Researchers devise DoS attack filter

Developing traffic authentication smarts.

Researchers at Auburn University in Alabama claim to have worked out a way to filter denial of service (DoS) attacks on computer networks, including cloud computing systems.

While there are methods of configuring a network to filter out known DoS attack vectors and to recognise some of the traffic patterns associated with a mounting DoS attack, so far they have not been particularly successful.

This is because current filters rely on the computer being attacked to check whether or not incoming information requests are legitimate or not. Since this takes time and resources it can actually make the problem worse.

But computer engineers John Wu, Tong Liu, Andy Huang, and David Irwin of Auburn University devised a passive protocol filter that gets around this problem by using client software put in place at the user end.

Dubbed Identity-Based Privacy-Protected Access Control Filter (IPACF), the system blocks threats to the gatekeeping Authentication Servers and so allows legitimate users with valid passwords to access private resources.

The user presents a filter value with each request packet for the server to do a quick check. The filter value is a one-time secret that is presented along with a pseudo-ID. The pseudo-ID is also one-time use.

Attackers cannot forge either of these request authentication values correctly, so DoS attack packets are filtered out.

Researchers were a bit concerned that the additional information transfer required for checking the legitimacy of user requests could add to the resources required by the server.

They tested it using DoS attacks simulated on a 10Gbps network consisting of 1,000 nodes.

They found that the server suffers little degradation, negligible added latency and minimal extra processor usage even when the 10Gbps pipe to the authentication server is saturated with DoS packets.

The researchers claimed it took only 6 nanoseconds to detect an illegitimate information request packet associated with a DoS attack and stage a quick cyber-lynching.