A Dynamic Packet Stamping Methodology for DDoS Defense Project Presentation by Maitreya Natu, Kireeti Valicherla, Namratha Hundigopal CISC 859 University of Delaware

05/11/2004 CISC Outline Objectives Problem Description Related Work Proposed Solution Implementation Details Results Future Work Conclusion

05/11/2004 CISC Objectives of the Project Propose a new simple and effective solution to stamp IP packet to enable easy authentication of IP packets so as to counter DDoS Attacks. Implement the above solution and conduct experiments on emulab testbed to verify its effectiveness.

05/11/2004 CISC Problem Description DDoS is enormous threat to Internet. Many public websites available which don’t verify the authenticity of their users. Victims overwhelmed with requests and the legitimate users are denied service.

05/11/2004 CISC Why DDoS difficult to solve? No authentication required to use services Little chance of attacker being caught Difficult to differentiate attack from legitimate traffic Huge Number of Vulnerable machines available Problem of finite resources

05/11/2004 CISC Related Work IP Easy-pass: Edge Resource Access Control by H. Wang, A. Bose, M. El-Gendy, K. G. Shin Practical Network Support for IP Traceback by S. Savage, D. Wetherall, A. Karlin, T. Anderson StackPi by A. Perrig, D. Song. A. Yaar

05/11/2004 CISC IP Easy-pass: Edge Resource Access Control by H. Wang, A. Bose, M. El-Gendy, K. G. Shin What we liked about this paper? –Per Packet Filtering based on IP Easy Pass –Dynamic Passes What we didn’t like about this paper? –Space Overhead –Encryption and Decryption Overhead

05/11/2004 CISC Practical Network Support for IP Traceback by S. Savage, D. Wetherall, A. Karlin, T. Anderson What we liked about this paper? –The use of IP identification field for storing marks in the packets. What we didn’t like about this paper? –Reactive in nature

05/11/2004 CISC StackPi by A. Perrig, D. Song. A. Yaar What we liked about this paper? –Per Packet Filtering –Proactive approach What we didn’t like about this paper? –Stale Pass –Complicated

05/11/2004 CISC Desired Properties in Proposed Solution Simple to implement Limited Overheads Limited increase in end to end delay Per Packet Filtering Easily Deployable Robust

05/11/2004 CISC Proposed Solution Create mechanism which would distinguish legitimate IP packets from attack packets. Drop all the packets which fail the filtering test.

05/11/2004 CISC How to differentiate attack and legitimate packets? Generate Unique ID for each packet Store this key in the IP header’s identification field to avoid space overheads Routers check the packets ID field to check whether the given packet is genuine or not before forwarding to destination (Victim)

05/11/2004 CISC Issues with key generation Complex generation techniques at client so that key spoofing is difficult to do Simple verification at router so that router overhead remains small Keep changing the keys so that attackers don’t have time to predict the keys

05/11/2004 CISC How does our solution work? Generation of keys is done at client Initial communication between client and core router takes place to understand the initial key Generation of legitimate packets takes place Verification of packets done at core routers Router drops or accepts packets based on the key value

05/11/2004 CISC Other Issues We use a sliding window to take care of packet loss or reordering. As we use dynamic pass and not a stale pass replay attacks are also avoided. Our solution can be used with any Transport or Application protocol as we just change IP ID field.

Implementation Details by Maitreya Natu

05/11/2004 CISC

05/11/2004 CISC f1f1 f 100 f 101 Client uses SHA to generate a queue of 101 keys

05/11/2004 CISC f1f1 f 100 f 101 Client sends the 101 st key to the router for before sending the data packets

05/11/2004 CISC f 101 f1f1 f Router receives the key and stores it in a client table Router maintains a window to keep track of arriving packets

05/11/2004 CISC f 101 f1f1 f 99 f Client inserts a new key (here f 100 ) in the IP ID field of each outgoing packet We use the dos code to insert the key in ID field

05/11/2004 CISC f 101 f1f1 f 99 f

05/11/2004 CISC f 101 f1f1 f 99 f

05/11/2004 CISC f 101 f1f1 f 99 f 100 f (f 100 ) = f Router captures each packet and extracts the key from the IP ID field We use capture code to capture incoming packets It identifies the source IP address and accepts packets only with valid IP addresses For each packet with a valid IP address, applies SHA on the ID key to detect if the key is in the window range f 101 f94f94

05/11/2004 CISC f 101 f1f1 f 99 f 100 f (f 100 ) = f Router sets the corresponding bit in the window and forwards the packet

05/11/2004 CISC f 100 f1f1 f 99 f Router sets the corresponding bit in the window and forwards the packet

05/11/2004 CISC f 101 f1f1 f 98 f

05/11/2004 CISC f 101 f1f1 f 97 f

05/11/2004 CISC f 101 f1f1 f 96 f

05/11/2004 CISC f 97 f1f1 f f 97 When the first four bits of the window are set, the window is advanced by 4 bits by setting the client key to the 4 th key (here f 97 ) received

05/11/2004 CISC f 97 f1f1 f 95 f The window is advanced by 4 bits by left shifting by 4 bits to process further packets

05/11/2004 CISC f 101 f1f1 f

05/11/2004 CISC f 101 f1f1 f 92 f

05/11/2004 CISC f 93 f1f1 f f 93 If the first 4 bits are not set due to packet loss, then the window is shifted when the 8 th packet is received, changing the client key to the 8 th key (here f 93 ) received

05/11/2004 CISC f 93 f1f1 f 91 f The window is advanced by 8 bits by left shifting by 8 bits to process further packets

Results By Namratha Hundigopal

05/11/2004 CISC Topology V LAN 5Mb 250 kb 1Mb

05/11/2004 CISC Results Client  20 pkts/sec for 10 sec Attacker  5 – 130 pkts/sec for 15 sec

05/11/2004 CISC Client  20 pkts/sec for 10 sec Attacker  5 – 70 pkts/sec for 15 sec

05/11/2004 CISC

05/11/2004 CISC

05/11/2004 CISC Future Work Implementation of initial handshake between legitimate clients and router Extension of the scheme to achieve a secure end to end path Testing with smart attacks Testing with real time applications

05/11/2004 CISC Conclusion Proposed a stamping technique to identify legitimate packets Implemented the algorithm on emulab testbed It effectively prevents legitimate packets from loss for all flooding rates we considered with negligible increase in end to end delay

05/11/2004 CISC Question or Comments? Thank you