IP Traceback in Cloud IP Traceback in Cloud ComputingComputing

Through Deterministic Flow Through Deterministic Flow MarkingMarking

Mouiad Abid HaniMouiad Abid Hani

Presentation figures are from references given on slide 21. Presentation figures are from references given on slide 21.

ByBy

PresentedPresented

IntroductionIntroduction

IP traceback problemIP traceback problem– The problem of identifying the source of the offending The problem of identifying the source of the offending

packets (DoS and DDoS attacks)packets (DoS and DDoS attacks)– Source: zombie; reflector; spoofed addresses …etc.Source: zombie; reflector; spoofed addresses …etc.

SolutionSolution– Rely on the routers (PPM)Rely on the routers (PPM)

Only for DOSOnly for DOS

– Rely on the ingress routers only (DPM and DFM) for Rely on the ingress routers only (DPM and DFM) for DDoS and DoS.DDoS and DoS.

– Centralized management (log of packet infor.)Centralized management (log of packet infor.)Large overhead, complex, not scalable Large overhead, complex, not scalable

DoS and DDoS AttacksDoS and DDoS Attacks

Why Cloud Computing?Why Cloud Computing?

Cloud Computing is Traditional Distributed Cloud Computing is Traditional Distributed Environment (TDE).Environment (TDE).

Cloud Computing is vulnerable to any attack Cloud Computing is vulnerable to any attack targeting TDEs.targeting TDEs.

DoS and DDoS are targeting TDEs.DoS and DDoS are targeting TDEs.

DoS and DDoS targeting the availability of a DoS and DDoS targeting the availability of a service.service.

The Cost in cloud computing will be greater.The Cost in cloud computing will be greater.

Deterministic Packet Marking (DPM)Deterministic Packet Marking (DPM)Each packet is marked when it enters the networkOnly mark Only mark Incoming Incoming packets packets MarkMark ：：address address information of information of this interfacethis interface16 bit ID + 1 16 bit ID + 1 bit Flagbit Flag

Coding of a markCoding of a mark

Flag =0 Flag =0 address bits 0~15 address bits 0~15

Flag =1 Flag =1 address bits 16~31 address bits 16~31

RandomlyRandomly setting flag value setting flag value

How many packet are enoughHow many packet are enough ？？– nn ：： the number of received packets the number of received packets – The probability of successfully generate the ingress IP The probability of successfully generate the ingress IP

address is greater than address is greater than – 2 packets 2 packets 75% 75% ；； 4 packets 4 packets 93.75%93.75%

6 packets 6 packets 98.43%98.43% ；； 10 packets 10 packets 99.9%99.9%

n5.01

ProsPros

Simple to implementSimple to implementIntroduces no bandwidth Introduces no bandwidth Practically no processing overheadPractically no processing overheadsuitable for a variety of attacks [not just (D)DoS]Backward compatible with equipment which Backward compatible with equipment which does not implement it does not implement it does not have inherent security flawsDo not reveal internet topologyDo not reveal internet topologyNo mark spoofingNo mark spoofingScalableScalable

Schematics Schematics

Pad

Ideal hash

Reconstruction Reconstruction

AreaArea

each area each area hashas k k segmentssegments

Each Each segment segment has has bitsbits

area

d2

a2

DPM LimitationsDPM Limitations

Can not handle the fragmentation/ reassembly problem

All packets need to be marked

Can trace the attack only to ingress routerCan trace the attack only to ingress router

Can handle up to 2058 attack sourcesCan handle up to 2058 attack sources

Does not support IPv6 implementation Does not support IPv6 implementation

Deterministic Flow MarkingDeterministic Flow Marking

Based on DPM

Only the first K packets need to be marked

Can trace the attack to the attacker’s nodeCan trace the attack to the attacker’s node

Can handle up to 64K attack sourcesCan handle up to 64K attack sources

Does not support IPv6 implementation Does not support IPv6 implementation

Can not handle subverted router problemCan not handle subverted router problem

DPM VS. DFM DPM VS. DFM

Identifiers used by DFMIdentifiers used by DFM

Using the gray fields as marking field in IP header for K=2

DFM LimitationsDFM Limitations

Can not handle the fragmentation/ reassembly problem

Does not support IPv6 implementation Does not support IPv6 implementation

Using 42-byte signature to authenticate Using 42-byte signature to authenticate the whole flow the whole flow

The Proposed SolutionsThe Proposed Solutions

Using the IPv6 header Flow Label field to Using the IPv6 header Flow Label field to hold the markhold the mark

Using MD4 algorithm instead of elliptic Using MD4 algorithm instead of elliptic curve signature within the packet (not curve signature within the packet (not assured till now).assured till now).

The fragmentation/reassembly problem is The fragmentation/reassembly problem is not an issue in IPv6 protocol.not an issue in IPv6 protocol.

Conclusion Conclusion

DFM is more practical and efficient than DPM

DFM and DPM can not prevent DDoS attack but try to trace the source of it

DFM need some improvements to be fully applicable on Intrusion Detection Systems.

I have I have questionsquestions……

References

Vahid A. F. Nur A. Zincir-Heywood, “IP traceback through (authenticated) deterministic flow marking: an empirical evaluation”, EURASIP Journal on Information Security, Vol. 1, No. 5, pp. 1-24, 2013.

Xiang, Y., W. Zhou and M. Guo, “Flexible deterministic packet marking: An IP traceback system to find the real source of attacks”, IEEE Transactions on Parallel and Distributed Systems, Vol. 20, No. 4, pp. 567-580, 2009.

Andrey Belenky and Nirwan Ansari, “IP Traceback with Deterministic Packet Marking”, IEEE COMMUNICATIONS LETTERS, VOL. 7, NO. 4, pp: 162-164, 2003.

Andrey Belenky and Nirwan Ansari, “Tracing Multiple Attackers with Deterministic Packet Marking (DPM)”, pp: 49-52, 2003.

Vahid A. F. Nur A. Zincir-Heywood, “On Evaluating IP Traceback Schemes: A Practical Perspective”, IEEE Communications, Pp: 127-134