pSAV: A Practical and Decentralized Inter-AS Source Address Validation
pSAV:실 용적 인 분산 식 내부 AS 소스 주소 검증 방법
pSAV: un método práctico de verificación de direcciones de fuentes internas distribuidas
pSAV: une méthode pratique et décentralisée de vérification interne des adresses des sources
pSAV: практичная децентрализованная внутренняя система проверки адресов AS
Jiamin Cao ¹, Ying Liu 刘莹 ¹, Mingxing Liu ¹, Lin He ¹, Yihao Jia ², Fei Yang ²
¹ Institute for Network Sciences and Cyberspace, Tsinghua University
Beijing National Research Center for Information Science and Technology (BNRist)
² Huawei Technologies
2021 IEEE/ACM 29th International Symposium on Quality of Service (IWQOS), 26 August 2021
Source IP address spoofing has been a major vulnerability of the Internet for many years. Although much work has been done to study the problem extensively, spoofing continues to occur frequently and has led to many serious network attacks. Inter-AS source address validation (SAV) is considered an important defense method for AS to filter spoofed packets.
However, existing work has been unable to drive inter-AS SAV deployment into practice due to the lack of deployment incentives and trust foundation.In this paper, we propose a practical and decentralized inter-AS SAV service framework, pSAV, to promote inter-AS SAV deployment. pSAV increases deployment incentives by treating SAV as a payable service and dividing the participant ASes into service subscribers, providers, and auditors. On the control plane, pSAV leverages blockchain as a trust foundation to provide service subscriptions and audits with automatic incentive allocation. On the data plane, pSAV leverages P4-programmable switches to provide flexible and high-performance SAV services.
We prototype the pSAV control plane based on Hyperledger Fabric and implement various SAV techniques on Barefoot Tofino switches. The evaluation results show that (1) on the control plane, pSAV blockchain can provide high-performance service transactions (hundreds of transactions per second with second latency), and (2) on the data plane, pSAV can provide various high-throughput (hundreds of Gbps) SAV services using only one programmable switch.