SEC: Secure, Efficient, and Compatible Source Address Validation with Packet Tags

Spoofed traffic has been a great threat to the Internet. Tag-based inter-AS source address validation solutions show great effectiveness and high deployment incentives on filtering spoofed traffic. However, they fail to consider secure key negotiation for tags, efficient tag generation for network devices, and compatible tag placement for network functionalities. In this paper, we present SEC, a secure, efficient, and compatible source address validation scheme based on packet tags. We provide a secure key negotiation method and a lightweight tag generation algorithm for SEC considering hardware limitations of network devices. They can be easily implemented in network devices to filter spoofed packets while forwarding packets at approximately line rate. We also carefully place all tags into appropriate option fields in packet headers to guarantee the compatibility of network functionalities. We implement SEC in real programmable switches. Both theoretical analysis and experimental results show SEC can verify source addresses of packets in a secure, efficient, and compatible way.