RPKI (Resource Public Key Infrastructure) adds cryptographic verification to BGP origin claims.
How it works:
Address owners create ROAs (Route Origin Authorizations) stating which ASN can originate their prefixes.
ROAs are signed and published in RPKI repositories.
Routers download ROAs and validate incoming BGP announcements.
If announcement doesn't match any ROA, mark INVALID. If it matches, VALID.
Adoption: Growing but incomplete. Creating ROAs for your prefixes helps protect them.