Route blocking is a newly emerged category of routing threats following the Russia-Ukraine conflict. Unlike conventional routing threats, route blocking constitutes targeted, large-scale network-layer obstruction between regions or even nations, typically affecting extensive areas at regional or national levels. The damage caused by route blocking extends beyond economic losses, potentially triggering political or social instability, thus necessitating effective security measures. However, the vast scope of route blocking poses a challenge to comprehensively analyzing its impact on the real-world Internet. Furthermore, conducting route blocking experiments on the real-world Internet incurs prohibitively high costs and raises a series of ethical concerns. Consequently, conducting an in-depth security analysis becomes difficult, and validating the effectiveness of designed defense measures becomes even more challenging.

To design and validate effective countermeasures against route blocking, this paper proposes SimBlock, a fine-grained global Internet route blocking simulation and detection system that analyzes the characteristic patterns of route blocking through simulation to provide a foundation for security measure design and validation. SimBlock comprises four modules: (1) global Internet topology construction using open third-party topology data, (2) global Internet routing simulation on the established topology, (3) route blocking simulation implementing various blocking techniques based on the designed routing algorithm, and (4) route blocking detection and identification through characteristic analysis. SimBlock is capable of simulating both autonomous system (AS)-level and router-level paths between arbitrary IP addresses. The system additionally supports the simulation of point-to-point packet transmission, ping probing, and traceroute probing, while enabling the granular simulation of dynamic network conditions, including congestion and failures. SimBlock demonstrates comprehensive simulation capabilities of at least five fundamental route blocking methods: DDoS attacks, IP blocking, physical blocking, route hijacking, and business relationship termination. Building upon this foundation, the system has successfully validated a route blocking detection and identification algorithm based on distributed prober triplets, delivering robust security measures to mitigate potential route blocking threats.

This paper conducts extensive experiments to validate the effectiveness of SimBlock. The experimental results demonstrate that: (1) even with 47.65% of the routers lacking valid IP addresses in the dataset, SimBlock can simulate valid AS/router-level paths with a 98.94% success rate, proving that the constructed global Internet topology maintains high coverage and excellent connectivity; (2) without prior knowledge of specific AS-routing policies, the AS-level paths simulated by SimBlock achieve an average 61.00% similarity with real-world traceroute paths (reaching over 80% similarity in 16.21% of cases), while the router-level paths maintain an average 42.44% similarity (exceeding 70% in 7.40% of cases) despite 47.65% missing router IPs, confirming that the simulation algorithm accurately captures overall routing trends; (3) for Internet topologies containing over 70, 000 AS nodes, SimBlock maintains millisecond-level latency in AS-level path simulation and handles router-level simulation for approximately 60 million nodes with second-level latency, demonstrating exceptional efficiency in large-scale Internet data processing; (4) across various victim-attacker country combinations, the detection algorithm of SimBlock reliably distinguishes route blocking from normal network failures, and its identification algorithm effectively differentiates between various blocking techniques, validating the effectiveness and universality of the system.

In summary, SimBlock provides an effective solution for in-depth analysis of route blocking, while also offering an effective security measure to counter the potential threats posed by route blocking.

Internet is an important infrastructure that has been evolving for decades. Border gateway protocol (BGP) is the de facto interdomain routing protocol on the internet and connects autonomous systems (ASes) around the world. The BGP uses internet number resources (INR), including internet protocol (IP) prefixes and autonomous system numbers for addressing and routing. However, BGP has been vulnerable to the INR misusage threat recently, which causes a common type of anomaly called prefix hijacking. In prefix hijacking, a malicious AS originates the victim AS's prefixes to blackhole or intercept the victim's data traffic. The existing security solution, called resource public key infrastructure (RPKI), provides INR ownership and prefix-to-AS mapping information through a centralized infrastructure. ASes can extract and use the information from RPKI to prevent prefix hijacking. However, this solution has three typical drawbacks. First, the centralized architecture of RPKI causes single-point failures. Second, to obtain consistent INR information from RPKI, ASes need a long convergence time owing to the disorderly distribution of information. Third, ASes incur high interaction cost for extracting real-time INR information frequently.

To solve the above mentioned shortcomings, this study proposes a decentralized internet number resource management system (DINRMS) based on blockchain technology. The proposed system adopts a hierarchical architecture consisting of an autonomy layer and an arbitration layer. DINRMS partitions all ASes on the internet into groups that form the autonomy layer. The arbitration layer comprises the Internet Assigned Numbers Authority, five Regional Internet Registries and representatives elected by each group in the autonomy layer. Each entity in DINRMS has nearly the same impact on the system and the single-point failure of an entity does not lead to a serious global breakdown. The architecture of the proposed system overcomes the poor scalability of blockchain technology, which cannot be applied to efficient global INR information management on the internet. A blockchain is maintained within each group to record the INR ownership and prefix-to-AS mapping information of the respective groups. Entities within a group use information from third parties, such as the Whois Lookup tool, to check the consistency of INR ownership information. For prefix-to-AS mapping information, entities within a group use routing data from public route collectors to check the consistency and then vote on the legitimacy of the information. Subsequently, the entities judge the legitimacy of the information according to the majority rule. The arbitration layer maintains the global INR ownership information in the form of group granularity and prefix-to-AS mapping information. This information is sourced from representatives elected by each group in the autonomy layer for mutual supervision and endorsement. The arbitration layer is responsible for arbitrating usage conflicts related to INR. The DINRMS proposes a heuristic INR information push mechanism based on the architecture and dynamics of INR information. The mechanism decides to push INR information to ASes if a long time has passed since the last information push or if many information items have not been pushed.

Experiments results show that DINRMS provides secure and trusted INR information for interdomain routing. In addition, the degree of centralization of DINRMS is 60% less than that of RPKI in terms of the Gini coefficient. Moreover, DINRMS reduces the convergence time and interaction overhead by more than 50%.

DINRMS manages INRs based on blockchain technology using a decentralized approach. The hierarchical and grouping architecture of DINRMS improves system scalability. The efficient push mechanism based on the dynamics of INR information shortens the convergence time and reduces the interaction overhead for ASes to obtain consistent INR ownership and mapping information.