wider propagation. However, this study challenges whether this assumption holds true in practice and if this is indeed the most effective and practical approach for real-world deployment.

Key Findings

▶ Watch: Understanding BGP hijacking, RPKI, and MANRS Action 1. (2:00)

The research uncovered several critical findings that shed light on the current state of ROV deployment and the efficacy of various intervention strategies:

• Low MANRS Action 1 Compliance: An alarming 61.3% of the 895 non-stub ASes identified as propagating RPKI-invalid prefixes were found to be passing invalid prefixes received from their customers. This directly contradicts MANRS Action 1, which mandates ROV deployment at all customer interfaces.
• Interface-Specific Filtering Preferences: Many ASes prioritize ROV deployment at provider interfaces (29.0% never accepted invalid prefixes from providers) or peer interfaces (31.6% never accepted invalid prefixes from peers) rather than, or in addition to, customer interfaces. Only 25% of the 1,012 observed ASes propagated invalid prefixes from all interface types, indicating a complete lack of ROV.
• AS Size and Deployment Strategy Correlation: Different sizes of ASes exhibit varying ROV deployment tendencies. Small ASes (fewer than 2 customers) are more likely to filter at customer interfaces (78.9% of non-stub small ASes). Large ASes (more than 180 customers) show a greater inclination towards filtering at provider interfaces (37.2% accepted no invalid prefixes from providers), while medium ASes (2-180 customers) tend to prioritize peer interfaces (36.1% accepted no invalid prefixes from peers).
• Ineffectiveness of Notifications: A novel notification experiment, employing various nudge conditions (Baseline, Social Norms, Authority, Reminder, Elicitation) and native language messages, found no statistically significant impact on ROV remediation rates within a 55-day observation period. Most ASes in the study did not remediate, suggesting that awareness alone is insufficient to drive adoption.
• Primary Barriers: Economical and Technical Challenges: A comprehensive survey revealed that the slow adoption and non-compliance are primarily due to a combination of economical and technical challenges. Economical reasons include significant time and effort (43.9%), business conflicts (23.2%) – particularly transit providers' reluctance to discard customer announcements due to revenue concerns – and limited router capability or budget for upgrades (15.6%). Technical reasons include availability concerns (19.5%) regarding potential customer outages, doubts about effectiveness (9.8%) against sophisticated hijackers, perceived false positives, and difficulty finding reliable external RPKI validators.
• Operational Problems Highlighted: Operators reported specific problems such as pollution from upstream ASes (26.8%), limited ROA adoption (22.0%), technical bugs in RPKI RTR servers or router software (19.5%), mandatory impact on BGP routing selection (13.3%), and performance impact (6.7%).
• Optimal Deployment Strategy via Simulation: Internet-scale simulations conclusively demonstrated that deploying ROV at provider interfaces first is the most effective strategy, achieving over 80% reduction in polluted ASes for 99.74% of invalid prefixes. Deploying at customer interfaces was also effective (86.01% reduction >80%), while peer interfaces showed extremely limited effectiveness (less than 10% reduction for over 90% of prefixes). A combined strategy of provider and customer interfaces performed best overall.
• Revised Practical Recommendations: Based on simulations, the study proposes a revised ROV deployment strategy: Provider interfaces first, then customer interfaces, and finally peer interfaces. This prioritizes global effectiveness and addresses business conflicts by avoiding immediate filtering of customer routes.

Technical Deep Dive

▶ Watch: Overview of research methodology: measurement, notification, interviews, simu... (4:00)

The study employed a multi-faceted methodology to thoroughly investigate ROV deployment.

The Internet-scale measurement phase focused on identifying ASes that propagate RPKI-invalid prefixes, rather than directly measuring ROV deployment, which ensures accuracy for identified non-compliant ASes. BGP data was collected from all public RouteViews and RIPE RIS route collectors. Each BGP announcement was then subjected to ROV to determine its validation status (valid, invalid, unknown). By analyzing the AS path of RPKI-invalid announcements, the researchers pinpointed the propagating ASes. The measurement period was from June 15 to June 30, 2022, during which approximately 0.6% of prefixes were RPKI-invalid. To understand the influence of business relationships, AS business relationship data from CAIDA was used to classify interfaces as customer, provider, or peer. ASes were also categorized by size based on their number of customers: small (<2 customers), medium (2-180 customers), and large (>180 customers). Two formulas, P_interfaces and P_prefixes, quantified the percentage of interfaces accepting invalid prefixes and the overall percentage of propagated invalid prefixes, respectively.

The notification experiment was designed as a randomized controlled trial to assess the impact of different notification treatments on ROV remediation rates. From the 1,012 ASes identified in the measurement phase as propagating invalid prefixes, 859 were assigned to one of seven experimental groups: six treatment groups and one control group. The six treatment groups included five nudge conditions (Baseline, Social Norms, Authority, Reminder, Elicitation) and one Native Language group. The Baseline group received a standard informational email in English explaining their propagation of invalid prefixes. Social Norms added text about global ROV adoption rates (around 35%) and MANRS participation. Authority emphasized MANRS as an Internet Society-supported global initiative. Reminder ASes received a second notification if they hadn't remediated. Elicitation included a questionnaire link to understand BGP security concerns. The Native Language group received the baseline message translated for non-native English speakers. The remaining 138 ASes formed the Control group, receiving no notification. To overcome high email bounce rates, contact information was prioritized from PeeringDB and technical contacts, then abuse contacts. On July 9, 2022, 824 notifications were successfully delivered (4.07% bounce rate). The observation phase lasted 55 days, with weekly measurements to identify remediation based on criteria similar to Galid et al. 21, requiring an AS to stop propagating invalid prefixes from three different origin ASes. Survival analysis and log-rank tests were used to compare remediation rates between groups.

Given the limited impact of notifications, a survey and interviews were conducted to delve into the reasons for non-compliance. Initial qualitative insights were gathered from interviews with five network operators from diverse regions (South Africa, Germany, China, Netherlands), highlighting business interests (e.g., transit providers' reluctance to discard customer announcements due to revenue loss) and lack of time as major barriers. These insights informed the design of a comprehensive, anonymous questionnaire, distributed to experiment participants and major Network Operators Groups (NANOG, AFNOG, SANOG) from May 25 to June 25, 2023, yielding 82 responses. The survey explored current and intended ROV deployment strategies across different interface types, reasons for non-deployment, problems encountered, and suggestions for improvement.

Finally, Internet-scale simulations were performed to determine the most effective partial filtering strategies, particularly in light of business conflicts. A topology comprising over 74,000 ASes, built using CAIDA business relationship data, was used. 10,000 simulation runs were performed, each with a randomly selected prefix hijacker announcing an RPKI-invalid prefix. The routing tree algorithm, adhering to the valley-free principle, simulated prefix propagation. The effectiveness metric was the reduction ratio of polluted ASes, quantifying how many ASes stopped accepting and propagating the invalid prefix after ROV deployment. Scenarios included all ASes deploying ROV at provider, customer, or peer interfaces, and then varying ROV deployment ratios from 20% to 100% to assess impact on the average reduction ratio.

Demo / Proof of Concept

▶ Watch: Measurement results: 61.3% of ASes non-compliant with MANRS Action 1. (8:00)

The presented work focuses on extensive empirical measurements, controlled experiments, surveys, and simulations to understand real-world ROV deployment and propose new strategies. The talk did not include a demonstration of a specific tool, code, or a live proof-of-concept for a new vulnerability or defense mechanism. Instead, its "proof of concept" lies in the rigorous analytical methods employed to validate hypotheses and derive data-driven recommendations.

Defensive Implications

▶ Watch: Interface-specific ROV deployment patterns across different AS sizes. (10:00)

The findings of this study provide crucial insights for network operators, industry bodies like MANRS, and equipment vendors to enhance routing security. The most significant defensive implication is the proposed revised ROV deployment strategy:

1. First, deploy ROV at provider interfaces.
2. Second, deploy ROV at customer interfaces.
3. Finally, deploy ROV at peer interfaces.

This strategy is not only shown to be the most globally effective in mitigating prefix origin hijackings, but it also directly addresses the prevalent business conflicts. For transit networks, prioritizing ROV at provider interfaces allows them to secure their network without immediately discarding customer announcements, thus avoiding the "discarding money" problem that hinders MANRS Action 1 compliance. This approach is expected to significantly reduce economical resistance and motivate more non-deploying networks to initiate partial filtering.

Beyond the deployment strategy, the study offers specific recommendations for backup and purchasing:

• Backup Strategies: To mitigate the impact of technical bugs and outages, operators should validate RTR servers and cache relying party software. Increasing geographic diversity (e.g., across two data centers) and software diversity (e.g., using two different code-bases) for ROV implementation is strongly advised to enhance resilience.
• Purchasing Recommendations: The study identified several router vendors that support ROV, including Arista, Arrcus, Cisco, Extreme Networks, Huawei, H3C, Juniper, MikroTik, and Nokia. Government agencies are encouraged to offer grants for equipment upgrades to facilitate ROV adoption and to preferentially purchase from vendors that offer robust ROV support. Critically, vendors should also develop mechanisms that allow users to enable or disable ROV's mandatory impact on BGP routing selection based on their operational preferences, rather than enforcing a default behavior that can lead to deoptimization or unwanted BGP updates.

The research also highlights critical areas for future development that directly impact defensive capabilities:

• Automated Configuration and Operations: The development of automated systems is essential to assist operators, especially smaller ASes, in crafting correct and appropriate router configurations for ROV, overcoming challenges posed by diverse vendor syntax and complex network environments.
• Correctness Validation for ROV Implementation: An authoritative system is needed to verify that equipment vendors' ROV implementations strictly adhere to standard procedures, proactively identifying and preventing technical defects that can lead to legitimate routes being mistakenly discarded.
• Route Path Authorization: ROV, by design, cannot prevent hijackings where the origin ASN is spoofed. There is an urgent need for new routing security mechanisms or enhancements to RPKI to achieve route path authorization. While BGPsec exists, its high computational overhead is a barrier; ASPA (Autonomous System Provider Authorization) is a more lightweight alternative under preliminary discussion that warrants further development.
• Registration for Legacy IP Resources: A significant portion of legacy IP resources remain uncovered by ROAs due to cumbersome registration mechanisms, such as the reluctance to sign ARIN's Legacy Registration Services Agreement (LRSA). A more user-friendly and less constrained registration process, seamlessly integrated with RPKI, is vital to encourage broader ROA adoption and enhance ROV's overall effectiveness.

Key Takeaways

• MANRS Action 1 Compliance is Critically Low: Over 60% of non-stub ASes identified in the study failed to comply with MANRS Action 1 by propagating RPKI-invalid prefixes received from their customers, indicating a widespread gap between recommended and actual practices.
• Notifications Alone Are Insufficient: Despite varied nudge conditions and native language support, a novel notification experiment demonstrated that simply informing network operators about RPKI-invalid prefix propagation does not significantly improve ROV remediation rates.
• Economical and Technical Barriers Dominate Non-Compliance: The primary reasons for slow ROV adoption and non-compliance are rooted in significant economical challenges (e.g., business conflicts, time/effort, limited router budget) and technical hurdles (e.g., availability concerns, bugs in RPKI RTR servers, limited ROA adoption, router performance impact).
• "Provider-First" ROV Deployment is Most Effective: Internet-scale simulations conclusively show that deploying ROV at provider interfaces first, followed by customer interfaces, and then peer interfaces, is the most effective strategy for mitigating prefix origin hijackings and aligns better with transit networks' business interests.
• Enhanced Vendor Support and Tooling Are Essential: There is a strong call for equipment vendors to provide more flexible ROV implementations (e.g., allowing users to enable/disable ROV's impact on BGP routing selection), alongside the development of automated configuration tools and authoritative correctness validation systems.
• Future Routing Security Requires Path Authorization: ROV's inherent limitation in preventing origin ASN spoofing necessitates the urgent development and adoption of robust route path authorization mechanisms like ASPA, as well as improved registration processes for legacy IP resources to expand ROA coverage.

About the Speaker(s)

The talk was presented by Lancheng Qin. Based on the provided metadata and transcript, no specific title or company affiliation for Lancheng Qin is available.