Tutorial 11: Control-Plane Security and Secure Routing Expanded

Learning Objectives

• Identify the major security threats to routing: prefix hijacking, route leaks, and man-in-the-middle attacks.
• Explain the vulnerabilities inherent in BGP and OSPF that enable these threats.
• Describe the authentication mechanisms available in OSPF (MD5, SHA) and how they protect link-state integrity.
• Analyze the architecture and operation of RPKI, including Route Origin Authorizations (ROAs) and Route Origin Validation (ROV).
• Explain BGPsec and its role in providing cryptographic path validation.
• Evaluate the use of IRR and prefix filtering as operational security measures.
• Discuss secure routing best practices for ISPs and enterprise networks.
• Apply BGP FlowSpec and monitoring tools for anomaly detection.
• Analyze real-world incidents (e.g., prefix hijacking) and how they were mitigated.

Overview

The control plane is a critical target for adversaries because it determines how packets are forwarded. Attacks on routing can lead to traffic interception, black holes, denial of service, and unauthorized access. The two most prominent protocols—BGP (inter-domain) and OSPF (intra-domain)—face distinct threats. BGP lacks built-in authentication and validation, making it vulnerable to prefix hijacking and route leaks. OSPF can be compromised via forged LSAs if authentication is not used. This tutorial provides a thorough examination of routing security, covering the threat landscape, OSPF authentication, RPKI, BGPsec, IRR, and operational best practices. We also explore advanced topics like BGP FlowSpec, monitoring, and real-world case studies. By the end, students will understand the technical and operational measures needed to secure the control plane.

Technical and Theoretical Content

1. The Threat Landscape of Routing

Routing security threats can be categorized as:

• Prefix hijacking: An AS announces a prefix it does not own, attracting traffic that should go elsewhere.
• Route leaks: An AS announces routes to a peer or provider that it should not, violating policy and causing suboptimal routing or loops.
• Man-in-the-middle: Intercepting or modifying routing messages to divert traffic.
• DoS attacks: Flooding routers with updates to exhaust CPU/memory.
• Replay attacks: Replaying old routing messages to cause instability.

These threats arise due to the lack of authentication, authorization, and validation in legacy routing protocols.

2. Prefix Hijacking: Types, Causes, and Impacts

Prefix hijacking occurs when an unauthorized AS originates a prefix that belongs to another AS. Types:

• Exact prefix hijack: Announcing the exact prefix.
• Sub-prefix hijack: Announcing a more specific prefix (de-aggregation) to attract traffic.
• DNS poisoning (related) – often via hijacking.

Causes: misconfiguration, malicious intent, or accidental leaks. Impacts: traffic interception, data breaches, loss of service, and reputation damage. Examples: the 2008 YouTube hijack (Pakistan Telecom), the 2018 Google hijack (China Telecom), and many others.

3. Route Leaks and Their Consequences

A route leak occurs when an AS announces routes learned from one neighbor (e.g., a peer) to another neighbor (e.g., a provider), violating the valley-free policy. This can cause:

• Suboptimal routing (traffic taking longer paths).
• Congestion on links that were not intended to carry that traffic.
• Potential loops and black holes.

Leaks often happen due to misconfigured export policies. Recent large-scale leaks have disrupted Internet connectivity for major regions.

4. BGP Security: The Inherent Vulnerabilities

BGP is based on trust; it has no built-in authentication for session establishment (TCP MD5 is optional), no validation of the origin AS, and no validation of the path. Thus, any AS can announce any prefix, and other ASes will accept it. This is the root cause of prefix hijacking and leaks. Additionally, BGP sessions can be hijacked if TCP MD5 is not used, or if keys are weak.

5. OSPF Security: Authentication and Integrity

OSPF supports authentication at the packet level. Options include:

• Null: No authentication (vulnerable).
• Plaintext: Simple password transmitted in clear (not secure).
• Cryptographic (MD5, SHA): Uses a message digest to authenticate and verify packet integrity, preventing spoofing and replay.

Keys are configured per interface. Strong authentication is recommended to prevent unauthorized routers from injecting false LSAs. OSPFv3 relies on IPsec for authentication.

6. Resource Public Key Infrastructure (RPKI) – Architecture and Operation

RPKI (RFC 6480) is a framework to validate the origin AS of a prefix. It relies on a hierarchy of Certification Authorities (CAs) mirroring the IP address allocation hierarchy (IANA → RIRs → LIRs → ISPs). RPKI issues:

• Route Origin Authorization (ROA): A signed object that binds a prefix to an AS and specifies the maximum length (allowing sub-prefixes).
• Certificate: Used to sign ROAs, providing cryptographic proof of authorization.

Routers can validate BGP announcements against ROAs using Route Origin Validation (ROV) to determine if the origin AS is valid, invalid, or unknown.

7. RPKI in Practice: ROA, Validation, and ROV

An ROA contains:

• AS number (the authorized origin).
• Prefix and maximum length.
• Validity period.

When a BGP route is received, the router checks the origin AS and prefix against the ROA database (e.g., via RPKI validator). The result:

• Valid: Origin AS matches ROA, and prefix length ≤ max length.
• Invalid: Origin AS does not match, or prefix length exceeds max.
• Unknown: No ROA found.

Operators can filter or lower preference for Invalid/Unknown routes.

8. BGPsec: Path Validation and Cryptographic Signatures

BGPsec (RFC 8205) is an extension to BGP that provides cryptographic path validation. It adds a segment to the AS-PATH where each AS signs the path prefix. This ensures that no AS can be removed or inserted in the path. BGPsec assumes a PKI for AS numbers (similar to RPKI). However, it increases packet size and computational overhead, and is not widely deployed due to complexity and operational challenges.

9. IRR and Route Filtering

The Internet Routing Registry (IRR) is a distributed database where network operators register their routing policies (route objects). ISPs can use IRR data to build filters to reject routes that do not match the registered origin AS. However, IRR is not cryptographically secure (can be spoofed). RPKI is superior, but IRR is still widely used for filtering.

10. Secure Routing Best Practices for Operators

• Deploy RPKI validation: Use ROA creation and ROV on edge routers.
• Use BGP authentication: Enable TCP MD5 or stronger (e.g., M5 with key chains).
• Apply prefix filtering: Use IRR or RPKI-based filters to reject invalid announcements.
• Implement BGP FlowSpec: To drop specific traffic patterns (e.g., during attacks).
• Monitor BGP: Use BGP monitoring systems (e.g., BGPmon) to detect anomalies.
• Implement BGP community-based policies: To control route propagation.
• Limit prefix announcements: Use maximum-prefix limits to prevent route leaks.

11. Advanced Topics: BGP FlowSpec, BGP Monitoring, and Anomaly Detection

BGP FlowSpec (RFC 8955) allows operators to distribute traffic filtering rules via BGP, enabling DDoS mitigation at scale. BGP monitoring tools (e.g., RIPE RIS, RouteViews) collect BGP data for analysis. Anomaly detection uses machine learning to identify suspicious prefix announcements or path changes.

12. Case Studies: Real-World Attacks and Mitigations

• YouTube 2008: Pakistan Telecom announced YouTube's prefix, causing global misrouting. Mitigation: RPKI could have invalidated the origin.
• Amazon route leak (2018): A small ISP leaked routes from Amazon, causing outages. Mitigation: filtering and RPKI.
• China Telecom hijack (2010): Announced many prefixes, disrupting traffic. RPKI would have flagged invalid origins.

    BGP Update (prefix, origin AS) -> ROV Validator
    Check against ROA database:
    - Valid: Accept (or prefer)
    - Invalid: Reject or lower preference
    - Unknown: Apply policy
    

Quiz

Answer each question; check your understanding by revealing the answer.

Question 1: What is prefix hijacking?

Question 2: What is a route leak?

Question 3: What authentication methods does OSPF support?

Question 4: What is RPKI?

Question 5: What is a ROA?

Question 6: What are the three validation states in RPKI-based ROV?

Question 7: What is BGPsec?

Question 8: What is the primary vulnerability of BGP that allows prefix hijacking?

Question 9: What is the IRR and how is it used for security?

Question 10: Why is TCP MD5 authentication used in BGP?

Question 11: What is BGP FlowSpec?

Question 12: How does OSPF cryptographic authentication prevent replay attacks?

Question 13: What is the role of the RIR in RPKI?

Question 14: What is a "maximum length" in a ROA?

Question 15: Why is RPKI considered more secure than IRR?

Question 16: What is the impact of a route leak on traffic?

Question 17: How can an operator mitigate prefix hijacking?

Question 18: What is a "man-in-the-middle" attack on BGP?

Question 19: What are some best practices for OSPF security?

Question 20: What is the difference between RPKI and BGPsec?

Question 21: How does BGP FlowSpec help in security?

Question 22: Why is route filtering important?

Question 23: What is a common cause of route leaks?

Question 24: What is the purpose of BGP monitoring systems?

Question 25: In OSPF, what does the "MD5" authentication provide?

Question 26: What is a "prefix leak" vs "prefix hijack"?

Question 27: How does the RPKI validator communicate with routers?

Question 28: What is the role of the IETF in routing security?

Question 29: Why is BGPsec not widely deployed?

Question 30: What is the "valley-free" policy and how does it relate to route leaks?

Exercises

Work through these problems; sample solutions are hidden.

Exercise 1: Describe a scenario where a prefix hijack could cause a denial of service for a major website. Explain the steps an attacker might take and how RPKI would have prevented it.

Exercise 2: Compare the security of OSPF with and without authentication. What are the possible attacks if authentication is disabled?

Exercise 3: Explain the RPKI validation process when a BGP router receives a route for 192.0.2.0/24 with origin AS 64500, and there is a ROA for 192.0.2.0/22 with AS 64500 and max length 24. What is the validation state?

Exercise 4: How can an operator use BGP communities to prevent route leaks? Provide an example of a community that signals "do not advertise to peers".

Exercise 5: What is the difference between RPKI-based route validation and IRR-based filtering? Which is more secure and why?

Exercise 6: In OSPF, you have configured MD5 authentication. A router receives an OSPF packet with the correct MD5 digest but an incorrect sequence number. What happens?

Exercise 7: Describe a situation where a route leak can cause an outage for a large region. Provide a real-world example.

Exercise 8: What are the advantages and disadvantages of using BGP FlowSpec for security?

Exercise 9: Explain how BGPsec prevents a malicious AS from forging its AS number in the path.

Exercise 10: A network operator wants to implement RPKI validation. What steps are needed from creation of ROAs to applying policies on routers?

Homework Assignments

These questions require deeper thought and research. Write comprehensive answers.

Homework 1: Compare and contrast the security mechanisms in OSPF (MD5/SHA) and BGP (TCP MD5, RPKI, BGPsec). What are the strengths and weaknesses of each?

Homework 2: Explain the concept of "BGP route flap damping" and how it relates to security. Can it be exploited by attackers?

Homework 3: Research the deployment of RPKI in the Internet. What percentage of prefixes are covered by ROAs? What are the main obstacles to full deployment?

Homework 4: Design a comprehensive routing security policy for an ISP that includes inbound and outbound filtering, RPKI, BGP authentication, and monitoring. Provide configuration examples (conceptual).

Homework 5: Discuss the challenges of incremental deployment of BGPsec. Why is it difficult to deploy, and what alternative approaches exist?

Homework 6: Analyze the 2008 YouTube hijack incident. Describe how it happened, what the impact was, and how RPKI and BGPsec could have prevented it.

Homework 7: Compare and contrast RPKI and the IRR for origin validation. Why is IRR still used even though it is less secure?

Homework 8: Explain how BGP communities can be used to signal security policies between ASes. Provide examples of common communities used for filtering and traffic engineering.

Homework 9: Research the "BGP MON" project and other BGP monitoring tools. How do they help detect hijacks and leaks?

Homework 10: Discuss the security of SDN controllers and how attacks on the controller could affect routing. How can SDN be secured?

Homework 11: What is the role of the "Route Origin Validation" (ROV) in BGP? How does a router decide to reject or lower preference for Invalid routes?

Homework 12: Explain the concept of "BGP path validation" beyond RPKI. What are the proposals for improved path validation (e.g., ASPA, S-BGP)?

Summary

This tutorial provided an in-depth exploration of control-plane security and secure routing. We examined the threats of prefix hijacking and route leaks, the vulnerabilities in BGP and OSPF, and the mechanisms to mitigate them: OSPF authentication, RPKI, BGPsec, IRR, and operational best practices. We also covered advanced topics like BGP FlowSpec, monitoring, and anomaly detection. Real-world case studies illustrated the impact of attacks and the importance of proactive security measures. As the Internet continues to grow, ensuring the integrity and authenticity of routing information is critical for network stability and trust. Understanding these security concepts is essential for network operators and architects.

End of Tutorial 11 .