ASPA: the new protocol for improving BGP routing security#

Ondřej Caletka (RIPE NCC)

• Why: Routing security is moving from origin validation to partial path validation, and ASPA deployment decisions are landing on BGP operators now — directly within the PM's network-security scope.
• What: An introduction to Autonomous System Provider Authorization, the next RPKI feature being deployed after Route Origin Authorization: each AS can cryptographically declare which ASes are expected to provide it transit, and operators performing ASPA validation can drop routes arriving via unauthorized providers. (from abstract only)
• How: RPKI-signed provider-authorization objects let validators check a received route's propagation path against the declared transit graph, catching route leaks and hijacks propagated through unauthorized providers — complementing, not replacing, ROV.
• Where applicable: Any BGP operator — transit, enterprise, or DC — building on existing RPKI/ROV deployments. Deployment is early, so the practical constraints (who signs objects, which platforms validate) are the things to listen for. RIPE NCC is a registry, not a vendor, so no product-pitch risk.