Dos resistant internet progress
This presentation is the property of its rightful owner.
Sponsored Links
1 / 12

DoS-resistant Internet - progress PowerPoint PPT Presentation


  • 48 Views
  • Uploaded on
  • Presentation posted in: General

DoS-resistant Internet - progress. Bob Briscoe Jun 2005. BT activity. Research 2020 Communications Architecture project DoS-resistant Internet Architecture task Network Security project BGP security control plane separation intrusion detection systems Engineering Network design

Download Presentation

DoS-resistant Internet - progress

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Dos resistant internet progress

DoS-resistant Internet- progress

Bob Briscoe

Jun 2005


Bt activity

BT activity

  • Research

    • 2020 Communications Architecture project

      • DoS-resistant Internet Architecture task

    • Network Security project

      • BGP security

      • control plane separation

      • intrusion detection systems

  • Engineering

    • Network design

    • Second line support for operations

  • Operations

    • Deployment and operation of attack mitigation technology


Dos resistant internet architecture bt 0506 deliverables

CRN DoS-resistant Internet w-g task

Registry ofattacks

Operatorco-ord

Registry ofdefences

DoS-resistantarchitecture

Grandstrategy

DoS resistant Internet architectureBT 0506 deliverables

legend

M4.1 Industry co-ordination

BT DoS-resistant Internet Architecture task

D1.1 Taxonomyof attacks

M2.1 Focused literature study

M4.2 BT co-ordination

D1.2 Taxonomyof defences

M2.2? [Place-holder]: Testingarchitectural uncertainties

D3.x [Place-holder]: Newarchitectural ideas

D2.1 Agenda for arch change

D2.1.1? [Placeholder]: System demonstrator

D2.2 Roadmapping strategic options


Dos resistant internet architecture

DoS-resistant Internet Architecture

  • approach

    • cherry pick the ideas of others

    • sprinkle in a few ideas of our own

    • stress-test

    • propose a target architecture of complementary solutions

    • describe incremental deployment


Architectural component ideas candidate list

architectural component ideascandidate list

  • Symmetric paths, address separation, RPF checks, state set-up bit, nonce exchange, middlewalls

    • M Handley and A Greenhalgh “Steps towards a DoS-resistant Internet architecture” FDNA (2004)

  • Secure Internet Indirection Infrastructure

    • D Adkins et al “Towards a More Functional and Secure Network Infrastructure” UC Berkeley TR-CSD-03-1242 (2003)

  • Re-feedback

    • B Briscoe et al “Policing Congestion Response in an Internetwork using Re-feedback” SIGCOMM (2005)

  • Receiver-driven Capabilities

    • X Yang et al, “DoS-limiting Internet architecture” SIGCOMM (2005)

  • tactical approaches

    • ingress filtering, filter pushback…


  • Symmetric paths

    symmetric paths

    • powerful approach

    • loss of Internet flexibility acknowledged

    • extended to preserve data in flight during reroutes

    • stress-testing with authors

      • big question: would it significantly reduce worm attacks?

    NB

    NA

    R1

    ND

    S1

    NC


    Secure internet indirection infrastructure secure i 3

    Secure Internet Indirection Infrastructure Secure i3

    • rough analogy: receiver-driven multicast

      • receiver creates channel (trigger) in infrastructure

      • senders send to channel

  • unlike IP multicast, overlay infrastructure (Chord)

    • highly redundant

  • essentially, allow more, less efficient routes

    • choice of routes under receiver control

    • if some routes used for attack, drop them

    • efficient route could be norm, then less efficient routes when under attack

  • inherent weakness for servers: must advertise triggers

    • so attackers on dropped triggers just re-start

    • authors offer some mitigation


  • Re feedback incentive architecture

    N2

    N1

    N4

    N3

    N5

    re-feedback incentive architecture

    downstreampathcongest-ion, ρi

    0

    i

    bulk congestion charging

    bulk congestion pricing

    shaper/policer

    dropper

    R1

    S1

    routing

    traffic eng

    congestion control


    Receiver driven capabilities

    receiver-driven capabilities

    • yet to fully analyse (only just published)

    • sent traffic picks up time-bounded tags

      • tags from each network (router)

      • and byte permission from destination

      • collectively termed a capability

    • routers store tags

    • subsequent traffic authorised using capability

    • detail devils

      • bootstrapping

      • bounded router state

      • incremental deployment


    Grand strategy some questions

    Grand Strategy: some questions

    • if upstream network doesn’t filter/throttle

      • once attackers identified, what do we do?

        • continue to add more and more filters at borders?

        • disconnect their network?

        • throttle their network?

        • sue them (under what law – tort, criminal)?

    • can the network help identify persistent attackers?

      • unenforceable due to numerous weak legal systems?

      • pair-wise network agreements, or source identification?

  • inter-domain charging

    • congestion-based

      • would it slowly mitigate persistent attacks?

    • filter-based

      • would it encourage push-back?

  • incremental deployment

    • new, clean Internet?

    • gradually clean up the one we’ve got


  • In summary

    in summary

    • multiple answers, defence in depth

      • pair-wise network agreements AND source identification

  • complementary approaches

    • identify attackers (networks) by address

    • routers filter traffic from identified attacks/attackers

    • inter-domain charge to congestion-causing networks

    • police congestion-causing traffic


  • More info

    more info

    • Bob Briscoe

    • [email protected]

    • http://www.cs.ucl.ac.uk/staff/B.Briscoe/


  • Login