CT-ER: A DoS-resistant Internet Architecture

本研究旨在设计和评估一种能够抵抗任何规模的拒绝服务(DoS)洪泛攻击的Internet体系结构。DoS攻击已经成为对互联网可靠性的越来越大的威胁。这些攻击能够将任何用户、站点和服务器从互联网上摧毁。这项研究的目标是DoS洪流问题的根本原因：网络无法智能地处理过载。当发生DoS攻击时，网络丢弃合法流量和攻击流量，导致合法流量的严重损失，进而触发对合法客户端的TCP友好退避，进一步减少合法流量的数量。有效区分合法流量和攻击流量的一种方法是网络功能。功能是发送者向接收者请求的短期授权，并在其数据包上盖章。它们允许目的地将流量分为两大类：授权流量和未经授权流量。有了这些功能，网络能够丢弃未经授权的流量，转而支持授权流量，并保护授权通信免受未经授权的尝试。本研究将设计和评估基于能力概念的抗DoS网络体系结构。它还将比较此解决方案与基于其他原语的解决方案(如黑名单过滤器)的成本和收益。

This research is to design and evaluate an Internet architecture that is resistant to Denial-of-Service (DoS) flooding attacks of any scale. DoS attacks have become an increasing threat to the reliability of the Internet. These attacks are capable of knocking any user, site, and server right off the Internet. This research targets the root cause of the DoS flooding problem: the network's inability to intelligently handle overload. When DoS attacks occur, the network drops legitimate traffic and attack traffic alike, leading to heavy losses of legitimate traffic, which in turn triggers the TCP-friendly backoff of legitimate clients, further reducing the volume of legitimate traffic. One approach to robustly distinguish legitimate and attack traffic is network capabilities. Capabilities are short-term authorizations that senders request from receivers and stamp on their packets. They allow a destination to classify traffic into two broad categories: authorized traffic and unauthorized traffic. With capabilities, the network is able to discard unauthorized traffic in favor of authorized traffic, and protects authorized communications from unauthorized attempts. This research will design and evaluate a DoS-resistant network architecture that builds on the concept of capabilities. It will also compare the costs and benefits of this solution with solutions that build on other primitives, such as black-list filters.