Source Address Validation Lists for Asymmetric Routing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing edge network devices struggle with accurate source address validation due to asymmetric routing, leading to valid packets being identified as invalid, particularly in autonomous systems with cross-domain multi-homing and internet access types.
Innovation Solution
A method for generating a source address validation list based on IP address prefixes and access types, using blocklists and allowlists to validate packets, and an apparatus for obtaining and sending advertisement packets to ensure accurate and trustworthy validation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If unicast reverse path forwarding (URPF) is used for source address validation, then packet security is improved, but valid packets are incorrectly identified as invalid due to asymmetric routing
Solution Approach 1:
The patent segments the source address validation process by creating separate validation lists for different access types (cross-domain multi-homing, internet access, single-homing, complete multi-homing). Each list contains IP address prefixes appropriate for that specific access type, allowing packets to be validated against the correct list based on their access type, thereby resolving the contradiction between security and accuracy.
Solution Approach 2:
The patent applies local quality by making the validation criteria specific to each access type and interface. Instead of using a single universal validation rule, the system configures different source address validation lists with different IP address prefixes for different external interfaces and access types, ensuring that validation is locally optimized for each network context.
2Reliability
If source address validation is performed on all packets, then network security is improved, but operational complexity increases
Solution Approach 1:
The patent introduces dynamics by automatically determining the access type of each external interface and dynamically selecting the appropriate source address validation list. The system can adapt to different network configurations and access types without manual intervention, reducing operational complexity while maintaining security.
Solution Approach 2:
The system performs self-service by automatically obtaining IP address prefixes from routing information, determining access types, and configuring appropriate validation lists without requiring manual configuration. This automation reduces the complexity of managing source address validation across multiple interfaces and access types.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
This application discloses a method and apparatus for obtaining a source address validation list, an electronic device, and a storage medium, and pertains to the field of network technologies. In this method, an edge network device in an autonomous domain obtains an IP address prefix owned by an external network connected to the autonomous domain, so that the source address validation list can be obtained based on the obtained IP address prefix and an access type of the external network.