Mitigating Bandwidth- Exhaustion Attacks using Congestion Puzzles XiaoFeng Wang Michael K. Reiter

Overview Background Congestion puzzles mechanism Implementation and security analysis Experiments Conclusions

Bandwidth Exhaustion Attacks victim zombie attacker Background CP mechanism Implementation Experiments Conclusions

Attack model Can do: Forge any information in packets they send Coordinate their zombies perfectly Compromise some routers Cannot do: Modify a large fraction of the legitimate packets Eavesdrop on most legitimate flow Background CP mechanism Implementation Experiments Conclusions

Puzzles Router Good guy Bad guys Background CP mechanism Implementation Experiments Conclusions

One type of puzzle Random hash function h Client Nonce N c Server Nonce N s Puzzle Solution X mm…m Puzzle difficulty d Client Server Background CP mechanism Implementation Experiments Conclusions

Congestion Puzzles (CP) Apply puzzles at network (IP) level Don’t require attack signatures Only a small fraction of routers needs to implement CP Lightweight implementation within routers Background CP mechanism Implementation Experiments Conclusions

Algorithm overview Congestion !!! 1. Puzzle distribution mechanism Puzzle parameters 2.Puzzle based Rate Limiter Computation flow Bit flow 3. Distributed Puzzle Mechanism Background CP mechanism Implementation Experiments Conclusions

Puzzle distribution PBauPBauPNaupm auRPPSaupsPSaupsPNaupmps RPaupmps Congestion change Background CP mechanism Implementation Experiments Conclusions

Puzzle based rate limiter Control: Control: Function: Function: Background CP mechanism Implementation Experiments Conclusions

Distributed puzzle mechanism s NsNs NsNs N s |N 1 N s |N 2 N s |N 1 N s |N 2 NsNs N s |N 1 |N 3 |N C |X 3 N s |N 1 |N 4 |N C |X 4 N s |N 2 |N 5 |N C |X 5 N s |N 2 |N 6 |N C |X 6 Asking upstream routers to help Blocking reuse of solutions in different paths Background CP mechanism Implementation Experiments Conclusions

Implementation CPU: Checking only part of the solutions Needs only about 0.16% to mitigates Memory: We need to know if a sequence appeared Using Bloom filter requires only 1.1MB Background CP mechanism Implementation Experiments Conclusions

Security analysis Bandwidth allocation: moving from max-min fairness to weighted max-min fairness Malicious routers: can only affect the clients going through it Authentication: prevent cheating clients into solving puzzles Clients recruit: the malicious router can only use solutions needed as well by the clients Background CP mechanism Implementation Experiments Conclusions

Experiments NS-2 network simulator CAIDA’s Skitter map of real internet topologies 1500 paths: 500 legitimate (simulating surfing) and zombies (300kbps UDP) Congested link bandwidth: 20Mpbs Other: 30Mbps Simulating the puzzle solving delay Background CP mechanism Implementation Experiments Conclusions

Puzzle difficulty (d) Background CP mechanism Implementation Experiments Conclusions

Partial deployment (1) Background CP mechanism Implementation Experiments Conclusions

Partial deployment (2) Background CP mechanism Implementation Experiments Conclusions

Conclusions Congestion puzzles as a new countermeasure to bandwidth exhaustion attacks May encourages the owners of zombies to change their attacks Future work: Using attack signatures Using memory bound instead of computation May help managing flash crowds Background CP mechanism Implementation Experiments Conclusions

Thank you! Presented by Amitai Reuvenny

HW assignment What is the assumption on the attack that lets us use lightweight authentication schemes ? Describe what is the different between weighted averaging and exponential averaging How will a bloom filter with 16 bits and 2 functions: X mod 13, (X mod 11) + 5 look after adding the numbers 55 and 32 ? What is free riding and what can be done to mitigate it ?