Toward Practical Inter-Domain Source Address Validation

doi:10.1109/TNET.2024.3377116

Toward Practical Inter-Domain Source Address Validation

2024-08-01

1

PRE

AI

DOI：10.1109/TNET.2024.3377116

Original

Original request for help

Save

Abstract

En 中文

The Internet Protocol (IP) is the most fundamental building block of the Internet. However, it provides no explicit notion of packet-level authenticity. Such a weakness allows malicious actors to spoof IP packet headers and launch a wide variety of attacks. Meanwhile, the highly decentralized management of Internet infrastructure makes large-scale source address validation challenging in terms of overhead, validity, and flexibility. This paper presents a practical anti-spoofing approach, Source Address Validation Architecture eXternal (SAVA-X). SAVA-X introduces the concept of Address Domain to enable address validation in finer, prefix-level granularity. The address domains are organized in nested hierarchies to provide higher scalability and lower maintenance costs for partial deployment. We implement SAVA-X on commercial backbone routers and the P4 platform. The experiments indicate that the hardware implementation of SAVA-X can achieve 98% throughput on 100 Gbps links and close to the native IP forwarding in per-packet overhead, with less than 10 microseconds additional processing latency.

Keywords:

Network security

source address validation

hierarchical validation

Toward Practical Inter-Domain Source Address Validation

Abstract

Journal

Organization