Guaranteeing Access in Spite of Distributed Service-Flooding Attacks

Transcription

1 Guaanting Accss in Spit of Distibutd Svic-Flooding Attacks Vigil D. Gligo Scuity Potocols Wokshop Sidny Sussx Collg Cambidg, Apil 2-4, 2003 VDG 4/2/2003 1

2 I. Focus Lag, Opn Ntwoks - public svics : application and infastuctu svics (.g., scuity, naming) - all clints a lgitimatly authoizd to accss a public svic => cannot distinguish th good (lgitimat clints), bad (advsais), and ugly (flash cowds) => bounds on numb of clints and thi capabilitis a pactically unknown Flooding Vulnability of Public Svs - psists aft all oth typs of DDoS attacks a handld - caus: E2E Agumnt => at gap (ntwok lin at >> public sv at) - at-gap psistnc/incas ov tim => psistnt flooding vulnability - conomic analogy of svic flooding: tagdy of commons E2E Solution: simpl us agmnts - bhavio constaints: clint-sv, clint-clint, o both - dfinition and vification: (1) outsid th svic, and (2) at lin at - conomic analogy: gulation of souc ov-consumption by us noms VDG 4/2/2003 2

3 E2E Solution: Public Svic Flooding cannot b pvntd by ISPs - ISPs: no unusual taffic obsvd in 01 cnn, bay, yahoo! flooding attacks - Ntwok conomics: - Public Svics : picing modl =/= accss modl Rq. Sv... (.g., 679K pps *) N = Max. ntwok lin at Psistnt Rat Gap S = Max. Sv Rat (.g., K pps*) S F = 14 K pps* Tim * packts p scond (Moo, Volk, Savag, Usnix Scuity 2001) * qusts (= packt) p scond * fiwalls fo TCP SYN flood potction VDG 4/2/2003 3

4 II. GOALS Sv Potction - a ncssay but vy wak goal Wakst Guaant: sv sponds to som qusts Clint Guaants => Sv Potction - waiting-tim bounds fo accss to Sv - scop: p qust, p svic - bound quality: vaiabl-dpndnt, -indpndnt of attack, constant MWT - maximum waiting tim FWT - finit waiting tim PWT - pobabilistic waiting tim That: coodinatd svic-flooding attacks by -an unknown numb of clint zombis -with boundd but unknown computational capabilitis Non-Goals: Potction against *mn-in-th-middl QoS guaants (.g., agggat thoughput, cost) VDG 4/2/2003 4

5 Fo all clint qusts, Dfinitions MWT maximum waiting tim ([IEEE S&P 83, TSE 84, ICDE 86]) clint qust is accptd fo svic in tim T, wh T is known at th tim of th qust. PWT pobabilistic waiting tim ([Milln, IEEE S&P 92]) P [clint qust is accptd fo svic in tim T] θ, wh T is known at th tim of th qust, θ =/= 0 and is indpndnt of attack. FWT finit waiting tim ( [IEEE S&P 88]) clint qust is accptd fo svic vntually wpwt wak pobabilistic waiting tim P [clint qust is accptd fo svic vntually] p, wh p =/= 0. WPWT wpwt w/o th constaint that p =/= 0. Simila dfinitions fo P-Svic Waiting Tims: MWTs (.g., al tim), PWTs (FWTs, wpwts) P-Svic Waiting Tim => P-Rqust Waiting Tim guaant VDG 4/2/2003 5

6 Rlationships among Waiting-Tim Dfinitions Exampls of Us Agmnts MWTs FWTs MWT FWT wpwts wpwt som clint accss WPWT PWTs xplicit at-contol agmnts PWT simpl xampl 2 simpl xampl 1 puzzl auctions+ assumption [WR03] clint puzzls [DN92, JB99, ANL00, DS01] VDG 4/2/ Lgnd: = implis FWT <=/=>PWT

7 Gnal Obsvations Lay m - 1 DoS fdom - laying : DoS fdom at lay m-1 Lay m DoS fdom cannot b implmntd fom lay m (1) DoS fdom at lay m ==> DoS fdom at lay m-1 (not an E2E solvabl poblm, vn if th Ends coopat) (2) DoS fdom at lay m <=/= DoS fdom at lay m-1 (nd a solution fo lay m dfns vn if lay m-1 is DoS f) (3) Solution fo DoS fdom at lay m-1 cannot always b plicatd at lay m (likly to nd a distinct solution;.g., no sv pushback of clints) Challng: assuming that lay m-1 is DoS f, povid a solution that assus DoS fdom to a svic at lay m VDG 4/2/2003 7

8 III. Us Agmnts (1) Rat Gap => Undsiabl Dpndncis among Clints [IEEE S&P 83]: (viz., th tagdy of commons ) Clint 1 U s Clint i A g guaantd qust-dlivy path (lay m-1) Svic (lay m) Clint n m n t. s dpndncis (2) Us Agmnts [IEEE S&P 88] count undsiabl dpndncis, VDG 4/2/2003 8

9 Us-Agmnts 1. Exampls in Oth Aas 2. What do Clint Puzzls Achiv? -only that som clints gt accss to th sv 3. Explicit Contol of Clint Rqust Rat - tim-slot svation, total oding (.g., a Baky Mchanism ) 4. Gnal Rqust Contols VDG 4/2/2003 9

10 1. Exampls of Us Agmnts in Oth Aas (p us) local stat infomation quid - binay xponntial back-off agmnt fo (slottd) Ethnt collision handling - splitting algoithms fo collision handling in slottd multi-accss potocols - two-phas locking agmnt of distibutd tansactions fo maintaining data consistncy - odd souc qust agmnts fo dadlock pvntion global stat infomation quid - slf-stabilization agmnts in distibutd contol poblms (.g., pvnt stavation in Dijksta s dinning philosophs poblm) statlss - clint-sid, packt-filting; pushback agmnts in outs VDG 4/2/

11 1. Clint Puzzls basd on Hash Functions 1. Challng: givn k, find X Rspons: Mssag X Vification: h(mssag X) 2. Challng: givn k, h(x), Rspons: Mssag X 00 0 don t ca k bits 1 k 64 m-k Vification: bits m = don t ca h(mssag X) = h(x) k bits m-k bits 1 k 64 m 512 Avag Latncy p Clint: 2 k stps VDG 4/2/

12 A d v s a y Clint 1... Clint Z... Clint n C l i t P u z z l q. aival intval: c N Popty 1: Solution Latncy Clint Puzzl Modl Sv L L VDG 4/2/ Sτ Tim Buff c 3 2 k -1 /s c = (t Z -t L)+ (L/S-τ) + c N With high pobability a) Z 2L+2 (6L + 9) + 6 clints solv at last L puzzls in 2 k -1 Z stps (in tim 2 k -1 /s) b) Z solv at last Z puzzls in 2 k +1 Z stps (in tim 2 k +1 /s) S

13 Popty 2: Rqust-Rat Contol (WPWT): N Z k S ov intval t L +c <=> k 1+ log(z/s-c )s, wh c < Z/S N = Max. nt. ( lin ) Rat q._at X k 0 < k 1 <.... < k S = Max. Sv Rat Ent Puzzl Mod c Min. Sv Rat Exit Puzzl Mod t 0 t 1 t t L t Z L/S-τ c N tim VDG 4/2/

14 A d v s a y Clint 1... Clint Z... Clint n C l i t P u z z l Puzzl Auctions [WR03] bid k i+1 > k 1? no dop wak PWT k 1... Sv pmpt ys k 1 < k i dop k i... Sτ L > Z/2 < k k S P [any clint C s qust is accptd fo svic in tim T] = P [any clint C s qust is accptd fo svic in R+1 ounds k 0, k 1,,k ] =1-P[any clint C s qust is dnid at ound R+1] 2 ko-1 (2 1 -(1-2 -k o ) L/Z-τsΠ ki-1-2 ki-1-1 )L/Z R i=1 (1-2 -k i ) = p > 0 Dpndncy on attack paamt Z VDG 4/2/

15 Attack Coodination Goal: Dny Stong Guaants (FWT, PWT, MWT) Agg. Rq. Rat doppd qust ty accptd N S Agg. Rq. Rat doppd qust N k 0 N k z 1 z doppd ty doppd ty N z k 2 N z k 3 doppd ty N S k 0 k 1 Cood. q. k 2 Cood. q. t 0 t 1 t 2 t 3 Cood. q. Tim Coodinatd Attack fo a k 0 < k 1 < k 2 < k 3 squnc k 3 k 0 k 1 k 2 k 3 t 1 L δ t 2 L δ p 1-p t3 L L/N z k i < δ < Z/S p = max(p i ), i = 1,,m P [clint q. is accptd within m tis] < p Σ i=0 (1- p) i = 1-(1- p) 1+m < 1 m δ k 4 (= k 0 ) Tim VDG 4/2/

16 What Do Clint Puzzls Achiv? vy wak clint guaants at high Clint Guaants? WPWT (by P2) wpwt (with assumption L > Z/2) no PWT, no FWT => no MWT and unncssay qust ovhad. andom schduling (with pmption) achivs wpwt (PWT) VDG 4/2/

17 Exampl 1: Random Sτ = L < Nτ (w/o pmption) A d v s a y Clint 1... Clint Z... Clint n R q. R t y q./ty Nτ dop Nτ -L wak PWT Sv andom L m... L = Sτ n i /Sτ = no. of qusts civd / pocssd at ound i; S/N min {Sτ/n i }, i = 1,, P [clint qust is accptd fo svic vntually] P [clint qust is accptd fo svic in ounds] =1-P[clint qust dlayd to ound ] p = 1- (1- S/N) -> 1 Dpndncy on attack paamt VDG 4/2/ k... j S

18 A d v s a y 2. Exampl 2: Random L = Sτ with Pmption Clint 1... Clint Z... Clint n R q. R t y q./ty PWT = 0 dop and. no. [0, L] Sv 0 (1 i L) pmpt L L = Sτ dop P[q./ty is accptd by Sv in T +τ] = P[q_buff[1 L] q./ty in ] x P[q./ty not doppd in τ] [1-1/(L+1)] x [1/(L+1)+(L-1)/(L+1)] n = [L/(L+1)] 1+n [Sτ /(Sτ +1)] 1+Nτ = ρ =/= 0 (indpndnt of th numb and agggat qust at of zombis ). VDG 4/2/ i S

19 3. Ida: Explicit Contol of Clint Rqust Rat + Maximum Waiting Tim Guaants Phas 1: Clint-Polifation Contol (Statlss Sssion) Cooki => Rvs Tuing Tst (.g., CAPTCHA) passd -focs human-lvl collusion and coodination on global scal Phas 2: Rqust-Rat Contol fo Individual Clints Svic Rq. => Valid Rat-Contol Tickt => Valid Cooki (=> solvd puzzl, no Phas 1) - tickt: tim-slot svation, total oding (.g., a Baky Mchanism ) VDG 4/2/

20 Phas 1: Clint-Polifation Contol Untustd Host i Clint 1 Rq... Clint i... Rq 1. Rqust Cooki CAPTCHA Challng-Rspons 2. Cooki 5. Rq, Tickt 3. Rqust Tickt, Cooki 4. Tickt Cooki / TKT Sv - opat at ntwok lin at - sha ky - loos t. sync. TKT Vifi Rq Svic Clint n Rq Phas 2: Rqust-Rat Contol fo Individual Clints Cooki / Tickt duplication by Clints? thft, play by Clints? VDG 4/2/

21 Clint Rqust-Rat Contol: Tim-Slot Rsvation k tickts w 1 w 2 w i clint qusts = Σ w i T 1 us 1 cooki T 2 1 tkt 1-k t 1 t 2 t 3... t i t j 1 w i /k L/k L/s t = t i+1 -t i L/S... tkt 1 1 = t 1,t 2, cnt 1 tkt 1 2 = t 1, t 2, cnt... 2 tkt 1 k = t 1, t 2, cnt k t 1 -t 2 = t L/S * t = tim at sv = w 1 L k IPaddC 1 IPaddC 2 IPaddC k t*mac 1 t*mac 2 t* MAC k VDG 4/2/

22 Cookis and TKTs: simila function, diffnt tim scal.g., cooki = T i, T j, tkt.cnt, IPadd_list, t, MAC Sliding Tim Window cachs of TKTs Vifi of TKT Sv Packt filting in Accss-Point Routs (counts lag-scal IP spoofing; alady dployd) Optimization: Tickt Count w opt ; Window t opt = t i+1 t i? 1. Effct of unusd svations => small t i+1 t i =L/S. w= 1, k = 1 => Total Oding of Rqusts (low impact TGS taffic;.g., contnt distibution, potocol xchangs) 2. Rducing Clint TKT Sv communication => all L qusts in on tickt and lag t i+1 t i L/S. (high-impact TGS taffic;.g., high-spd, busty tansactions) w = L, k =1 => Sv Undutilization (by zombis not issuing qusts) VDG 4/2/

23 Simpl Optimization: w opt, t opt C total = C clint + C sv = c 1 A /w + c 2 (1-)w, wh w = total numb of qusts in a window (fo all that window s tickts) c 1 = communication cost fo gtting a tickt fom TGS c 2 = sv-utilization cost of waiting fo a qust not issud within w A = avag numb of Application Rqusts (Clint -> Sv qusts) = pcntag of lgitimat clints ( 0 < 1) δ C total / δw = 0 => w opt = c 1 A c, constaind by 1 w opt L 2 (1-) L/S t opt = w opt /S L/s Simulations Paamts: c 1 /c 2,, A Pocsss: clint qust, svic spons Attack chaactization: low int-aival tims of clint qusts to TGS, low, high A VDG 4/2/

24 What can Gnal Rqust Constaints Achiv? Additional constaints on Clint Rqusts Exampls - MWT fo coodinatd qusts fom Clints to Svs und attack Clint qusts to multipl Svs application-latd Clints qusts to Svs (.g., is Σ MWT i fo Clint i qusts to Sv i within T? in [t 1, t 1 ]?) - patchs: safty constaints not nfocd in Sv (.g., paamt constaints) VDG 4/2/

25 SUMMARY 1) poblm duction: flooding fdom of a simpl (distibutd) svic - RCS Svic (Sv 1,, Sv k) has spcializd, simpl function max. svic at of TKT Svic is at ntwok at o abov flooding is impossibl 2) maximum waiting tim (MWT) p qust - qust-at contol fo individual clints (.g., clint puzzls fo TKT qusts) - potction against TKT thft - packt filting on IP add. at accss-point outs, sliding-tim-window cachs of TKT us - poblm: long MWT 3) asonabl MWT fo lgitimat clints - contol of clint polifation - vs Tuing tsts (CAPTCHAs), statlss cookis - potction against cooki thft (sam as fo TKT thft) VDG 4/2/