ROA (Route Origin Authorization)

Also known as: Route Origin Authorisation

A ROA is a signed RPKI object binding an IP prefix and maximum prefix length to a single origin AS. Routers running RPKI-to-Router (RTR) consult ROA-derived validation state to accept, prefer or drop BGP announcements. Operators publish ROAs for their IPX/GRX ranges, SEPP and DEA IPs to prevent unauthorized ASes from originating those prefixes.

Categories: Security ControlsInternet and Routing

ROA in context

Security controls in telecom span signaling firewalls (SS7/Diameter/GTP screening at the network edge), transport encryption (IPsec, TLS, PRINS), identity and access on OSS/BSS, and monitoring at both the packet and log level. Controls are audited against GSMA FS.11/FS.19/FS.20/FS.36 and, in Europe, NIS2 sectoral rules.

Telecom networks depend on Internet-style routing (BGP, DNS, MPLS) for interconnect, transport and application delivery. Route hijacks and DNS abuse can degrade or intercept signaling as easily as any application-layer attack, which is why RPKI and DNSSEC are now standard hardening for carrier networks.

To place ROA in the wider telecom-security picture, review RPKI-to-Router, RPKI, BGP Hijacking, A5/1, ASN and Digital Signature.

Related terms

Related topic hubs

  • Diameter Security 4G/LTE Diameter threats across IPX/roaming and DEA defenses.
  • Roaming Security IPX/GRX interconnect risk, home-routed vs local-breakout, SEPP.
  • GTP Security GTP-C/GTP-U threats across S5/S8, N3/N9 and GRX/IPX borders under GSMA FS.20.
  • Diameter Firewall GSMA FS.19 screening at the Diameter Edge Agent on S6a/S9/S13.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.