Poison-Path Routing Policy for BGP Hijack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Communication networks, particularly those using Border Gateway Protocol (BGP), are vulnerable to prefix hijacking attacks where a rogue or malfunctioning BGP router announces false AS-level routes, leading to unauthorized interception or dropping of IP traffic.
Innovation Solution
Implementing a poison-path routing policy in BGP routers to detect hijacked routes and find alternative paths with no common autonomous systems, using a processor to search for routes with equal or shorter netmask lengths and modifying routing tables to insert and manage these alternative paths, ensuring data packets are routed through unaffected ASes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If BGP routers use standard routing protocols to exchange routing information, then routing efficiency and network connectivity are improved, but the network becomes vulnerable to prefix hijacking attacks where rogue routers can announce false routes
Solution Approach 1:
The patent applies preliminary action by pre-configuring poison path entries in the routing table before hijacking occurs. When a hijacked prefix is detected, the system immediately activates pre-prepared alternative routes with poisoned AS paths, preventing traffic redirection before it can happen. This proactive approach eliminates the vulnerability window that exists in traditional reactive BGP systems.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of poisoned AS path entries that act as mediators between legitimate routes and hijacked routes. These poisoned entries serve as intermediate steps that guide traffic away from hijacked prefixes by presenting themselves as alternative paths with deliberately corrupted AS sequences, causing receiving routers to reject them while steering traffic toward safe alternative routes.
2Adaptability or versatility
If BGP routers maintain detailed routing tables with multiple paths, then routing flexibility and alternative path availability are improved, but the complexity of detecting and managing hijacked routes increases
Solution Approach 1:
The patent applies segmentation by dividing the routing table into distinct segments: normal routing entries and poison path entries. This segmentation allows the system to maintain comprehensive routing information while isolating the complex poison path management logic into a separate, manageable structure. The poisoned AS path entries are organized as distinct segments that can be independently processed and managed without affecting the overall routing table complexity.
Solution Approach 2:
The patent utilizes parameter changes by modifying the AS path attribute of routing entries to create poisoned paths. By deliberately altering the AS sequence parameters (adding fictitious AS numbers or changing existing ones), the system transforms legitimate routing entries into poisoned entries that serve as protective measures. This parameter manipulation approach maintains routing table structure while adding security functionality through attribute modification.
3Reliability
If routers implement poison path routing policy to block hijacked routes, then network security against prefix hijacking is improved, but the ability to route traffic through all available paths may be reduced
Solution Approach 1:
The patent applies the blessing in disguise principle by converting the harmful effect of path blocking into a beneficial security feature. The poisoned AS path entries deliberately introduce corrupted routing information that appears harmful (invalid AS sequences) but actually serves the benefit of protecting the network by causing receiving routers to reject hijacked routes. The harm (route invalidation) is transformed into a security benefit (hijacking prevention).
Solution Approach 2:
The patent implements dynamics by making the routing table dynamically adaptable between normal operation and poison path activation. The system continuously monitors for hijacked prefixes and dynamically switches between using standard BGP routing and activated poison paths. This dynamic behavior allows the routing table to maintain optimal traffic routing during normal conditions while automatically transitioning to security-focused poison path routing when threats are detected, preserving both productivity and security.
Data Source
AI summary
In one embodiment a system, method, and related apparatus are described for a router which receives notice of a route including a hijacked prefix having a hijacked prefix netmask length, searches a set of routes with equal or shorter netmask lengths that cover the hijacked prefix in order to find at least one route which has no autonomous system (AS) in common with the particular route comprising the hijacked prefix, if a specific route is found with a netmask length equal to or shorter than the hijacked prefix netmask length, then the specific route which has been found is a determined alternative route, extracts the particular route comprising the hijacked prefix from the specific route if said specific route has a netmask length covering a larger address range than the hijacked prefix netmask length, inserts the determined alternative route in a routing table, and modifies attributes of the determined alternative route in the routing table according to the determined alternative route. Related systems, methods, and apparatus are also described.