Preventing Internet denial-of-service with capabilities

TLDR

In this paper, we propose a new approach to preventing and constraining denial‑of‑service (DoS) attacks. Our architecture requires senders to obtain destination‑issued tokens (capabilities) before transmitting, and these tokens are included in packets so that distributed verification points can confirm legitimacy and discard unauthorized traffic. Our approach overcomes limitations of existing DoS defenses, can be implemented with current technology and incremental deployment, and promotes innovation in application and networking protocols.

Abstract

In this paper, we propose a new approach to preventing and constraining denial-of-service (DoS) attacks. Instead of being able to send anything to anyone at any time, in our architecture, nodes must first obtain "permission to send" from the destination; a receiver provides tokens, or capabilities, to those senders whose traffic it agrees to accept. The senders then include these tokens in packets. This enables verification points distributed around the network to check that traffic has been certified as legitimate by both endpoints and the path in between, and to cleanly discard unauthorized traffic. We show that our approach addresses many of the limitations of the currently popular approaches to DoS based on anomaly detection, traceback, and pushback. Further, we argue that our approach can be readily implemented in today's technology, is suitable for incremental deployment, and requires no more of a security infrastructure than that already needed to fix BGP's security weaknesses. Finally, our proposal facilitates innovation in application and networking protocols, something increasingly curtailed by existing DoS measures.