Abstract:There are serious security vulnerabilities in BGP (Border Gateway Protocol) which may lead to route hijacking. In order to overcome these BGP security defects, RPKI (Resource Public Key Infrastructure) was proposed by IETF (Internet Engineering Task Force). However, with the development and global deployment of RPKI, a lot of concerns about the security of certificate authority in RPKI have been raised. In this paper, it carries out experiments about two scenarios (resource reassignment and unauthorized resource assignment) on our RPKI testbed, and analyzes the security problems they may lead to, based on our research and analysis of the process of resource allocation. Besides, for these two kinds of security risks, this paper presents and implements a pre-control mechanism. Finally, it conducts further experiments on our testbed to prove that the pre-control mechanism we presented is feasible and effective to avoid the time limit for recovering from the failure caused by certificate authority's operational mistakes during the process of resource allocation.