From Address Blocks to Authorized Prefixes: Redesigning RPKI ROV with a Hierarchical Hashing Scheme#
NSDI '25 digest Program Core pick 28–30 April 2025
- Authors / tier: Zedong Ni (CNIC, CAS / Southeast University); Yinbo Xu, Hui Zou, Yanbiao Li (CNIC, CAS / UCAS); Guang Cheng (Southeast University / Purple Mountain Labs); Gaogang Xie (CNIC, CAS / UCAS). Core.
- Why: RPKI Route Origin Validation is becoming table stakes for routing security, and its memory/lookup cost on routers is a practical adoption barrier. Directly relevant to the security-and-routing side of the PM's remit.
- What: A redesign of ROV's validation data structure to make origin validation fast and memory-efficient, reframing the problem from address blocks to authorized prefixes.
- How: A hierarchical hashing scheme for prefix-to-authorization lookup. (Specific performance numbers were not captured in this digest pass; confirm them from the paper.)
- Where applicable: Router-side ROV implementations; broadly applicable to any operator deploying RPKI.