BGP Route Learning With Region Validation Against Route Hijacking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current BGP routing protocols lack security authentication mechanisms, leading to frequent BGP route-based security attacks such as source hijacking and route leakage, compromising network security and trustworthiness.

Innovation Solution

Implement a route learning method that divides autonomous systems (AS) into regions, using region validation to authenticate BGP routing information by comparing the original AS with route origin authorization (ROA) data, and discards or sets low priority to inconsistent routing information to prevent external ISPs from forging routes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If BGP routing information is accepted without region validation, then route learning is simple and fast, but network security is compromised and routing hijacking can occur

Engineering Contradiction:

Improvenetwork securityVSAvoidroute validation complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by performing region validation on BGP routing information before accepting it into the routing table. The system checks whether the BGP peer belongs to the same region as the routing information source before learning the route, preventing routing hijacking attempts from external providers while maintaining normal operation for legitimate same-region peers.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If region validation is implemented for all BGP routing information, then routing security is improved, but route learning efficiency decreases due to additional validation checks

Engineering Contradiction:

Improverouting information authenticityVSAvoidroute learning efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies local quality by implementing region-specific validation rules. Instead of applying uniform validation to all routing information, the system checks whether the BGP peer and routing information source belong to the same region. This allows efficient validation for same-region peers while blocking external routing information, optimizing both security and efficiency.

Inventive Principle:

Principle #3Local quality

3Adaptability or versatility

If external ISP routing information is accepted, then network connectivity is maintained, but security attacks such as source hijacking can occur

Engineering Contradiction:

Improvenetwork connectivityVSAvoidrouting hijacking attacks

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies segmentation by dividing the network into distinct regions based on autonomous system boundaries. This segmentation enables the system to differentiate between trusted same-region peers and untrusted external providers. By segmenting the routing validation process into region-based checks, the system maintains connectivity with legitimate same-region peers while blocking harmful routing information from external ISPs.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentEP4016941B1Method for learning routing, device, and storage medium

Publication Date: 2025.07.30 HUAWEI TECH CO LTD

Figure 1
Figure 2
Figure 3A

AI summary

A route learning method is provided, including: A network device obtains BGP routing information from a BGP peer; when a target region to which the BGP peer belongs is the same as a target region to which a BGP route belongs, the network device learns the BGP routing information. A packet forwarding method is provided, including: A network device receives a packet through a network interface; when a target region to which the network interface belongs is the same as a target region to which the packet belongs, the network device forwards the packet.