Source Address Validation Lists for Asymmetric Routing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing edge network devices struggle with accurate source address validation due to asymmetric routing, incorrectly identifying valid packets as invalid when there is a mismatch between the interface corresponding to the source address and the incoming interface in the forwarding information base.

Innovation Solution

A method for generating a source address validation list based on IP address prefixes and access types, using blocklists and allowlists to validate packets, ensuring accurate identification of valid and invalid packets by determining the interface identifiers and IP address prefixes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If unicast reverse path forwarding (URPF) validation is used to filter packets with forged source addresses, then network security is improved, but valid packets are incorrectly identified as invalid due to asymmetric routing

Engineering Contradiction:

Improvesource address validation accuracyVSAvoidpacket validation accuracy

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The validation list is segmented into multiple subsets, each corresponding to a specific network segment or access type. This allows different validation rules to be applied to different packet sources, resolving the contradiction by enabling accurate validation for each segment while accommodating asymmetric routing characteristics of other segments.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different validation strictness levels are applied to different packet sources based on their access types. Packets from directly connected networks undergo strict URPF validation, while packets from networks with known asymmetric routing characteristics undergo relaxed validation or are excluded from validation, thereby maintaining high accuracy for local traffic while avoiding false positives for remote traffic.

Inventive Principle:

Principle #3Local quality

2Reliability

If a comprehensive source address validation list is generated to improve validation coverage, then more invalid packets are blocked, but the complexity of generating and maintaining the validation list increases

Engineering Contradiction:

Improvevalidation coverageVSAvoidvalidation list generation complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The validation list is generated in advance through automated procedures that collect IP address prefixes from routing information and organize them into subsets based on access types. This preliminary action reduces the complexity of real-time validation by pre-processing the validation data structure, allowing the system to maintain comprehensive coverage without excessive operational complexity.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Instead of generating a single comprehensive validation list containing all possible IP address prefixes, the system generates multiple subsets with different validation strictness levels. This partial action approach maintains adequate validation coverage for critical networks while reducing overall list complexity by excluding or relaxing validation for networks with asymmetric routing, thereby balancing coverage and complexity.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If strict source address validation is applied to all incoming packets, then network security is enhanced, but false positives increase causing legitimate traffic to be blocked

Engineering Contradiction:

Improvenetwork securityVSAvoidfalse positive rate

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The system applies different validation strictness levels to different packet sources based on their access types. Packets from directly connected networks undergo strict URPF validation to ensure high security, while packets from networks with asymmetric routing characteristics undergo relaxed validation or are excluded from validation, thereby maintaining high security for local traffic while minimizing false positives for remote traffic.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The validation parameters are dynamically adjusted based on the access type and network segment. The system changes the validation threshold parameter from strict (for directly connected networks) to relaxed or disabled (for networks with asymmetric routing), thereby maintaining security where needed while reducing false positives where asymmetric routing is expected.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20260025357A1Method and apparatus for obtaining source address validation list, electronic device, and storage medium

Publication Date: 2026.01.22 HUAWEI TECH CO LTD

AI summary

This application discloses a method and apparatus for obtaining a source address validation list, an electronic device, and a storage medium, and pertains to the field of network technologies. In this method, an edge network device in an autonomous domain obtains an IP address prefix owned by an external network connected to the autonomous domain, so that the source address validation list can be obtained based on the obtained IP address prefix and an access type of the external network.