Granted Patent B2

US 12,335,336 · App. 17/739,875 · Granted Jun 17, 2025

Inventors: Earl Edward Zmijewski (West Lebanon, NH); Douglas Madory (Lebanon, NH); Alexandr Sergeyev (Bedford, NH)

Assignee: Oracle International Corporation

H04L67/104H04L45/033H04L45/04H04L63/1416H04L63/1466H04L45/02

Abstract

Claims (87)

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:

identifying a plurality of prefixes in a border gateway protocol (BGP) update;

determining a particular prefix from among the plurality of prefixes includes one or more private Autonomous System Numbers (ASNs) at a beginning of the particular prefix; and

determining the particular prefix is a potential routing hijack by:

identifying one or more private ASNs at the beginning of the particular prefix;

identifying a next ASN, in the particular prefix, subsequent to the one or more private ASNs;

identifying an origin associated with the next ASN; and

responsive to determining that the origin is a new origin, reporting the particular prefix as a potential routing hijack,

wherein determining that the origin is the new origin comprises determining the origin has not been the origin of any prefix included in any BGP update within a predetermined historical time period.

2. The non-transitory computer readable medium of claim 1 , wherein identifying the next ASN comprises:

traversing the particular prefix from the beginning until an instance of a non-private ASN is identified; and

identifying the instance of the non-private ASN as the next ASN.

3. The non-transitory computer readable medium of claim 1 , wherein reporting the particular prefix as a potential routing hijack is further based on determining the particular prefix is not an RFC1918 prefix.

4. The non-transitory computer readable medium of claim 1 , wherein reporting the particular prefix as a potential routing hijack is further based on:

determining the particular prefix is a Multi-Originated AS (MOAS) prefix; and

the new origin is seen by a number of peers less than a threshold number of peers.

5. The non-transitory computer readable medium of claim 1 , wherein reporting the particular prefix as a potential routing hijack is further based on:

determining the particular prefix does not have a BGP relationship with any origin older than the new origin.

6. The non-transitory computer readable medium of claim 1 , wherein reporting the particular prefix as a potential routing hijack is further based on:

determining the particular prefix was announced by the new origin for an organization; and

the new origin did not previously announce at least one other prefix for the organization.

7. The non-transitory computer readable medium of claim 1 , wherein reporting the particular prefix as a potential routing hijack is further based on:

determining the particular prefix is not associated with a covering prefix originated by the new origin.

8. The non-transitory computer readable medium of claim 1 , wherein identifying the next ASN comprises:

removing from the particular prefix the one or more private ASNs at the beginning of the particular prefix;

subsequent to removing the one or more private ASNs: generating a modified particular prefix such that the next ASN is now at the beginning of the modified particular prefix; and

identifying the next ASN at the beginning of the modified particular prefix.

9. The non-transitory computer readable medium of claim 8 , wherein the operations further comprise:

determining at least one ASN preceding the next ASN in the particular prefix is a single-digit ASN,

wherein generating the modified particular prefix comprises removing the single-digit ASN from the particular prefix.

10. A method, comprising:

identifying a plurality of prefixes in a border gateway protocol (BGP) update;

determining a particular prefix from among the plurality of prefixes includes one or more private Autonomous System Numbers (ASNs) at a beginning of the particular prefix;

determining the particular prefix is a potential routing hijack by:

identifying one or more private ASNs at the beginning of the particular prefix;

identifying a next ASN, in the particular prefix, subsequent to the one or more private ASNs;

identifying an origin associated with the next ASN; and

responsive to determining that the origin is a new origin, reporting the particular prefix as a potential routing hijack,

wherein determining that the origin is the new origin comprises determining the origin has not been the origin of any prefix included in any BGP update within a predetermined historical time period.

11. The method of claim 10 , wherein identifying the next ASN comprises:

traversing the particular prefix from the beginning until an instance of a non-private ASN is identified; and

identifying the instance of the non-private ASN as the next ASN.

12. The method of claim 10 , wherein reporting the particular prefix as a potential routing hijack is further based on determining the particular prefix is not an RFC1918 prefix.

13. The method of claim 10 , wherein reporting the particular prefix as a potential routing hijack is further based on:

determining the particular prefix is a Multi-Originated AS (MOAS) prefix; and

the new origin is seen by a number of peers less than a threshold number of peers.

14. The method of claim 10 , wherein reporting the particular prefix as a potential routing hijack is further based on:

determining the particular prefix does not have a BGP relationship with any origin older than the new origin.

15. The method of claim 10 , wherein reporting the particular prefix as a potential routing hijack is further based on:

determining the particular prefix was announced by the new origin for an organization; and

the new origin did not previously announce at least one other prefix for the organization.

16. The method of claim 10 , wherein identifying the next ASN comprises:

removing from the particular prefix the one or more private ASNs at the beginning of the particular prefix;

subsequent to removing the one or more private ASNs: generating a modified particular prefix such that the next ASN is now at the beginning of the modified particular prefix; and

identifying the next ASN at the beginning of the modified particular prefix.

17. The method of claim 16 , further comprising:

determining at least one ASN preceding the next ASN in the particular prefix is a single-digit ASN,

wherein generating the modified particular prefix comprises removing the single-digit ASN from the particular prefix.

18. A system comprising:

one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the system to perform:

identifying a plurality of prefixes in a border gateway protocol (BGP) update;

determining a particular prefix from among the plurality of prefixes includes one or more private Autonomous System Numbers (ASNs) at a beginning of the particular prefix; and

determining the particular prefix is a potential routing hijack by:

identifying one or more private ASNs at the beginning of the particular prefix;

identifying a next ASN, in the particular prefix, subsequent to the one or more private ASNs;

identifying an origin associated with the next ASN; and

responsive to determining that the origin is a new origin, reporting the particular prefix as a potential routing hijack,

wherein determining that the origin is the new origin comprises determining the origin has not been the origin of any prefix included in any BGP update within a predetermined historical time period.

19. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:

identifying a plurality of prefixes in a border gateway protocol (BGP) update;

determining a particular prefix from among the plurality of prefixes includes one or more private Autonomous System Numbers (ASNs) at a beginning of the particular prefix; and

determining the particular prefix is a potential routing hijack by:

identifying one or more private ASNs at the beginning of the particular prefix;

identifying a next ASN, in the particular prefix, subsequent to the one or more private ASNs;

identifying an origin associated with the next ASN at least by:

traversing the particular prefix from the beginning until an instance of a non-private ASN is identified; and

identifying the instance of the non-private ASN as the next ASN; and

responsive to determining that the origin is a new origin, reporting the particular prefix as a potential routing hijack.

20. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:

identifying a plurality of prefixes in a border gateway protocol (BGP) update;

determining a particular prefix from among the plurality of prefixes includes one or more private Autonomous System Numbers (ASNs) at a beginning of the particular prefix; and

determining the particular prefix is a potential routing hijack by:

identifying one or more private ASNs at the beginning of the particular prefix;

identifying a next ASN, in the particular prefix, subsequent to the one or more private ASNs;

identifying an origin associated with the next ASN; and

responsive to determining that the origin is a new origin, reporting the particular prefix as a potential routing hijack,

wherein reporting the particular prefix as a potential routing hijack is further based on determining the particular prefix is not an RFC1918 prefix.

Assignments (1)

Continuity (3)

References Cited (21)