A End-to-end Source Address Validation Solution for IPv6

Jianping Wu

2007-01-01

Abstract:This document describes the detail mechanism and protocol definition of a light-weight signature based and end-to-end deployed method for preventing the spoofing of source IPv6 address.

What problem does this paper attempt to address?

<i>SAV6</i>: A Novel Inter-AS Source Address Validation Protocol for IPv6 Internet

Lin He,Gang Ren,Ying Liu,Guanglei Song,E. Jinlong,Jiahai Yang,Mingwei Xu

DOI: https://doi.org/10.1109/MNET.123.2200111

IF: 10.294

2023-01-01

IEEE Network

Abstract:IP spoofing is prevalently used for anonymity and reflection attacks, e.g., distributed denial of service (DDoS) attacks, which have shown increasingly destructive power in recent years because today's Internet lacks validation on source addresses. Moreover, the fast deployment of IPv6 on the Internet may further aggravate the damages of DDoS attacks. This paper proposes a novel source address validation mechanism called SAV6, which leverages the huge IPv6 address space to validate source addresses at an inter-autonomous system (AS) granularity. In SAV6, each IPv6 address contains an AS number (ASN), whose corresponding AS announces the prefix of the address to other ASes. An AS can determine the authenticity of the source address by whether the ASN in the address matches the corresponding prefix after receiving an incoming packet. The performance evaluation of a SAV6 prototype shows that it adds little performance overhead to the deployed infrastructures and is a lightweight and deployable protocol.
An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

Lizhong Xie,Jun Bi,Jianpin Wu

DOI: https://doi.org/10.1007/978-3-540-72590-9_121

2007-01-01

Abstract:In today's Internet routing architecture, the router doesn't validate the correctness of the source address carried in the packet, nor keep the state information when forwarding the packet. Thus the DDoS attacks with spoofed IP source address can cause security problems. In this paper, we aim to prevent the attackers from attacking somewhere outside the IPv6 edge network with forged source address in the fine granularity. The proposed methods include source address authentication by using session key and hash digest algorithm, and replay attack prevention by combining the sequence number method and the timestamp method. This paper presents the algorithm design and evaluates its feasibility and correctness by simulation experiments.
An IPv6 Source Address Validation Testbed and Prototype Implementation

Jun Bi,Guang Yao,Jianping Wu

DOI: https://doi.org/10.4304/jnw.4.2.100-107

2009-01-01

Journal of Networks

Abstract:Since the Internet uses destination-based packet forwarding, malicious attacks have been launched using spoofed source addresses. In an effort to enhance the Internet with IP source address validation, we prototyped an implementation of the IPv6 Source Address Validation Architecture (SAVA) and conducted the evaluation on an IPv6 test-bed. This paper reports our prototype implementation and the test results, as well as the lessons and insights gained from our experimentation. Some enhanced methods are also introduced in this article.
Design and Implementation of an IPv6 Source Address Validation Device

Guang Yao,Jun Bi

DOI: https://doi.org/10.1109/ICNS.2008.25

2008-01-01

Abstract:The lack of source address validation on the Internet makes attack with IP spoofing a serious problem. Many methods have been proposed to solve this problem, and among them, SPM and ARBIF are effective and feasible ones. We have implemented an IPv6 source address validation device with these two methods embedded, and this device is an open framework for other source address validation mechanisms.
Inter-AS Source Address Validation on IPv6 Network

吴建平,任罡,李星

DOI: https://doi.org/10.3969/j.issn.2095-2783.2007.10.003

2007-01-01

Abstract:The current Internet addressing architecture does not verify the source address of a packet received and forwarded.This causes serious security problems.This paper proposed the solutions for Inter-AS source address validation in IPv6 network,which can improve the security of IPv6 network.An AS relation based method is proposed for directly connected AS,and a signature based method is proposed for ASes which are not directly connected.This paper discusses the details of design,implementation and deployment into the CNGI-CERNET2 infrastructure-a large-scale native IPv6 backbone network of the China Next Generation Internet project.
An IPv6 Test-Bed Implementation for a Future Source Address Validation Architecture

Jun Bi,Jianping Wu,Xing Li,Xiangbin Cheng

DOI: https://doi.org/10.1109/ngi.2008.21

2008-01-01

Abstract:Since the Internet uses destination-based packet forwarding, malicious attacks have been launched using spoofed source addresses. In an effort to enhance the Internet with IP source address validation, we prototyped an implementation of the IPv6 source address validation architecture (SAVA) and conducted the evaluation on an IPv6 test-bed. This paper reports our prototype implementation and the test results, as well as the lessons and insights gained from our experimentation.
Investigating the efficiency of fine granularity source address validation in IPv6 networks

Fuliang Li,Changqing An,Jiahai Yang,Ning Jiang,Jianping Wu

DOI: https://doi.org/10.1109/APNOMS.2011.6077038

2011-01-01

Abstract:IPv6 protocol has been widely deployed in the world. As the IANA pool of IPv4 addresses has run out, IPv6 will become increasingly important. Although the IPv6 protocol stack presents considerable advantages compared with the IPv4 protocol stack, IP source address spoofing is still exploited in IPv6 to initiate malicious attacks. Some techniques are proposed and deployed to implement source address validation at fine granularity. In this paper, we investigate the efficiency of fine granularity IP source address validation, e.g. whether filtering technology is deployed to prevent hosts from using forged IP address. We develop a detection tool with controlled spoofing ability which can infer whether the function of filtering spoofing address packets is enabled. We run this tool in 12 famous universities in China and collect the testing data. We gather a total of 41373 probes from 324 clients, and each probe includes sending at least 5 packets with the same spoofing source address to the control server. Results reveal that, 77.02% of the spoofing probes are completely filtered, 0.29% of the spoofing probes are partly filtered and the rest spoofing probes are not filtered at all. Overall, this illustrates that techniques of source address validation have been widely deployed in campus networks. Our statistical results provide practical basis for the deployment and further development of source address validation protocols in IPv6 networks.
Trustworthy Identity System Based on IPv6 Source Address Validation

ZHOU Duan-qi,BI Jun,YAO Guang

DOI: https://doi.org/10.3969/j.issn.1000-436x.2014.z1.005

2014-01-01

Abstract:In the Internet, there are no mechanisms to verify the identity of a message sender, resulting in a large number of forged identity attacks, such as phishing websites. By mapping the user identity into the rightmost 64 bit of the IPv6 address, this paper tries to make every message embedded with an identity, which lay a credible foundation for commu-nications on the Internet. We design and realize a true identity communication system based on source address validation improvement, which can protect the privacy of the users, and ensure the verifiability and authenticity of the user identi-ties.
Source Address Validation: Architecture And Protocol Design

Jianping Wu,Gang Ren,Xing Li

DOI: https://doi.org/10.1109/ICNP.2007.4375858

2007-01-01

Abstract:The current Internet addressing architecture does not verify the source address of a packet received and forwarded. This causes serious security and accounting problems. Based on the drastically increased IPv6 address space; a '' Source Address Validation Architecture '' (SAVA) is proposed in this paper, which can guarantee that every packet received and forwarded holds an authenticated source IP address. The design goals of the architecture are lightweight, loose coupling, '' multi-fence support '' and incremental deployment. This paper discusses the details of design and implementation for the architecture, including inter-AS, intra-AS and local subnet. This architecture is deployed into the CNGI-CERNET2 infrastructure - a large-scale native IPv6 backbone network of the China Next Generation Internet project. We believe that the Source Address Validation Architecture will help the transition to a new, more secure and sustainable Internet.
A Light-weighted Source Address Validation Method in IPv4/IPv6 Translation

yu zhu,jun bi,yayuan sun

2012-01-01

Abstract:since global IPv4 address has already exhausted in 2011, IPv6 is going to be deployed more widely in the next years. Both IPv4 and IPv6 would coexist in Internet for many years. Some transition technologies can help IPv4 to work with IPv6, but most of them are vulnerable to IP address spoofing attack. This paper proposes a source address validation method which works with IPv4/IPv6 translation. Only one change is required in DNS translation, based on current translation technology. Currently, an IPv4 server's address in DNS reply would be translated to an IPv4-mapped IPv6 address by DNS translator. In this paper, we proposed a method called identify code (GIC) that the translator gateway embeds authentication information in IPv4- mapped IPv6 address in translated DNS reply. A host who receives this DNS reply would use this GIC embedded address to start communication. When packets reach translator gateway, validation is performed to check whether the GIC is correct. This technology can work with both stateful translation method and stateless translation method, including NAT-PT, NAT64 and IVI. This method will protect the address pool and filter the IP address spoofing attack.
The Automatic Peer-To-Peer Signature For Source Address Validation

Yan Shen,Jun Bi,Jianping Wu,Qiang Liu

DOI: https://doi.org/10.1007/978-3-540-74819-9_105

2007-01-01

Abstract:SPM (Spoofing Prevention Method) proposed a peer-to-peer anti-spoofing method which could effectively filter spoofed packets and support incremental deployment. However, mechanism of SPM key updating has some serious problems: (1) heavy management cost; (2) risk of becoming the target of DOS/DDOS attacks during the key updating; (3) limitation of the scale of the SPM union; (4) impossibility of tackling the threat of real-time packet sniffing. This paper proposes an Automatic Peer-to-Peer Anti-spoofing Method (APPA). APPA resolves the key management problem and could effectively prevent source address spoofing.
A Multi-fence Countermeasure Based Inter-domain Source Address Validation Method

Jie Li,Jun Bi,Jianping Wu,Wei Zhang

DOI: https://doi.org/10.1109/nca.2012.20

2012-01-01

Abstract:The functional deficiency of the Internet architecture enables attackers the ability to easily to spoof IP source address. The traditional signature-and-verification based anti-spoofing methods are often limited by essential process based on an explicit analysis and process of the IP header and does not adapt to incremental deployment. This paper designs a multi-fence countermeasure based inter-domain source address validation method named VIP. By employing intelligent originating information label and extended MPLS based cloud and network, VIP enables lightweight-label-based packet forwarding and validation. And VIP offers gains in efficiency by reducing the load on both forwarding tables and validation processing without negative influences and complex operations on de facto networks. In addition to enhanced scalability, VIP may facilitate incremental deployment in the long run.
A CGAbased IP Source Address Authentication Method in IPv6 Access Network.

Guang Yao,Jun Bi

DOI: https://doi.org/10.1109/lcn.2008.4664225

2008-01-01

Abstract:In this paper, we present a novel source address spoofing prevention method for IPv6 access network called CGA based source address authentication (CSAA). It makes use of CGA (cryptographically generated address) to generate an unspoofable identifier of host without PKI, and bind it to the authorized address of the host. Then all the packets sent out by the host can be validated in the first-hop router by a light-weight method.
Encryption and verification scheme of source IPv6 address between Internet domains

Longfei Zhen,Ke Ma

DOI: https://doi.org/10.1109/CCNS53852.2021.00032

2021-01-01

Abstract:Source address verification is to prevent nodes on the same link from deceiving each other’s IP addresses, to prevent hackers from gaining the trust of each other’s terminals, and then controlling the terminals, thus avoiding the penetration of attacks. Based on this, this paper proposes an inter-domain source IPv6 address encryption and verification scheme based on HMAC (HMAC-SAV). The verificati...
Internet Draft Tsinghua Univ. Intended status: Standard Tracks F. Shi Expires: November 2012 China Telecom May 8, 2012

SAVI K Xu,G Hu,J Bi,M Xu

2012-01-01

Abstract:Many proposals have been presented for preventing IP spoofing from occurring in network. An outstanding of them is the SAVI (Source Address Validation Improvement) proposal which was advocated by IETF SAVI workgroup for solving this problem from user access switch. SAVI Working Group is developing standardize mechanisms that prevent nodes attached to the same IP link from spoofing each other’s IP addresses, and achieve IP source address validation at a finer granularity. However, up to now, to the best of our knowledge, none of them has focused on the scenarios of 4over6 transition, that is, IPv4 packets transit IPv6 network and arrive at other edge IPv4 network (s). With the boom of IPv6 networks, this issue becomes more and more urgent. In addition, since 4over6 plans are plenty and various, one solution cannot meet all requirements of these plans. This document describes a framework of IP …
Access path based source address validation in mobile IPv6

Zhu Min,Xu Ke,Li Qi

DOI: https://doi.org/10.1007/978-3-642-24403-2_26

2011-01-01

Abstract:Mobile IPv6 runs high risk of being attacked by IP spoofing due to the introduction of mobility and route optimization. In this paper, an authentic IP address validation scheme is proposed to protect mobile nodes in Mobile IPv6 against IP spoofing attack. The mobile nodes' historical traffic information is leveraged to validate the authenticity of its claimed home address in the scheme. Compared with other authentication schemes, this scheme is much simpler to implement and easier to deploy based on the usage of real data, and does not require additional computational overhead. It also solves the address ownership problem and the unauthenticated binding update issue in Mobile IPv6. Real traces are used to demonstrate the applicability of the scheme in this paper. The experimental results show that only three consecutive historical packet records are required to construct a unique authentication key, which can identify forged home address efficiently.
Experience with SPM in IPv6

Mingjiang Ye,Jianping Wu,Miao Zhang

DOI: https://doi.org/10.1007/978-3-540-72590-9_125

2007-01-01

Abstract:The lack of source IP address checking makes it easy for the attackers to spoof the source address. Spoofing Prevention Method (SPM), as a prospective candidate to be deployed in the Internet, is a newly proposed scheme to solve this problem. However, there is no work on SPM prototype system. In this paper, we present our experience in achieving a prototype system for SPM. In addition to realizing the basic idea of SPM described in the original paper, we make the following three contributions: First, the detail design is made for the whole SPM system architecture and detail mechanisms. Second, several important issues for SPM system are addressed, e.g., how to carry the key required by SPM, the MTU problem, etc. Third, a prototype system is made and some experiments are done with this prototype system.
A Two-Level Source Address Spoofing Prevention Based on Automatic Signature and Verification Mechanism

Yan Shen,Jun Bi,Jianping Wu,Qiang Liu

DOI: https://doi.org/10.1109/iscc.2008.4625684

2008-01-01

Abstract:IP source address spoofing is used by DDoS and DrDoS attacks in the Internet. This paper presents a signature-and-verification based IP spoofing prevention method, automatic peer-to-peer based anti-spoofing method (APPA). APPA has two levels: intra-AS (autonomous system) level and inter-AS level. In the intra-AS level, the end host tags a one-time key into each outgoing packet and the gateway at the AS border verifies the key. In inter-AS level, the gateway at the AS border tags a periodically changed key into the leaving packet and the gateway at border of the destination AS verifies and removes the key. The most prominent characteristic of APPA is the automatically synchronizing state-machine, which is used to update keys automatically and effectively. The benefits of APPA are: (1) preventing IP address spoofing strictly, end systems canpsilat even spoof addresses in the same AS or subnet, (2) providing very low running and management costs, (3) supporting anti-replay attacks and incremental deployment.
Building a Next Generation Internet with Source Address Validation Architecture.

JianPing Wu,Gang Ren,Xing Li

DOI: https://doi.org/10.1007/s11432-008-0142-x

2008-01-01

Science in China Series F Information Sciences

Abstract:The IP packet forwarding of current Internet is mainly destination based. In the forwarding process, the source IP address is not checked in most cases. This causes serious security, management and accounting problems. Based on the drastically increased IPv6 address space, a “source address validation architecture” (SAVA) is proposed in this paper, which can guarantee that every packet received and forwarded holds an authenticated source IP address. The design goals of the architecture are lightweight, loose coupling, “multi-fence support” and incremental deployment. This paper discusses the design and implementation for the architecture, including inter-AS, intra-AS and local subnet. The performance and scalability of SAVA are described. This architecture is deployed into the CNGI-CERNET2 infrastructure—a large-scale native IPv6 backbone network of the China Next Generation Internet project. We believe that the SAVA will help the transition to a new, more secure and dependable Internet.
Internet Draft Tsinghua Univ. Intended status: Standard Tracks F. Shi Expires: May 2013 China Telecom November 6, 2012

SAVI K Xu,G Hu,J Bi,M Xu

2012-01-01

Abstract:IP spoofing always is bothering us along with the Internet invention. With the rapid development of IPv6 next generation Internet, this issue is more prominent. Existing IP anti-spoofing proposals, including SAVI (Source Address Validation Improvement) which was advocated by IETF, only focused on single-stack or simple network scenarios. To the best of our knowledge, none of them has paid attention to the IPv4/IPv6 transition scenarios. However, since transition schemes are plenty and various, one solution cannot meet all requirements of them. In this draft, we present a SAVI-based general frame-work for IP source address validation and traceback in the IPv4/IPv6 transition scenarios, which achieve this by extracting out essential and mutual properties from these schemes, and forming sub-solutions for each property. When one transition scheme is composed from various properties, its IP source address …

A End-to-end Source Address Validation Solution for IPv6

<i>SAV6</i>: A Novel Inter-AS Source Address Validation Protocol for IPv6 Internet

An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

An IPv6 Source Address Validation Testbed and Prototype Implementation

Design and Implementation of an IPv6 Source Address Validation Device

Inter-AS Source Address Validation on IPv6 Network

An IPv6 Test-Bed Implementation for a Future Source Address Validation Architecture

Investigating the efficiency of fine granularity source address validation in IPv6 networks

Trustworthy Identity System Based on IPv6 Source Address Validation

Source Address Validation: Architecture And Protocol Design

A Light-weighted Source Address Validation Method in IPv4/IPv6 Translation

The Automatic Peer-To-Peer Signature For Source Address Validation

A Multi-fence Countermeasure Based Inter-domain Source Address Validation Method

A CGAbased IP Source Address Authentication Method in IPv6 Access Network.

Encryption and verification scheme of source IPv6 address between Internet domains

Internet Draft Tsinghua Univ. Intended status: Standard Tracks F. Shi Expires: November 2012 China Telecom May 8, 2012

Access path based source address validation in mobile IPv6

Experience with SPM in IPv6

A Two-Level Source Address Spoofing Prevention Based on Automatic Signature and Verification Mechanism

Building a Next Generation Internet with Source Address Validation Architecture.

Internet Draft Tsinghua Univ. Intended status: Standard Tracks F. Shi Expires: May 2013 China Telecom November 6, 2012