Method and apparatus for out of path border gateway protocol validation

1. A method for out of path border gateway protocol (BGP) validation, the method comprising:

receiving, at a first network component of a network from a second network component of a different network, a prefix announcement;

denying, by the first network component, acceptance of the prefix announcement;

sending, via a BGP monitor at the first network component, the prefix announcement to a BGP monitor at an out of path validation controller;

evaluating, at the out of path validation controller, the prefix announcement against one or more validation tests;

sending, by the BGP monitor at the out of path validation controller to the first network component, a validation notification based on a validation score for the one or more validation tests; and

updating, the first network component by the out of path validation controller with the prefix announcement, based on the validation notification being associated with a positive validation.

2. The method of claim 1 , further comprising:

setting the first network component to deny all inbound prefix announcements.

3. The method of claim 1 , further comprising:

retrieving, by the BGP monitor at the first network component, the prefix announcement; and

receiving, by the BGP monitor at the out of path validation controller, the prefix announcement.

4. The method of claim 1 , wherein the evaluation further comprising at least one of:

determining a score for a prefix list validation test;

determining a score for an autonomous system (AS)-path filter validation test;

determining a score for a routing assets database (RADb) validation test;

determining a score for an Internet routing registry (IRR) filter validation test;

determining a score for a maximum prefix validation test;

determining a score for a resource public key infrastructure (RPKI)validation test;

determining a score for secure origin signing validation test;

determining a score for a path security tracking validation test;

determining a score for a topology tracking validation test;

determining a score for a path longevity validation test;

determining a score for a specific route overlap validation test; and

determining a score for a geographic boundary crossings validation test.

5. The method of claim 4 , wherein the evaluation further comprising:

computing the validation score by summing scores from the one or more validation tests.

6. The method of claim 5 , wherein the evaluation further comprising:

comparing the validation score against a security threshold.

7. The method of claim 1 , wherein the updating further comprising:

programming, by the out of path validation controller, the first network component with the prefix announcement for a positive validation notification.

8. The method of claim 7 , wherein a local routing information base of the first network component is programmed by the out of path validation controller with the prefix announcement for a positive validation notification.

9. A system for out of path border gateway protocol (BGP) validation, the system comprising:

a non-route path server including a BGP monitor; and

a first physical router including a BGP monitor, wherein the first physical router being in a network and is configured to receive inbound prefix announcements from a second router in a different network and deny acceptance of the inbound prefix announcements, wherein the BGP monitor of the first physical router configured to retrieve and send the inbound prefix announcements to the BGP monitor of the non-route path server, and wherein the non-route path server is configured to:

validate the inbound prefix announcements by comparing a validation score with a threshold, where the validation score is based on a plurality of route path tests applied to the inbound prefix announcements;

send, via the BGP monitor of the non-route path server to the first physical router, a validation notification in response to the comparing; and

program the first physical router with a validated inbound prefix announcement of the inbound prefix announcements based on the validation notification being associated with a positive validation.

10. The system of claim 9 , wherein the plurality of route path tests include at least a prefix list validation test, an autonomous system (AS)-path filter validation test, a routing assets database (RADb) validation test, an Internet routing registry (IRR) filter validation test, a maximum prefix validation test, a resource public key infrastructure (RPKI)validation test, a secure origin signing validation test, a path security tracking validation test, a topology tracking validation test, a path longevity validation test, a specific route overlap validation test, and a geographic boundary crossings validation test.

11. The system of claim 9 , wherein the threshold is configurable to provide multiple levels of security.

12. The system of claim 9 , wherein the first physical router includes a local routing information base which is programmed by the non-route path server.

13. The system of claim 9 , wherein the first physical router includes a pre-policy routing information base IN module which is set to deny acceptance of the inbound prefix announcements.

14. A method for out of path border gateway protocol (BGP) validation, the method comprising:

receiving, at a BGP monitor at an out of path server from a BGP monitor at a first router of a network, a denied inbound prefix announcement sent via a BGP monitoring protocol, wherein the denied inbound prefix announcement is an inbound prefix announcement received by the first router from a second router of a different network and being denied acceptance by the first router;

computing, at the out of path server, a validation score for the denied inbound prefix announcement by applying a plurality of validation tests to the denied inbound prefix announcement;

comparing, at the out of path server, the validation score against a security threshold;

sending, by the BGP monitor at the out of path server to the first router, a validation notification in response to the comparing; and

programming, by the out of path server, the first router with the denied inbound prefix announcement based on the validation notification being associated with a positive validation.

15. The method of claim 14 , further comprising:

setting the first router to deny all inbound prefix announcements.

16. The method of claim 15 , wherein a local routing information base of the first router is programmed by the out of path server with the denied inbound prefix announcement for a positive validation.

17. The method of claim 14 , wherein the plurality of validation tests include at least a prefix list validation test, an autonomous system (AS)-path filter validation test, a routing assets database (RADb) validation test, an Internet routing registry (IRR) filter validation test, a maximum prefix validation test, a resource public key infrastructure (RPKI)validation test, a secure origin signing validation test, a path security tracking validation test, a topology tracking validation test, a path longevity validation test, a specific route overlap validation test, and a geographic boundary crossings validation test.

18. The method of claim 17 , wherein the computing further comprising:

computing a score for each of the plurality of validation tests.

19. The method of claim 17 , wherein at least some of the plurality of validation tests have a scoring weight different than unity.

20. The method of claim 14 , wherein the security threshold is a configurable multi-level security setting.