{"id":{"repo_id":"vt","oai_identifier":"oai:vtechworks.lib.vt.edu:10919/139895"},"canonical_url":"https://search.dev.ndltd.org/etd/vt/oai:vtechworks.lib.vt.edu:10919/139895","repository":{"repo_id":"vt","name":"Virginia Tech","base_url":"https://vtechworks.lib.vt.edu/oai/request"},"display":{"title":"Securing Internet Routing: Measuring and Improving the Resource Public Key Infrastructure","abstract":"The Border Gateway Protocol (BGP) underpins global Internet routing among thousands of Autonomous Systems (ASes) but lacks built-in security. The Resource Public Key Infrastructure (RPKI) enhances BGP security by verifying route authenticity through Route Origin Validation (ROV). However, its effectiveness remains limited by partial adoption, misconfigurations, and collateral routing effects. This dissertation conducts a comprehensive study of RPKI deployment and proposes practical methods to strengthen ROV security. First, we present RoVista, a scalable measurement framework that leverages in-the-wild RPKI-invalid prefixes to assess real-world ROV enforcement across 28,000 ASes. Second, we identify and mitigate collateral damage, where ROV-enabled networks can still misroute traffic via vulnerable next hops. We design ImpROV, a lightweight mechanism that proactively avoids such paths, reducing hijack risks with minimal computational overhead. Finally, we uncover systematic causes of RPKI-invalid prefixes—chiefly misconfigurations in IP leasing and transit services—and quantify their impact on routing reliability and hijack detection. These contributions provide the foundation for the development of scalable RPKI measurement techniques, new strategies for mitigating collateral damage, and actionable recommendations for improving ROA management practices.","abstract_html":"The Border Gateway Protocol (BGP) underpins global Internet routing among thousands of Autonomous Systems (ASes) but lacks built-in security. The Resource Public Key Infrastructure (RPKI) enhances BGP security by verifying route authenticity through Route Origin Validation (ROV). However, its effectiveness remains limited by partial adoption, misconfigurations, and collateral routing effects. This dissertation conducts a comprehensive study of RPKI deployment and proposes practical methods to strengthen ROV security. First, we present RoVista, a scalable measurement framework that leverages in-the-wild RPKI-invalid prefixes to assess real-world ROV enforcement across 28,000 ASes. Second, we identify and mitigate collateral damage, where ROV-enabled networks can still misroute traffic via vulnerable next hops. We design ImpROV, a lightweight mechanism that proactively avoids such paths, reducing hijack risks with minimal computational overhead. Finally, we uncover systematic causes of RPKI-invalid prefixes—chiefly misconfigurations in IP leasing and transit services—and quantify their impact on routing reliability and hijack detection. These contributions provide the foundation for the development of scalable RPKI measurement techniques, new strategies for mitigating collateral damage, and actionable recommendations for improving ROA management practices.","abstract_has_math":false,"creators":["Li, Weitong"],"institution":"Virginia Tech","degree_name":"Doctor of Philosophy","degree_level":"doctoral","degree_discipline":"Computer Science & Applications","degree_department":"Computer Science and#38; Applications","school":null,"contributors":[],"advisors":[],"committee_chairs":["Chung, Taejoong Tijay"],"committee_members":["Ji, Bo","Yao, Danfeng","Giotsas, Vasilis","Viswanath, Bimal"],"year":2025,"date_issued":"2025-12-11","date_published":"2025-12-11","updated_at":"2026-07-22T22:20:21Z","subjects":["Internet Measurement","Routing Security","BGP","RPKI"],"languages":["en"],"rights":["Creative Commons Attribution 4.0 International"],"rights_urls":["http://creativecommons.org/licenses/by/4.0/"],"identifier_entries":[{"key":"dc:identifier.other","label":"Dc Identifier Other","values":["vt_gsexam:44906"],"render_values":[{"text":"vt_gsexam:44906","href":null,"code":true}]}]},"links":{"outbound_url":"https://hdl.handle.net/10919/139895","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.committeechair","label":"Committee Chair","values":["Chung, Taejoong Tijay"]},{"key":"dc:contributor.committeemember","label":"Committee Member","values":["Ji, Bo","Yao, Danfeng","Giotsas, Vasilis","Viswanath, Bimal"]},{"key":"dc:contributor.department","label":"Department","values":["Computer Science and#38; Applications"]},{"key":"dc:creator","label":"Author","values":["Li, Weitong"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2025-12-12T09:00:13Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2025-12-12T09:00:13Z"]},{"key":"dc:date.issued","label":"Date","values":["2025-12-11"]},{"key":"dc:publisher","label":"Institution","values":["Virginia Tech"]},{"key":"dc:type","label":"Dc Type","values":["Dissertation"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science & Applications"]},{"key":"thesis:degree_level","label":"Degree Level","values":["doctoral"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Doctor of Philosophy"]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["Virginia Polytechnic Institute and State University"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Internet Measurement","Routing Security","BGP","RPKI"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language.iso","label":"Language (ISO)","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["Creative Commons Attribution 4.0 International"]},{"key":"dc:rights.uri","label":"Rights URI","values":["http://creativecommons.org/licenses/by/4.0/"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.other","label":"Dc Identifier Other","values":["vt_gsexam:44906"]},{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/10919/139895"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["The Border Gateway Protocol (BGP) underpins global Internet routing among thousands of Autonomous Systems (ASes) but lacks built-in security. The Resource Public Key Infrastructure (RPKI) enhances BGP security by verifying route authenticity through Route Origin Validation (ROV). However, its effectiveness remains limited by partial adoption, misconfigurations, and collateral routing effects. This dissertation conducts a comprehensive study of RPKI deployment and proposes practical methods to strengthen ROV security. First, we present RoVista, a scalable measurement framework that leverages in-the-wild RPKI-invalid prefixes to assess real-world ROV enforcement across 28,000 ASes. Second, we identify and mitigate collateral damage, where ROV-enabled networks can still misroute traffic via vulnerable next hops. We design ImpROV, a lightweight mechanism that proactively avoids such paths, reducing hijack risks with minimal computational overhead. Finally, we uncover systematic causes of RPKI-invalid prefixes—chiefly misconfigurations in IP leasing and transit services—and quantify their impact on routing reliability and hijack detection. These contributions provide the foundation for the development of scalable RPKI measurement techniques, new strategies for mitigating collateral damage, and actionable recommendations for improving ROA management practices."]},{"key":"dc:description.abstractgeneral","label":"General Abstract","values":["The Internet relies on the Border Gateway Protocol (BGP) to deliver data between networks. However, BGP was designed without built-in security, which allows attackers or configuration mistakes to misdirect Internet traffic—a problem that can cause major service outages. To address this, the Resource Public Key Infrastructure (RPKI) was introduced to verify that networks announce only the routes they are authorized to use. Yet, despite its growing deployment, RPKI still faces challenges due to incomplete adoption, configuration errors, and unintended side effects that can disrupt normal routing. This dissertation studies how well RPKI is deployed in practice and proposes new ways to make Internet routing more secure. First, it introduces RoVista, a large-scale measurement system that tests how thousands of Internet networks enforce RPKI security in real-world conditions. Second, it develops ImpROV, a system that prevents routing problems caused by partial RPKI deployment, helping networks avoid risky paths while keeping Internet performance stable. Finally, it examines the underlying causes of invalid routing records—often due to mistakes or complex business arrangements in IP address leasing—and measures their global impact. Together, these findings advance our understanding of Internet routing security, and offer practical guidance to operators and policymakers working to make the Internet safer and more reliable."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["Doctor of Philosophy"]},{"key":"dc:format.medium","label":"Dc Format Medium","values":["ETD"]},{"key":"dc:title","label":"Title","values":["Securing Internet Routing: Measuring and Improving the Resource Public Key Infrastructure"]}]}],"canonical_facts":{"dc:contributor.committeechair":["Chung, Taejoong Tijay"],"dc:contributor.committeemember":["Ji, Bo","Yao, Danfeng","Giotsas, Vasilis","Viswanath, Bimal"],"dc:contributor.department":["Computer Science and#38; Applications"],"dc:creator":["Li, Weitong"],"dc:date.accessioned":["2025-12-12T09:00:13Z"],"dc:date.available":["2025-12-12T09:00:13Z"],"dc:date.issued":["2025-12-11"],"dc:description.abstract":["The Border Gateway Protocol (BGP) underpins global Internet routing among thousands of Autonomous Systems (ASes) but lacks built-in security. The Resource Public Key Infrastructure (RPKI) enhances BGP security by verifying route authenticity through Route Origin Validation (ROV). However, its effectiveness remains limited by partial adoption, misconfigurations, and collateral routing effects. This dissertation conducts a comprehensive study of RPKI deployment and proposes practical methods to strengthen ROV security. First, we present RoVista, a scalable measurement framework that leverages in-the-wild RPKI-invalid prefixes to assess real-world ROV enforcement across 28,000 ASes. Second, we identify and mitigate collateral damage, where ROV-enabled networks can still misroute traffic via vulnerable next hops. We design ImpROV, a lightweight mechanism that proactively avoids such paths, reducing hijack risks with minimal computational overhead. Finally, we uncover systematic causes of RPKI-invalid prefixes—chiefly misconfigurations in IP leasing and transit services—and quantify their impact on routing reliability and hijack detection. These contributions provide the foundation for the development of scalable RPKI measurement techniques, new strategies for mitigating collateral damage, and actionable recommendations for improving ROA management practices."],"dc:description.abstractgeneral":["The Internet relies on the Border Gateway Protocol (BGP) to deliver data between networks. However, BGP was designed without built-in security, which allows attackers or configuration mistakes to misdirect Internet traffic—a problem that can cause major service outages. To address this, the Resource Public Key Infrastructure (RPKI) was introduced to verify that networks announce only the routes they are authorized to use. Yet, despite its growing deployment, RPKI still faces challenges due to incomplete adoption, configuration errors, and unintended side effects that can disrupt normal routing. This dissertation studies how well RPKI is deployed in practice and proposes new ways to make Internet routing more secure. First, it introduces RoVista, a large-scale measurement system that tests how thousands of Internet networks enforce RPKI security in real-world conditions. Second, it develops ImpROV, a system that prevents routing problems caused by partial RPKI deployment, helping networks avoid risky paths while keeping Internet performance stable. Finally, it examines the underlying causes of invalid routing records—often due to mistakes or complex business arrangements in IP address leasing—and measures their global impact. Together, these findings advance our understanding of Internet routing security, and offer practical guidance to operators and policymakers working to make the Internet safer and more reliable."],"dc:description.degree":["Doctor of Philosophy"],"dc:format.medium":["ETD"],"dc:identifier.other":["vt_gsexam:44906"],"dc:identifier.uri":["https://hdl.handle.net/10919/139895"],"dc:language.iso":["en"],"dc:publisher":["Virginia Tech"],"dc:rights":["Creative Commons Attribution 4.0 International"],"dc:rights.uri":["http://creativecommons.org/licenses/by/4.0/"],"dc:subject":["Internet Measurement","Routing Security","BGP","RPKI"],"dc:title":["Securing Internet Routing: Measuring and Improving the Resource Public Key Infrastructure"],"dc:type":["Dissertation"],"thesis:degree_discipline":["Computer Science & Applications"],"thesis:degree_level":["doctoral"],"thesis:degree_name":["Doctor of Philosophy"],"thesis:institution_name":["Virginia Polytechnic Institute and State University"]},"updated_at":"2026-07-22T22:20:21Z"}