On SRv6 Security

SRv6 is a routing architecture that can provide hybrid cooperation a centralized network network policy, nodes: IPv6 routers maintain the multi-hop ECMP-aware segments, whereasbetween the controller, responsible for controller the Traffic and Engineering IPv6 routers maintain multi-hop ECMP-aware segments, whereas thethe controller, responsible for theatTraffic Engineering policy, combines them to formthe a source-routed path through the network. Since state of the flow is defined the ingress to the network combines to forminaasource-routed path through the Segment network. Routing Since theHeader state of(SRH), the flow defined at the to the network and then isthem contained specific packet header, called theis importance of ingress such a header itself is and then is contained in a specific packet header, called Segment Routing Header (SRH), the importance of such a header itself is vital. Motivated by the increasing success and widespread deployment of such approaches and technologies, this paper introduces vital. Motivated by the increasing andtied widespread deployment suchthe approaches technologies, this paper introduces the context and discusses some ofsuccess the issues to possible tamperingofwith Segment and Routing Header content. Finally, some the context discusses some ofaimed the issues tied to possible tampering with the Segment Routing Header content. Finally, some details of anand experimental testbed at evaluating the above issues are provided. details of an experimental testbed aimed at evaluating the above issues are provided.