UC San Diego

A key vulnerability of the Border Gateway Protocol (BGP) is its lack of origin validation, which allows attackers to falsely advertise IP address space they do not legitimately control, exposing victims to significant risks including service disruption, data theft, and financial loss. To mitigate such threats, the Internet community has developed origin validation mechanisms that operate in parallel with BGP to serve as an external source of trust. These systems rely on authoritative databases where networks voluntarily register their route origins and use the published information to verify BGP messages they receive. However, the effectiveness of these systems remains uncertain, as evolving usage and operational constraints may undermine the protection they could provide for the routing system. Evaluating such effectiveness is challenging, especially without access to how authoritative databases are operated or incorporated into routing operations by networks. Nonetheless, the public nature of these databases and the external observability of BGP behavior provide a useful basis for assessing the deployment and limitations of these mechanisms.This dissertation demonstrates that it is possible to evaluate the effectiveness of BGP origin validation mechanisms using public measurement data. I present four studies that use such data to examine key aspects of BGP origin validation mechanisms. First, I assess the integrity of authoritative databases by identifying outdated and attacker-falsified records. Second, I analyze how adversaries have exploited the emerging IP address leasing market in ways that undermine the effectiveness of origin validation. Third, I evaluate the adoption of origin validation mechanisms among networks participating in the MANRS initiative. Finally, I simulate partial deployment strategies to identify high-priority networks for targeted BGP origin validation deployment. These analyses reveal weaknesses in how trust is established, delegated, and adopted in the systems network operators use to validate BGP announcements. My findings offer the networking community actionable insights to improve the reliability and deployment of these origin validation mechanisms, and provide stakeholders with guidance to prioritize the most impactful networks for advancing routing security. Together, these studies present a repeatable methodology for continuously evaluating the effectiveness of origin validation mechanisms and monitoring their evolution over time.