ID-SAVE: Incrementally Deployable Source Address Validity Enforcement

Routers in the Internet today know which direction a packet should be sent towards, but not which direction a packet should have come from. This is the root cause of problems on the Internet such as IP-spoofing being common in network attacks and source-address-based protocols such as RPF being unreliable. Previous work has either not attacked this root cause, or has had unrealistic deployment assumptions.

Our current work, ID-SAVE (Incrementally Deployable Source Address Validity Enforcement), utilizes ideas similar to those presented in [1]. ID-SAVE attacks the root cause by building up "incoming tables" for routers, much like the forwarding tables currently in use by routers. It uses a variety of novel mechanisms to be incrementally deployable such as packet marking, neighbor discovery, on-demand updates, blacklists, and packet-driven pushback.

[1] J. Li, J. Mirkovic, M. Wang, P. L. Reiher, and L. Zhang, "SAVE: Source address validity enforcement protocol", in INFOCOM, New York, 2002, pp. 1557-1566.