# Enhancing Border Gateway Protocol Security Using Public Blockchain
## 3 Design
### Operations  
In the section above, we say that architecture consists of a set of smart contracts. It allows entities to manage their prefixes and subconfigurations. Also, it decreases the risk of the spread of prefixes with false origin. It allows the router to advert prefixes with its AS if they are in fact owned by its AS. There are three types of smart contracts:  
1. BGP Prefixes Manager Contract (BGPPMC) is the leading smart contract that is common to all participants. It is built by the central authority of IANA. It keeps ROA entries and subconfigurations of routers in the one place. Figure 3: Management sequence diagram. RIR contract is designed for Regional Internet registry. It is responsible for allocation of IP prefixes and create smart contracts to LIR. * LIR contract is intended for local/national Internet registry. They lease prefixes with the right to create ROA entries that are bound on their resources. RIR add/del prefix starts with a smart contract receiving a request to add/del a prefix. It contains fields such as prefix and mask. These operations describe the process of allocation/deallocation prefixes. RIR createLIRContract request obtains fields such as the public address of LIR wallet, name LIR and array of prefixes. It verifies if there is already created a smart contract for LIR address. If successful, a prefixes verification process is performed. This process searches if some of the prefixes are already assigned to LIR. Finally, it checks if all prefixes are in the pool of allocated prefixes. If this process is successful, it is created a LIR smart contract. The RIR, that initialized create operation is notified of the result and obtains the address of LIR smart contract. The operation is logged to the blockchain. LIR isPrefixMe operation verifies if the prefix is allocated for LIR smart contract. It ensures that LIR can not create ROA entry with prefix which is not allocated for it. LIR setROA/removeROA/addISP are operations which call external functions of BGPPMC smart contract. BGPPMC addROA starts with smart contract receiving a request from LIR smart contract. The request contains arguments such as AS number, prefix, max length of the prefix and validity period. It subsequently validates format of the IP prefix. If successful, it is performed to verification if there is ROA entry for the prefix. Once found of the ROA entry, the process is failed, otherwise network mask and max length of the prefix are compared. If the mask is less than or equal to the max length, it finally verifies if the prefix is owned by LIR. After a successful verification process, the new ROA record is created and the record validity period is set. The action is also logged to the blockchain. BGPPMC delROA is a reversal operation with one change. The argument of the validity period is left out. BGPPMC getROA request contains arguments such as prefix and AS number. Result of the request obtains ROA entry for the IP prefix. BGPPMC addISP operation adds the new ISP to ACL. It has arguments such as AS number and public address of the ISP wallet. BGPPMC addDeviceConfiguration request contains field such as AS number, ID router and an array of prefixes. It adds new subconfiguration for the router to the blockchain if the verification process is successful. At first, it checks if the IP prefix matches with some record of ACL. If successful, the verification of the AS number is performed. It verifies if the source address of request leases the AS number. Finally, it searches a valid ROA entry for the IP prefix. If ROA entry exists, subconfiguration will be added to the blockchain. The affected router is notified of the new subconfiguration and operation is also logged. The data structure of the subconfiguration is shown in Figure 4. BGPPMC delDeviceConfiguration is a reversal operation with one changed. It omits argument with an array of prefixes. Arguments for BGPPMC getDeviceConfiguration are AS number and ID router. This operation reads current subconfiguration for the ID router, and the result is sent to the request.