CONTRA Camouflage of Network Traffic to Resist Attack (Intrusion Tolerance Using Masking, Redundancy and Dispersion) DARPA OASIS PI Meeting – Hilton Head – March 12-15, 2002 Janet Lepanto William Weinstein The Charles Stark Draper Laboratory, Inc. Aegis Research Corporation® Aegis Research Corporation

DDoS Flooding Attack is Analogous to Jamming DDoS Flooding Attacks DDoS Flooding Attack is Analogous to Jamming Jammer concentrates energy at a particular frequency and location Jamming Attacker directs traffic against a particular IP address DDoS Flood Frequency Hopping Jamming Defenses IP Address Masking IP Address Hopping Flooding Defenses Energy Dispersion IP Identity Dispersion

Key Ideas Spread the identity of a server across multiple IP addresses Add redundancy to each message, and send a portion of each message to each of the IP addresses of the server If some of the addresses are flooded, that traffic can be dropped The messages can be reconstructed from the remaining traffic Prevent an attacker from associating a set of addresses with a particular server Force the attacker to dilute the attack by spreading the flood across randomly chosen sets of IP addresses

Assumptions CONTRA system comprises a set of cooperating hosts Communicate among themselves over the Internet Servers could be made available to outsiders by designating some of the clients as gateways Attacker attempts to determine address(es) of high value target By monitoring traffic at one or more accessible points of the Internet By analyzing communication patterns Attacker can use public data to determine IP block assignments Attacker knows the organization that is communicating Pipes have sufficient capacity to accommodate the total traffic

Approach Leverage selected aspects of Consider ease of deployment VPNs Anonymity systems Fault-tolerant communications Consider ease of deployment Implement as a communications proxy on top of UDP Redundancy in messages provides reliability Real source IP addresses can be masked Structure protocols to support Continuous operation through attack Distribution of reconfiguration information Monitoring of attack progress Extension to mitigate “insider” attacks

Implementation Messages are sent from a source to a destination host as follows: Messages are encoded with redundancy and divided into N parts, any K<N of which can be used to recover the message The N parts are sent over different paths, each of which contains at least one relay host that functions as a mix The N parts of the message are dispersed across all of the IP addresses that define the destination host The “real” IP addresses of the source and destination, and the message content, are encrypted Only the IP addresses of individual hops are exposed A virtual network topology can be chosen that exposes only a portion of the system’s IP address to an attacker sniffing at a single point

Message Encoding X = -1 X = ? Predetermined Transformation Origin Host Relay Host MESSAGE ? NETWORK M1 M2 M3 T11 T31 T41 T12 T32 T42 T13 T33 T43 -1 T21 T51 T22 T52 T23 T53 SELECT 1, 3, 4 T11 T21 T31 T41 T51 T12 T22 T32 T42 T52 T13 T23 T33 T43 T53 X Z1 Z2 Z3 Z4 Z5 = Z1 Z3 Z5 Z4 Destination Host w/ Multiple IP Addresses Z1 Z3 Z4 X = M1 M2 M3 MESSAGE

CONTRA Packet Structure Encrypted Between Hops Encrypted Source-to-Destination IP Header Transport Header CONTRA Header Payload Contains: Real SourceIP/port Real Destination IP/port K-of-N Encoding Msg Segment Number Padding Source/relay host status Vnet configuration status

Message Relay Relay Host Destination Source

Relay Operations Decrypt CONTRA header Extract real destination Change padding Reencrypt with key of next hop Mix

Server IP Address Assignments Internet Server listens on M >= N addresses K<N parts needed to rebuild message Site Router Server Client Server

Challenges Robustness of traffic mixing “Insider” attacks Minimum level of traffic “Insider” attacks Clients are users as well as relays The CONTRA proxy on the client needs to know the real addresses of CONTRA destinations Need to protect this information