Method for defending border gateway protocol prefix hijacking attack

Abstract

The invention discloses a method for defending border gateway protocol prefix hijacking attack. Firstly, a layered dispatching system is structured according to IP (Internet Protocol) prefix and AS numbers to assign PKIs (Public Key Infrastructures), and two types of the PKIs based on the IP prefix and the AS number are assigned; the two types of PKIs respectively comprise IP prefix assignment certification and AS number assignment certification; the PKI is updated according to the assignment and revocation of the IP prefix and the AS number; the assignment of the PKI adopts the method that an ISP (Internet Service Provider) builds a assignment library; and when the IP prefix and announce messages of AS reach a router, verification is performed, a public key is validated firstly, then an assignment certificate and connectivity are validated, and the accreditation of the IP prefix or the AS number is validated. The method can protect an inter-domain routing system from the attacking of prefix hijacking, IP subnetwork prefix hijacking and particularly upper layer ISP prefix hijacking, and simultaneously can effectively prevent IP prefix AS path hijacking and IP subnetwork prefix AS path hijacking.

Description

technical field [0001] The present invention relates to the technical field of computer network, in particular to a public key infrastructure (PKI-Public Key Infrastructure) based on IP (Internet Protocol) prefix and autonomous system (Autonomous System) number assignment relationship, which can effectively prevent BGP prefix hijacking attacks . Background technique [0002] BGP (Border Gateway Protocol-Border Gateway Protocol), as an inter-domain routing protocol commonly used on the global Internet, plays a vital role in providing and maintaining Internet connectivity. However, the security capabilities of the BGP routing protocol are limited. The communication between BGP peer entities lacks basic authentication and authorization mechanisms, and the routing information transmitted between entities cannot be protected. It is very vulnerable to many malicious attacks. In particular, the prefix hijacking attack is particularly harmful, which will cause turbulence on the glo...

AI Technical Summary

Problems solved by technology

But a more important aspect is: existing security solutions, such as attack detection mechanisms, cannot prevent the occurrence of IP prefix hijacking

However, the attack prevention mechanism can only prevent hijacking of one or several IP prefixes, and has the disadvantage of incomplete security protection, especially in the current system of distributing PKI according to the distribution level of IP prefixes and AS numbers, the upper-level ISP includes the PKI of the lower-level ISP Authentication certificates, leading to upper-layer ISP prefix hijacking, and path hijacking due to the inability of existing PKI to authenticate connectivity, both of which cannot be well prevented

Images