RPKI

RPKI, or Resource Public Key Infrastructure, is a framework for securing Internet routing by providing cryptographic authorization of IP address space and autonomous system (AS) numbers used in the Border Gateway Protocol (BGP). It enables operators to verify that a given origin AS is permitted to announce a specific prefix, helping to prevent route hijacking and misconfigurations.

The system relies on a hierarchy of trusted authorities. Regional Internet registries (RIRs) act as trust anchors and issue cryptographic certificates for IP address blocks and AS numbers. Resource holders publish Route Origin Authorizations (ROAs), which state which AS is authorized to originate a particular prefix. These certificates and ROAs are distributed through public repositories and are validated by RPKI validators. Routers or network operators can then apply routing policies based on the validation result, typically labeled as valid, invalid, or unknown.

Key components include the RPKI trust anchors maintained by the RIRs, certificate authorities that bind resources to entities, ROA publications, RPKI validators, and the RTR protocol or similar mechanisms that deliver validation data to routers. When integrated into routing decisions, RPKI-based validation can be used to filter or prefer routes, reducing the likelihood that invalid announcements will be accepted.

Adoption and limitations: RPKI is widely deployed in many networks and IXs, contributing to improved routing security. However, it only validates the origin of a route (not the full AS path), depends on correct ROA configuration, and may introduce operational complexity. Privacy concerns and partial coverage across the Internet are also considerations for its deployment.