Keeping Internet Navigation on Track: TWNIC Promotes RPKI Routing Security and Defense Mechanisms to Build a Trustworthy Network Environment

Every day, we use phones or computers to look up information, shop, send messages, and access cloud services. It seems as simple as opening a website or app; however, behind every connection lies a navigation-like routing mechanism that guides data to the correct destination. If someone hijacks a route, or if a misconfiguration causes data to go astray, users may fail to connect to services or even be redirected to fraudulent websites. Businesses, on the other hand, face risks such as transaction disruptions, customer service outages, cloud system anomalies, and damaged trust.

To mitigate such risks, the international community has progressively introduced the Resource Public Key Infrastructure (RPKI) as a critical mechanism to reinforce internet routing security. RPKI's operation can be understood in two steps: The first step is "Route Registration," where IP address holders verify which network operators are authorized to announce specific routes, establishing a trusted basis of authorization. The second step is "Route Validation," enabling network operators to verify whether a received route is trustworthy, thereby reducing the risk of data being misrouted.

Jo-Fan Yu, CEO of TWNIC, stated: "The next step for RPKI is not merely pursuing higher coverage, but ensuring that registered routing information can be validated in actual network environments to deliver real risk-reduction defense. ROA acts as the route registration, while ROV is the mechanism that validates route trustworthiness in live network environments. TWNIC will continue to assist IP holders and network operators with resource audits, ROA configurations, operational consultations, and maintenance support, while working alongside operators to stably implement ROV validation mechanisms. Routing security is not a job any single organization can accomplish alone; only through the joint participation of IP holders, network operators, and related communities can Taiwan's digital services be built on a safer and more trustworthy network foundation."

In Taiwan, TWNIC has actively assisted IP holders and network operators in deploying RPKI in recent years, pushing routing security mechanisms from theory into live network environments. Beyond technical implementation, TWNIC continues to offer training, technical consultations, and an RPKI management platform to help organizations lower the barrier to configuration and daily maintenance.

Why Does Internet Navigation Lose Its Way? The Fundamental Challenge of Routing Security

The internet operates much like a multinational logistics system, where routing mechanisms act as the guide for data. When we open a website or use cloud services, data acts like packages delivered to the correct destination according to routing information exchanged among network operators.

In the early days of the internet, the network was small, participating operators were limited, and mutual familiarity was high. Routing operations relied heavily on mutual trust—much like familiar logistics partners informing each other that "this road is open," with everyone arranging deliveries accordingly. However, as the network expanded and services grew increasingly complex, relying solely on mutual trust became insufficient to guarantee routing accuracy. Routes can be hijacked, misled, or misconfigured, causing connection anomalies, service outages, or even redirection to fraudulent websites.

RPKI is designed to ensure that internet routes no longer rely solely on trust, but rather on a verifiable foundation. Its core comprises two mechanisms: Route Origin Authorization (ROA) provides "route registration," allowing IP address holders to confirm which operators are authorized to announce specific route segments; Route Origin Validation (ROV) provides "route validation," enabling network operators to judge whether a received route announcement is trustworthy. Combined, they make valid routes easier to verify and give incorrect or impersonated routes a higher chance of being intercepted.

The Cost of Navigation Failures: From Personal Accounts to Corporate Service Outages

Routing vulnerabilities not only lead to connection issues but can also be exploited for fraud. In the past, hackers hijacked the IP address routes of Amazon AWS Route 53's DNS services, redirecting users heading to legitimate cryptocurrency platforms to fake websites and stealing nearly NT$5 million worth of cryptocurrency.

Routing issues do not always stem from malicious attacks. Meta once accidentally revoked its global BGP routing announcements due to an internal misconfiguration, resulting in a six-hour global outage across Facebook and Instagram. In 2024, two Brazilian network operators caused global anomalies in Cloudflare's public DNS service due to misannouncements and routing leaks, affecting over 70 countries.

For the public, routing failures can lead to inaccessible services, communications blackouts, and threats to accounts, personal data, or financial assets. For businesses, they can cause interrupted transactions, delayed orders, and customer service shutdowns, ultimately damaging reputation and customer trust.

Through ROA "route registration" and ROV "route validation," RPKI minimizes the probability of connection hijacking and service disruptions, establishing a safer network foundation for everyday public use and critical business services.

From Route Registration to Route Validation: A Key Shift in Taiwan's RPKI Promotion

According to APNIC Labs data as of May 2026, Taiwan's ROA coverage rate has reached 97.60%, with an ROV filtering rate of 57.83%. Compared to major Asia-Pacific economies, Taiwan not only maintains a high level of ROA coverage but is also advancing ROV validation simultaneously, transitioning routing security from "completing route registration" to "enforcing route validation."

Completing route registration does not mean defense is fully in place. The ROV validation mechanism must be actively enabled by network operators in live operations to perform its filtering function during routing exchanges. Raising the ROV filtering rate is the core mission for the next phase of Taiwan's RPKI initiative.

Currently, approximately 2% of IP address space remains outside ROA protection, consisting primarily of IP holders who must apply for settings independently through APNIC and smaller organizations with limited technical manpower. TWNIC provides IP resource inventories, ROA configuration checks, abnormal resource alerts, operational consultations, and educational training, leveraging the RPKI management platform to lower operational hurdles.

The target for 2026 is to achieve 98% ROA coverage and maintain an ROV filtering rate stably above 65%. Reaching these two goals will ensure that more of Taiwan's network routes possess verifiable authorization, giving error-prone or suspicious routes a higher chance of being intercepted before circulating. This will reduce risks of connection redirection for the public, as well as service disruptions and trust erosion for businesses.

Routing security cannot be maintained by trust alone; validation is the key to defense. To achieve these protection goals, TWNIC will continue assisting IP holders and network operators with resource audits, ROA configurations, operational consultations, and maintenance support while jointly advancing the stable implementation of ROV validation mechanisms. Routing security cannot be achieved by any single entity; only with the concerted effort of IP holders, network operators, and related communities can we effectively eliminate the risk of internet navigation loss and build Taiwan's digital services on a safer, more trustworthy foundation.