Validation : Architecture and Protocol Design
Validation : Architecture and Protocol Design
复制标题
DOI：
--
复制
发表时间：
2007
期刊：
影响因子：
--
通讯作者：
Jianping Wu;Gang Ren;Xing Li
中科院分区：
文献类型：
--
作者：
Jianping Wu;Gang Ren;Xing Li
当前的互联网寻址架构不验证接收和转发的数据包的源地址。这会导致严重的安全和会计问题。针对IPv6地址空间急剧增加的特点，提出了一种“源地址验证体系结构”（SAVA），该体系结构能够保证接收和转发的每一个数据包都具有经过认证的源IP地址。该架构的设计目标是轻量级、松耦合、“多栅栏支持”和增量部署。本文详细讨论了该体系结构的设计与实现，包括AS间、AS内和本地子网。该体系结构已被部署到中国下一代互联网工程的CNGI-CERNET 2基础设施中，CNGI-CERNET 2是一个大规模的本地IPv6骨干网络。我们相信，源地址验证架构将有助于过渡到一个新的，更安全和可持续的互联网。
The current Internet addressing architecture does not verify the source address of a packet received and forwarded. This causes serious security and accounting problems. Based on the drastically increased IPv6 address space, a "Source Address Validation Architecture" (SAVA) is proposed in this paper, which can guarantee that every packet received and forwarded holds an authenticated source IP address. The design goals of the architecture are lightweight, loose coupling, "multi-fence support" and incremental deployment. This paper discusses the details of design and implementation for the architecture, including inter-AS, intra-AS and local subnet. This architecture is deployed into the CNGI-CERNET2 infrastructure a large-scale native IPv6 backbone network of the China Next Generation Internet project. We believe that the Source Address Validation Architecture will help the transition to a new, more secure and sustainable Internet.