Preventing DDoS Flooding Attacks With Cryptographic Path Identifiers in Future Internet

Distributed denial of service (DDoS) flooding attacks are very harmful and difficult to prevent due to the default-on nature of both inter-domain and intra-domain routing adopted by the current Internet. Accordingly, many future Internet initiatives try to eliminate DDoS attacks by design. Among these efforts, using path identifiers (PIDs) as inter-domain routing objects has attracted much research interest. However, existing approaches either advertise PIDs throughout the Internet or use secret but forgeable (whether static or dynamic) PIDs, which makes it easy to launch DDoS flooding attacks. To address this issue, in this paper we propose K-PID that uses cryptographic (thus unforgeable) PIDs as inter-domain routing objects. In particular, an
${N}$
-bit PID is comprised of an
${n}$
-bit prefix and (
${N}\,\,-\,\,{n}$
) bits that are cryptographic hash over per-flow/request information and a secret number. The prefix is used for inter-domain packet forwarding and the cryptographic hash is used as a token for allowing a data packet to enter into (or, pass through) a domain. We analyze K-PID’s performance in preventing DDoS flooding attacks and implement K-PID in a prototype to verify K-PID’s feasibility. The results show that K-PID can effectively prevent DDoS flooding attacks at a low cost of reducing the forwarding capability of routers.