认证确定包标记算法

Authenticated Deterministic Packet Marking Scheme

确定包标记算法只需要边界路由器进行标记,可以对只使用少量包的拒绝服务攻击进行追踪,能同时追踪上千个攻击者,并且易于实现.针对确定包标记算法中,被攻击者控制的路由器(边界路由器或中间路由器)修改标记或加入伪造包,进而妨碍受害者重构入口地址的问题,提出了新的基于MAC认证的确定包标记算法.研究表明,认证确定包标记算法提供了足够的安全性,能有效阻止子网内的攻击者或傀儡路由器伪造虚假的标记,从而保证了受害者端地址重构的准确性.

Deterministic packet marking （DPM） algorithm only requires edge routers to perform packet marking and can trace a large number of attackers simultaneously with only a few packets from each attacker. For that, compromised routers, either edge routers or transit routers, can easily forge packet markings to prevent the victim performing reconstruction successfully. For that, a new scheme, namely MAC - based Authenticated DPM （ ADPM ）, is pro- posed. Researches indicate that ADPM algorithm supplies sufficient security that attackers in subnets or compromised routers cannot forge markings, which assures the veracity of address reconstruction at the victim.