Cyber Trust: Controlling Internet Denial-of-Service with Capabilities

提案0430304David Wetherall，华盛顿大学摘要在过去的几年里，Internet拒绝服务（DoS）洪水攻击变得更加频繁，规模更大，更复杂。 这些攻击的根本原因是，现有的互联网架构允许任何一方在任何时候向任何目的地发送数据包，而不管目的地的意愿如何。 为了解决这个问题，研究人员正在试验一种新的架构，在这种架构中，目的地可以控制用于到达它们的网络资源。 由数据包上携带的令牌表示的能力是用于影响这种控制的机制。 该体系结构提供了两个关键优势。 首先，它旨在为拒绝服务问题提供长期解决方案，而不是与攻击者进行军备竞赛。 第二，它控制拒绝服务，同时保持传统的开放性的互联网架构，减少了对防火墙和入侵检测系统的需要，阻碍了新类型的应用程序的增长。 目前正在建立该结构的原型，以便在因特网上试用。

Proposal 0430304David Wetherall, University of WashingtonAbstractOver the past several years, Internet denial-of-service (DoS) flooding attacks have become more frequent, larger, and more sophisticated. The root cause of these attacks is that the existing Internet architecture allows any party to send packets to any destination at any time, regardless of the wishes of that destination. To address this problem, the investigators are experimenting with a new architecture in which destinations have control over the network resources used to reach them. Capabilities, represented by tokens carried on packets, are the mechanism that is used to affect this control. The architecture provides two key benefits. First, it aims to provide a long-term solution to the problem of DoS, rather than a further step in an arms race with attackers. Second, it controls DoS while preserving the traditional openness of the Internet architecture, lessening the need for firewalls and intrusion detection systems that hinder the growth of new kinds of applications. A prototype of the architecture is being built for trial deployment on the Internet.