RScope: Unveiling Global ROV Deployments and Dependencies in the Post-ROV Era#

Authors: Weitong Li, Yongzhe Xu (Virginia Tech), Mingwei Zhang, Vasileios Giotsas (Cloudflare), Taejoong Chung (Virginia Tech)

• Why: RPKI/ROV is the routing-security mechanism the industry is standardizing on, and this paper answers the question every operator should ask before relying on it: who is actually filtering, versus who merely looks protected because their upstream does? Promoted from Adjacent: empirical routing-security deployment data is core to network-security work.
• What: RScope maps ROV deployment and dependencies across 21,827 ASes. Findings: 1,127 ASes actively deploy ROV themselves; 1,815 rely purely on upstream filtering, and 69.6% of those "protected" ASes remain vulnerable to local hijacks. Leverage is starkly concentrated: enabling ROV in the top 100 ASes protects 27.6% of networks, while disabling it in Tier-1s exposes 23.8% to hijacks. Operationally notable: router enforcement lags ROA updates by 37 minutes on average. (from abstract only)
• How: Dynamically manipulates Route Origin Authorizations from controlled publication points to isolate the effect of individual Relying Party (RP) servers — selectively invalidating prefixes for specific RPs and probing resulting connectivity changes — which sidesteps the classic confound between local ROV adoption and upstream filtering.
• Where applicable: Global BGP routing. The framework requires controlled ROA publication points (research-grade setup, tools and data open-sourced), but the findings — which ASes actually filter, where RP fragility lies — are directly consumable by anyone planning RPKI rollout or assessing hijack exposure.