Amazon Technologies, Inc.

Jonathan Phillibert

Thomas Bradley Scholl

Kushal Mall

Eric Andrew Rubin-Smith

Michael W Palladino

Bobby Brown

Gaston Keller

Michael Marano

Andrew Lee Newton

Mario Souza

Samuel Kenney

Jun Sung Park

Technologies are disclosed for mitigating attempts to capture traffic on a network using unauthorized advertisements. Responsive to detecting an authorized advertisement for a path to a service on the network, a mitigation/orchestration service may determine a synthetic route advertisement that is configured to win back the captured traffic (e.g., by providing a route specificity that is at least equal to the unauthorized advertisement) and propagate the synthetic route advertisement from routers in the network. The won back traffic may be directed through a backbone of the network to the service.

Route hijack mitigation

In a computer networking system, data is transmitted through a network based on advertised routes. The disclosure provides mechanisms for detecting anomalies in network routing by analyzing autonomous system (AS) paths in data corresponding to Border Gateway Protocol (BPG) messages. The AS path information from the BGP message data may be evaluated to detect different types of anomalies, which may be reported to a management entity for further review or mitigation.

Network routing anomaly detection

A caching sub-system downloads and authenticates Resource Public Key Infrastructure (RPKI) cryptographically signed Route Origin Authorizations (ROAs) from a plurality of repositories, forming a VRP set for each repository. When the caching sub-system determines that the VRP count of a VRP set drops to or below a threshold, it substitutes in a last known valid VRP set. A route validating sub-system downloads route information data from one or more global routing tables and calculates the number of valid routes, the number of unknown routes and the number of invalid routes. When the number of valid routes drops to or below a threshold, the route validating sub-system sets an alarm to stop the distribution of VRPs to one or more group of pre-determined routers.

Resource public key infrastructure (RPKI) validation system

Growing community of inventors

Seattle, WA, United States of America

Jonathan Phillibert