Research has shown that the Border Gateway Protocol (BGP) is vulnerable to a new attack that exploits the community attribute. These community attacks can influence BGP routing in unintended ways. Currently, there are no effective mitigations against these attacks which do not limit the normal usage of BGP communities or offer cryptographic authorization of community values. In this thesis, we are the first to design and evaluate a new Resource Public Key Infrastructure (RPKI) object that provides these properties, called a Route Community Authorization (RCA). Autonomous Systems (ASes) can sign and upload an RCA that includes which communities are authorized to be used and under which conditions to reduce the attack surface. The approach does not alter BGP itself and ASes that deploy the security solution can verify if route announcements with community values are allowed to use those communities. With the RPKI construction of our solution, cryptographic operations are offloaded from the router to a separate server. This is because most BGP routers deployed on the internet are not capable yet of performing cryptographic operations on every announcement.

We simulate attack scenarios and evaluate the developed solution to see if it is a viable option to be deployed on the internet. The results show that the developed solution can block the community attacks, on the condition that ASes have properly configured the RCA and at least the target, or an AS between the attacker and the target, deploys the solution. If ASes configure the RCAs too broad, then there is still room for an attacker to abuse the community values. We show that the performance of the solution using properly configured RCAs can keep up with the rate of announcements seen on the internet. Since experiments were performed in simulations, additional experiments are needed in the future on hardware routers and by ASes on the internet to see if the results are the same. The biggest issue for the developed solution is the initial adoption by ASes since security benefits are low in the beginning, but increase once more ASes participate.

Once deployed BGP routers can handle cryptographic operations on every announcement, we suggest using BGPsec and extending it to include the community attribute. Using a BGPsec approach will improve security and provide integrity of the community attribute, which RCA does not provide.

The internet consists of many networks connected by the BGP protocol and can easily be manipulated by a hacker. Every day, hackers reroute internet traffic and use that to impersonate entities such as companies, devices and humans. To detect this rerouting, which is also know as a route leak, a BGP monitor can be used. A BGP monitor checks whether the local route is correct by comparing the local route to the route from hundreds of devices. The lower the percentage of the routes that are the same, the bigger the chance there is a route leak. Hence, a user can tell whether a hacker manipulated the route. This project aims to build a BGP monitor application, that will ease the process of finding whether a hacker rerouted a part of the internet. To achieve this, the Internet Monitor application has been developed. In the Internet Monitor, an admin can add different types of tasks that will be run by the devices. This input will then be transmitted to the backend and to the database, where they will be stored. After some time, the backend will send out the tasks to the nodes. The nodes will execute the task and send back the results to the backend. These results can then be used to check whether the information from BGP servers or the local result is the same, and thus not manipulated. Apart from this, Internet Monitor also offers the possibility to see the map of all the real-time traffic between devices.