基于增强权证的无状态过滤机制

Stateless Filtering Based on Enhanced Capabilities

该文针对拒绝服务攻击的防御技术,着重分析了新涌现的权证技术,包括基本思想、无状态过滤和通信量验证体系。探讨了权证能否引发新的攻击和对网络传输性能的影响,针对已有方案的一些技术缺陷提出了改进对策,包括:用通知保护权证请求,多级别权证,动态的权证分配。理论估算和仿真试验表明,这些方法能更好地兼顾安全性和效率性,性能明显优于原方案,提高了权证技术的可行性。

Major defensive mechanisms against DoS attacks in the Internet are reviewed. Especially the most recent capabilities techniques, such as basic concepts, stateless flow filtering and the Traffic Validation Architecture （TVA）, are analyzed deeply. The related discussions about the shortcomings of current capabilities techniques, such as potential Denial-of-Capability （DoC） attacks, decrement of transmission efficiency, are given in detail. Some improvement methods are provided. They include protecting capabilities requests with notifications, bi-level capabilities, flexible and dynamical capabilities assignment, etc. These methods enhance the robustness and efficiency of capabilities. Theoretical evaluations and simulations show that the improvements outperform original schemes and are more practical in the Internet.