A Cost-Based Framework for Analysis of Denial of Service in NetworksWhat is a DoS Attack ?Attack Architecture – Direct AttacksExample – SYN FloodingAttacker v/s. DefenderContribution of the paperFrameworkSlide 8Station to Station ProtocolAlice-and-Bob SpecificationsProtocol SpecificationCost FunctionsDefinitionSlide 14Evaluating Protocol SecurityStation-to-Station ProtocolTools & ModelsComments on the PaperQuestions ???A Cost-Based Framework for Analysis of A Cost-Based Framework for Analysis of Denial of Service in NetworksDenial of Service in NetworksAuthor: Catherine MeadowsAuthor: Catherine MeadowsPresenter: Ajay Mahimkar Presenter: Ajay MahimkarWhat is a DoS Attack ?What is a DoS Attack ?Malicious attempt by a group of people to cripple Malicious attempt by a group of people to cripple an online servicean online serviceFlood the victim (server) with packetsFlood the victim (server) with packetsOverload packet processing capacityOverload packet processing capacitySaturate network bandwidthSaturate network bandwidthTwo Types of DoS AttacksTwo Types of DoS AttacksResource Exhaustion AttacksResource Exhaustion AttacksBandwidth Consumption AttacksBandwidth Consumption AttacksAttack Architecture – Direct AttacksAttack Architecture – Direct AttacksAttackerZombie 1VictimZombie 2Zombie 3Direct traffic towards victimSrc: random Dst: victim“zombies” send streams of spoofed traffic to victimExample – SYN FloodingExample – SYN FloodingEstablishment of TCP connection Establishment of TCP connection using three-way handshakeusing three-way handshakeAttacker makes connection requests aimed at the victim server with packets from spoofed source addressesTCP ClientMalicious TCP ClientTCP ServerVictim TCP Server SYN SYN / ACK ACK SYN SYN / ACK802312?80Service Ports ( 1 – 1023)Service Ports ( 1 – 1023)Client PortsClient PortsSYN Packet with spoofed IP address1Attacker v/s. DefenderAttacker v/s. DefenderGoal of the attackerGoal of the attackerMake the defender waste its resources by interacting Make the defender waste its resources by interacting with the attackerwith the attackerPrevent the defender from learning its identityPrevent the defender from learning its identityDefense against DoS AttacksDefense against DoS AttacksReduce the cost to the defender of engaging in the Reduce the cost to the defender of engaging in the protocolprotocolIntroduce some sort of authenticationIntroduce some sort of authenticationFormal methodsFormal methods are a good way to analyze DoS are a good way to analyze DoSContribution of the paperContribution of the paperFramework to evaluate a protocol for resistance Framework to evaluate a protocol for resistance to DoS attacksto DoS attacksCost-based ModelCost-based Model for the list of actions taken by for the list of actions taken by the attacker and the defenderthe attacker and the defenderCompare the cost to the attacker with the cost to Compare the cost to the attacker with the cost to the defenderthe defenderFrameworkFrameworkAssign costs of engaging in individual actionsAssign costs of engaging in individual actionsCompare costs of defender and attackerCompare costs of defender and attackerIncorporate Gong-Syverson’s fail-stop modelIncorporate Gong-Syverson’s fail-stop modelA protocol is fail-stop if it halts upon detection of any A protocol is fail-stop if it halts upon detection of any bogus message (replay or message from intruder)bogus message (replay or message from intruder)Requires strong authentication making itself Requires strong authentication making itself vulnerable to DoS attacksvulnerable to DoS attacksFrameworkFrameworkModified Fail-stop ProtocolModified Fail-stop ProtocolExtension to any action taken by a principal, not just Extension to any action taken by a principal, not just the acceptance of a messagethe acceptance of a messageDefine a function Define a function FF from actions to costs from actions to costsProtocol is fail-stop with respect to Protocol is fail-stop with respect to FF, if a principal cannot be , if a principal cannot be tricked into engaging in a protocol up to and including action tricked into engaging in a protocol up to and including action AA, unless attacker expends an effort of more than , unless attacker expends an effort of more than F(A)F(A)Protocol is insecure against DoS attacks, if Protocol is insecure against DoS attacks, if F(A)F(A) is trivial for is trivial for the attacker as compared to that of the defenderthe attacker as compared to that of the defenderStation to Station ProtocolStation to Station ProtocolUses Diffie-Hellman protocol along with digital Uses Diffie-Hellman protocol along with digital signatures for key exchange and key signatures for key exchange and key authentication between two principalsauthentication between two principalsA B : gA B : gXXAAB A : gB A : gXXB B , E, EKK (S (SBB(g(gXXB B , g, gXXAA))))A B : EA B : EKK (S (SAA(g(gXXA A , g, gXXBB))))• g – generator of the group• XA – A’s secret• XB – B’s secret• K – shared secret between A & BK = g g XXB B .. XXAAAlice-and-Bob SpecificationsAlice-and-Bob SpecificationsIt is a sequence of statements of the form It is a sequence of statements of the form A B : TA B : T11, T, T22, …, T, …, Tkk || M || O || M || O11, O, O22, …, O, …, Onn TTii – operations performed by A, and – operations performed by A, and OOjj – operations performed by B – operations performed by BThree Types of EventsThree Types of EventsNormal Events (send and receive)Normal Events (send and receive)Verification Events (occur only at receiver)Verification Events (occur only at receiver)Accept Event (OAccept Event (Onn))Desirably precedes relationDesirably precedes relationProtocol SpecificationProtocol Specification1.1.A B : A B : preexppreexp11, storename, storename11 || || ggXXAA || || storenoncestorenonce11, storename, storename22, accept, accept112.2.B A : B A : preexppreexp11, sign, sign11, exp, exp11, encrypt, encrypt11 || || ggXXB B , E, EKK (S (SBB(g(gXXB B , g, gXXAA)))) || || checknamecheckname11, retrievenonce, retrievenonce11, exp, exp22, decrypt, decrypt11, , checksigchecksig11, accept, accept223.3.A B : signA B : sign22, encrypt, encrypt22 || || EEKK (S (SAA(g(gXXA A , g, gXXBB)))) || ||
View Full Document
Unlocking...