SASA: Source Address Spoofing Avoidance Mechanism under High Movement for Mega-Constellations

The emergence of mega-constellations is the most promising satellite network trend in recent years, which brings new security challenges to the network layer and higher layers, such as DDoS, worm, and DNS pollution. Source address validation is one of the effective solutions in terrestrial networks, by filtering the invalid address and resisting the source address spoofing. Because of the time-vary topology in mega-constellations, the source address validation mechanism faces the severe problem of the anchor mobility, which leads to a sharp decline in SAVI (Source Address Validation Improvements) performance and increases the cost to maintain the user status. In this paper, we develop a source address spoofing avoidance mechanism under high movement (SASA) for mega-constellations. Specifically, we propose that the user and the satellite both maintain the user status. After the satellite signed the binding information by the private key, it forms the mapping between the authenticity of the user address and the initial access satellite on the user side. Moreover, when the handover occurs, the user safely transmits the authentication information to the new access satellite through asymmetric encryption to complete rebinding. Simulation results show that SASA can greatly reduce the rebinding cost of mega-constellations by 95.04% in Starlink and 81.84% in Kuiper.