# US 12,007,910 B1 · Resource public key infrastructure (RPKI) validation system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,007,910 B1
- Document ID: US12007910B1
- Status: Granted
- Kind: B1
- Application number: 17/532,666
- Filed: 2021-11-22
- Granted: 2024-06-11
- Earliest claimed: 2021-11-22
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Jonathan Phillibert; Andrew Lee Newton; Gaston Keller; Jun Sung Park; Samuel Kenney
- Web page: https://patentgrep.com/patent/US12007910B1

## CPC

- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3006: {underlying computational problems or public-key parameters}
- H04L 9/3297: {involving time stamps, e.g. generation of time stamps}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 2212/1052: Security improvement
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A caching sub-system downloads and authenticates Resource Public Key Infrastructure (RPKI) cryptographically signed Route Origin Authorizations (ROAs) from a plurality of repositories, forming a VRP set for each repository. When the caching sub-system determines that the VRP count of a VRP set drops to or below a threshold, it substitutes in a last known valid VRP set. A route validating sub-system downloads route information data from one or more global routing tables and calculates the number of valid routes, the number of unknown routes and the number of invalid routes. When the number of valid routes drops to or below a threshold, the route validating sub-system sets an alarm to stop the distribution of VRPs to one or more group of pre-determined routers.

## Claims

### Claim 1

A computer executable method comprising:
receiving, by a caching sub-system, one or more Resource Public Key Infrastructure (RPKI) cryptographically signed Route Origin Authorizations (ROAs) from a plurality of repositories;
authenticating, by the caching sub-system, the ROAs received from the plurality of repositories, forming Validated ROA Payload (VRP) sets, one VRP set for each of the plurality of repositories;
storing, by the caching sub-system, the VRP sets in a cache memory, wherein each entry of each VRP set includes a repository network address, a VRP count, a last version identification, a timestamp, and a state;
determining, by the caching sub-system, that the VRP count of a VRP set is at or below a first threshold;
substituting, by the caching sub-system, the VRP set with a last stored VRP set, forming a substituted VRP set;
storing, by the caching sub-system, the substituted VRP set in a storage area for a distribution to routers, wherein the storage area stores VRPs for a group of pre-determined routers;
receiving, by a route validating sub-system, route information data from a global routing table;
calculating, by the route validating sub-system, a number of valid routes, a number of unknown routes, and a number of invalid routes in the route information data received from the global routing table;
determining, by the route validating sub-system, that a transition of route information data is at or above a second threshold; and
setting, by the route validating sub-system, an alarm to stop the distribution of VRPs in the storage area to the group of pre-determined routers.

### Claim 2 (depends on 1)

The method of claim 1, wherein the last version identification includes a link to the last stored VRP set.

### Claim 3 (depends on 1)

The method of claim 1, wherein determining that the VRP count of a VRP set is at or below the first threshold includes detecting that the VRP count is below a VRP count of the last stored VRP set.

### Claim 4 (depends on 1)

The method of claim 1, wherein determining that a transition of route information data is at or above the second threshold includes analyzing the number of valid routes against the substituted VRP set and analyzing the number of valid routes against the stored VRP set.

### Claim 5 (depends on 1)

The method of claim 1, wherein the last stored VRP set was saved in the cache memory.

### Claim 6 (depends on 1)

The method of claim 1, wherein during the distribution of VRPs to routers is done in stages, each stage includes a distribution to a pre-determined group of routers.

### Claim 7 (depends on 6)

The method of claim 6, wherein each successive distribution stage begins after a previous stage has completed.

### Claim 8

A system configured to:
receive one or more Resource Public Key Infrastructure (RPKI) cryptographically signed Route Origin Authorizations (ROAs) from a plurality of repositories;
authenticate the ROAs received from the plurality of repositories to create Validated ROA Payload (VRP) sets, one VRP set for each of the repositories;
store the VRP sets in a memory, wherein each entry of each VRP set includes a repository network address and a VRP count;
determine that the VRP count of a VRP set is at or below a threshold; and
substitute the VRP set with a last stored VRP set, thereby creating a substituted VRP set.

### Claim 9 (depends on 8)

The system of claim 8, wherein each entry of each VRP set further includes a link to the last stored VRP set.

### Claim 10 (depends on 8)

The system of claim 8, wherein determining that the VRP count of a VRP set is at or below a threshold includes detecting that the VRP count is below a VRP count of the last stored VRP set.

### Claim 11 (depends on 8)

The caching sub-system of claim 8, wherein the VRP sets are stored in the memory per repository.

### Claim 12 (depends on 8)

The system of claim 8, wherein the saved last known valid VRP set was saved in the cache memory.

### Claim 13 (depends on 8)

The system of claim 8 further configured to store the substituted VRP set in a storage area, wherein the storage area stores VRPs for a group of pre-determined routers.

### Claim 14 (depends on 13)

The system of claim 13 further configured to distribute the substituted VRP set from the storage area as part of a distribution executed in stages.

### Claim 15 (depends on 14)

The system of claim 14, wherein each successive distribution stage begins after a previous stage has completed.

### Claim 16

A system configured to:
receive route information data from a global routing table;
calculate, using the route information, a number of valid routes, a number of unknown routes, and a number of invalid routes;
determine that a transition of route information data is at or above a threshold; and
prevent distribution of route information data in a storage area;
wherein the storage area contains Validated Route Origin Authorizations Payload (VRP) sets and wherein determining that the transition is at or above the threshold includes analyzing the number of valid routes against the VRP sets in the storage area.

### Claim 17 (depends on 16)

The route validating sub-system of claim 16,
wherein determining that the transition is at or above the threshold further includes analyzing the number of valid routes against a last stored sets of VRPs.

### Claim 18 (depends on 16)

The route validating sub-system of claim 16, wherein preventing the distribution of route information data includes setting an alarm.