BGP Message Signaling for Automatic MAC-Based Attacker Blocking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Manual configuration of forwarding rules on network devices to block attacker hosts is labor-intensive, and existing BGP-based solutions do not efficiently address cyberattacks without additional manual intervention.

Innovation Solution

A method where a network device automatically generates and sends a BGP message to another device indicating an attacker's MAC address, allowing the receiving device to generate forwarding rules without manual configuration, using VTEPs and EVPN routing messages to prevent packets from reaching the attacker.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual configuration of forwarding rules is used to block attacker hosts, then the network device can effectively block packets to attackers, but the workload of manual configuration becomes heavy and labor-intensive

Engineering Contradiction:

Improveblocking effectivenessVSAvoidconfiguration workload

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system enables network devices to automatically detect attackers and configure blocking rules without human intervention. The first network device identifies attacker hosts and generates BGP messages containing MAC addresses, allowing the second network device to automatically generate forwarding rules that block packets to attackers, eliminating manual configuration workload while maintaining reliable blocking effectiveness

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system establishes a feedback mechanism where the first network device monitors network traffic, identifies attackers, and sends BGP messages to the second network device. The second network device receives this information, generates appropriate forwarding rules, and implements blocking. This closed-loop feedback system enables automatic response to attacks without manual reconfiguration

Inventive Principle:

Principle #23Feedback

2Extent of automation

If existing BGP-based solutions are used for DDoS attack mitigation, then automated response can be achieved, but additional manual intervention is still required and time delay occurs

Engineering Contradiction:

Improveautomatic response capabilityVSAvoidresponse time delay

Core Design Contradiction:

Extent of automationVSLoss of time

Solution Approach 1:

The system performs preliminary actions by having network devices continuously monitor traffic and pre-configure the ability to generate and send BGP messages. When an attack is detected, the first network device immediately generates the BGP message with attacker MAC addresses and sends it to the second network device, which instantly generates blocking rules. This pre-prepared automated response eliminates time delays associated with manual intervention

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP3800842B9Method for sending BGP message, method for receiving BGP message, and device

Publication Date: 2025.10.15 HUAWEI TECH CO LTD

Figure 1
Figure 1a~1b
Figure 2~3

AI summary

This application provides a BGP message sending method. The method includes: determining, by a first network device, that a host identified by a first MAC address is an attacker; generating, by the first network device, a BGP message, where the BGP message includes the first MAC address and indication information, and the indication information is used to indicate that the host identified by the first MAC address is the attacker; and sending, by the first network device, the BGP message to a second network device. In addition, another method and another device are further provided. The foregoing technical solution helps reduce workloads of an engineer in performing manual configuration on a network device.