I often read that checkpoints protect the network from a 51% attack because an attacker cannot reverse transactions made before the last checkpoint.
How exactly does this checkpoint mechanism work? And who creates the checkpoints?
The checkpoints are hard coded into the standard client. The concept is, that the standard client will accept all transactions up to the checkpoint as valid and irreversible. If anyone tries to fork the blockchain starting from a block before the checkpoint, the client will not accept the fork. This makes those blocks "set in stone".
Update on this as of time of writing, just to clarify more specifically upon the other answer: dependence on checkpoints in the security model has been significantly reduced, they are only used in one very specific case now. That case is just to ignore forks from the chain early on, before the most recently seen checkpoint. When a node has seen a block it recognises as a checkpoint, any further blocks received below that height will be ignored.
It is a long term goal of removing the checkpoints entirely, because they are a source of confusion over the security model and power the developers have. But currently the role they serve is to prevent low difficulty header flooding attacks, and there has been no alternative solution proposed yet (that I know of).
AIK there‘s one big use case so far for checkpoints and there‘s actually no golden path to achieve that otherwise.
Let‘s say one has a really really lot of computing power and intentionally or accidentally starts mining at a very low difficulty. Then all nodes were „forced by the rules of consensus“ to check that blocks for validity even there is praktically low to now chance they catch up the entire blockchain. On a time critical node that kind of behaviour could at least create disturbance.
Checkpoints are a tool against that. The node will only check higher blocks than the last checkpoint anf hence „focus on real (trans)actions on the net“.