Google and Its Contribution to Routing Security in the Region
December 15, 2022
Content Delivery and Interconnection Strategy at Google
The problem of routing security is difficult to solve, as it requires multiple tools and solutions, as well as the participation of the majority of the interconnected networks. To contribute to this effort, Google has developed its network in compliance with the best practices for secure Internet routing. This involves publishing and checking that the information in our Internet Routing Registry (IRR) and Resource Public Key Infrastructure (RPKI) is correct and up-to-date, and using this information from other networks to create filters that will avoid routing security issues. With this, we hope to increase the security of our network and reduce the possibility of route leaks or hijacking.
What information must an organization provide when installing a cache or peering with the Content Distribution Network (CDN)? What objects must be created in RPKI and the IRR?
(Free access, no subscription required)
For the IRR, the network must create at least its route objects, its ASN objects (single autonomous system), and its maintainer. If the organization is providing transit to other ASNs, an AS-SET object must be created, which must also be shared in their PeeringDB record. In the case of RPKI, the network must create its ROAs (digitally signed objects to support routing security) and check that they are valid for the prefix announcements that are sent to us.
For the moment, the IRR and RPKI requirement applies only to peering. Google does not currently require these records for GGC (caches on the operator’s network).
Why do we use AS-SET?
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of LACNIC.