# RPKI Defense Capability Simulation Method Based on Container Virtualization
## 3 Architecture of a Cloud-Based BGP Simulation Platform for BGP Security Evaluation  
Virtualization based on Docker containers offers advantages such as resource conservation, rapid startup, and easy maintenance and expansion. When coupled with cloud computing technology, it provides efficient and large-scale distributed management for virtualization. This combination equips us with powerful tools to create experimental environments and test scenarios, effectively meeting the research requirements for studying malicious attack behaviors in the BGP and the defense mechanisms of the RPKI. Considering this background, this paper leverages cloud computing platforms to design and implement a virtualization-based BGP network security simulation system. The aim is to provide a comprehensive and flexible simulation environment for the in-depth research and analysis of security issues in BGP networks. Additionally, the system can deploy components related to the RPKI, such as Certificate Authorities (CAs), RPKI repositories, and Relaying Parties (RPs), to support experiments associated with ROV. The overall architecture of the platform is illustrated in Figure 1. In this architecture, we adopt a virtualized environment following the deployment model of the OpenStack cloud platform. Specifically, the system consists of one control node, one network node, and multiple compute nodes. Among them, the network node is responsible for creating, connecting, and controlling the virtual networks, whereas the compute nodes are used for creating virtual nodes and managing resources. The control node plays a guiding role in the entire system and is responsible for invoking the APIs of each node to achieve the construction and deployment of the target network topology. On the basis of the above virtualized environment, the proposed BGP simulation network attack testing platform in this paper comprises simulation scenario management in Section 4.1, BGP network and RPKI component simulation in Section 4.2, BGP malicious  
Figure 1: Cloud-based BGP simulation network attack–defense system architecture. attack scenario simulation in Section 4.3, and data collection with effect evaluation in Section 5. The details are as follows:  
1. Simulation scenario management: The main purpose of the SOD-BGP is to study the results of deploying defensive strategies to counter malicious attack scenarios under specific conditions. We define various elements used to create the simulation network, such as images, AS relationships, AS defense strategies, and configuration files for virtual routers, within a simulation scenario. Specifically, in a virtualized environment, the images serve as static forms of virtual nodes, where simulation nodes are composed of the images from virtual systems. By embedding a dynamic routing simulation module developed with FRRouting [30] into the base image, we achieve a functional transformation from regular virtual nodes to router virtual nodes. The generated routing images are synchronized to all the compute nodes under the control node's scheduling to prevent the need to regenerate the images during the deployment, thus accelerating the deployment process. By adjusting the parameters of the simulation scenario, our simulation framework can achieve diverse simulation network deployments. The details are introduced in Section 4.1. 2. BGP network and RPKI component simulation: In accordance with the simulated network topology of the BGP, deployment configuration files containing information about the network and node deployments are generated. The control node initially parses the AS connectivity relationships from the configuration files. Invoking the Neutron API of the network node creates a virtual network to interconnect the virtual nodes. The control node subsequently parses the information about the virtual nodes and uses the routing images generated in the simulation scenario management, along with the RPKI components, to instantiate virtual routing nodes, virtual CA nodes, and virtual RP nodes.