RPKI: Route Security Against BGP Hijacking

RPKI (Resource Public Key Infrastructure) is a security system that cryptographically defines which network (Autonomous System) may announce which IP prefixes on the internet. It protects against BGP hijacking - the accidental or malicious rerouting of traffic.

What is BGP hijacking?

The internet consists of thousands of networks that tell each other via BGP which IP ranges they can reach. By default, BGP trusts these announcements. If a network - deliberately or through misconfiguration - announces someone else's prefixes, traffic can be rerouted to it. The result: outages, eavesdropping or redirection to fake services.

How RPKI protects

With RPKI, the legitimate holder of a prefix publishes a signed statement - a ROA (Route Origin Authorization). It defines which AS may announce the prefix and up to which prefix length. The ROA is cryptographically secured through the allocation hierarchy of the Regional Internet Registries (RIRs).

ROV: Route Origin Validation

Route Origin Validation (ROV) checks incoming BGP announcements against ROAs and classifies them as 'valid', 'invalid' or 'not found'. The network operator's routing policy determines how each state is handled; a security-focused policy rejects RPKI-invalid routes. This can detect and block many origin hijacks.

Why this matters for your services

• Origin mis-announcements can be detected using valid ROA data and rejected according to routing policy.
• Your ROAs must match the origin AS and prefix length; incorrect entries can make legitimate routes invalid.
• ROV validates the origin, not the complete AS path. It does not prevent every form of hijacking or route leak.

Conclusion

RPKI turns the 'trust network' that is BGP into a verifiable system. If you run prefixes, you should publish ROAs - and choose an upstream that enforces ROV.