Abstract:<p>We consider the problem of source address validation implementation (SAVI) in a Software-Defined Network (SDN) environment. The integration of SAVI and SDN can further address the challenges in a typical architecture such as the complexity of SAVI's deployment and the acquisition of security data in the access layer. A key aspect of this campaign consists of filtering forged packets and verifying the authenticity of the source address. A common strategy is to create bindings between the IP address of a node and a property of the host's network attachment. However, problem still accompany with the deployment of SAVI, including the performance cost of the SDN controller caused by the redundant validation process, especially in the case of an overflow of the flow table and other anomalous conditions in the network. Our contribution in this paper is to design and implement a dynamic framework for lightweight SAVI based on SDN (D-SAVI), which is an enhancement of SDN setups to allow proper source address validation on downstream network ingress ports, without incurring a large performance overhead. Initially, we proposed a fine-grained dual-level structure to match flow entry flexibly to complete the dynamic deployment of SAVI. A priority-based validation mechanism was added for further efficiency optimization. We then designed a state partition and transition module to optimize network performance under anomalous conditions, especially the communication performance between the controllers and switches in the SDN-based networks with a global view. Consequently, under the premise of network security, D-SAVI could filter out, with better packet forwarding efficiency, packets that do not match existing binding relationships. The experimental results demonstrate that our implementation provides source address verification with less resource consumption than existing methods.</p>

<i>pSAV</i>: A Practical and Decentralized Inter-AS Source Address Validation Service Framework

UniSAV: A Unified Framework for Internet-Scale Source Address Validation.

<i>SAV6</i>: A Novel Inter-AS Source Address Validation Protocol for IPv6 Internet

SAVSH: IP Source Address Validation for SDN Hybrid Networks

A dynamic and lightweight framework to secure source addresses in the SDN-based networks

SAVT: A Practical Scheme for Source Address Validation and Traceback in Campus Network

Source Address Validation Solution with OpenFlow/NOX Architecture

Building a Next Generation Internet with Source Address Validation Architecture.

Source Address Validation Improvement (SAVI) Framework

Source Address Validation In Software Defined Networks

SAV-D: Defending DDoS with Incremental Deployment of SAV

Sra: Switch Resource Aggregation For Application Offloading In Programmable Networks

Toward Practical Inter-Domain Source Address Validation

Source Address Validation: Architecture And Protocol Design

P4SC: A High Performance and Flexible Framework for Service Function Chain

ApproSync: Approximate State Synchronization for Programmable Networks.

Address Protection-as-a-Service An inter-AS Framework for IP Spoofing Resilience

Testing of a Source Address Validation Protocol with Parallel Parameterized Extended Finite State Machines

RISP: an RPKI-based Inter-As Source Protection Mechanism

Revisiting Inter-As IP Spoofing Let the Protection Drive Source Address Validation.

Inter-AS Source Address Validation Based on Source Declaration and AS Alliance