具重組性低儲存量複合式封包溯源機制

近年來網際網路的發展相當迅速，各種與網路相關的應用相當廣泛，但同時也產生了許多網路安全的問題。由於攻擊者可以偽造來源IP隱藏自己的位置並發動攻擊，因此要找出攻擊者相當困難。目前已經有許多研究提出各種封包溯源機制，其中封包轉存機制只需單一封包就能追踨到攻擊者，但它需要大量的儲存空間；封包標記機制雖然不需要在路由器上儲存封包資訊，但它需要收集大量的攻擊封包；複合封包溯源機制結合了封包轉存機制及封包標記機制，可做到單一封包追蹤，且減少路由器轉存所需的儲存量。然而根據其轉存方式的不同又可分為轉存封包摘要以及轉存路徑資訊等兩類。轉存封包摘要的這類方法儲存量將隨著封包數量增加而成長，另一類的方法儲存量則可受到路徑數目的控制。在本篇論文中，我們將提出一個轉存路徑資訊的低儲存量16位元標記複合封包溯源機制。我們比較現有轉存路徑資訊的複合封包溯源機制RIHT以及HAHIT。RIHT與HAHIT不會受到封包數量影響，相較之下前者使用32位元標記機制會有封包重組的問題，後者使用16位元標記機制解決了封包重組的問題但儲存量卻比前者來的高。我們的方法除了具備單一封包溯源、不受封包數量影響的特性以及使用16位元標記機制解決封包重組問題等優點，同時也針對其轉存機制與儲存量來改善，在worst case的情況下我們較HAHIT下降66%的儲存量，在average case的情況下我們的儲存需求甚至比使用32bits封包標記欄位的RIHT還低。

關鍵字

複合封包溯源機制；封包轉存機制；封包標記機制；分散式阻斷服務攻擊； IP位址偽裝

並列摘要

The Internet technology has been widely applied in many areas in the past decades and therefore its security issues have also attracted more and more concern. Because adversaries may spoof their source IPs and launch attacks, many traceback schemes have been proposed to identify the attack source. Packet logging uses only one packet to achieve IP traceback, but it requires much storage. Packet marking does not need to store any packet information on the routers, but it has to collect a large amount of attacking packets. Hybrid IP traceback schemes combine the two methods, using only one packet for traceback and reducing the storage requirements during packet logging. Current hybrid IP traceback schemes have two logging methods: logging of packet digests; logging of route info. While the first method’s storage requirements increase with the rise of packet numbers, the second method’s storage requirements are bounded by route numbers. Thus, we propose a 16-bit hybrid IP traceback scheme with low storage requirements. We analyze and compare current related schemes RIHT and HAHIT. Both of their performance is not affected by packet numbers. But RIHT’s marking field takes 32 bits and may lead to the failure of packet re-assembly. HAHIT uses 16 bits as its marking field to prevent the failure but pushes up its storage requirements. The main contributions of our scheme include: we use only one single packet for traceback; our performance is not affected by packet numbers; it is fragment compatible; we improve the logging method and decrease the storage requirements. Compared with HAHIT in the worst case, ours can decrease the storage requirements by 66%. In the average case, we can even keep our storage requirements lower than RIHT, whose marking field takes 32 bits.

並列關鍵字

hybrid IP traceback ； packet logging ； packet marking ； DDoS ； IP spoofing

參考文獻

[1] A. Belenky and N. Ansari, “Accommodating Fragmentation in Deterministic Packet Marking for IP Traceback,” IEEE Global Telecommunications Conference, vol. 3, pp. 1374–1378, Dec. 2003.

[2] A. Belenky and N. Ansari, “IP traceback with deterministic packet marking,” IEEE Communications Letters, vol. 7, no. 4, pp. 162–164, April 2003.

[3] A. Belenky and N. Ansari, “Tracing multiple attackers with deterministic packet marking (DPM),” IEEE Pacific Rim, vol.1, pp.49–52, Aug. 2003.

[5] A. Hussain, J. Heidemann, and C. Papadopoulos, “A Framework for Classifying Denial of Service Attacks,” in Proc. ACM SIGCOMM ’03, Karlsruhe, Germany, pp.99-110, Aug. 2003.

[7] Burton H. Bloom, “Space/Time Trade-offs in Hash Coding with Allowable Errors,” Communications of the ACM, vol. 13, no. 7, pp. 422-426, July 1970.

國際替代計量

具重組性低儲存量複合式封包溯源機制

全文下載

主題瀏覽