# SD-BROV: An Enhanced BGP Hijacking Protection with Route Validation in Software-Defined eXchange
###### Abstract  
In global networks, Border Gateway Protocol (BGP) is widely used in exchanging routing information. While the original design of BGP did not focus on security protection against deliberate or accidental errors regarding to routing disruption, one of fundamental vulnerabilities in BGP is a lack of insurance in validating authority for announcing network layer reachability. Therefore, a distributed repository system known as Resource Public Key Infrastructure (RPKI) has been utilized to mitigate this issue. However, such a validation requires further deployment steps for Autonomous System (AS), and it might cause performance and compatibility problems in legacy network infrastructure. Nevertheless, with recent advancements in network innovation, some traditional networks are planning to be restructured with Software-Defined Networking (SDN) technology for gaining more benefits. By using SDN, Internet eXchange Point (IXP) is able to enhance its capability of management by applying softwarized control methods, acting as a Software-Defined eXchange (SDX) center to handle numerous advertisement adaptively. To use the SDN method to strengthen routing security of IXP, this paper proposed an alternative SDX development, SD-BROV, an SDX-based BGP Route Origin Validation mechanism that establishes a flexible route exchange scenario with RPKI validation. The validating application built in the SDN controller is capable of investigating received routing information. It aims to support hybrid SDN environments and help non-SDN BGP neighbors to get trusted routes and drop suspicious ones in transition. To verify proposed idea with emulated environment, the proof-of-concept development is deployed on SDN testbed running over Research and Education Networks (RENs). During BGP hijacking experiment, the results show that developed SD-BROV is able to detect and stop legitimate traffic to be redirected by attacker, making approach to secure traffic forwarding on BGP routers. SDN; BGP; route validation +
Footnote †: journal: Future Internet  
To mitigate the above issues, the Secure Inter-Domain Routing (SIDR) Working Group of IETF has proposed a distributed repository system known as the Resource Public Key Infrastructure (RPKI [3]), maintaining the allocation of IP address with AS Number (ASN) for improving BGP security [4]. The data in RPKI repository can be referenced by routers to draw conclusions about the validity of route advertisement, ensuring they only accept announcements of prefixes with authentic original ASes. Consequently, the decision made by BGP Routing Information Base (RIB) should be reflected at the Forwarding Information Base (FIB) as well for finding proper mitigation of abnormal situations. However, some mechanisms are already in use to provide BGP route validation, the advertisement verification is still not well described as to whether an AS is qualified to make an announcement for certain IP prefixes or not. If there is a way to engage route validation more easily, the route exchange progress among ASes could be more security and adaptation. For enhancing the controllability of network, recently, there is a trend to restructure traditional network architecture to Software-Defined Networking (SDN [5]) one for gaining more benefits from flexibility in both data plane and control plane. SDN has several advantages [6], such as supporting self-assurance to minimize the complication of statical defined network, improving capability of hastening the delivery of new networking applications and services, simplifying the provisioning and management of network resources, and unlocking new potential in cross-domain traffic delivery. By applying SDN on WAN, network engineers are able to efficiently make use of bandwidth and ensure performance levels for critical applications without sacrificing security or data privacy.