Abstract:<p>We consider the problem of source address validation implementation (SAVI) in a Software-Defined Network (SDN) environment. The integration of SAVI and SDN can further address the challenges in a typical architecture such as the complexity of SAVI's deployment and the acquisition of security data in the access layer. A key aspect of this campaign consists of filtering forged packets and verifying the authenticity of the source address. A common strategy is to create bindings between the IP address of a node and a property of the host's network attachment. However, problem still accompany with the deployment of SAVI, including the performance cost of the SDN controller caused by the redundant validation process, especially in the case of an overflow of the flow table and other anomalous conditions in the network. Our contribution in this paper is to design and implement a dynamic framework for lightweight SAVI based on SDN (D-SAVI), which is an enhancement of SDN setups to allow proper source address validation on downstream network ingress ports, without incurring a large performance overhead. Initially, we proposed a fine-grained dual-level structure to match flow entry flexibly to complete the dynamic deployment of SAVI. A priority-based validation mechanism was added for further efficiency optimization. We then designed a state partition and transition module to optimize network performance under anomalous conditions, especially the communication performance between the controllers and switches in the SDN-based networks with a global view. Consequently, under the premise of network security, D-SAVI could filter out, with better packet forwarding efficiency, packets that do not match existing binding relationships. The experimental results demonstrate that our implementation provides source address verification with less resource consumption than existing methods.</p>

Network Working Group Tao Zijin Internet Draft Gong Zhenghu Lu Zexin Wang Baosheng

Network Working Group Tao Zijin Internet Draft Gong Zhenghu Intended status: Informational Lu Zexin Expires: February 24, 2012 Wang Baosheng

Internet Draft Tsinghua Univ. Intended status: Standard Tracks F. Shi Expires: November 2012 China Telecom May 8, 2012

<i>SAV6</i>: A Novel Inter-AS Source Address Validation Protocol for IPv6 Internet

Source Address Validation Improvement (SAVI) Framework

Internet Draft Tsinghua Univ. Intended status: Standard Tracks F. Shi Expires: May 2013 China Telecom November 6, 2012

Building a Next Generation Internet with Source Address Validation Architecture.

Source Address Validation Solution with OpenFlow/NOX Architecture

Source Address Validation: Architecture And Protocol Design

SAVT: A Practical Scheme for Source Address Validation and Traceback in Campus Network

A dynamic and lightweight framework to secure source addresses in the SDN-based networks

SAVSH: IP Source Address Validation for SDN Hybrid Networks

UniSAV: A Unified Framework for Internet-Scale Source Address Validation.

An IPv6 Source Address Validation Testbed and Prototype Implementation

Toward Practical Inter-Domain Source Address Validation

Source Address Validation In Software Defined Networks

Network Working Group J. Wu Internet-Draft Tsinghua University Intended status: Experimental R. Bonica Expires: August 9, 2007 Juniper Networks

A General Framework of Source Address Validation and Traceback for IPv4/IPv6 Transition Scenarios

An IPv6 Test-Bed Implementation for a Future Source Address Validation Architecture

Inter-AS Source Address Validation Based on Source Declaration and AS Alliance

<i>pSAV</i>: A Practical and Decentralized Inter-AS Source Address Validation Service Framework