NPLA: Network Prefix Level Authentication

We present the design and evaluation of NPLA (Network Prefix Level Authentication), a system allowing source addresses to be validated within the network to the granularity of network prefix. Prefix routers use public key cryptography to insert NPLA headers in outgoing packets. En route entities holding the corresponding public key verify the source of a packet. NPLA provides deployment incentives because each upgraded prefix can prevent its address space from being maliciously used by other networks and its traffic is forwarded with high priority. In order to increase the scalability, NPLA does not employ PKI but leverages BGP to distribute public keys. Based on the relative damage reduction analysis, we conclude that NPLA provides more relative benefit than other approaches when they are all partially deployed. In order to decrease the overhead induced by public key cryptography, NPLA uses FPGA based hardware cryptography accelerator which has been proven to achieve several Gbps throughput on average.