Preventing Internet denial-of-service with capabilities

Citations Over TimeTop 1% of 2004 papers

Abstract

In this paper, we propose a new approach to preventing and constraining denial-of-service (DoS) attacks. Instead of being able to send anything to anyone at any time, in our architecture, nodes must first obtain "permission to send" from the destination; a receiver provides tokens, or capabilities, to those senders whose traffic it agrees to accept. The senders then include these tokens in packets. This enables verification points distributed around the network to check that traffic has been certified as legitimate by both endpoints and the path in between, and to cleanly discard unauthorized traffic. We show that our approach addresses many of the limitations of the currently popular approaches to DoS based on anomaly detection, traceback, and pushback. Further, we argue that our approach can be readily implemented in today's technology, is suitable for incremental deployment, and requires no more of a security infrastructure than that already needed to fix BGP's security weaknesses. Finally, our proposal facilitates innovation in application and networking protocols, something increasingly curtailed by existing DoS measures.

Related Papers

• → A Survey of DDoS Attacks Detection Schemes in SDN Environment(2023)7 cited
• → Review of modern DDoS-attacks, methods and means of counteraction(2017)18 cited
• → Serving Away From Home: How Deployments Influence Reenlistment(2002)19 cited
• → Large-Scale Deployment of Tablet Computers in Brazilian Public Schools: Decisive Factors and an Implementation Model(2017)1 cited
• → A Review Paper on DDoS Detection Using Machine Learning(2023)