1. Improving reliability of IRR database
The University of Tokyo
Kengo Nagahashi
Nara Institute of Science and Technology
Masasi Eto
JPNIC IRR Planning Team
2018/11/29

2. Research Activity of JPIRR
Nagahashi
Prefix Validation using IRR Database
Eto
Improvement of consistency among AS policies on IRR database
Our goal is
Improving reliability of IRR database
More widespread use of IRR
JPIRR Planning Team investigates 2 research activities
One is checking invalid origin AS using IRR Database
By Kengo Nagahashi.
And the other is Improvement of consistency among AS Policies on
IRR database.
Our goal is to improve reliability of IRR database and
Though its activities, we aim to more wide spread use of IRR
2018/11/29

3. Prefix Validation using IRR Database
The University of Tokyo
Kengo Nagahashi
2018/11/29

4. Background One of severe problems in Inter-domain routing; Why happen?
Hijacking prefix (black hole)
Why happen?
One AS propagates invalid origin prefix
AS2
AS3
There are several important issues in BGP.
And one of severe problems is hijacking prefix also
Said black hole problem.
The reason why its problem happens is that
One AS propagates invalid origin prefix.
For example, in this figure, AS5 should announce
133.11/16 but AS4 announces its prefix and
AS3,AS2 and AS1 goes AS4 and unreachable problem is happened
AS1
AS5
originates /16
133.11/16=AS5->AS3->AS2
133.27/16=AS4-AS3->AS2
⇒UNREACH!!
AS4
133.11/16
2018/11/29

5. Counter major Approach
Authenticate prefix in BGP update
BGP Routers exchange Certificate
Candidates: sBGP, soBGP
Problem
Take long time solution
Heavy protocol:
To verify certificate per one prefix
BGP holds over 120,000 prefixes…
There are several counter major approach for
Detecting hijacking prefix. One of valid solution
Is to authenticate prefix in BGP update
To authenticate prefix, BGP routers exchange Certificate.
The protocol to exchange Certificate is sBGP and soBGP.
But problem is to take long time to deploy and
Protocol is heavy . There needs to verify vertificate
Per one prefix and current BGP holds
One hundred and twenty thousands of prefixes ,
So it can say it is overhead
2018/11/29

6. Motivation To check a correct prefix by lightweight and simple
What to “check” ?
To identify invalid origin prefix
To use certificate is too heavy (same as sBGP, soBGP)
How to verify?
Using IRR Database
So our motivation is to check a correct prefix by
Light weight and simple method.
So what we check? The answer is to
Identify invalid origin prefix. As we said previously,
To use certificate is too heavy.
And next, how to verify prefix?
To verify it we use IRR database
2018/11/29

7. Approach Using IRR as Database router router DB
(1)Download request for DB (once a day)
router
router DB
Prefix
announcement
(2)Response prefix/origin-as pairs
(3)Comparison with (1) and (2)
Example:
#show invalid route
Network origin origin in DB /
Our approach is consists of 3 flows.
One is router issues download request for Database one a day
And second, Database response prefix/origin-as pairs to routers
Finally, router can compare prefix in BGP update and prefix in Database.
As database we us IRR
2018/11/29

8. simple protocol Download Response Router requests Download to DB
Frequency is once a day
Response
DB responses to router
Response prefix/origin-as pairs which stores in DB
There needs simple protocol to communicate
Router and Database.
One is Download message . Router requests Download to
Database one a day.
Next is Response message , Database responses to router
With prefix/origin-as pairs
2018/11/29

9. Problems to be solved Future Work Router Overhead Utilization of IRR
To hold 120,000 prefix/origin-as pairs is overhead?
Utilization of IRR
All entries are registered in IRR database?
Duration of update
Is Once a day too long ?
There are several issues to be solved.
One is router overhead , this means
Router hold one hundred twenty thousands of prefix/origin-as pairs
The other is utilization of IRR. All Entries are no registered in IRR database.
2018/11/29

10. Consistency Check among AS policies
Nara Institute of Science and Technology
Masasi Eto
2018/11/29

11. auto-configuration with IRR
Generate router configuration from routing policy registered in IRR with “RtConfig”
Policy
IRR
RtConfig
Config
AS 1
AS 2
2018/11/29

12. Consistency among AS policies
Inconsistencies
Inconsistency of import in routing information
Inconsistency of export in routing information
As a result
When we generate the router configurations from IRR database, the connectivity between peering ASes will be lost.
IRR inspects only policy’s syntax.
→ Need to inspect policy’s semantics
2018/11/29

13. Inconsistency of import
AS 3
import
AS 2
AS 3
AS 4
AS 5
export
AS 2
AS 3
AS 4
IX 3
AS 1
AS 2
AS 4
AS 5
2018/11/29

14. Inconsistency of export
AS 3
import
AS 2
AS 3
AS 4
export
AS 2
AS 3
AS 4
AS 5
IX 3
AS 1
AS 2
AS 4
AS 5
2018/11/29

15. Classification of Inconsistencies
Inconsistencies of import
Peer AS-SET doesn’t exist on IRR database
Peer AS doesn’t exist on IRR database
Peer AS doesn’t export any route to the AS
Peer AS doesn’t export route which the AS imports
Inconsistencies of export
Peer AS doesn’t import any route from the AS
Peer AS doesn’t import route which the AS exports
2018/11/29

16. Policy Check Server Policy Checker Database Checker
Inspects if the policy is consistent with peer ASes’ policies
Database Checker
Inspects how many inconsistencies exist on unified IRR database.
2018/11/29

17. Example - query
2018/11/29

18. Example - result
2018/11/29

19. Analysis of Inspection Result
Registered Ases: > 55.8% of AS has at least one inconsistency
2018/11/29

20. Detail of Inconsistencies
Classification
Number
Rate
Peer AS-SET doesn’t exist on IRR database
482
0.2 %
Peer AS doesn’t exist on IRR database
7,971
4.0 %
Peer AS doesn’t exist export any routes to the AS
36,333
18.6 %
Peer AS doesn’t import any routes from the AS
34,710
17.8 %
Peer AS doesn’t export route which the AS imports
11,436
5.8 %
Peer AS doesn’t import route which the AS exports
17,753
9.1 %
Total
108,685
55.8 %
Rate of each inconsistency in all 194,820 import and export sentences
2018/11/29

21. Future Work Deploy Policy Checker on JPIRR.
Implement a function to notify result of investigation to JPIRR users periodically.
2018/11/29