ROV++: Improved Deployable Defense against BGP Hijacking

Abstract

We study and extend Route Origin Validation (ROV), the basis for the IETF defenses of interdomain routing. We focus on two important hijack attacks: subprefix hijacks and non-routed prefix hijacks. For both attacks, we show that, with partial deployment, ROV provides disappointing security benefits. We also present a new attack, superprefix hijacks, which completely circumvent ROV's defense for non-routed prefix hijacks.