RPKI IPchain (Paper Reading)

IPchain (Paper Reading)

• IPchain: Securing IP Prefix Allocation and Delegation with Blockchain

Abstract

• We present IPchain, a blockchain to store the allocations and delegations of IP addresses, with the aim of easing the deployment of secure interdomain routing systems.

Introduction

• Unfortunately, the global deployment of the RPKI is slower than expected with only ∼9% of the total /24 IPv4 address blocks owned by the five Internet Registries being protected by the RPKI.
• In this paper we propose IPchain: a blockchain to store IP address allocation and delegation data.
• Three of these properties stand out when compared to the RPKI: (i) the ability to create flexible trust models, providing a different balance of power between CAs and downstream users, (ii) simplified management, especially regarding common PKI operations such as key rollover and (iii) auditability: blockchain’s append-only ledger can detect possible configuration errors even before a modification.
• IPchain allows its participants to exchange IP prefixes just like in coins are transferred in Bitcoin.

Why blockchain?

• Flexible trust models: Some researchers argue that the centralized nature of the RPKI hinders its deployment[6]. This is due to the fact that its users (typically ISPs) have to trust the RPKI CA, which can arbitrarily revoke any downstream certificate[9].
• Simplified management: A key rollover in a blockchain can be easily performed transferring a coin/asset to a new address (keypair).
• Privacy: Blockchain transactions are not linked to the user’s identity, just to a public key.
• Consistent vision of the state: Exactly like in Bitcoin, in the RPKI we need to keep track of the owner of each IP prefix (coins), e.g. to avoid the transfer of the same prefix to two different users (double-spending).
• Auditability: Given the permanent nature of blockchain records, it is possible to determine if an object (e.g. a ROA) utilizing a particular resource (e.g. an IP address) has been made obsolete by a new object.

Which consensus algorithm?

• In a Proof of Stake (PoS [14]) blockchain, participants with more assets/coins are more likely to add blocks.
• This aspect is of particular importance in the context of IPchain: users holding a large number of IP addresses are more likely to add blocks.
• In a blockchain for IP addresses, this would mean buying IP addresses from other parties. These parties do not have a clear incentive to sell their blocks of addresses to the attacker since IP addresses are an important economical asset.

Architecture of IPchain

• IP prefixes as coins
• Supported Operation：Allocate, Delegate, Metadata
  • A delegated prefix cannot be further allocated.
• Deployment
  • The deployment of our proposed blockchain mimics the current procedure used to allocate IP addresses, which is typically conformed of three tiers (figure 5). IANA, as the top-level regulator of Internet numbers, owns the genesis block keys. First, IANA allocates huge blocks of addresses to the Regional Internet Registries (1). Those, in turn, allocate or delegate blocks to its customers, usually ISPs (2). Finally, ISPs can also assign addresses to their users (3).
• Other considerations
  • Rekeying: we only have to add a new transaction re-allocating the IP prefix to a new keypair controlled by ourselves.
  • Privacy: Since IP addresses are linked to their owners’ public key, it is not possible to identify the holder only with the data in the blockchain.
  • IPv6 Support: We create alternative blocks of v4 or v6 transactions.

Implementation

• IPchain: https://github.com/OpenOverlayRouter/blockchain-mapping-system
• PoS Consensus Algorithm:
  • NIST’s random beacon: https://www.nist.gov/programs-projects/nistrandomness-beacon
• Peer-to-Peer Network:
  • The P2P module: Pyhton’s Twisted10 library https://twistedmatrix.com/trac/