What Is RPKI / Route Origin Authorization (ROA)?

RPKI lets a network cryptographically authorize which AS may originate a prefix. The signed record is a ROA — a Route Origin Authorization.

How Whisper models it

ROA—ROA_AUTHORIZES_ORIGIN→ASN

A ROA is a node; ROA_AUTHORIZES_ORIGIN links it to the AS it authorizes — a zero count means an unauthorized origin.

ROAs authorizing an ASNOpen in Console →

MATCH (roa:ROA)-[:ROA_AUTHORIZES_ORIGIN]->(a:ASN {name:"AS13335"}) RETURN count(roa) AS roas

RPKI (Resource Public Key Infrastructure) is the internet's defence against BGP route hijacks. A resource holder publishes a Route Origin Authorization (ROA): a signed statement that a given AS may originate a prefix, up to a maximum length. Routers can then reject announcements that don't match.

Checking RPKI validity by hand means querying registry trust anchors and matching them to live BGP. WhisperGraph pre-joins it: `ROA` nodes connect to prefixes and origin ASNs via `ROA_AUTHORIZES_PREFIX` and `ROA_AUTHORIZES_ORIGIN`, so you can ask whether a route's origin is authorized in a single hop.

See it in practice

Run it live in these use cases: Spot BGP hijacks & route anomalies.

Where this shows up

See it in a live investigation: Enrich an ASN — routing, RPKI & physical footprint.

Go hands-on with the BGP & routing recipes.