Securing UPDATE messages
A secure UPDATE consists of an UPDATE message with a new, optional, transitive path attribute for route authorization
This attribute consists of a signed sequence of route attestations, nominally terminating in an address space attestation
This attribute is structured to support both route aggregation and AS sets
Validation of the attribute verifies that the route was authorized by each AS along the path and by the ultimate address space owner