A method of srv6-based inter-domain source address verification

Abstract

The present invention relates to a method for SRv6-based inter-domain source address verification, which is characterized in that it comprises the following steps: 1) enabling SRv6 in each trusted AS domain in the network and all source address verification nodes preset in the backbone network , and determine the relevant information of the SRH extension header used for source address verification when communicating between each AS domain and the backbone network; 2) The trusted AS domain adds the SRH extension header to the IPv6 header of the data packet to be protected After that, it is forwarded to the backbone network, and the source address verification node in the backbone network performs source address verification services. The invention uses the SRv6 technology to introduce the message that needs to be verified into the node that can provide the verification service, and can solve the problem of inter-domain source address forgery without changing the existing network structure. Therefore, it can be widely used in the field of Internet technology.

Description

Technical field[0001]The present invention belongs to the field of Internet technology, involving SRV6 and inter-domain source address verification techniques, especially for a method based on SRV6-based domain source address authentication.Background technique[0002]Access Subsource Address Verification (SAVI) Gets the host packet source IP and its allocation of the host packet source IP and its allocation of the IP address acquired by developing a switch monitoring policy standard. Source address verification. However, the defense of the forged source address attack is dependent on SAVI global deployment based on SAVI implementation.[0003]When using SAVI partial deployment, there will be the following questions:figure 1 As shown, existing SRV6-based domain source address verification schemes, autonomous domains AS1, AS3, and AS4 deploy SAVI, the source address of traffic issued by AS1, AS3, and AS4, but if they When the traffic is not deployed in unspecified area AS2, it is possibl...

AI Technical Summary

Problems solved by technology

[0003] When using SAVI partial deployment, there will be the following problems: such as figure 1 As shown, in the existing SRv6-based inter-domain source address verification scheme, AS1, AS3, and AS4 are all deployed with SAVI, that is, the source addresses of the traffic sent by AS1, AS3, and AS4 are all real, but if the When the traffic passes through the untrusted area AS2 where SAVI is not deployed, it may cause two attacks against AS3

Similarly, for AS3, the attacker AS2 can hide himself and amplify the attack scale

In addition, AS3 cannot determine whether the message passing through the untrusted AS2 has been tampered with

Images