Securing Internet Routing: BGP RPKI ROA Signing with Hardware Enclaves

Protecting autonomous systems (ASNs) from BGP route hijacking using hardware-signed Route Origin Authorizations.

The Fragility of Global BGP Routing

Border Gateway Protocol (BGP) governs how traffic flows across the global internet, but lacks built-in authentication, making it notoriously susceptible to accidental route leaks and malicious BGP hijacking. Resource Public Key Infrastructure (RPKI) fixes this by binding IP prefixes to authorized ASNs using X.509 certificates.

Hardware Signing of Route Origin Authorizations (ROAs)

NetworkHSM enables network operators to sign ROA payloads within FIPS 140-3 hardware, ensuring that compromised network management servers cannot forge routing announcements or redirect internet traffic.

Route Hijack Elimination: Cryptographically validating that IP prefixes originate from legitimate autonomous systems.
High-Throughput ROA Signing: Generating cryptographically signed CMS objects conforming to RFC 6482.
Hardware Root for Regional Registries: Providing certified key custody for RIR, NIR, and enterprise LIR routing authorities.
Sub-Millisecond Path Validation: Hardware verification of AS-Path cryptographic attestations (BGPsec).

Domains ansehen