ASPA (Autonomous System Provider Authorization)
An Autonomous System Provider Authorization (ASPA), defined in RFC 9582, is a signed object published in the Resource Public Key Infrastructure (RPKI) that states which autonomous systems are authorized to act as an AS's upstream transit providers. Where an RPKI ROA only lets a router validate the origin AS of a BGP announcement -- the last hop -- an ASPA lets a router validate the relationships between hops along the rest of the AS path, catching route leaks and certain hijacks that forge a path while keeping a technically valid origin AS, exactly the gap ROA-based Route Origin Validation leaves open. A router performing AS-Path validation checks each adjacent AS pair in an announced path against the providers each AS has authorized in its own ASPA, flagging a path as invalid if it claims a provider relationship that was never authorized. Like ROA adoption before it, ASPA only protects traffic once enough networks along a path actually publish authorizations and validate against them, so its real-world effect depends on how broadly operators deploy it, not just on the standard existing.
By AdminKit team, Netbase JSC · Updated