CT-ER: A DoS-resistant Internet Architecture

CT-ER：抗 DoS 的互联网架构

• 批准号: 0925585
• 负责人: Xiaowei Yang
• 金额: $ 4.5万
• 依托单位: Duke University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2008
• 资助国家: 美国
• 起止时间: 2008-12-04 至 2010-01-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0925585&HistoricalAwards=false
• 关键词: CT; ER; DoS; resistant; Internet

This research is to design and evaluate an Internet architecture that is resistant to Denial-of-Service (DoS) flooding attacks of any scale. DoS attacks have become an increasing threat to the reliability of the Internet. These attacks are capable of knocking any user, site, and server right off the Internet. This research targets the root cause of the DoS flooding problem: the network's inability to intelligently handle overload. When DoS attacks occur, the network drops legitimate traffic and attack traffic alike, leading to heavy losses of legitimate traffic, which in turn triggers the TCP-friendly backoff of legitimate clients, further reducing the volume of legitimate traffic. One approach to robustly distinguish legitimate and attack traffic is network capabilities. Capabilities are short-term authorizations that senders request from receivers and stamp on their packets. They allow a destination to classify traffic into two broad categories: authorized traffic and unauthorized traffic. With capabilities, the network is able to discard unauthorized traffic in favor of authorized traffic, and protects authorized communications from unauthorized attempts. This research will design and evaluate a DoS-resistant network architecture that builds on the concept of capabilities. It will also compare the costs and benefits of this solution with solutions that build on other primitives, such as black-list filters.

本研究旨在设计和评估一种能够抵抗任何规模的拒绝服务（DoS）洪水攻击的互联网架构。DoS攻击对互联网的可靠性构成了日益严重的威胁。这些攻击能够将任何用户、站点和服务器从互联网上断开。本研究针对DoS泛滥问题的根本原因：网络无法智能处理过载。当发生DoS攻击时，网络会将合法流量和攻击流量同时丢弃，导致合法流量损失严重，进而触发合法客户端tcp友好型退出，进一步减少合法流量。可靠地区分合法流量和攻击流量的一种方法是网络功能。功能是发送方向接收方请求并在其数据包上盖章的短期授权。它们允许目的地将流量分为两大类：授权流量和未授权流量。有了这些功能，网络就能够丢弃未经授权的通信，而支持已授权的通信，并保护已授权的通信免受未经授权的尝试。本研究将设计和评估基于能力概念的抗dos网络架构。本文还将比较此解决方案与构建在其他原语（如黑名单过滤器）上的解决方案的成本和收益。