1Shadow IP Route Caching for Trusted Internet Routing

Abstract—Routers forward IP packets based on the desti-nation address lookup guided by the longest prefix matching algorithm. Destination address of each IP packet is com-pared against all the prefixes in routing table and the packet is forwarded to a next hop port (NHP) associated with the longest of all matched prefixes. A wide scale effort is on to provide fast address lookup schemes for routing pack-ets at wire speeds. The set of prefixes in a routing table is obtained by aggregation of all routes gathered by backbone router guided by the border gateway protocol (BGP). An an-nouncement of a false route by an autonomous system (AS) results in an undesired prefix, or an unwarranted NHP for a prefix in the routing table. Such announcement of a false route can occur due to an operational fault or an external malicious (intentional) attack. Packets forwarded based on such false routing information will either be dropped, or for-warded to a node predetermined by the external attacker, or can be made to constantly circulate between a set of nodes thus creating an explosion in traffic for the nodes. Our past work includes both hardware and software based efficient address lookup mechanisms. This paper introduces shadow route caching, a mechanism to detect and avoid forwarding packets to bogus routes. Our scheme enables the fast ad-dress lookup mechanisms to perform intelligent packet for-warding to provide a trusted Internet routing environment. I