Byzantine-Secure Relying Party for Resilient RPKI
Jens Friess, Donika Mirdita, Haya Schulmann, Michael Waidner

TL;DR
This paper introduces BRP, a Byzantine-secure relying party system for RPKI, enhancing resilience against failures and attacks, and enabling secure, scalable, and backward-compatible RPKI validation for networks.
Contribution
It proposes BRP, the first Byzantine-secure RPKI relying party, using redundancy and consensus to improve security and resilience without requiring changes to existing infrastructure.
Findings
BRP reduces load on RPKI publication points
BRP maintains robust validation despite repository failures and attacks
BRP is fully backward compatible and easy to deploy
Abstract
To protect against prefix hijacks, Resource Public Key Infrastructure (RPKI) has been standardized. To enjoy the security guarantees of RPKI validation, networks need to install a new component, the relying party validator, which fetches and validates RPKI objects and provides them to border routers. However, recent work shows that relying parties experience failures when retrieving RPKI objects and are vulnerable to attacks, all of which can disable RPKI validation. Therefore even the few adopters are not necessarily secure. We make the first proposal that significantly improves the resilience and security of RPKI. We develop BRP, a Byzantine-Secure relying party implementation. In BRP the relying party nodes redundantly validate RPKI objects and reach a global consensus through voting. BRP provides an RPKI equivalent of public DNS, removing the need for networks to install, operate,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsEurasian Exchange Networks · Balkans: History, Politics, Society
