RPKI: Route Security Against BGP Hijacking

RPKI (Resource Public Key Infrastructure) is a security system that cryptographically defines which network (Autonomous System) may announce which IP prefixes on the internet. It protects against BGP hijacking - the accidental or malicious rerouting of traffic.

What is BGP hijacking?

The internet consists of thousands of networks that tell each other via BGP which IP ranges they can reach. By default, BGP trusts these announcements. If a network - deliberately or through misconfiguration - announces someone else's prefixes, traffic can be rerouted to it. The result: outages, eavesdropping or redirection to fake services.

How RPKI protects

With RPKI, the legitimate holder of a prefix publishes a signed statement - a ROA (Route Origin Authorization). It defines which AS may announce the prefix and up to which prefix length. The ROA is cryptographically secured through the allocation hierarchy of the Regional Internet Registries (RIRs).

ROV: Route Origin Validation

Routers perform Route Origin Validation (ROV): they check incoming BGP announcements against the ROAs. Announcements with a valid ROA are considered 'valid', conflicting ones 'invalid' and are dropped. This detects and blocks hijacks before they do damage.

Why this matters for your services

• Protection from rerouting and outages caused by third-party mis-announcements.
• Higher reachability, because invalid routes are filtered out.
• Trust: more and more networks enforce ROV - unprotected prefixes are at a disadvantage.

Conclusion

RPKI turns the 'trust network' that is BGP into a verifiable system. If you run prefixes, you should publish ROAs - and choose an upstream that enforces ROV.