Simplified Local Internet Number Resource Management (SLURM) with RPKI Autonomous System Provider Authorizations (ASPA)

Abstract

ISPs may want to establish a local view of exceptions to the Resource Public Key Infrastructure (RPKI) data in the form of local filters or additional attestations. This document defines an addendum to RFC 8416 by specifying a format for local filters and local assertions for Autonomous System Provider Authorizations (ASPA) for use with the RPKI.¶

1. Introduction

ISPs may want to establish a local view of exceptions to the Resource Public Key Infrastructure (RPKI) data in the form of local filters or additional attestations. This document defines an addendum to RFC 8416 by specifying a format for local filters and local assertions for Autonomous System Provider Authorizations (ASPA) for use with the RPKI.¶

See [RFC8416] for an overview of the SLURM mechanism, specifically Section 3 and Section 4.¶

2. SLURM v2 File Overview

A SLURM file consists of a single JSON [RFC8259] object containing the following members:¶

• A "slurmVersion" member that MUST be set to 2, encoded as a number¶

• A "validationOutputFilters" member whose value is an object. The object MUST contain exactly three members:¶

  • A "prefixFilters" member, see Section 3.3.1 [RFC8416]¶
  • A "bgpsecFilters" member, see section 3.3.2 [RFC8416]¶
  • A "aspaFilters" member, see Section 3.1¶

• A "locallyAddedAssertions" member whose value is an object. The object MUST contain exactly three members:¶

  • A "prefixAssertions" member, see Section 3.4.1 [RFC8416]¶
  • A "bgpsecAssertions" member, see Section 3.4.2 [RFC8416]¶
  • A "aspaAssertions" member, see Section 3.2¶

The following JSON structure with JSON members represents a SLURM file that has no filters or assertions:¶

{
  "slurmVersion": 2,
  "validationOutputFilters": {
    "aspaFilters": [],
    "bgpsecFilters": [],
    "prefixFilters": []
  },
  "locallyAddedAssertions": {
    "aspaAssertions": [],
    "bgpsecAssertions": [],
    "prefixAssertions": []
  }
}

3. Validation Output Filters for ASPA

"aspaFilter": [
  {
    "customerAsid": 64496,
    "comment": "Filter out ASPA Payloads which specify AS 64496 as the Customer ASID"
  }
]

"aspaAssertions": [
  {
    "customerAsid": 64496,
    "providerSet": [64497, 64498],
    "comment": "Locally assert 64497 are 64498 are providers to 64496"
  }
]

4. Example of a SLURM file with ASPA Filters and Assertions

{
  "slurmVersion": 2,
  "validationOutputFilters": {
    "prefixFilters": [
      {
        "prefix": "192.0.2.0/24",
        "comment": "All VRPs encompassed by prefix"
      },
      {
        "asn": 64496,
        "comment": "All VRPs matching ASN"
      },
      {
        "prefix": "198.51.100.0/24",
        "asn": 64497,
        "comment": "All VRPs encompassed by prefix, matching ASN"
      }
    ],
    "bgpsecFilters": [
      {
        "asn": 64496,
        "comment": "All keys for ASN"
      },
      {
        "SKI": "voibVdC3Nzl9dcSfSFuFj6mK0R8",
        "comment": "Key matching Router SKI"
      },
      {
        "asn": 64497,
        "SKI": "UQ9IXSminbe1FfnEePjtPLeqfSM",
        "comment": "Key for ASN 64497 matching Router SKI"
      }
    ],
    "aspaFilters": [
      {
        "customerAsid": 64496,
        "comment": "ASPAs matching Customer ASID 64496"
      }
    ]
  },
  "locallyAddedAssertions": {
    "prefixAssertions": [
      {
        "asn": 64496,
        "prefix": "198.51.100.0/24",
        "comment": "My other important route"
      },
      {
        "asn": 64496,
        "prefix": "2001:db8::/32",
        "maxPrefixLength": 48,
        "comment": "My other important de-aggregated routes"
      }
    ],
    "bgpsecAssertions": [
      {
        "asn": 64496,
        "comment" : "My known key for my important ASN",
        "SKI": "XUJQ4tgdREjYop786R0p/wdeyeI",
        "routerPublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgFcjQ/g//LAQerAH2Mpp+GucoDAGBbhIqD33wNPsXxnAGb+mtZ7XQrVO9DQ6UlAShtig5+QfEKpTtFgiqfiAFQ"
      }
    ],
    "aspaAssertions": [
      {
        "customerAsid": 64496,
        "providerSet": [64497, 64498],
        "comment": "Locally assert 64497 and 64498 are providers for 64496"
      }
    ]
  }
}

5. Security Considerations

For Security Considerations see Section 6 of [RFC8416].¶

6. IANA Considerations

This document has no IANA actions.¶

7. Acknowledgements

The authors would like to thank Tim Bruijnzeels for their helpful review of this document.¶

8. References

Appendix A. Implementation status - RFC EDITOR: REMOVE BEFORE PUBLICATION

This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft, and is based on a proposal described in RFC 7942. The description of implementations in this section is intended to assist the IETF in its decision processes in progressing drafts to RFCs. Please note that the listing of any individual implementation here does not imply endorsement by the IETF. Furthermore, no effort has been spent to verify the information presented here that was supplied by IETF contributors. This is not intended as, and must not be construed to be, a catalog of available implementations or their features. Readers are advised to note that other implementations may exist.¶

According to RFC 7942, "this will allow reviewers and working groups to assign due consideration to documents that have the benefit of running code, which may serve as evidence of valuable experimentation and feedback that have made the implemented protocols more mature. It is up to the individual working groups to use this information as they see fit".¶

• StayRTR [stayrtr]¶