Methods, systems, and computer program products for protecting against IP prefix hijacking

A system for operating a communication network, comprising:

• a hijack mitigation server to identify a plurality of potential hijack autonomous system that can be used to generate a corrupt routing path from a source autonomous system to a destination autonomous system,
• for each of the plurality of potential hijack autonomous systems:
• identify a regional autonomous system to adopt the corrupt routing path from the source autonomous system to the destination autonomous system;
• and
• determine a reflector autonomous system set such that, for each reflector autonomous system in the set, a source autonomous system to reflector autonomous system routing path and a reflector autonomous system to destination autonomous system routing path do not comprise the regional autonomous system, then
• identify one of the reflector autonomous systems that is common among the reflector autonomous system sets responsive to performing the identifying and determining operations for each of the plurality of potential hijack autonomous systems;
• wherein the hijack mitigation server is further to detect that the routing path from the source autonomous system to the destination autonomous system has been corrupted and to direct communication traffic from the source autonomous system to the destination autonomous system through the one of the reflector autonomous systems that was identified;
• wherein the hijack mitigation server is further to determine, for each of the plurality of potential hijack autonomous systems, a mirror autonomous system set such that, for each mirror autonomous system in the set, a source autonomous system to mirror autonomous system routing path does not comprise the regional autonomous system and to identify a mirror autonomous system that is common among the mirror autonomous system sets responsive to performing the identifying and determining the mirror autonomous system set operations for each of the plurality of potential hijack autonomous systems.

A computer program product for operating a communication network, comprising:

• a non-transitory computer readable storage medium having computer readable program code embodied in the computer readable storage medium, the computer readable program code comprising:
• computer readable program code to identify a plurality of potential hijack autonomous systems that can be used to generate a corrupt routing path from a source autonomous system to a destination autonomous system;
• for each of the plurality of potential hijack autonomous system:
• computer readable program code to identify a regional autonomous system that is to adopt the corrupt routing path from the source autonomous system to the destination autonomous system;
• and
• computer readable program code to determine a reflector autonomous system set such that, for each reflector autonomous system in the set, a source autonomous system to reflector autonomous system routing path and a reflector autonomous system to destination autonomous system routing path do not comprise the regional autonomous system;
• and
• computer readable program code to then identify a reflector autonomous system that is common among the at least one reflector autonomous system set responsive to performing the identifying and determining operations for each of the plurality of potential hijack autonomous systems;
• computer readable program code to detect that the routing path from the source autonomous system to the destination autonomous system has been corrupted;
• computer readable program code to direct communication traffic from the source autonomous system to the destination autonomous system through the one of the reflector autonomous systems that was identified;
• computer readable program code to determine, for each of the plurality of potential hijack autonomous systems, a mirror autonomous system set such that, for each mirror autonomous system in the set, a source autonomous system to mirror autonomous system routing path does not comprise the regional autonomous system;
• and
• computer readable program code to identify a mirror autonomous system that is common among the mirror autonomous system sets responsive to identifying and determining the mirror autonomous system set for each of the plurality of potential hijack autonomous systems.