A practical system for guaranteed access in the presence of DDoS attacks and flash crowds
Journal
Proceedings - International Conference on Network Protocols, ICNP
Journal Volume
2016-March
ISBN
9781467382953
Date Issued
2016-03-18
Author(s)
Kung, Yi Hsuan
Lee, Taeho
Tseng, Po Ning
Kim, Tiffany Hyun Jin
Lee, Soo Bum
Lin, Yue Hsun
Perrig, Adrian
Abstract
With the growing incidents of flash crowds and sophisticated DDoS attacks mimicking benign traffic, it becomes challenging to protect Internet-based services solely by differentiating attack traffic from legitimate traffic. While fair-sharing schemes are commonly suggested as a defense when differentiation is difficult, they alone may suffer from highly variable or even unbounded waiting times. We propose RainCheck Filter (RCF), a lightweight primitive that guarantees bounded waiting time for clients despite server flooding without keeping per-client state on the server. RCF achieves strong waiting time guarantees by prioritizing clients based on how long the clients have waited - as if the server maintained a queue in which the clients lined up waiting for service. To avoid keeping state for every incoming client request, the server sends to the client a raincheck, a timestamped cryptographic token that not only informs the client to retry later but also serves as a proof of the client's priority level within the virtual queue. We prove that every client complying with RCF can access the server in bounded time, even under a flash crowd incident or a DDoS attack. Our large-scale simulations confirm that RCF provides a small and predictable maximum waiting time while existing schemes cannot. To demonstrate its deployability, we implement RCF as a Python module such that web developers can protect a critical server resource by adding only three lines of code.
Subjects
DDoS | Flash crowds | Maximum waiting time guarantees; Computer Science - Cryptography and Security; Computer Science - Cryptography and Security
Description
16 pages, a full technical report for 'A Practical System for
Guaranteed Access in the Presence of DDoS Attacks and Flash Crowds' in IEEE
International Conference on Network Protocols, 2015
Guaranteed Access in the Presence of DDoS Attacks and Flash Crowds' in IEEE
International Conference on Network Protocols, 2015
Type
conference paper