Cyber Trust: Controlling Internet Denial-of-Service with Capabilities

网络信任：用能力控制互联网拒绝服务

• 批准号: 0430304
• 负责人: David Wetherall
• 金额: $ 33万
• 依托单位: University of Washington
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2004
• 资助国家: 美国
• 起止时间: 2004-10-01 至 2008-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0430304&HistoricalAwards=false
• 关键词: Cyber; Trust; Controlling; Internet; Denial

Proposal 0430304David Wetherall, University of WashingtonAbstractOver the past several years, Internet denial-of-service (DoS) flooding attacks have become more frequent, larger, and more sophisticated. The root cause of these attacks is that the existing Internet architecture allows any party to send packets to any destination at any time, regardless of the wishes of that destination. To address this problem, the investigators are experimenting with a new architecture in which destinations have control over the network resources used to reach them. Capabilities, represented by tokens carried on packets, are the mechanism that is used to affect this control. The architecture provides two key benefits. First, it aims to provide a long-term solution to the problem of DoS, rather than a further step in an arms race with attackers. Second, it controls DoS while preserving the traditional openness of the Internet architecture, lessening the need for firewalls and intrusion detection systems that hinder the growth of new kinds of applications. A prototype of the architecture is being built for trial deployment on the Internet.

提案 0430304David Wetherall，华盛顿大学 摘要 在过去几年中，互联网拒绝服务 (DoS) 洪水攻击变得更加频繁、规模更大且更加复杂。 这些攻击的根本原因是现有的互联网架构允许任何一方在任何时间向任何目的地发送数据包，而不管该目的地的意愿。 为了解决这个问题，研究人员正在试验一种新的架构，其中目的地可以控制用于到达它们的网络资源。 由数据包上携带的令牌表示的功能是用于影响此控制的机制。 该架构提供了两个关键优势。 首先，它旨在为DoS问题提供长期解决方案，而不是进一步与攻击者进行军备竞赛。 其次，它控制 DoS，同时保留互联网架构的传统开放性，减少对阻碍新型应用程序增长的防火墙和入侵检测系统的需求。 该架构的原型正在构建中，以便在互联网上进行试用部署。