Provider Interface SAV for Customer Cone Sources

Current source address validation (SAV) on AS's provider interfaces primarily relies on loose uRPF, which can protect against IP spoofing based on unannounced internet prefixes but lacks the ability to defend against spoofing based on valid internet prefixes. Furthermore, if a default route is present, this protection is effectively nullified. Based on the traffic flow characteristics between the ASes in a customer cone, this document describes a general solution architecture -- provider interface SAV for customer cone source spoofing (PI-SAV for CC). This mechanism can be applied on the provider interfaces of an AS to prevent spoofing traffic with the customer cone source addresses from flowing into the local AS and its customer cone. Specially, this mechanism offers protection against reflective amplification DDoS attacks that leverage local servers to target victims within the customer cone.