Technology Category
Planning, Routing, and Scheduling: RoutingApplication Domains: Internet of Things, Sensor Networks & Smart CitiesComputer Vision: Adversarial Attacks & Robustness
TORCH: Characterizing Invalid Route Filtering via Tunnelled Observation
🤖 AI Summary
This study addresses the lack of systematic evaluation of RPKI-based invalid route filtering in IPv6, a gap stemming from limited observability and data-plane opacity. The authors innovatively repurpose globally distributed 6in4 tunnel endpoints as measurement vantage points and employ a response-free, cross-plane reachability inference technique to conduct the first large-scale active measurement of real-world IPv6 invalid routes. Their findings reveal that approximately 27% of autonomous systems have deployed near-complete Route Origin Validation (ROV) protection, yet some Tier-1 operators still propagate invalid routes. Notably, the work uncovers for the first time that filtering same-length prefixes induces widespread collateral damage, significantly impairing global Internet connectivity.
Technology Category
Application Category
📝 Abstract
To mitigate BGP prefix hijacking, the Resource Public Key Infrastructure (RPKI) provides prefix origin authentication via Route Origin Validation (ROV). Despite extensive measurement efforts in IPv4, the protective impact of ROV in IPv6 has yet to be systematically assessed. Existing approaches suffer from limited observability into invalid route propagation: they often rely on a small set of controlled prefixes or cannot fully profile the filtering of in-the-wild RPKI-invalid routes, which undermines the accuracy of assessment. Furthermore, the inherent opacity of the IPv6 data plane exacerbates the difficulty of performing scalable and reliable active measurements.
In this paper, we present TORCH, a novel framework for measuring invalid route filtering in IPv6. It repurposes open 6in4 tunnel endpoints as widely distributed vantage points for global measurement. At its core, we develop a cross-plane inference technique that determines reachability without requiring responsive targets. This method allows us to characterize whether and how traffic is steered to invalid origins across diverse routing scenarios, leading to an in-depth evaluation of the real-world impact of ROV.
Our measurements reveal that about 27\% of ASes have achieved nearly full ROV protection. However, several permissive Tier-1 ASes still transit traffic towards invalid origins, maintaining a substantial attack surface. Through a prefix-centric analysis, we provide the first empirical evidence that the collateral damage of same-length prefix filtering can affect a significant fraction of the global Internet. Our findings pinpoint fundamental vulnerabilities in ROV deployment and underscore the urgent necessity for network operators to accelerate RPKI adoption. We make our datasets publicly available.
Problem
Research questions and friction points this paper is trying to address.
RPKI
ROV
IPv6
BGP prefix hijacking
invalid route filtering
Innovation
Methods, ideas, or system contributions that make the work stand out.
TORCH
RPKI
ROV
IPv6 measurement
6in4 tunnel
🔎 Similar Papers
No similar papers found.
