China Rolls out the ROAs | Kentik BlogSlide 1 of 1

Kentik is joining Infoblox•<br>Read the blog

Kentik is joining Infoblox•<br>Read the blog

Kentik is joining Infoblox•<br>Read the blog

Table of contentsBackgroundHere comes ChinaConclusion

Join our network<br>Sign up for the best of Kentik, from articles to analysis and more.

CountryUnited States of AmericaCanada──────────AfghanistanÅland IslandsAlbaniaAlgeriaAmerican SamoaAndorraAngolaAnguillaAntarcticaAntigua and BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBoliviaBonaire, Sint Eustatius and SabaBosnia and HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman IslandsCentral African RepublicChadChileChristmas IslandCocos (Keeling) IslandsColombiaComorosCook IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech RepublicDemocratic Republic of the CongoDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEswatiniEthiopiaFalkland Islands (Malvinas)Faroe IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern TerritoriesGabonGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard Island and McDonald IslandsHoly See (Vatican City State)HondurasHong KongHungaryIcelandIndiaIndonesiaIraqIrelandIslamic Republic of IranIsle of ManIsraelItalyJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKosovoKuwaitKyrgyzstanLao People's Democratic RepublicLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMacaoMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall IslandsMartiniqueMauritaniaMauritiusMayotteMexicoMicronesia, Federated States ofMoldova, Republic ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorth KoreaNorthern Mariana IslandsNorwayOmanPakistanPalauPanamaPapua New GuineaParaguayPeople's Republic of ChinaPeruPhilippinesPitcairnPolandPortugalPuerto RicoQatarRepublic of the CongoRepublic of The GambiaReunionRomaniaRussian FederationRwandaSaint BarthélemySaint HelenaSaint Kitts and NevisSaint LuciaSaint Martin (French part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint Maarten (Dutch part)SlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSouth Georgia and the South Sandwich IslandsSouth KoreaSouth SudanSpainSri LankaState of PalestineSudanSurinameSvalbard and Jan MayenSwedenSwitzerlandSyrian Arab RepublicTaiwan, Province of ChinaTajikistanThailandThe Republic of North MacedoniaTimor-LesteTogoTokelauTongaTrinidad and TobagoTunisiaTürkiyeTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited Republic of TanzaniaUnited States Minor Outlying IslandsUnited States of AmericaUruguayUzbekistanVanuatuVenezuelaVietnamVirgin Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern SaharaYemenZambiaZimbabwe

Sign up

By completing this form, you agree to our Privacy Policy and Terms of Use.

Table of contents<br>BackgroundHere comes ChinaConclusion

SubscribeSummary<br>Long a laggard in RPKI adoption, China has dramatically increased its ROA coverage from 4% to 81% since April, signaling a major commitment to securing the internet’s routing system. This post explores the dramatic shift marking a significant milestone in global routing security, helping to protect networks from BGP routing mishaps that cause internet disruptions.

In the long-running effort to secure the internet’s routing system, RPKI Route Origin Validation (ROV) has played a central role. The success of its global adoption has been a contributing factor in reducing major disruptions caused by BGP routing mishaps.

Up until recently, the largest segment of the global internet that hadn’t yet embraced the technology was China. In this post, we’ll take a look at China’s sudden embrace of RPKI ROV by deploying Route Origin Authorizations (ROAs) for the vast majority of its BGP routes in a matter of weeks.

Background

As we’ve covered in previous posts, the deployment of RPKI ROV involves two steps: resource owners creating ROAs that define the proper origin AS of IP address space, and then networks (ASes) rejecting routes that don’t conform to those definitions. In recent years, we’ve documented the measurable progress made on both fronts.

Beginning several years ago, the majority of internet traffic is destined for RPKI-valid routes. Our analysis showed that RPKI-invalid routes rarely achieve propagation beyond a third of the internet due to the number of major ASes currently rejecting those routes. RPKI ROV works silently in the background, actively suppressing errant BGP announcements before they can cause further disruption, as evidenced by the recent leak of a BGP hijack...