CT: Making Network Layer Proofs-of-Work Work

使网络层工作量证明（Proof-of-Work）工作拒绝服务（DoS）攻击继续扰乱互联网上的流量。 工作量证明或“客户端谜题”是一种保护许多协议免受DoS攻击的机制。难题是由服务器生成的密码学或组合学上的难题，在客户端接收服务之前必须由客户端解决。的难题的难度是由服务器作为一个功能，以前的客户端的行为，服务器负载等，而难题已被用于大多数在应用层（甚至只有有限的成功），我们认为，为了防止DoS攻击保护必须存在于一个层共同的所有应用程序：IP层。在实现这一点之前，谜题机制必须克服许多重大挑战，包括效率、公平性、防篡改和控制。更重要的是，我们相信谜题只有在有了坚实的理论基础之后才能充分发挥其潜力。到目前为止，还没有一个。在这个项目中，我们将解决这些挑战中的每一个。首先，我们将给这个难题一个完整的可证明安全的处理。具体来说，我们将给出一个正式的定义，什么是一个难题的计划，正式的定义安全的难题，并建立可证明满足这些定义的难题机制。 作为其中的一部分，我们将根据我们和其他人以前的工作正式分析现有的谜题机制。 此外，我们将探索新的设计，特别注意从T函数构造的谜题，这表明有希望成为快速和有效的谜题的基础。 我们的工作还将解决控制平面的问题，智能地设置难题的困难。最后，我们将通过构建一个智能的“Internet Tar Pit”来展示我们方法的实用性，该设备采用IP谜题来选择性地减缓DoS攻击，垃圾邮件，端口扫描和其他不受欢迎的网络通信。

Making Network Layer Proofs-of-Work WorkDenial-of-service (DoS) attacks continue to disrupt the flow of traffic on the Internet. Proofs-of-work or "client puzzles" are a mechanism for protecting a number of protocols against DoS attacks. A puzzle is a cryptographically or combinatorially difficult problem that is generated by a server and must be solved by a client before it receives service. The difficulty of the puzzle is determined by the server as a function of previous client behavior, server load, etc. While puzzles have been used mostly at the application layer (and even there with only limited success), we argue that to prevent DoS attacks protection must exist in a layer common to all applications: the IP layer. Before this can be realized, there are a number of significant challenges that puzzle mechanisms must overcome, including efficiency, fairness, tamper-resistance, and control. More fundamentally, we believe that puzzles will not realize their full potential until there is a solid theoretical foundation for them. To date, one does not exist. In this project we will address each of these challenges. First, we will give the puzzle problem a full provable-security treatment. Specifically, we will give a formal definition of what is a puzzle scheme, formal definitions of security for puzzles, and build puzzle mechanisms that provably meet these definitions. As part of this, we will formally analyze existing puzzle mechanisms based on previous work by us and others. In addition, we will explore new designs, with special attention given to puzzles constructed from T-functions, which show promise for being a basis for fast and effective puzzles. Our work will also address control-plane issues for intelligently setting puzzle difficulties. Finally, we will demonstrate the utility of our approaches by building a smart "Internet Tar Pit", a device that employs IP puzzles to selectively slow down DoS attacks, spam, port scans, and other undesirable network communication.