--- id: CP-231 slug: bgp-rpki-internet-routing-security lang: en title: "BGP and RPKI: securing Internet routes" description: BGP tells networks where to send traffic. Its weaknesses (hijacks, leaks) and the RPKI safeguard, explained for employees. canonical_url: https://startbrain.io/cyberpedia/en/articles/bgp-rpki-internet-routing-security/ markdown_url: https://startbrain.io/cyberpedia/en/articles/bgp-rpki-internet-routing-security.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: "Brain, \"BGP and RPKI: securing Internet routes\", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/bgp-rpki-internet-routing-security/ (CC BY 4.0)" wing: 3 theme: browse_safely reflex: cr-059 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/bgp-rpki-internet-routing-security/ fr: https://startbrain.io/cyberpedia/fr/articles/bgp-rpki-securite-routes-internet/ de: https://startbrain.io/cyberpedia/de/articles/bgp-rpki-sicherheit-internet-routen/ es: https://startbrain.io/cyberpedia/es/articles/bgp-rpki-seguridad-rutas-internet/ sources: - "n": 1 title: "Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation" publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/189/final published: "2019-12-17" accessed: "2026-11-03" - "n": 2 title: "Resilient Interdomain Traffic Exchange: BGP Security and DDos Mitigation" publisher: NIST url: https://www.nist.gov/publications/resilient-interdomain-traffic-exchange-bgp-security-and-ddos-mitigation published: "2019-12-17" accessed: "2026-11-03" - "n": 3 title: Border Gateway Protocol Security publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/54/final published: "2007-07-17" accessed: "2026-11-03" - "n": 4 title: Identifying and protecting against the largest DDoS attacks publisher: Google url: https://cloud.google.com/blog/products/identity-security/identifying-and-protecting-against-the-largest-ddos-attacks published: "2020-10-17" accessed: "2026-11-03" --- # BGP and RPKI: securing Internet routes When an employee opens a website or sends a message, the data crosses several networks, and the employee's company knows neither how many there are nor who runs them. The BGP (Border Gateway Protocol) protocol is used to choose the route between these networks. The US agency NIST describes it as the control protocol that distributes and computes paths among the tens of thousands of autonomous systems that make up the Internet [1]. This page explains what this protocol means for an employee, what routing anomalies can cause, and which protection (RPKI) NIST recommends. It also states what the NIST source does not say, so as not to promise more than what is established. ## In 30 seconds - Where it happens: between networks, out of sight of the employee and the company. NIST speaks of routing control-plane anomalies, such as BGP prefix hijacking and route leaks [2]. - What it causes: denial of service, unwanted traffic detours and degraded performance [2]. - The operators' safeguard: RPKI, BGP origin validation and prefix filtering [1]. - The reflex: ask your internet or hosting provider how it protects its routes, and do not rely on the network alone for confidentiality. ## Straight answers ### What is BGP for? BGP distributes and computes the paths between the autonomous systems that make up the Internet [1]. The employee never takes part in this mechanism: they depend on the choices of their internet provider and of the networks crossed. ### What is the problem? NIST observes that in recent years, many routing control-plane anomalies, such as BGP prefix hijacking and route leaks, have caused denial of service, unwanted traffic detours and degraded performance [2]. ### What does RPKI stand for? RPKI stands for Resource Public Key Infrastructure. NIST ranks it, along with BGP origin validation (BGP-OV) and prefix filtering, among the recommended technologies for securing inter-domain routing control traffic [1]. The sources cited here do not detail its inner workings, so this page does not describe them. ### Can an employee protect themselves from a route hijack? Not directly. These protections are deployed at the operators. The employee and their manager can, however, ask questions of their providers, as explained below. ### Does RPKI solve everything? The sources cited here do not say. NIST presents RPKI as one recommended technology among others, and adds measures against IP address spoofing and denial-of-service attacks [1]. An older NIST publication on BGP already warned that its recommendations were not a complete defense against all threats [3]. ## How it works In December 2019, NIST publishes the SP 800-189 guide, devoted to resilient interdomain traffic exchange (RITE). It gives initial guidance for protecting routing control traffic, preventing IP address spoofing, and detecting and mitigating certain denial-of-service attacks [2]. It replaces publication SP 800-54, released in July 2007 and withdrawn on 17 December 2019 [3]. The 2019 recommendations include many measures on BGP. For routing, they cite RPKI, BGP origin validation and prefix filtering [1]. Against denial-of-service attacks, they first target IP address spoofing, with source address validation (SAV) through access control lists and uRPF (unicast Reverse Path Forwarding). They also cite remotely triggered black hole (RTBH) filtering, Flowspec and response rate limiting (RRL) [1]. The 2007 text already explained what BGP is and why it matters for the Internet, and proposed best practices applicable to almost all the BGP routers then available. It noted that the improved protocols proposed generally required substantial changes to the protocol and might not work with existing implementations [3]. ## What you do The sources do not address employees: what follows applies their findings to everyday work, without claiming that they prescribe it. - IT or purchasing manager: ask the internet or hosting provider whether it applies BGP origin validation, RPKI and prefix filtering, which NIST recommends to operators [1]. - IT manager: also ask the provider to check that the source addresses of the packets it sends are legitimate, which falls under the source address validation that NIST recommends [1]. - Company targeted by criminal activity: report it, ask its network providers to trace the spoofed traffic to its origin, and share the information with the community, Google advises [4]. - Employee: treat the network as ground you do not control. The cases below show that traffic passes through networks that nobody controls end to end, which is why confidentiality should not be entrusted to it alone. ## Pitfalls Believing that the company network is a closed circuit is the first. Traffic passes through third-party networks, beyond the company's control. The second pitfall is to assume that routing protection is enough. NIST places it within a set of measures that also includes anti-spoofing and denial-of-service filtering [1]. The third is to confuse the different network incidents. A denial-of-service attack floods its target with useless traffic; according to Google, it does not expose users' data and does not lead to a compromise, but can cause an outage and a loss of trust if it is not mitigated quickly [4]. ## Real cases ### March 2014: YouTube flooded by browsers According to Google, in March 2014, malicious JavaScript injected into thousands of websites by a man-in-the-middle attack on the network led hundreds of thousands of browsers to flood YouTube with requests, up to a peak of 2.7 million requests per second [4]. This is not a BGP hijack, and Google's text does not present it as one. It shows that traffic can be modified along the way and turned against a service, which justifies the employee's caution toward the network. ### September 2017: a 2.5 Tbps denial of service Google says it absorbed a 2.5 Tbps attack in September 2017, the culmination of a six-month campaign. The attacker had used several networks to spoof 167 million packets per second to 180,000 exposed CLDAP, DNS and SNMP servers, which then sent large responses back to Google. The attack had no impact [4]. Google reported thousands of vulnerable servers to their network providers and worked with them to trace the origin of the spoofed packets, so that they would be filtered [4]. The case illustrates the IP address spoofing that NIST's recommendations seek to prevent [1]. Google's 2018 traffic hijacks and the 2008 YouTube and Pakistan Telecom incident appear in none of the sources cited here and are therefore not described here. ## Sources 1. NIST, "Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation", 17 December 2019. https://csrc.nist.gov/pubs/sp/800/189/final (accessed 3 November 2026) 2. NIST, "Resilient Interdomain Traffic Exchange: BGP Security and DDos Mitigation", 17 December 2019. https://www.nist.gov/publications/resilient-interdomain-traffic-exchange-bgp-security-and-ddos-mitigation (accessed 3 November 2026) 3. NIST, "Border Gateway Protocol Security", 17 July 2007. https://csrc.nist.gov/pubs/sp/800/54/final (accessed 3 November 2026) 4. Google, "Identifying and protecting against the largest DDoS attacks", 17 October 2020. https://cloud.google.com/blog/products/identity-security/identifying-and-protecting-against-the-largest-ddos-attacks (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/bgp-rpki-internet-routing-security/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.