• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>Networking Architecture and Storage, 2007 International Conference on; Guilin,China >Mitigating Denial of Capability with An Notification Mechanism
【24h】

Mitigating Denial of Capability with An Notification Mechanism

机译：借助通知机制缓解拒绝能力

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Denial-of-service (DoS) attacks is a major threat to Internet security. Among numerous defense techniques, recently architecture-level capabilities scheme is a promising one. As a typical and comprehensive capabilities scheme, traffic validation architecture (TVA) tries to limit DoS attacks essentially and completely. Yet its effectiveness suffers from a new kind of DoS attacks, denial-of-capability (DoC), which takes place in the connection-setup step when clients send requests for capabilities. To overcome the DoC attacks, potential attack characteristics are analyzed in detail. And a notification-based mechanism is proposed to mitigate DoC attacks and enhance the robustness of TVA. A capability-enabled router should send a reverse notification with a special and unforgeable source identifier to the source when it has to drop a request packet under DoC attacks. Then an enhanced request packet including the source identifier is returned by the source and verified by the router. The enhanced request packet with higher secure level is processed in enhanced channels instead of unprivileged channels. Moreover enhanced requests are fair-queued based on per-source instead of per-Pi in TVA. Theoretical analysis and simulation results show that the notification mechanism can suppress DoC attacks effectively and make the capabilities architecture more robust and practical.
机译：拒绝服务（DoS）攻击是对Internet安全的主要威胁。在众多防御技术中，最近的体系结构级功能方案是有前途的。作为一种典型且全面的功能方案，流量验证体系结构（TVA）试图从根本上完全限制DoS攻击。然而，其有效性却遭受了一种新型的DoS攻击，即拒绝能力（DoC），这种攻击发生在客户端发送功能请求时的连接设置步骤中。为了克服DoC攻击，详细分析了潜在的攻击特征。提出了一种基于通知的机制来减轻DoC攻击并增强TVA的鲁棒性。启用功能的路由器在遭受DoC攻击时必须丢弃请求数据包时，应向源发送带有特殊且不可伪造的源标识符的反向通知。然后，包括源标识符的增强型请求包由源返回并由路由器进行验证。具有更高安全级别的增强请求数据包将在增强通道而不是非特权通道中进行处理。此外，增强请求是根据每个源而不是TVA中的每个Pi进行公平排队的。理论分析和仿真结果表明，通知机制可以有效地抑制DoC攻击，使功能体系结构更加健壮和实用。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号