IP spoofing hinders the efficiency of DDoS defenses. While recent proposals of IP spoofing prevention mechanisms are weak at filtering spoofing packets due to the complexity in maintaining source IP spaces and the low...IP spoofing hinders the efficiency of DDoS defenses. While recent proposals of IP spoofing prevention mechanisms are weak at filtering spoofing packets due to the complexity in maintaining source IP spaces and the low incentive of deployments. To address this problem, we propose an efficient mechanism to extend the range of inter-domain IP spoofing prevention called MASK. Source MASK nodes inform destination MASK nodes about the source IP spaces and labels of their neighbor Stub-ASes in order to implement the marking and verification of packets towards the Stub-ASes, and limit the number of MASK peers through the propagation of BGP updates so as to reduce the overheads of computing and storing of labels. By utilizing the method of extending the spoofing prevention to Stub-ASes, MASK can not only enlarge the domain of the spoofing prevention service, but also filter spoofing packets in advance. Through analysis and simulations, we demonstrate MASK＇s accuracy and effectiveness.展开更多
IP source address spoofing is regarded as one of the most prevalent components when launching an anonymous invasion, especially a Distributed Denial-of-Service （DDoS） attack. Although Source Address Validations （S...IP source address spoofing is regarded as one of the most prevalent components when launching an anonymous invasion, especially a Distributed Denial-of-Service （DDoS） attack. Although Source Address Validations （SAVs） at the access network level are standardized by the Internet Engineering Task Force （iETF）, SAV at the inter-Autonomous System （AS） level still remains an important issue. To prevent routing hijacking, the IETF is constructing a Resource Public Key Infrastructure （RPKI） as a united trust anchor to secure interdomain routing, in this study, we creatively use the RPKI to support inter-AS SAV and propose an RPKI-based Inter-AS Source Protection （RISP） mechanism. According to the trust basis provided by the RPKI, RISP offers ASes a more credible source-oriented protection for the IP addresses they own and remains independent of the RPKI. Based on the experiments with real Internet topology, RISP not only provides better incentives, but also improves efficacy and economizes bandwidth with a modest resource consumption.展开更多
基金the National Basic Research Program of China (973 Program) (Grant Nos. 2003CB314802 and 2005CB321801)
文摘IP spoofing hinders the efficiency of DDoS defenses. While recent proposals of IP spoofing prevention mechanisms are weak at filtering spoofing packets due to the complexity in maintaining source IP spaces and the low incentive of deployments. To address this problem, we propose an efficient mechanism to extend the range of inter-domain IP spoofing prevention called MASK. Source MASK nodes inform destination MASK nodes about the source IP spaces and labels of their neighbor Stub-ASes in order to implement the marking and verification of packets towards the Stub-ASes, and limit the number of MASK peers through the propagation of BGP updates so as to reduce the overheads of computing and storing of labels. By utilizing the method of extending the spoofing prevention to Stub-ASes, MASK can not only enlarge the domain of the spoofing prevention service, but also filter spoofing packets in advance. Through analysis and simulations, we demonstrate MASK＇s accuracy and effectiveness.
基金supported by the National Natural Science Foundation of China Nos.61772307 and 61402257the National Key Basic Research and Development(973) Program of China Nos.2009CB320500 and 2009CB320501Tsinghua University Self-determined Project under grant No.2014z21051
文摘IP source address spoofing is regarded as one of the most prevalent components when launching an anonymous invasion, especially a Distributed Denial-of-Service （DDoS） attack. Although Source Address Validations （SAVs） at the access network level are standardized by the Internet Engineering Task Force （iETF）, SAV at the inter-Autonomous System （AS） level still remains an important issue. To prevent routing hijacking, the IETF is constructing a Resource Public Key Infrastructure （RPKI） as a united trust anchor to secure interdomain routing, in this study, we creatively use the RPKI to support inter-AS SAV and propose an RPKI-based Inter-AS Source Protection （RISP） mechanism. According to the trust basis provided by the RPKI, RISP offers ASes a more credible source-oriented protection for the IP addresses they own and remains independent of the RPKI. Based on the experiments with real Internet topology, RISP not only provides better incentives, but also improves efficacy and economizes bandwidth with a modest resource consumption.
