RPKI (Resource Public Key Infrastructure)
Also known as: resource public key infrastructure
A cryptographic system that lets address holders authorize which ASN may originate their prefixes, so routers can reject invalid announcements.
RPKI binds IP address allocations to cryptographic certificates issued through the RIR hierarchy. Using it, the legitimate holder of a prefix publishes a Route Origin Authorization (ROA) stating which ASN is allowed to originate that prefix and up to what length.
Routers (or their validators) then perform Route Origin Validation: a BGP announcement is marked valid, invalid, or not-found by comparing its origin ASN and prefix length against published ROAs. Networks that drop RPKI-invalid routes are protected from the most common form of accidental and malicious origin hijack.
RPKI only validates the origin of a route, not the entire AS-path - that gap is what ASPA and path validation aim to close.