Upload
geona
View
20
Download
0
Tags:
Embed Size (px)
DESCRIPTION
Using Self-interest to Prevent Malice Fixing the Denial of Service Flaw of the Internet. Bob Briscoe Chief Researcher, BT Group Oct 2006 Credits: Martin Koyabe, Carla Di Cariano-Gilfedder, Arnaud Jacquet. intro. defend against what attackers could do not what they do - PowerPoint PPT Presentation
Citation preview
Using Self-interest to Prevent MaliceFixing the Denial of Service Flaw of the Internet
Bob BriscoeChief Researcher, BT GroupOct 2006
Credits: Martin Koyabe, Carla Di Cariano-Gilfedder, Arnaud Jacquet
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
2
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
context & problem
• infrastructure must serve v large population• even during genuine flash crowds of demand
• most cost-effective attack: flood requests during flash crowd• when most people need/value a service most
• when least effort needed to tip it over the edge
• assume virus-prone end systems won’t go away• cell phones, TVs, MP3 players, game boxes, domestic control systems
• attackers can amass 100,000s into zombie botnets• can and do saturate even the biggest links in the Internet at will
• other approaches all try to detect attack traffic• then block future attempts from same source address
• they need to stop attackers faking different source addresses for each packet
• still problem with floods of single packets
• with this mindset, researchers have defined success as
– forcing an attacker to imitate a flash crowd
defend against what attackers could donot what they do
need to win the last battlenot just the next one
defend against what attackers could donot what they do
need to win the last battlenot just the next one
intro
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
3
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
status
• one result of 3yrs research to fix Internet architecture• prime directive: don’t unduly restrict Internet’s ability to foster surprises
• fixed Internet resource sharing – DDoS fix a pleasant consequence
• plan to do whatever it takes to standardise into IP• 2005 full standards specs drafted
– been progressing them through IETF
• propose to use last undefined bit in IP packet header
– we don’t underestimate the task ahead
• huge effort trying to pervert protocol• two major flaws successfully fixed without additional complexity
• seeking wider collaboration• co-operative or adversarial
status
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
4
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
approach
• fix generic IP layer first• will raise the bar (increasing attacks on higher layer vulnerabilities)
• treat DoS for what it is: extreme congestion – an externality• genuine sources should slow down in response to congestion
• voluntary response inherent to current Internet design• persistently sending fast into high congestion is never genuine behaviour• don’t need to judge good/bad, ISP can just force response to congestion• stability of Internet depends on congestion response anyway
• designers don’t mandate congestion response, each ISP does • market decides• but relevant ISP liable for externality if it doesn’t act
• focus on liabilities between networks• enforce liability for congestion externality, but recursively
• NB liable for congestion it lets into NC and onward
• NA liable for congestion it lets into NB and onward
legend
network
packet flow from source to receiver
congested link
Si Rj
NA
NB
NCS1
S3
ND
S2
R4
policer
¥
fixedsubscription
$
variable congestion
cost
$
variable congestion
cost
• requires solution to an inherent information asymmetry in IP• requires solution to an inherent information asymmetry in IP
solution
P2P
P2P
Web
P2P 76
7
8
5
3
P2P
P2P
Web Web
6
5
3
1
1
Web
Web 2
2
4
8
4
info symmetry solution
re-feedbackbase scenario: no attack
animation requires Office XP or equivalent
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
6
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
solution packetpacket
network (IP) headersufficient to
deliver packet
payload (including TCP)hidden from networks
black proposed for IP
solutioninformation symmetry‘re-feedback’
• routers approaching congestion mark some packets red receiver feeds back to sender– already standardised & implemented
– not generally turned on by operators
• sender re-inserts feedback by marking packets black– re-feedback requires standardisation
• routers approaching congestion mark some packets red receiver feeds back to sender– already standardised & implemented
– not generally turned on by operators
• sender re-inserts feedback by marking packets black– re-feedback requires standardisation
• currently NA contracts with NB to deliver packets but without information about NB’s quality (congestion)
• S1 has this information, so make it reveal it
0%
markingfraction
resourceindex
NANB
NC
R4S1
3%
feedback std in TCP
3%red std in IP
$ $
black – red
• flows get no further than their ‘fare’ pays for• routers discard persistent negative balance
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
7
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
solution
ND
NA
NB
NC
aggregation internalisation of externalities
downstreamcongestionmarking [%]
bit rate
large step implies highly congested link
area =instantaneousdownstream
congestion
total area =aggregate
downstream congestion
legend
metering per month:
bulk volume black – red
metering per month:
bulk volume black – red
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
8
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
solution
congestion policer one example: per-user policerbase scenario: no attack many possibilities – up to ISPs
two different customers, same deal
non-interactive long flows(e.g. P2P, ftp)
interactive short flows(e.g. Web, IM)
overdraftcongestionvolumeallowance
NANB
R1S1
policerpolicer
animation requires Office XP or equivalent
WebClient
Web Server
BOTAgent
BOTAgent
BOTAgent
BOTAgent
WebClient
BOTAgent
distributed denial of service (DDoS) attackstrategy #1
animation requires Office XP or equivalent
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
10
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
effect
BOT agent attack traffic
interactive short flows(e.g. Web, IM)
overdraftcongestionvolumeallowance
per-user congestion policerDDoS attack strategy #1
NANB
R1S1
policerpolicer
animation requires Office XP or equivalent
WebClient
Web Server
BOTAgent
BOTAgent
BOTAgent
WebClient
BOTAgent
BOTAgent
distributed denial of service (DDoS) attackstrategy #2
animation requires Office XP or equivalent
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
12
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
will re-feedback prevent DDoS?≡ will it be deployed widely enough?
• deployment bootstrap incentives
• deployment closure incentives• doesn’t have to finish the job itself
• can create right incentives to deploy complementary solutions
• once fully deployed, winning the war• distinguishing genuine flash crowd from simultaneous attack
deployment
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
13
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
deployment bootstrap incentives
• deployment effectively involves architectural change1. (minor) change to sender’s Internet stack
2. network deploys edge/border incentive functions
• preventing gridlock between these actors requires strong incentives
deployment
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
14
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
deployment
deployment bootstrap incentives
bundling with itself• re-feedback solves central cost control problem of ISPs
– third party services competing with ISP pay below network cost– ISP has to compete while paying balance of competitor’s costs
• hits very big fear and button and greed button• but keeps moral high ground
– net neutral and doesn’t help lock-in or lock-out• re-f/b as a solution to DDoS bundled with re-f/b as cost-control
• alliance deployment strategy• 3GPP alliance has most to lose from not deploying, followed by NGNs• controls vertically integrated network and mobile terminal market
deployment by cross-infection• nomadic, roaming devices
inverse bundling• can degrade a substitute product (legacy network service without re-feedback)• generally useful model for security products – tend to restrict rather than enhance
novel deployment models wrt Ozment & Schechter
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
15
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
deployment
deployment closure incentives
• assume 1st mover (cellular industry?) has deployed
• 2nd movers (NGNs?) didn’t because benefit lower than cost (if rational) • but first mover removed costs (risks of unknown, R&D recovered)
• early adopters also change operational finances for non-adopters...
• money valve effect• between adopters and non-adopters
• re-feedback controls congestion costs for adopters
• peaks in incoming traffic demand drive money inward
• outgoing traffic peaks only generate averaged money flow
– costs of non-adopters depend on peak not average
• stronger effect, the more variance in demand
• DDoS is extreme variance in demand
• like alternating current through a diode/valve
• chain reaction• adopters’ incoming border charges focus on non-adopters
• bots concentrate into smaller non-adopter space
• money valve effect surrounds more of non-adopters’ borders
$£¥
€
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
16
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
deployment
winning the last battle (not just the next)distinguishing flash crowds from attacks
• incentives not to be too greedy• a rate policer is effectively a revenue limiter
• if policer allows DDoS attacks, customer has to buy bigger quota
• why would operators try to distinguish the two?
• customers will switch to responsible operators • distinguishing true demand form zombies is in operator’s interest
• fortunately society still civilised enough • huge white market revenue not worth risking
– just to capture marginal gains from black market
• strategic greed overcomes myopic greed
Self-interest can Prevent Malice
Q&A
th
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritth
e c
ulp
ritco
nges
tion
cong
estio
nch
argi
ngch
argi
ngco
nges
tion
cong
estio
nch
argi
ngch
argi
ngre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kre
-fee
dbac
kac
coun
tabi
lity
acco
unta
bilit
yac
coun
tabi
lity
acco
unta
bilit
ysu
mm
ary
sum
ma
rysu
mm
ary
sum
ma
ry
18
intr
oin
tro
intr
oin
tro
sta
tus
sta
tus
sta
tus
sta
tus
solu
tion
solu
tion
solu
tion
solu
tion
effe
cte
ffect
effe
cte
ffect
dep
loym
en
td
eplo
yme
nt
dep
loym
en
td
eplo
yme
nt
solution
incentive frameworkdownstreampathcongest-ion
index
NANA
NBNB
NENE
NCNC
NDND
R4
S1
policerpolicerdropperdropper
bulk congestion pricingbulk congestion pricingbulk congestion chargingbulk congestion charging
routingroutingroutingrouting
congestion control
congestion control
0