Inter-Domain Source Address Validation With Direct AS Entry Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing inter-domain source address validation schemes incur significant communication overheads and are inefficient due to the need to validate source addresses across multiple autonomous systems, and existing solutions fail to address these challenges.
Innovation Solution
A method where a network device obtains validation information from a first network device to a second network device, a first network device, reduces communication overheads by sending validation information to a second network device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If source address validation is performed across multiple autonomous systems using existing schemes, then source address spoofing attacks can be prevented, but communication overheads increase significantly
Solution Approach 1:
The patent extracts and separates the validation information dissemination process from the traditional hop-by-hop forwarding approach. Instead of validating at every AS along the path, the solution extracts only the essential validation information (source address, valid incoming interface) and disseminates it directly to the destination AS, eliminating redundant validation communications along the path.
Solution Approach 2:
The patent implements preliminary action by pre-establishing validation information in the destination AS before actual packet validation occurs. The destination AS proactively obtains validation information from the source AS or intermediate ASes, so that when packets arrive, validation can be performed immediately without real-time communication overhead.
2Reliability
If validation information is sent to all ASs on the path from first AS to second AS, then complete validation coverage is achieved, but communication overheads increase
Solution Approach 1:
The patent extracts the critical validation information from the complete path validation process. Instead of sending validation information to every AS along the path, it extracts only the necessary information (source address, valid incoming interface identification) and sends it directly to the destination AS, achieving validation coverage without the communication overhead of path-wide dissemination.
Solution Approach 2:
The patent changes the dimension of validation information dissemination from a linear path-based approach (sending to each AS sequentially along the path) to a direct destination-based approach (sending directly to the destination AS). This dimensional change eliminates redundant transmissions to intermediate ASes while maintaining validation effectiveness.
3Reliability
If distributed source address validation is performed across many autonomous systems, then source address spoofing can be detected, but calculation overheads increase
Solution Approach 1:
The patent extracts the essential validation logic from the distributed validation process. Instead of requiring each AS to perform complex validation calculations, it extracts the core validation data (source address and valid incoming interface) and delivers it to the destination AS, which then performs the validation using simple comparison operations, significantly reducing calculation overheads across the network.
Data Source
AI summary
This application discloses a validation information sending method, a validation entry obtaining method, an apparatus, and a device. A first network device in a first AS serving as an origin autonomous system AS obtains validation information corresponding to the first AS and a neighbor AS corresponding to a second AS used for validation, where the neighbor AS is a previous-hop AS of the second AS in a direction from the first AS to the second AS. The first network device sends the validation information and the neighbor AS to the second AS, and the validation AS obtains a validation entry based on the validation information and the neighbor AS, and performs validation on a source address of a received service packet based on the validation entry.