Verification of Routes Using Region Authorization

The Border Gateway Protocol (BGP) was originally designed without built-in cryptographic mechanisms to validate route attributes, making it susceptible to BGP hijacking and route leaks . RPKI-based Origin Validation (OV) allows BGP routers to verify the origin AS of prefixes, mitigating basic origin AS hijacking. Furthermore, ASPA-based path verification introduces AS-pair authorization to detect AS-Path hijacking and route leaks. However, when large ISPs managing complex multi-AS networks deploy these technologies, security blind spots remain. An attacker can construct valid-looking paths that bypass both ROA and ASPA validation, leading to traffic hijacking across sub-ASes within or between large ISPs.

OV: Origin Validation RPKI: Resource Public Key Infrastructure RP: Relying Party RBA: Region Based Authorization

Large ISPs frequently operate multiple public ASes to manage extensive geographic or functional domains. Typically, only a subset of these ASes (border ASes) establish eBGP peering with external ISPs, while internal sub-ASes exchange routes to serve different customer segments. Under this topology, route exchanges between sub-ASes remain vulnerable to crafted path-hijacking attacks.

As shown in Figure 1, ISP1 consists of AS65001, AS65002, and AS65003, and connects to an external ISP (AS65500) via AS65001. A server is connected to AS65003, and a user is connected to AS65002. AS65003 advertises the server's route to AS65002 (via AS65001 or directly), enabling the user to access the server. When external AS65500 learns this prefix, it can forge a route by spoofing the origin AS as AS65003. AS65500 then advertises this forged route with AS-Path {AS65500, AS65003} back to AS65001. If AS65001 receives both the legitimate route from AS65003 and the forged route from AS65500, local preference or path selection rules may cause AS65001 (or AS65002) to prefer the route via AS65500. Consequently, traffic from the user to the server is hijacked to AS65500. In practical deployments, ROA max-length parameters or broad prefix aggregations configured for traffic engineering expand the attack surface, allowing AS65500 to easily succeed by announcing more-specific prefixes with the spoofed origin AS. Standard ASPA cannot prevent this attack because the AS-pair (AS65500, AS65003) may be registered as a valid provider relationship or cannot be flagged as Invalid if customer-provider relationships are not fully strictly constrained across international borders.

As shown in Figure 2, ISP1 (comprising AS65001, AS65002, AS65003) peers with ISP2 (comprising AS65104, AS65105, AS65106) via AS65001-AS65104. Both ISP1 and ISP2 connect independently to an external transit provider, ISP3 (AS65500). A server is connected to AS65105, and a user is connected to AS65002. AS65105 advertises the server prefix to ISP1 via AS65104. AS65500 can also receive the server prefix from AS65104/AS65105. AS65500 can spoof a route with a more-specific prefix, keeping origin AS65105 and AS-Path {AS65500, AS65104, AS65105}, and announce it to AS65001. If AS65001 prefers this path, traffic from the user to the server in ISP2 will be diverted to AS65500. This multi-ISP scenario similarly circumvents standard ASPA validation.

A Region-Based Authorization (RBA) is a digitally signed RPKI object expressing geographic or administrative domain boundaries. An RBA object defines two key bindings: ASN-to-Region Binding: Binds a set of ASNs owned by a single ISP to a unique Region ID. The RBA is signed by the administrative authority of the ISP, asserting that these ASNs belong to the same domain. An ASN MUST belong to at most one Region. Region-to-Confederation Binding: Binds an ISP's Region ID to a Region Confederation ID, representing a coalition of administrative domains (e.g., mutually trusted partner ISPs). Region IDs and Region Confederation IDs are managed and allocated under a unified RPKI registry structure.

This section specifies the region-based route validation logic. Region verification acts as an additional validation check alongside standard RPKI Origin Validation (OV).

Taking Figure 1 as an example, ISP1's ASes (AS65001, AS65002, AS65003) are configured into Region 1. When a BGP speaker receives a route, it validates whether the route is a local region route using the following procedure: Perform standard RPKI Origin Validation (OV). If the OV result is Invalid, process according to standard RFC 6811 rules. If Valid, proceed to region verification. Check whether the origin AS of the route belongs to the Local Region. If the origin AS does not belong to the Local Region, the route is classified as an external region route. No further single-region checks are required. If the origin AS belongs to the Local Region, check whether the eBGP peer from which the route was learned belongs to the Local Region. If the peer does NOT belong to the Local Region, the region verification state MUST be set to Invalid. Routes evaluated as Region-Invalid SHOULD be treated as ineligible for best-path selection or assigned the lowest local preference, preventing internal routes leaked/spoofed by external ASes from being accepted.

For multi-ISP scenarios (Figure 2), ISP1 (Region 1) and ISP2 (Region 2) form Region Confederation 1. The validation procedure for a BGP speaker in Region 1 is as follows: Execute single-region verification (Section 5.1). If the route's origin AS does NOT belong to the Local Region, check whether it belongs to the Local Region Confederation. If the origin AS belongs to the Local Region Confederation, check whether the eBGP peer from which the route was learned belongs to the Local Region Confederation. If the peer does NOT belong to the Local Region Confederation, the confederation verification state MUST be set to Invalid. (Optional) Verify whether the peer matches the specific origin Region. If the learned peer does not match the designated transit path for that Region within the confederation, the route SHOULD be assigned a lower preference. Routes evaluated as Confederation-Invalid MUST NOT be selected as best paths over legitimate intra-confederation routes.

Routers CAN obtain RBA and Region mapping data via two mechanisms: RPKI-RTR Protocol Extension: Relying Parties (RPs) fetch signed RBA objects from the RPKI repository and push validated data to BGP routers via an extended RPKI-RTR protocol. (RECOMMENDED) Static Local Configuration: Routers are manually configured with Region and Confederation AS sets when RPKI deployment is incomplete.

While similar route filtering can theoretically be achieved using BGP AS- Path regular expressions (e.g., rejecting routes arriving from external peers whose origin AS belongs to the local ISP), this operational approach presents significant drawbacks: High Management Complexity: Requires manually updating complex BGP route-maps across all edge routers whenever AS topologies change. Error-Prone Integration: Hard to maintain consistency when combined with existing complex traffic engineering policies. Automating region validation via RPKI/RBA eliminates manual policy drift and simplifies large-scale network operation.

[Note to IANA: This section will be updated prior to publication.] This document requests IANA to perform the following actions:

IANA is requested to register an Object Identifier (OID) for the Region- Based Authorization (RBA) signed object in the "SMI Security for S/MIME CMS Content Type" registry under the id-ct arc, as follows:

IANA is requested to register the file extension ".rba" in the "RPKI Repository Object Extensions" registry, as follows:

This document requests IANA to allocate a new PDU type in the "RPKI-RTR PDU Types" registry for transmitting Region Authorization data to BGP routers:

This document introduces Region-Based Authorization (RBA) objects to prevent crafted path hijacking across multi-AS domain boundaries. RBA relies on the underlying security of the RPKI Trust Anchor Architecture. If an unauthorized entity compromises an ISP's RPKI private key, it could publish fraudulent RBA records, potentially altering region boundaries. Additionally, operators MUST ensure that all ASes belonging to a Region or Confederation are accurately maintained in the RPKI repository to avoid false-positive invalidations during legitimate route propagation.

The authors would like to thank the IETF SIDROPS Working Group members for their valuable feedback and discussion.