Self-Routing Denial-of-Service Resistant Capabilities Using In-packet Bloom Filters

摘要: In this paper, we propose and analyze an in-packet Bloom-filter-based source-routing architecture resistant to Distributed Denial-of-Service attacks. The approach is based on forwarding identifiers that act simultaneously as path designators, i.e. define which the packet should take, capabilities, effectively allowing nodes along enforce a security policy where only explicitly authorized packets are forwarded. compact representation small Bloom filter whose candidate elements (i.e. link names) dynamically computed at time using loosely synchronized time-based shared secret additional flow information (e.g., invariant contents). capabilities thus expirable flow-dependent, but do not require any per-flow network state or memory look-ups, have been traded-off for additional, though amenable, per-packet computation. Our preliminary analysis suggests self-routing can be effective building block towards DDoS-resistant architectures.