CT-ER: A DoS-resistant Internet Architecture

CT-ER：抗 DoS 的互联网架构

• 批准号: 0627787
• 负责人: Xiaowei Yang
• 金额: $ 20万
• 依托单位: University of California-Irvine
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-08-15 至 2009-11-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627787&HistoricalAwards=false
• 关键词: CT; ER; DoS; resistant; Internet

This research is to design and evaluate an Internet architecture that is resistant to Denial-of-Service (DoS) flooding attacks of any scale. DoS attacks have become an increasing threat to the reliability of the Internet. These attacks are capable of knocking any user, site, and server right off the Internet. This research targets the root cause of the DoS flooding problem: the network's inability to intelligently handle overload. When DoS attacks occur, the network drops legitimate traffic and attack traffic alike, leading to heavy losses of legitimate traffic, which in turn triggers the TCP-friendly backoff of legitimate clients, further reducing the volume of legitimate traffic. One approach to robustly distinguish legitimate and attack traffic is network capabilities. Capabilities are short-term authorizations that senders request from receivers and stamp on their packets. They allow a destination to classify traffic into two broad categories: authorized traffic and unauthorized traffic. With capabilities, the network is able to discard unauthorized traffic in favor of authorized traffic, and protects authorized communications from unauthorized attempts. This research will design and evaluate a DoS-resistant network architecture that builds on the concept of capabilities. It will also compare the costs and benefits of this solution with solutions that build on other primitives, such as black-list filters.

这项研究是为了设计和评估一种耐拒绝服务（DOS）洪水攻击的互联网体系结构。 DOS攻击已成为对互联网可靠性的日益威胁。这些攻击能够将任何用户，站点和服务器立即击倒。这项研究针对DOS洪水问题的根本原因：网络无法智能处理过载。当DOS攻击发生时，网络会降低合法的流量并攻击交通，从而导致合法流量的损失，这反过来触发了合法客户的TCP友好型退缩，从而进一步减少了合法流量的数量。强大区分合法和攻击流量的一种方法是网络功能。功能是短期授权，发件人从接收器请求并在数据包上盖章。他们允许目的地将流量分为两个广泛的类别：授权流量和未经授权的流量。借助功能，该网络能够丢弃未经授权的流量以支持授权的流量，并保护授权的通信免受未经授权的尝试。这项研究将设计和评估以功能概念为基础的抗DOS网络体系结构。它还将将该解决方案的成本和收益与基于其他原始图的解决方案（例如黑名单过滤器）进行比较。