<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Sep 27, 2016, at 1:49 PM, Cesar Ghali <<a href="mailto:cghali@uci.edu" class="">cghali@uci.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><span style="font-size:12.8px" class="">The PIT may very well serve a useful purpose in NDN/CCN. However, it </span><span style="font-size:12.8px" class="">creates well-known security problems (interest flooding is trivial) </span><span style="font-size:12.8px" class="">and it’s highly doubtful that a deterministic solution is possible.</span></div></div></blockquote><div><br class=""></div>the discussion below is on how to effectively mitigate Interest flooding.</div><div>By removing PIT, one also removes a number of important functions enabled by PIT.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><span style="font-size:12.8px" class=""> </span><span style="font-size:12.8px" class="">However, the CCN model of communication is possible without PITs. See, </span><span style="font-size:12.8px" class="">e.g., [1] and [2].</span><br class=""><div class=""><span style="font-size:12.8px" class=""><br class=""></span></div><div class=""><div style="font-size:12.8px" class="">[1] Content-Centric Networking Using Anonymous Datagrams: <a href="http://arxiv.org/abs/1603.08491" target="_blank" class="">http://arxiv.org/<wbr class="">abs/1603.08491</a>.<br class=""></div><div style="font-size:12.8px" class="">[2] Living in a PIT-less World: A Case Against Stateful Forwarding in Content-Centric Networking: <a href="https://arxiv.org/abs/1512.07755" target="_blank" class="">https://arxiv.org/<wbr class="">abs/1512.07755</a>.</div></div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Cesar</div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Tue, Sep 27, 2016 at 10:13 AM, Lixia Zhang <span dir="ltr" class=""><<a href="mailto:lixia@cs.ucla.edu" target="_blank" class="">lixia@cs.ucla.edu</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">thanks Christos for sharing this interesting news, that triggered interesting discussion. I'm trying to summarize up the exchanges in my 2 cents (not in original order), so if I missed/misinterpreted anything:<br class="">
<br class="">
- non data producer devices dont attract attacks<br class="">
- there is no reflect attack in NDN network since interest/data myst take symmetric path<br class="">
- brute force interest flood need to generate random names to get sent forward, because caching dumps those attack interest with known names of existing data<br class="">
- the above suggests (anyone see a whole here?) that DDoD by interesting flooding has a unique mark of leaving in each router PIT unsatisfied PIT entries after normally expected RTT time, so this seems leaving a few things to investigate towards DDoD mitigation<br class="">
<br class="">
a) one should constantly watch out unsatisfied PIT entries (not wait till PIT overflows)<br class="">
b) one can observe the arriving patterns of these PIT entries (speed, from where)<br class="">
c) one can slow down the downstream that seem only/mostly supply bad PIT, to protect other interest going through the same forwarder...<br class="">
<br class="">
I woke up mid of night to catch up email, although the brain is cloudy, one thing still seems clear: IP router has hard time because its stateless data plate.<br class="">
NDN routers, thanks to PIT, knows everything going on -- this seems "the real difference" from IP case, a great enabler for us to develop smart detection and mitigations...<br class="">
<br class="">
and BTW the PIT was set up to serve many purposes, just "happen" to be useful for DDoS mitigation as well<br class="">
this is in contrast to all other proposed IP DDoD imitation solutions that need to install *new* state into routers (and that state is only useful for DDoS but nothing else)<br class="">
<div class="HOEnZb"><div class="h5"><br class="">
<br class="">
> On Sep 25, 2016, at 6:04 PM, Christos Papadopoulos <<a href="mailto:christos@colostate.edu" class="">christos@colostate.edu</a>> wrote:<br class="">
><br class="">
> <a href="http://www.networkworld.com/article/3123672/security/largest-ddos-attack-ever-delivered-by-botnet-of-hijacked-iot-devices.html" rel="noreferrer" target="_blank" class="">http://www.networkworld.com/<wbr class="">article/3123672/security/<wbr class="">largest-ddos-attack-ever-<wbr class="">delivered-by-botnet-of-<wbr class="">hijacked-iot-devices.html</a><br class="">
><br class="">
> Apologies if you have seen this already, but 600+Gbps DDoS attack from IoT devices is truly remarkable. Moreover, it was *not* and reflection attack! The target was protected by Akamai, who had to drop them (it was hosted pro-bono) after a few days of sustained attack because it was costing too much.<br class="">
><br class="">
> There are a few elements that might make this event a game changer. (a) from now on, people may want to always talk about security in IoT, (b) it raises questions about protecting the little guy from DDoS, the customer here found a home at Google's Project Shield, but obviously this is not scalable, and (c) cloud protection from DDoS is not a general solution despite what cloud providers will have you believe.<br class="">
><br class="">
> To me such events bring to focus the weaknesses and fragility of the IP architecture. With billions of IoT devices projected in the future, even one packet/second (or even per minute) from a fraction of these devices would be enough to cause real damage. We all know about the code quality and ease of patching of IoT devices, this will not change.<br class="">
><br class="">
> Maybe Bruce Schneier 's near-apocalyptic thoughts are not too far off.<br class="">
><br class="">
> <a href="https://www.schneier.com/crypto-gram/archives/2016/0915.html#2" rel="noreferrer" target="_blank" class="">https://www.schneier.com/<wbr class="">crypto-gram/archives/2016/<wbr class="">0915.html#2</a><br class="">
><br class="">
> Christos.<br class="">
> ______________________________<wbr class="">_________________<br class="">
> Ndn-interest mailing list<br class="">
> <a href="mailto:Ndn-interest@lists.cs.ucla.edu" class="">Ndn-interest@lists.cs.ucla.edu</a><br class="">
> <a href="http://www.lists.cs.ucla.edu/mailman/listinfo/ndn-interest" rel="noreferrer" target="_blank" class="">http://www.lists.cs.ucla.edu/<wbr class="">mailman/listinfo/ndn-interest</a><br class="">
<br class="">
<br class="">
______________________________<wbr class="">_________________<br class="">
Ndn-interest mailing list<br class="">
<a href="mailto:Ndn-interest@lists.cs.ucla.edu" class="">Ndn-interest@lists.cs.ucla.edu</a><br class="">
<a href="http://www.lists.cs.ucla.edu/mailman/listinfo/ndn-interest" rel="noreferrer" target="_blank" class="">http://www.lists.cs.ucla.edu/<wbr class="">mailman/listinfo/ndn-interest</a><br class="">
</div></div></blockquote></div><br class=""></div></div>
</div></blockquote></div><br class=""></body></html>