NetFence

摘要: Denial of Service (DoS) attacks frequently happen on the Internet, paralyzing Internet services and causing millions dollars financial loss. This work presents NetFence, a scalable DoS-resistant network architecture. NetFence uses novel mechanism, secure congestion policing feedback, to enable robust inside network. Bottleneck routers update feedback in packet headers signal congestion, access use it police senders' traffic. Targeted DoS victims can as capability tokens suppress unwanted When compromised senders receivers organize into pairs congest link, provably guarantees legitimate sender its fair share resources without keeping per-host state at congested link. We Linux implementation, ns-2 simulations, theoretical analysis show that is an effective solution: reduces amount maintained by router from most per-(Autonomous System).