From Address Blocks to Authorized Prefixes: Redesigning RPKI ROV with a Hierarchical...
summary
Proposes an Authorized Prefix (AP) model and implements it as h2ROV, a hierarchical hashing validator that stores bitmap-encoded ROAs and uses two hash tables (SOT and ST) to do exact-match then coverage checks. Implements changes in FRR and BIRD, runs emulations on real topologies and shows IPv4 validation is 1.7×–9.8× faster and uses 49.3%–86.6% less memory; reduces ROV-induced routing delays by 30.4%–64.7% and confines convergence impact to under 8.5% during update bursts.
AI-written summary · about
chapters (13)
- 0:00RPKI and ROV challenges
- 1:45Low RPKI ROV adoption
- 2:49Address block validation bottlenecks
- 4:16Current ROV validation steps
- 5:20Authorized prefix model design
- 6:27Bitmap encoding for prefixes
- 7:53Hierarchical hashing for validation
- 9:17Coverage checks with subtree table
- 10:44Optimized IPv4/IPv6 algorithms
- 11:27H-Square RV in software routers
- 12:32Performance vs existing schemes
- 13:38Faster routing convergence with H-Square RV
- 13:59Conclusion
related talks
32mLet's talk about routing security
18mcc-pipe: Breaking Systemic Bottlenecks in RPKI Data Supply Chain with Concurrent and...
33mAdvanced rp_ filter
15mRHINE: Robust and High-performance Internet Naming with E2E Authenticity
14mEZ-SAVE: Evaluation of Easy-to-Deploy Source Address Validation Policies
21mStealth BGP Hijacks with uRPF Filtering
34mArchitecting PKI Hierarchies for Graceful PQ Migration
21mR2P2: Making RPCs first-class datacenter citizens