Using Rhythmic Nonces for Puzzle-Based DoS Resistance

1. Using Rhythmic Nonces for Puzzle-Based DoS Resistance Ellick M. Chan, Carl A. Gunter, Sonia Jahid, Evgeni Peryshkin, and Daniel Rebolledo University of Illinois

2. Agenda Introduction Rhythmic Nonces SYN Puzzles Theoretical Evaluation Experimental Evaluation Concluding Remarks 2

3. Introduction 3

4. Client Puzzles Today Cryptographic nonces: proof of work and freshness in distributed applications Example: client puzzles as proof of work Issued by service provider: costly bookkeeping under heavy load 4

5. Threat model Loss of availability to legitimate clients through stateful server-side resource depletion by malicious clients. Examples: SYN Floods Server-side expensive operations (e.g. cryptographic computations, database queries, etc.) Connection table flooding Attacks that are not addressed: Bandwidth flooding Extremely powerful attacker (100k+ nodes) Attackers controlling core routers 5 Syn floods will be ignored because they don’t have puzzles. Expensive operations are moderated by puzzle difficulty Connection table flooding, will be throttled because time consuming puzzles need to be solved. Bandwidth flooding is not addressed. Unless Routers do puzzle checking. Which in our model is a possibility. Powerful attacker is addressed only somewhat. Puzzles throttle attackers. We model graceful degradation, but enough attackers will degrade us to non operability.Syn floods will be ignored because they don’t have puzzles. Expensive operations are moderated by puzzle difficulty Connection table flooding, will be throttled because time consuming puzzles need to be solved. Bandwidth flooding is not addressed. Unless Routers do puzzle checking. Which in our model is a possibility. Powerful attacker is addressed only somewhat. Puzzles throttle attackers. We model graceful degradation, but enough attackers will degrade us to non operability.

6. Vulnerabilities of Existing Systems