Upward dependencies can be an obstacle for issuing RCs. the RC for prefix p must be signed by an entity already in possession of a valid RC for a super-prefix containing p.
We find the organizations that must first obtain an RC for the owner of the queried IP-prefix to be certified in RPKI.
The figure below illustrates the hierarchical structure of RPKI and the inter-organizational upward dependencies that it entails.
Level 3 Communications is one of the largest ISPs worldwide. It was allocated its IP addresses directly from ARIN, the Regional Internet Registrar for North-America, but did not issue an RC. Consequently, over 500 other organizations are unable to obtain RCs and issue ROAs to protect their thousands of prefixes.
These organizations include, for example, Twitter, LinkedIn, and eBay, as illustrated in the figure.
Back to the main page