Re: [Sidrops] Welcome your attention and any comments // FW: New Version Notification for draft-shen-sidrops-region-verification-00.txt

Hi Chrisopher,

Thanks for your comments.

Filtering is a common method. Before ROV and ASPA, routing policies are used to filter data. ROV and ASPA provide easy-to-use filtering methods.
Currently, ROV and ASPA technologies are deployed from the perspective of Internet service deployment.
The deployment progress depends on data completeness. The deployment of ROVs is also accelerating, and ASPA is still lacking.

In this case, we mainly consider how to strengthen the route defense on our own network.
For example, in scenario 1, ASPA can be used for protection, but the deployment progress of ASPA is insufficient.
In scenario 2, even though ASPA has been fully deployed, it cannot be protected.

So we looked at the solution on that basis.

Regards,
Haibo

From: Sidrops [mailto:sidrops-bounces@ietf.org] On Behalf Of Christopher Morrow
Sent: Friday, July 16, 2021 3:23 AM
To: Wanghaibo (Rainsword) <rainsword.wang@huawei.com>
Cc: sidrops@ietf.org
Subject: Re: [Sidrops] Welcome your attention and any comments // FW: New Version Notification for draft-shen-sidrops-region-verification-00.txt

(for clarity, from a reading reader of the written words I wrote)

On Thu, Jul 15, 2021 at 1:38 PM Christopher Morrow <christopher.morrow@gmail.com<mailto:christopher.morrow@gmail.com>> wrote:
My reading of this, admittedly quickly, is that the draft says basically:
  "hey, you can do some leak prevention with ROA and some with ASPA, but these alone are not sufficient"

"hey, you can do some leak prevention with RouteOriginValidation (ROV, meaning using the RPKI/ROA data to validate origins of prefixes seen in the bgp stream)..."

I think I agree, except that in all cases so far we've always said:
  "You should keep RPKI data updated, and IRR data updated and filter your bgp peerings"

So, without filters there's not a clear way to prevent leaks... Does this draft basically need to say:
  "Hey, rpki is cool, but you still must filter!!"

"Hey, RPKI-based  ROV, ASPA are cool, but you still must filter!!"

apologies for being less than clear...as much as a complain about other people with their loose words you'd think I'd learn :(

and yes aspa may help you get better filters...

On Thu, Jul 8, 2021 at 10:05 PM Wanghaibo (Rainsword) <rainsword.wang@huawei.com<mailto:rainsword.wang@huawei.com>> wrote:
Hi All,

We have published a new draft of region verifcation recently.
https://datatracker.ietf.org/doc/draft-shen-sidrops-region-verification/

This is also introduced in the APNIC 50.
https://conference.apnic.net/50/assets/files/APCS790/BGP-Routing-Security-Region-based-Trust-Alliance-Validation.pdf

Welcome your comments and suggestions

Abstract:
   BGP routing security is becoming a major issue that affects the
   normal running of Internet services.  Currently, there are many
   solutions, including ROA authentication and ASPA authentication, to
   prevent route source hijacking, path hijacking, and route leaking.
   However, on an actual network, large ISPs with multiple ASes can use
   carefully constructed routes to bypass ROA and ASPA authentication to
   attack the target network.

   This document defines an region-based authentication method for large
   ISPs with many ASes to prevent traffic hijacking within ISPs.

_______________________________________________
Sidrops mailing list
Sidrops@ietf.org<mailto:Sidrops@ietf.org>
https://www.ietf.org/mailman/listinfo/sidrops