DDoS RIP

Question 1

Coremelt attack

Answer 1

congest network by sending leg. traffic between bots

Question 2

Crossfire attack

Answer 2

flood specific link to disconnect target from rest of the internet

Question 3

SCION Hidden path

Answer 3

Path that is not announced to core AS instead announce it only to selected entities

Question 4

SCMP Authentication Host H in AS A sends to AS C

Answer 4

1. First-level Key Exchange: AS C uses SVC to generate first level key KC→A = PRFSVC (“A”). AS C securely sends KC→A to AS A.
2. Second-level Key Exchange: AS A generates a second-level key for H that can be used
   for source authentication by AS C, i.e., KSCMP = PRFK (“H|SCMP”) and gives it to C→A:H C→A
   host H.
3. Host H authenticates its ICMP message using KSCMP . C→A:H
4. AS C dynamically recreates KSCMP by retrieving the first-level key that it generated in C→A:H
   Step 1 and computing the second-level key that AS A computed. 5. Finally it verifies the authenticity of the message.

Question 5

How is communication flow with DRKey Kx->y

Answer 5

In opposite direction as key derivation. Burden lies on sender of the message, receiver can just derive key to verify.

Question 6

Colibri

Answer 6

Colibri allows hosts to reserve end to end paths between each other with guar- anteed bandwidth. This solves the DDoS problem as the legitimate path is guaranteed at least some bandwidth. In order to reserve a path, first each segment needs to be reserved by the source AS, and then these reserved segments are used to exchange packets to set up the whole e2e path reservation.

Question 7

Admission Control Algo of colibri prevents:

Answer 7

• A single AS congests a link by requesting multiple different paths that traverse it.
  • A group of ASes, controlled by the same attacker, can reserve too many paths going through the same link.

Question 8

EPIC

Answer 8

Every packet is checked:

• duplicate suppression with bloom filter
• per packet source auth. with DRKeys
• per packet variable hop fields, include packet creation time -> prevents brute force of hop fields MAC