NIST SPECIAL PUBLICATION 1800-14

---

Protecting the Integrity of Internet Routing

Border Gateway Protocol (BGP) Route Origin Validation

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How-To Guides (C)

William Haag

Doug Montgomery

William C. Barker

Allen Tan

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800-14

The first draft of this publication is available free of charge from: https://www.nccoe.nist.gov/sites/default/files/library/sp1800/sidr-piir-nist-sp1800-14-draft.pdf

NIST SPECIAL PUBLICATION 1800-14

Proctecting the Integrity of the Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How-To Guides (C)

William Haag

Applied Cybersecurity Division

Information Technology Laboratory

Doug Montgomery

Advanced Network Technologies Division

Information Technology Laboratory

Allen Tan

The MITRE Corporation

McLean, VA

William C. Barker

Dakota Consulting

Silver Spring, Maryland

June 2019

U.S. Department of Commerce

Wilbur Ross, Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Undersecretary of Commerce for Standards and Technology

• Volume A
  • Executive Summary
    • Challenge
    • Solution
    • Benefits
    • Share Your Feedback
    • Technology Partner/Collaborators

• Volume B
  • 1. Summary
    • 1.1. Challenge
    • 1.2. Solution
    • 1.3. Benefits
  • 2. How to Use This Guide
    • 2.1. Typographic Conventions
  • 3. Background
  • 4. Approach
    • 4.1. Audience
    • 4.2. Scope
    • 4.3. Assumptions
    • 4.4. Risk Assessment
      • 4.4.1. Threats
      • 4.4.2. Vulnerabilities
      • 4.4.3. Risk
      • 4.4.4. Cybersecurity Framework Functions, Categories, and Subcategories Addressed by the SIDR Project
    • 4.5. Technologies
      • 4.5.1. ROV-Enabled Routers
      • 4.5.2. RPKI CA
      • 4.5.3. RPKI Repository
      • 4.5.4. VCs
      • 4.5.5. Circuit
      • 4.5.6. Firewall
  • 5. Architecture
    • 5.1. Overall RPKI-Based ROV Reference Architecture
      • 5.1.1. ROV Reference Architecture
      • 5.1.2. RPKI Reference Architecture
    • 5.2. Combined ROV and RPKI Reference Architecture Example
    • 5.3. Usage Scenarios
      • 5.3.1. ROV Usage Scenario
      • 5.3.2. Hosted-Model Usage Scenario
      • 5.3.3. Delegated-Model Usage Scenario
    • 5.4. SIDR Laboratory Architecture
  • 6. Outcome
    • 6.1. ROV Policy Configuration Options
    • 6.2. Implementation Status of RPKI Components
      • 6.2.1. RPKI VC Component
      • 6.2.2. RPKI CA and Repository Components
      • 6.2.3. ROV-Capable Routers
      • 6.2.4. Lessons Learned
  • 7. Functional and Robustness Results
    • 7.1. Assumptions and Limitations
    • 7.2. Functional Test Requirements
      • 7.2.1. ROV Functional Requirements
      • 7.2.2. Delegated RPKI-Model Functional Requirements
    • 7.3. Functional Test Findings
    • 7.4. Robustness Findings
  • 8. Recommendations for Follow-on Activities
    • 8.1. Standards Initiatives
    • 8.2. Future Demonstration Activities
    • 8.3. Tool Development and Maintenance
    • 8.4. Infrastructure Testing
    • 8.5. Research Activities

• Volume C
  • 1. Introduction
    • 1.1. Practice Guide Structure
    • 1.2. Build Overview
    • 1.3. Typographic Conventions
  • 2. Product Installation Guides
    • 2.1. RPKI Validators
      • 2.1.1. RIPE NCC RPKI Validator Configuration/Installation
      • 2.1.2. Dragon Research RPKI.net Validator Configuration/Installation
    • 2.2. RPKI CA and Repository
      • 2.2.1. Dragon Research RPKI.net CA and Repository Configuration/Installation
    • 2.3. BGP-SRx Software Suite
    • 2.4. Firewalls
    • 2.5. Test Harness Topology Configuration
      • 2.5.1. RTR 1-1 Configuration – Cisco
      • 2.5.2. RTR 2-1 Configuration – Cisco
      • 2.5.3. RTR 2-2 Configuration – Cisco
      • 2.5.4. RTR 1-1 Configuration – Juniper
      • 2.5.5. RTR 2-1 Configuration – Juniper
      • 2.5.6. RTR 2-2 Configuration – Juniper
      • 2.5.7. Traffic Generator BIO Configuration
    • 2.6. Live Data Configuration
      • 2.6.1. CenturyLink Configuration Router AS 65501 – Cisco
      • 2.6.2. Router AS 65500 Configuration – Cisco
      • 2.6.3. Router 65501 Configuration – Cisco
      • 2.6.4. Router AS 65502 Configuration – Juniper
      • 2.6.5. Router AS 65503 Configuration – Cisco
      • 2.6.6. Router AS 65504A Configuration – Cisco
      • 2.6.7. Router AS 65504B Configuration – Cisco
      • 2.6.8. Router AS 65505 Configuration – Juniper
      • 2.6.9. Router AS 65507 Configuration – Cisco
      • 2.6.10. Router AS 65508 Configuration – Cisco
      • 2.6.11. Cisco IOS XRv Router Configuration