What is ASPA?

ASPA (Autonomous System Provider Authorization) is a proposed RPKI object in which a network signs its list of upstream providers, so routers can check paths.

RPKI route origin validation only checks the last AS in a path: is this AS allowed to originate this prefix? It says nothing about the hops in between, so an attacker can forge a path that ends in the correct origin, and a network can leak routes it learnt from one provider to another without breaking any ROA. ASPA fills part of that gap. A customer AS, say AS64500, publishes a signed record saying "my providers are AS64496 and AS64497". A router checking an AS_PATH uses these records to test whether each hop is consistent with a real customer-to-provider relationship. Legitimate paths are "valley-free": they go up through providers, optionally across one peering link, then down through customers. A path that climbs back up after going down, or claims a provider link nobody authorised, can be marked invalid.

ASPA is still being standardised in the IETF, so details may change, and support is currently limited to some validators and some routing software. It is meant to sit alongside origin validation rather than replace it: ROAs check who originates a prefix, ASPA checks that the path to it is plausible. Like ROV, it only helps once enough networks publish records and enough routers act on them, and an AS without a record simply gives no information. It is far lighter than BGPsec, which signs every hop of every update and needs every AS on the path to take part. The RPKI and Route Origin Validation lesson shows what ROV cannot catch and where ASPA comes in.