AI帮你理解科学

AI 生成解读视频

AI抽取解析论文重点内容自动生成视频


pub
生成解读视频

AI 溯源

AI解析本论文相关学术脉络


Master Reading Tree
生成 溯源树

AI 精读

AI抽取本论文的概要总结


微博一下
We propose an architecture called Secure Overlay Services that proactively prevents DoS attacks, geared toward supporting Emergency Services or similar types of communication

SOS: secure overlay services.

Special Interest Group on Data Communication, no. 4 (2002): 61-72

引用764|浏览41
EI
下载 PDF 全文
引用
微博一下

摘要

Denial of service (DoS) attacks continue to threaten the reliability of networking systems. Previous approaches for protecting networks from DoS attacks are reactive in that they wait for an attack to be launched before taking appropriate measures to protect the network. This leaves the door open for other attacks that use more sophistica...更多

代码

数据

0
简介
  • In the immediate aftermath of 9/11 events in New York City, the Internet was used to facilitate communication between family members and friends, as the phone network was overwhelmed1.
  • The network could be used to carry communications between widely dispersed “static” sites and roaming stations and users
  • In such an environment, the communication path between the various sites and the emergency response teams (ERTs) needs to be kept clear of interference such as denial of service (DoS) attacks: attacks that attempt to overwhelm the processing or link capacity of the target site by saturating it with bogus packets.
  • The authors cannot reasonably expect any one entity to effectively police and control it
重点内容
  • In the immediate aftermath of 9/11 events in New York City, the Internet was used to facilitate communication between family members and friends, as the phone network was overwhelmed1
  • We address the problem of securing communication on top of today’s existing IP infrastructure from denial of service attacks, where the communication is between a pre-determined location and users, located anywhere in the wide-area network, who have authorization to communicate with that location
  • We addressed the problem of securing a communication service on top of the existing IP infrastructure from denial of service attacks
  • While it is not strictly necessary that different service providers connect their overlay networks, doing so would allow them to exploit the benefits of scale described in Section 4
  • Through simple analytical models we show that denial of service attacks directed against any part of the Secure Overlay Services infrastructure have negligible probability of disrupting the communication between two parties: for instance, when only ten nodes act as beacons, ten nodes act as secret servlets, and ten nodes act as access points, for an attack to be successful in one out of ten thousand attempts, approximately forty percent of the nodes in the overlay must be attacked simultaneously
  • The resistance of a Secure Overlay Services network against denial of service attacks increases greatly with the number of nodes that participate in the overlay
方法
  • Design Rationale

    Fundamentally, the goal of the SOS infrastructure is to distinguish between authorized and unauthorized traffic.
  • At a very basic level, the authors need the functionality of a firewall “deep” enough in the network that the access link to the target is not congested.
  • This imaginary firewall would perform access control by using traditional protocols such as IPsec.
  • Since the distributed firewall has performed the access control step, it would seem obvious that all the authors need around the target is a router that is configured to only let through traffic forwarded to it by one of the firewalls
结论
  • The authors' study of SOS is admittedly in its early stages. There are several issues that need to be addressed for the service to have a viable impact within the Internet.
  • The authors attack the problem with a proactive mechanism, which is composed of aggressive packet filtering in a site’s network periphery, an overlay network that can self-heal during a DoS attack, and a scalable access control mechanism that allows legitimate users to use the overlay network.
  • The authors call this architecture Secure Overlay Services, or SOS.
  • Implementing an SOS infrastructure is fairly straightforward and can be done using almost exclusively off-theshelf protocols and software
表格
  • Table1: Queueing models for the variants of attack and repair processes
Download tables as Excel
相关工作
  • A fundamental design principle of the IP architecture is to keep the functionality inside the core of the network simple, pushing as much mechanism as possible to the network end-points. This principle, commonly referred to as the “end-to-end principle”[22, 5], has been the basic premise behind protocol design. However, as has been demonstrated in the past few years [25, 10], such mechanisms are inadequate in addressing the problem of DoS attacks.

    It is trivial to abuse[23] or simply ignore congestion control mechanisms, and there are plenty of protocols that have no provision for congestion control. Furthermore, no great technical sophistication is required to launch one of these attacks. Even relatively largescale DoS attacks (Distributed DoS — DDoS)2 are not very difficult to launch, given the lack of security in certain email clients and the ability to cause arbitrary code to be executed by an email recipient.
基金
  • This material is supported in part by DARPA contract No F30602-02-2-0125 (FTN program) and by the National Science Foundation under grant No ANI-0117738 and CAREER Award No ANI-0133829
引用论文
  • D. Andersen, H. Balakrishnan, F. Kaashoek, and R. Morris. Resilient Overlay Networks. In Proceedings of the 18th Symposium on Operating Systems Principles (SOSP), October 2001.
    Google ScholarLocate open access versionFindings
  • S. Blake, D. Black, M. Carlson, E. Davies, Z. Wang, and W. Weiss. An Architecture for Differentiated Services. Technical report, IETF RFC 2475, December 1998.
    Google ScholarFindings
  • M. Blaze, J. Feigenbaum, J. Ioannidis, and A. D. Keromytis. The KeyNote Trust Management System Version 2. Internet RFC 2704, September 1999.
    Google ScholarFindings
  • M. Blaze, J. Ioannidis, and A. Keromytis. Trust Managent for IPsec. In Proceedings of Network and Distributed System Security Symposium (NDSS), pages 139–151, February 2001.
    Google ScholarLocate open access versionFindings
  • D. D. Clark. The Design Philosophy of the DARPA Internet Protocols. In Proceedings of ACM SIGCOMM, pages 106–114, 1988.
    Google ScholarLocate open access versionFindings
  • F. Dabek, M. F. Kaashoek, R. Morris, D. Karger, and I. Stoica. Wide-Area Cooperative Storage with CFS. In Proceedings of ACM SOSP, 2001.
    Google ScholarLocate open access versionFindings
  • D. Dean, M. Franklin, and A. Stubblefield. An Algebraic Approach to IP Traceback. In Proceedings of the Network and Dsitributed System Security Symposium (NDSS), pages 3–12, February 2001.
    Google ScholarLocate open access versionFindings
  • D. Farinacci, T. Li, S. Hanks, D. Meyer, and P. Traina. Generic routing encapsulation (GRE). Request for Comments 2784, Internet Engineering Task Force, Mar. 2000.
    Google ScholarFindings
  • D. Harkins and D. Carrel. The Internet Key Exchange (IKE). Request for Comments (Proposed Standard) 2409, Internet Engineering Task Force, Nov. 1998.
    Google ScholarFindings
  • L. Heberlein and M. Bishop. Attack Class: Address Spoofing. In Proceedings of the 19th National Information Systems Security Conference, pages 371–377, October 1996.
    Google ScholarLocate open access versionFindings
  • J. Ioannidis. Protocols for Mobile Networking. PhD thesis, Columbia University, New York, 1993.
    Google ScholarFindings
  • J. Ioannidis and S. M. Bellovin. Implementing Pushback: Router-Based Defense Against DDoS Attacks. In Proceedings of the Network and Distributed System Security Symposium (NDSS), February 2002.
    Google ScholarLocate open access versionFindings
  • S. Ioannidis, A. Keromytis, S. Bellovin, and J. Smith. Implementing a Distributed Firewall. In Proceedings of Computer and Communications Security (CCS), pages 190–199, November 2000.
    Google ScholarLocate open access versionFindings
  • D. Karger, E. Lehman, F. Leighton, R. Panigrahy, M. Levine, and D. Lewin. Consistent Hashing and Random Trees: Distributed Caching Protocols for Relievig Hot Spots on the World Wide Web. In Proceedings of ACM Symposium on Theory of Computing (STOC), pages 654–663, May 1997.
    Google ScholarLocate open access versionFindings
  • S. Kent and R. Atkinson. Security Architecture for the Internet Protocol. Request for Comments (Proposed Standard) 2401, Internet Engineering Task Force, Nov. 1998.
    Google ScholarFindings
  • A. D. Keromytis. STRONGMAN: A Scalable Solution To Trust Management In Networks. PhD thesis, University of Pennsylvania, Philadelphia, 2001.
    Google ScholarFindings
  • L. Kleinrock. Queueing Systems, Volume I: Theory. Wiley-Interscience, 1975.
    Google ScholarLocate open access versionFindings
  • D. Moore, G. Voelker, and S. Savage. Inferring Internet Denial-of-Service Activity. In Proceedings of the 10th USENIX Security Symposium, pages 9–22, August 2001.
    Google ScholarLocate open access versionFindings
  • C. Perkins. IP encapsulation within IP. Request for Comments 2003, Internet Engineering Task Force, Oct. 1996.
    Google ScholarFindings
  • M. G. Reed, P. F. Syverson, and D. M. Goldschlag. Anonymous connections and onion routing. IEEE Journal on Special Areas in Communications, 16(4):482–494, 1998.
    Google ScholarLocate open access versionFindings
  • K. W. Ross. Multiservice Loss Models for Broadband Telecommunication Networks. Springer-Verlag, 1995.
    Google ScholarFindings
  • J. H. Saltzer, D. P. Reed, and D. D. Clark. End-to-end arguments in System Design. ACM Transactions on Computer Systems, 2(4):277–288, November 1984.
    Google ScholarLocate open access versionFindings
  • S. Savage, N. Cardwell, D. Wetherall, and T. Anderson. TCP Congestion Control with a Misbehaving Receiver. ACM Computer Communications Review, 29(5):71–78, October 1999.
    Google ScholarLocate open access versionFindings
  • S. Savage, D. Wetherall, A. Karlin, and T. Anderson. Network Support for IP Traceback. ACM/IEEE Transactions on Networking, 9(3):226–237, June 2001.
    Google ScholarLocate open access versionFindings
  • C. Schuba, I. Krsul, M. Kuhn, E. Spafford, A. Sundaram, and D. Zamboni. Analysis of a Denial of Service Attack on TCP. In Proceedings of IEEE Security and Privacy, pages 208–223, May 1997.
    Google ScholarLocate open access versionFindings
  • I. Stoica, R. Morris, D. Karger, M. F. Kaashoek, and H. Balakrishnan. Chord: A Scalable Peer-To-Peer Lookup Service for Internet Applications. In Proceedings of ACM SIGCOMM, 2001.
    Google ScholarLocate open access versionFindings
0
您的评分 :

暂无评分

标签
评论
数据免责声明
页面数据均来自互联网公开来源、合作出版商和通过AI技术自动分析结果,我们不对页面数据的有效性、准确性、正确性、可靠性、完整性和及时性做出任何承诺和保证。若有疑问,可以通过电子邮件方式联系我们:report@aminer.cn