Right the Ship: Assessing the Legitimacy of Invalid Routes in RPKI

Resource Public Key Infrastructure (RPKI) aims to prevent prefix hijacking by providing secure mappings between IP prefixes and their authorized origin Autonomous Systems (ASes). In recent years, there has been notable growth in the deployment of RPKI and Route Origin Validation (ROV). Nonetheless, over 40% of the routes in the global routing table still lack the protection of RPKI. One of the critical reasons some networks are reluctant to deploy RPKI is the concern that some ROV-invalid routes may be legitimate, and filtering these routes will harm network service quality, especially affecting network connectivity.

In this work, we perform a comprehensive measurement study to assess the legitimacy of ROV-invalid routes in RPKI. We evaluate the impact of filtering all ROV-invalid routes in the global routing table, presenting a view that some ROV-invalid routes are not illegitimate, defined as harmlessly ROV-invalid (h-invalid). We propose five characteristics and design a characteristics-based methodology for identifying h-invalid routes. Based on the methodology, we analyze the magnitude of h-invalid routes present on the Internet each day, revealing that over 91% of ROV-invalid results are h-invalid. Furthermore, we conclude three main reasons for h-invalid routes. Finally, with all our findings, we provide practical recommendations for network operators to help promote RPKI deployment.