# US 11,909,763 B2 · BGP blackhole and hijack mitigation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,763 B2
- Document ID: US11909763B2
- Status: Granted
- Kind: B2
- Application number: 17/224,275
- Filed: 2021-04-07
- Published: 2022-10-13
- Granted: 2024-02-20
- Earliest claimed: 2021-04-07
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Jakob Heitz; Juan Alcaide
- Web page: https://patentgrep.com/patent/US11909763B2

## CPC

- H04L 45/22: {Alternate routing}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Techniques for mitigating BGP blackholes and hijackings are disclosed herein. The techniques include methods for determining, by a victim autonomous system (AS), that a first AS is associated with a first BGP route that includes the victim AS as the destination or as an AS along the first BGP route to the destination and sending a message to a second AS directing the second AS to refrain from using the first AS to propagate data to the victim AS. The message can include a set of one or more AS numbers to avoid in refraining from using to propagate data to the victim AS, a timestamp, an expiration interval, a signature of the victim AS, and an identifier identifying a certificate to be used to verify the signature. Systems and computer-readable media are also provided.

## Claims

### Claim 1

A method comprising:
determining, by a victim autonomous system (AS), that a first AS is diverting traffic from the victim AS to an unintended destination;
determining, by the victim AS, that the first AS is associated with a first Border Gateway Protocol (BGP) route that includes the victim AS as a destination or as an AS along the first BGP route to the destination; and
suppressing utilization of the first BGP route in propagating data to the victim AS by sending a message to a second AS to avoid traffic being hijacked by the first AS, the message to the second AS including:
a set of one or more AS numbers to avoid using to propagate data to the victim AS, wherein the set of one or more AS numbers includes the first AS;
a timestamp;
an expiration interval;
a signature of the victim AS; and
an identifier identifying a certificate for verifying the signature.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
verifying, by the second AS, that the message originates from the victim AS; and
refraining, by the second AS, from using the first AS to propagate the data to the victim AS.

### Claim 3 (depends on 2)

The method of claim 2, wherein the second AS verifies the message based on the certificate.

### Claim 4 (depends on 2)

The method of claim 2, wherein the second AS refrains from using the first AS by routing the data through an alternate AS.

### Claim 5 (depends on 4)

The method of claim 4, wherein the alternate AS is not in the set of one or more AS numbers to avoid.

### Claim 6 (depends on 1)

The method of claim 1, wherein the second AS is in a separate network from the victim AS.

### Claim 7 (depends on 1)

The method of claim 1, wherein the first AS is a malicious AS.

### Claim 8 (depends on 1)

The method of claim 1, wherein the first AS is associated with a potential network attack.

### Claim 9 (depends on 1)

The method of claim 1, wherein the first AS is a malicious AS.

### Claim 10

A non-transitory computer-readable medium comprising instructions, which when executed by one or more processors, cause the one or more processors to:
determine, by a victim autonomous system (AS), that a first AS is diverting traffic from the victim AS to an unintended destination;
determine, by the victim AS, that the first AS is associated with a first Border Gateway Protocol (BGP) route that includes the victim AS as a destination or as an AS along the first BGP route to the destination; and
send a message to a second AS to avoid traffic being hijacked by the first AS by suppressing utilization of the first BGP route in propagating data to the victim AS, the message to the second AS including:
a set of one or more AS numbers to avoid using to propagate data to the victim AS, wherein the set of one or more AS numbers include the first AS;
a timestamp;
an expiration interval;
a signature of the victim AS; and
an identifier identifying a certificate for verifying the signature.

### Claim 11 (depends on 10)

The non-transitory computer-readable medium of claim 10, wherein the instructions, when executed, further cause the one or more processors to:
verify, by the second AS, that the message originates from the victim AS; and
refrain, by the second AS, from using the first AS to propagate the data to the victim AS.

### Claim 12 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the second AS verifies the message based on the certificate.

### Claim 13 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein the second AS refrains from using the first AS by routing the data through an alternate AS.

### Claim 14 (depends on 13)

The non-transitory computer-readable medium of claim 13, wherein the alternate AS is not in the set of one or more AS numbers to avoid.

### Claim 15 (depends on 10)

The non-transitory computer-readable medium of claim 10, wherein the second AS is in a separate network from the victim AS.

### Claim 16 (depends on 10)

The non-transitory computer-readable medium of claim 10, wherein the first AS is a malicious AS.

### Claim 17 (depends on 10)

The non-transitory computer-readable medium of claim 10, wherein the first AS is associated with a potential network attack.

### Claim 18

A system comprising:
one or more processors; and
one or more memories storing computer-readable instructions, which when executed by the one or more processors, cause the one or more processors to:
determine, by a victim autonomous system (AS), that a first AS is diverting traffic from the victim AS to an unintended destination;
determine, by the victim AS, that the first AS is associated with a first Border Gateway Protocol (BGP) route that includes the victim AS as a destination or as an AS along the first BGP route to the destination; and
send a message to a second AS to avoid traffic being hijacked by the first AS by suppressing utilization of the first BGP route in propagating data to the victim AS, the message to the second AS including:
a set of one or more AS numbers to avoid using to propagate data to the victim AS, wherein the set of one or more AS numbers includes the first AS;
a timestamp;
an expiration interval;
a signature of the victim AS; and
an identifier identifying a certificate for verifying the signature.

### Claim 19 (depends on 18)

The system of claim 18, wherein the second AS is in a separate network from the victim AS.

### Claim 20 (depends on 18)

The system of claim 18, wherein the first AS is associated with a potential network attack.