BGP blackhole and hijack mitigation
AssigneeCisco Technology, Inc.
InventorsJakob Heitz, Juan Alcaide
Life of this patent
Estimating the term…
Abstract
Techniques for mitigating BGP blackholes and hijackings are disclosed herein. The techniques include methods for determining, by a victim autonomous system (AS), that a first AS is associated with a first BGP route that includes the victim AS as the destination or as an AS along the first BGP route to the destination and sending a message to a second AS directing the second AS to refrain from using the first AS to propagate data to the victim AS. The message can include a set of one or more AS numbers to avoid in refraining from using to propagate data to the victim AS, a timestamp, an expiration interval, a signature of the victim AS, and an identifier identifying a certificate to be used to verify the signature. Systems and computer-readable media are also provided.
Claims20
A method comprising:
- determining, by a victim autonomous system (AS), that a first AS is associated with a first Border Gateway Protocol (BGP) route that includes the victim AS as a destination or as another AS along the first BGP route to the destination;
- and
- sending a message to a second AS to suppress utilization of the first BGP route in propagating data to the victim AS, wherein the suppression occurs without removing the first BGP route from a routing table of the second AS while still using the routing table to route traffic, and wherein the message including:
- a set of one or more AS numbers to avoid using to propagate data to the victim AS, wherein the set of one or more AS numbers includes the first AS;
- a timestamp to identify when the message was sent;
- and
- an expiration interval that specifies how long to suppress utilization of the first BGP route to prevent an attack on the first BGP route.
A non-transitory computer-readable medium comprising instructions, which when executed by one or more processors, cause the one or more processors to:
- determine, by a victim autonomous system (AS), that a first AS is associated with a first Border Gateway Protocol (BGP) route that includes the victim AS as a destination or as another AS along the first BGP route to the destination;
- and
- send a message to a second AS to suppress utilization of the first BGP route in propagating data to the victim AS, wherein the suppression occurs without removing the first BGP route from a routing table of the second AS while still using the routing table to route traffic, and wherein the message including:
- a set of one or more AS numbers to avoid using to propagate data to the victim AS, wherein the set of one or more AS numbers includes the first AS;
- a timestamp to identify when the message was sent;
- and
- an expiration interval that specifies how long to suppress utilization of the first BGP route to prevent an attack on the first BGP route.
A system comprising:
- one or more processors;
- and
- one or more memories storing computer-readable instructions, which when executed by the one or more processors, cause the one or more processors to:
- determine, by a victim autonomous system (AS), that a first AS is associated with a first Border Gateway Protocol (BGP) route that includes the victim AS as a destination or as another AS along the first BGP route to the destination;
- and
- send a message to a second AS to suppress utilization of the first BGP route in propagating data to the victim AS, wherein the suppression occurs without removing the first BGP route from a routing table of the second AS while still using the routing table to route traffic, and wherein the message including:
- a set of one or more AS numbers to avoid using to propagate data to the victim AS, wherein the set of one or more AS numbers includes the first AS;
- a timestamp to identify when the message was sent;
- and
- an expiration interval that specifies how long to suppress utilization of the first BGP route to prevent an attack on the first BGP route.
Dependencies are inferred from the claim text.