How RPKI Prevents BGP Hijacks & Protects Your Network Traffic

RPKI: A Leader’s Guide to Securing Your Network’s Digital Highways

Executive Summary: What You Need to Know

Why Should Business Leaders Care About “Technical” Topics Like RPKI?

Imagine waking up to discover that your company’s website is unreachable, customer emails are bouncing, and your cloud services are inaccessible. Your technical team informs you that someone has “hijacked” your internet traffic. This isn’t a hypothetical scenario – it happens regularly to organizations of all sizes when they haven’t properly secured their digital addresses.

In simple terms, RPKI (Resource Public Key Infrastructure) is like a digital deed system for your internet addresses. It proves you’re the legitimate owner of your IP addresses and prevents others from impersonating your network on the internet. Without this protection, your digital presence exists in a surprisingly vulnerable state.

As Customer Account Manager at InterLIR, I’ve seen firsthand how organizations struggle with the consequences of routing security incidents. Our clients – from cybersecurity firms to hosting providers to gaming companies – increasingly recognize that securing their IP addresses isn’t just a technical concern but a fundamental business requirement.

The internet was built on a foundation of trust, but that trust is increasingly exploited. When Pakistan accidentally blocked YouTube globally in 2008 by announcing YouTube’s IP addresses as their own, it exposed a fundamental flaw in internet routing. Today, similar incidents continue to occur, sometimes accidentally, but often as deliberate attacks.

In this guide, I will break down what RPKI is in straightforward terms, explain why implementing it is critical for your business continuity, and provide a clear roadmap for making smart decisions about securing your organization’s internet presence. You don’t need to understand the technical details – you just need to know why it matters and what actions to take.

How Did We End Up With Such Vulnerable Digital Highways?

To understand why RPKI matters, let’s look at how we arrived at our current situation. The internet wasn’t originally designed with security as a primary concern – it was built on trust between a small community of academic and research institutions.

When the internet was young, announcing which IP addresses belonged to your network was a simple, trust-based system. It was like a small town where everyone knew each other, and nobody locked their doors. The Border Gateway Protocol (BGP), which controls how traffic is routed across the internet, was designed in this trusting environment.

From Small Community to Global Infrastructure

As the internet grew from a research network to global critical infrastructure, that trust model became increasingly problematic. Today, the internet connects billions of devices across millions of networks operated by countless organizations worldwide. Yet remarkably, the core routing system still largely operates on the honor system.

This creates a fundamental security challenge: any network can claim to be the legitimate destination for any IP address, and there’s no built-in way to verify these claims. It’s as if anyone could claim ownership of your business’s physical location simply by putting up a sign with your company name.

At InterLIR, we’ve helped clients who discovered their IP addresses were being announced by unauthorized entities, resulting in their traffic being diverted. In one case, a hosting provider only discovered the problem after customers complained about intermittent service issues – by which time sensitive data had already been exposed.

The consequences of this vulnerability extend far beyond technical inconvenience. When your traffic is hijacked, attackers can:

RPKI was developed to address this fundamental security gap by creating a cryptographic system to verify who has the right to announce specific IP addresses. It’s the digital equivalent of securing property deeds in a tamper-proof registry.

What Exactly Is RPKI and How Does It Protect My Business?

When I explain RPKI to our clients at InterLIR, I start with a simple analogy: RPKI is like a system of digital property deeds and verification certificates for your internet addresses. Let me break this down into practical terms that matter for your business.

The Building Blocks of RPKI Protection

RPKI consists of three key components that work together to secure your network:

Here’s how this works in practice: Your organization creates ROAs for your IP addresses through your Regional Internet Registry (RIR). These ROAs cryptographically prove you’re authorized to use those addresses. Other networks then check route announcements against these ROAs before accepting traffic destined for your addresses.

The Three States of Route Validation

When other networks validate your route announcements, they classify them into three states:

At InterLIR, we’ve seen a significant shift in how organizations approach RPKI. Just two years ago, many of our clients viewed it as optional. Today, it’s becoming a standard business requirement as major networks increasingly filter invalid routes.

For example, one of our clients, a gaming company with IP addresses in multiple regions, initially resisted implementing RPKI due to perceived complexity. After experiencing a route hijacking incident that took their services offline for several hours, they quickly changed their approach. The business impact – lost revenue, customer complaints, and emergency response costs – far outweighed the modest effort required to implement RPKI.

Two Implementation Approaches: Hosted vs. Delegated

There are two ways to implement RPKI, each with different levels of complexity and control:

For most of our clients at InterLIR, I recommend starting with Hosted RPKI. It provides the security benefits with minimal operational overhead. You can always transition to Delegated RPKI later if your specific requirements demand it.

What Is the True Business Cost of Ignoring RPKI?

When discussing RPKI with clients, the question of ROI inevitably arises. Let me frame this in terms that matter to business leaders rather than just technical teams.

The Hidden Costs of Routing Insecurity

One of our clients, a SaaS provider with customers across Europe, experienced this firsthand. Their traffic was hijacked for nearly four hours before they detected the issue. The incident resulted in approximately €30,000 in lost revenue, required emergency response from their technical team (including overnight hours), and prompted an expensive security audit to determine if data had been compromised.

The Competitive Disadvantage of Inaction

Beyond direct costs, there’s an emerging competitive disadvantage to ignoring RPKI. Major networks and content providers are increasingly implementing strict route validation, meaning they will reject invalid routes. If your organization hasn’t properly implemented RPKI, your services may become unreachable to customers using these networks.

This trend is accelerating. At InterLIR, we’ve observed that RPKI adoption has grown from covering roughly 20% of the IPv4 address space in 2020 to over 40% today. Major cloud providers and content delivery networks are leading this charge, with some already implementing filtering of invalid routes.

The business reality is simple: implementing RPKI is transitioning from a security best practice to a basic requirement for internet connectivity. Organizations that delay implementation face increasing risk of service disruptions as the internet ecosystem evolves.

Justifying the Investment

Compared to the potential costs of routing incidents, implementing RPKI requires minimal investment:

When I discuss this with clients, I frame RPKI not as a cost but as an insurance policy that protects their digital infrastructure. The return on this modest investment becomes clear when compared to the potential costs of a single routing incident.

What Is the Smart Leader’s Roadmap for Implementing RPKI?

Based on our experience helping organizations implement RPKI at InterLIR, I’ve developed a straightforward roadmap that business leaders can follow. This approach balances security improvements with operational practicality.

Phase 1: Preparation and Planning

1️⃣ Inventory your IP resources – Compile a complete list of all IP address blocks your organization owns or uses, including which RIR they’re registered with.

2️⃣ Document your BGP announcements – Work with your technical team to document exactly which IP prefixes you announce and through which ASNs (Autonomous System Numbers).

3️⃣ Identify stakeholders – Determine who needs to be involved in the implementation process, typically including network operations, security teams, and service providers.

This preparation phase is crucial for a smooth implementation. At InterLIR, we often help clients with this inventory process, as many organizations discover they have incomplete records of their IP resources.

Phase 2: ROA Creation and Testing

1️⃣ Start with Hosted RPKI – Unless you have specific requirements for Delegated RPKI, begin with the simpler Hosted option through your RIR.

2️⃣ Create precise ROAs – Follow the “exact match principle” by creating ROAs that precisely match your actual BGP announcements.

3️⃣ Use caution with maxLength – Set the maxLength field to match exactly what you announce to avoid creating security vulnerabilities.

4️⃣ Verify your ROAs – Use public validation tools to confirm your ROAs are correctly published and match your announcements.

A common mistake we see is organizations creating overly permissive ROAs with broad maxLength values. This creates security vulnerabilities that can be exploited. For example, if you announce a /24 prefix but set a maxLength of /28, attackers could potentially announce more specific prefixes (like a /28) that would be considered valid under your ROA.

Phase 3: Implementing Route Origin Validation (ROV)

Once your ROAs are in place, you can begin validating incoming route announcements from others. This should be implemented in stages:

1️⃣ Monitor mode – Begin by simply logging the validation status of routes without taking action. This helps you understand the potential impact of filtering.

2️⃣ Preference adjustment – Modify your routing preferences to favor valid routes over unknown ones, while still accepting both.

3️⃣ Invalid route filtering – Once comfortable with the process, begin rejecting invalid routes. This is the full security benefit of RPKI.

This gradual approach minimizes the risk of service disruptions. One of our clients, a hosting provider, discovered during their monitoring phase that several of their upstream providers had invalid route announcements. By identifying these issues before implementing filtering, they avoided potential connectivity problems.

Future-Proofing Your Implementation

As RPKI adoption continues to grow, consider these forward-looking steps:

Vladislava Shadrina

Customer Account Manager