5 ms·

I am currently working on a course project that involves bolting a proof-of-work system onto DNS to throttle connections to servers. Using IPv6, the DNS server

I am currently working on a course project that involves bolting a proof-of-work system onto DNS to throttle connections to servers. Using IPv6, the DNS server can return an IPv6 address that is usable only by the requesting client because it was randomized in the lower 64-bits and is firewalled from other clients. I've put the project on GitHub and would appreciate any comments! https://github.com/jevinskie/SlothNS https://github.com/jevinskie/SlothNS

JoachimSchipper 16y ago
The idea is cool, but I'm somewhat unclear on the economic model that would make it work. Certainly, if I can connect to visa.com within a reasonable time, Anonymous would have no meaningful trouble DDoS'ing it. Requiring a new unit of work for every new connection may or may not allow legitimate requests while making DDoS infeasible; the linked Wikipedia page gives to some papers that may help you build such an economic model, if you want to look at this. Note that http://www.csoonline.com/article/220336/how-a-bookmaker-and-a-whiz-kid-took-on-a-ddos-based-online-extortion-attack http://www.csoonline.com/article/220336/how-a-bookmaker-and-... suggests that DDoS attacks were (in 2005) quite a bit more profitable than spam runs. Google "dos extortion" for much more, including Symantec saying that DoS extortion was no longer profitable in 2007. I'm not sure you actually need IPv6; can't you just use 2^15 (optionally unused) ports in the registered ports range (1024-49151) for your scheme? If you're worried about firewalls blocking traffic to such uncommon ports, you could use a single port on a class C network (256 hosts) if you're willing to blacklist anyone connecting to the wrong host (which runs a risk of wrongly blacklisting people behind a NAT). Have you chosen which PoW function you are going to use yet? I've looked into this stuff a bit and I thought http://www.wisdom.weizmann.ac.il/~naor/PAPERS/mem_abs.html http://www.wisdom.weizmann.ac.il/~naor/PAPERS/mem_abs.html looked cool, but I've never seen an implementation. If you happen to implement something like that, could you drop me a line on your experiences/benchmarks (e-mail in profile)? Questions are also welcome. Of course, you're aware that this proposal is never going to be implemented, right? People won't accept extra connection latency, it requires every single resolver to be updated (because you need to block clients that didn't do the PoW), it's incompatible with caching, etc. I don't think this is that big of a problem - it's just an exercise - but don't expect to convince the BIND maintainers. I do think the idea is quite cool, though.

JoachimSchipper 16y ago

The idea is cool, but I'm somewhat unclear on the economic model that would make it work. Certainly, if I can connect to visa.com within a reasonable time, Anonymous would have no meaningful trouble DDoS'ing it. Requiring a new unit of work for every new connection may or may not allow legitimate requests while making DDoS infeasible; the linked Wikipedia page gives to some papers that may help you build such an economic model, if you want to look at this. Note that http://www.csoonline.com/article/220336/how-a-bookmaker-and-a-whiz-kid-took-on-a-ddos-based-online-extortion-attack http://www.csoonline.com/article/220336/how-a-bookmaker-and-... suggests that DDoS attacks were (in 2005) quite a bit more profitable than spam runs. Google "dos extortion" for much more, including Symantec saying that DoS extortion was no longer profitable in 2007. I'm not sure you actually need IPv6; can't you just use 2^15 (optionally unused) ports in the registered ports range (1024-49151) for your scheme? If you're worried about firewalls blocking traffic to such uncommon ports, you could use a single port on a class C network (256 hosts) if you're willing to blacklist anyone connecting to the wrong host (which runs a risk of wrongly blacklisting people behind a NAT). Have you chosen which PoW function you are going to use yet? I've looked into this stuff a bit and I thought http://www.wisdom.weizmann.ac.il/~naor/PAPERS/mem_abs.html http://www.wisdom.weizmann.ac.il/~naor/PAPERS/mem_abs.html looked cool, but I've never seen an implementation. If you happen to implement something like that, could you drop me a line on your experiences/benchmarks (e-mail in profile)? Questions are also welcome. Of course, you're aware that this proposal is never going to be implemented, right? People won't accept extra connection latency, it requires every single resolver to be updated (because you need to block clients that didn't do the PoW), it's incompatible with caching, etc. I don't think this is that big of a problem - it's just an exercise - but don't expect to convince the BIND maintainers. I do think the idea is quite cool, though.