BGP Route Identification for AS_PATH Hijacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional BGP route propagation mechanisms fail to timely detect route hijacking, leading to network security risks due to forged routes that exploit existing loop detection processes.
Innovation Solution
A method and apparatus for BGP route identification that determines whether a BGP route is abnormal by checking if the first AS number in the AS_PATH attribute matches the local autonomous system, and if the local system has not advertised the corresponding IP prefix, identifying potential route hijacking or configuration errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional BGP loop detection is used to discard routes with matching AS numbers, then routing loops are avoided, but route hijacking cannot be detected timely
Solution Approach 1:
The patent segments the AS_PATH attribute analysis into multiple components: local AS number identification, AS_PATH sequence extraction, and origin AS comparison. This segmentation allows the system to distinguish between legitimate loops (detected by conventional methods) and hijacked routes (where the local AS number appears but the origin AS is forged), thereby detecting route hijacking while maintaining loop prevention.
Solution Approach 2:
The patent adds a new dimension of analysis by comparing not only the local AS number in the AS_PATH but also the origin AS number of the route. This dimensional expansion transforms the single-criterion loop detection into a multi-criterion security verification system, enabling detection of route hijacking attempts that exploit conventional loop detection mechanisms.
2Productivity
If BGP route propagation follows conventional mechanisms, then route information is transmitted between autonomous systems, but forged routes create network security risks
Solution Approach 1:
The patent implements preliminary verification of route authenticity by checking both the local AS number presence in AS_PATH and the origin AS number match before accepting route propagation. This preliminary action prevents forged routes from entering the BGP routing table, blocking route hijacking attacks before they can affect network traffic while maintaining efficient propagation of legitimate routes.
3Stability of the object's composition
If AS_PATH attribute is used for loop detection, then routing loops are prevented, but forged AS_PATH attributes cannot be identified
Solution Approach 1:
The patent introduces feedback mechanisms by verifying the origin AS number against the local AS number after detecting the local AS in the AS_PATH. This feedback loop provides additional verification that distinguishes between legitimate routes (where origin AS matches local AS) and forged routes (where origin AS is manipulated), thereby maintaining routing stability while improving authentication precision.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Embodiments of this application provide a BGP route identification method and apparatus, and a device. A network device obtains a BGP route. The BGP route includes an autonomous system path attribute AS_PATH attribute, the AS_PATH attribute includes a first autonomous system number AS number, an AS number corresponding to an autonomous system that the network device is located in or manages is a second AS number, and the first AS number is equal to the second AS number. The network device determines, based on the first AS number and the second AS number, whether the BGP route is abnormal, so that an abnormal loop route caused by a reason such as route hijacking can be found in a timely manner, thereby improving network security.