sMAT – A Simplified MAC Address Translation Scheme

In Ethernet-based access networks, network security plays a more significant role than in ATM-based access environments. We assume that in the foreseeable future Internet access can be established without using the conventional Point-to-Point protocol. Various scenarios already envisage straightforward delivery of selected IP services over Ethernet, e.g., forwarding of multicast services in Ethernet-based DSL access networks [1]. Traffic will be switched on Layer 2 without any further traffic separation by protocol encapsulation (Figure 1). Thus, access segments will be prone to typical Layer 2 attacks: MAC Address Spoofing & Flooding and Address Resolution Protocol (ARP) Spoofing as illustrated in Figure 2. Furthermore, customers demand newfangled services. Providers satisfy these wishes with modern multimedia services. New technologies provide the required bandwidth, e.g., GDSL [2]. Thus, increasing traffic and workload must already be handled in the first aggregation levels of an access network. It is necessary to move functionality towards the customer edge and to decentralize. Following, an approach for a simplified MAC Address Translation (sMAT) scheme for Ethernet-based DSL access networks is introduced. It addresses several relevant issues as discussed in [3]. sMAT focuses on security and