Network route hijack protection
AssigneeArchitecture Technology Corporation
InventorsRyan L. Hagelstrom, Ranga S. Ramanujan, Nathan E. Bahr
Life of this patent
Estimating the term…
Abstract
A method of cyber-attack protection is provided. The method includes receiving a unicast packet at a first router and determining whether a destination for the unicast packet is behind a cooperating router. If the destination for the unicast packet is behind a cooperating router, the unicast packet is tunneled from the first router to a tunnel multicast address to which the cooperating router subscribes.
Claims25
A method of cyber-attack protection, the method comprising:
- maintaining an overlay routing table at a first router, the overlay routing table including a respective tunnel multicast address subscribed to by each of a plurality of cooperating routers neighboring the first router;
- receiving a unicast packet at the first router, the unicast packet having a destination internet protocol (IP) address in a destination IP address field of an IP header thereof;
- determining, at the first router, whether the destination IP address for the unicast packet is behind a cooperating router of the plurality of cooperating routers;
- and
- if the destination IP address for the unicast packet is behind the cooperating router, tunneling the unicast packet from the first router to a subscribed tunnel multicast address in the overlay routing table for the cooperating router.
A non-transitory processor readable medium comprising:
- instructions stored thereon, wherein the instructions, when executed by one or more processing devices, cause the one or more processing devices to configure a data plane of a first router to:
- maintain an overlay routing table, the overlay routing table including a respective tunnel multicast address subscribed to by each of a plurality of cooperating routers neighboring the first router;
- receive a unicast packet, the unicast packet having a destination internet protocol (IP) address in a destination IP address field of an IP header thereof;
- determine whether the destination IP address for the unicast packet is behind a cooperating router of the plurality of cooperating routers;
- and
- if the destination IP address for the unicast packet is behind the cooperating router, tunnel the unicast packet to a subscribed tunnel multicast address in the overlay routing table for the cooperating router.
A controller for a data plane of a first router, the controller comprising:
- one or more processing devices;
- a data storage medium coupled to the one or more processing devices, the data storage medium having instructions stored thereon, wherein the instructions, when executed by the one or more processing devices, cause the one or more processing devices to configure the data plane of the first router to:
- maintain an overlay routing table, the overlay routing table including a respective tunnel multicast address subscribed to by each of the plurality of cooperating routers neighboring the first router;
- receive a unicast packet, the unicast packet having a destination internet protocol (IP) address in a destination IP address field of an IP header thereof;
- determine whether the destination IP address for the unicast packet is behind a cooperating router of the plurality of cooperating routers;
- and
- if the destination IP address for the unicast packet is behind the cooperating router, tunnel the unicast packet to a subscribed tunnel multicast address in the overlay routing table for the cooperating router.
Dependencies are inferred from the claim text.