Overcoming circular dependencies when bootstrapping an RPKI site

Patent metadata

Field	Value
Publication number	US-9654482-B2
Application number	US-201414160968-A
Country	US
Kind code	B2
Filing date	Jan 22, 2014
Priority date	Jan 22, 2014
Publication date	May 16, 2017
Grant date	May 16, 2017

Abstract

In one embodiment, a validation server in a computer network determines that an edge router of the computer network has blocked access to a desired server address based on the edge router not having authentication information for the desired server address. In response, the server creates a white-listing policy to temporarily allow access to the desired server address at the edge router, and sends the white-listing policy to the edge router. The validation server may then proceed with performing server fetching operations to the desired server address from the validation server while the white-listing policy is in effect, and instructs the edge device to remove the white-listing policy once the server fetching operations are completed.

First claim

What is claimed is:

1. A method, comprising:
hosting, at a validation server, a local domain name service and network time protocol service;
determining, by the validation server in a computer network, that an edge router of the computer network is blocking access to a desired server address based on the edge router not having authentication information for the desired server address;
based on determining that the edge router is blocking access, dynamically creating at and by the validation server itself, a white-listing policy to temporarily allow access to the desired server address at the edge router, wherein the validation server uses the local domain name service and network time protocol service to create the white-listing policy;
sending, by the validation server, the white-listing policy to the edge router;
performing server fetching operations to the desired server address from the validation server while the white-listing policy is in effect; and
sending instructions from the validation server to the edge device to remove the white-listing policy once the server fetching operations are completed.

2. The method as in claim 1 , wherein determining that the edge router has blocked access to the desired server address comprises:
querying the edge router for its routing table authentication information.

3. The method as in claim 1 , wherein the edge router blocks access based on setting routing origin states to one of either “NOT FOUND” or “INVALID”.

4. The method as in claim 1 , wherein the validation server is a Resource Public Key Infrastructure (RPKI) validation server.

5. The method as in claim 1 , wherein the server fetching operations are at least one of domain name service (DNS) lookups; network time protocol (NTP) lookups; or Resource Public Key Infrastructure (RPKI) repository lookups.

6. The method as in claim 1 , wherein the white-listing policy lists one or more of an IP prefix, an origin autonomous system (AS), an AS path, a public key infrastructure (PKI) information, and a PKI key hash.

7. The method as in claim 1 , further comprising:
determining which addresses to which the white-listing policy is to be applied based on stored and previously valid address information.

8. The method as in claim 1 , wherein sending the white-listing policy to the edge router comprises:
using a Resource Public Key Infrastructure (RPKI) router (RTR) protocol message payload.

9. The method as in claim 1 , further comprising:
ensuring that the edge router is not in a targeted hijacked state prior to sending the white-listing policy.

10. The method as in claim 1 , further comprising:
signaling to the edge router a specific desired server address within a range of addresses associated with the white-list policy.

11. The method as in claim 1 , further comprising:
servicing, by the validation server, a plurality of edge devices within the computer network.

12. An apparatus, comprising:
one or more network interfaces to communicate within a computer network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
host, as a validation server, a local domain name service and network time protocol service;
determine that an edge router of the computer network is blocking access to a desired server address based on the edge router not having authentication information for the desired server address;
based on determining that the edge router is blocking access, dynamically create a white-listing policy to temporarily allow access to the desired server address at the edge router, wherein the validation server uses the local domain name service and network time protocol service;
send the white-listing policy to the edge router;
perform server fetching operations to the desired server address from the validation server while the white-listing policy is in effect; and
send instructions to the edge device to remove the white-listing policy once the server fetching operations are completed,
wherein the apparatus is a validation server.

13. The apparatus as in claim 12 , wherein the process when executed to determine that the edge router has blocked access to the desired server address is further operable to:
query the edge router for its routing table authentication information.

14. The apparatus as in claim 12 , wherein the validation server is a Resource Public Key Infrastructure (RPKI) validation server.

15. The apparatus as in claim 12 , wherein the server fetching operations are at least one of domain name service (DNS) lookups; network time protocol (NTP) lookups; or Resource Public Key Infrastructure (RPKI) repository lookups.

16. The apparatus as in claim 12 , wherein the white-listing policy lists one or more of an IP prefix, an origin autonomous system (AS), an AS path, a public key infrastructure (PKI) information, and a PKI key hash.

17. The apparatus as in claim 12 , wherein the process when executed is further operable to:
determine which addresses to which the white-listing policy is to be applied based on stored and previously valid address information.

18. The apparatus as in claim 12 , wherein the process when executed is further operable to:
signal to the edge router a specific desired server address within a range of addresses associated with the white-list policy.

19. A method, comprising:
blocking access to a range of addresses by an edge router in a computer network based on the edge router not having authentication information for the range of addresses;
receiving a white-listing policy from a validation server in the computer network hosting a local domain name service and network time protocol service, wherein the white-listing policy is dynamically created at and by the validation server itself to temporarily allow access to at least a desired server address at the edge router within the range of addresses, wherein the validation server uses the local domain name service and network time protocol service to create the white-list policy;
temporarily allowing access to the desired server address while the white-listing policy is in effect; and
removing the white-listing policy in response to instructions received from the validation server.

20. The method as in claim 19 , wherein the edge router blocks access based on setting routing origin states to one of either “NOT FOUND” or “INVALID”.

21. The method as in claim 19 , wherein the validation server is a Resource Public Key Infrastructure (RPKI) validation server.

Assignees

• Cisco Tech Inc

Inventors

• Gagliano Roque
• Retana Alvaro E
• Patel Keyur P

Classifications

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/108 Primary

  when the policy decisions are valid for a limited amount of time · CPC title