NetFence: Preventing Internet Denial of Service from Inside Out
Xin Liu, Xiaowei Yang, Yong Xia

TL;DR
NetFence introduces a scalable network architecture that effectively prevents DoS attacks by using secure congestion feedback, ensuring fair resource allocation without extensive per-host state at routers.
Contribution
The paper presents a novel congestion policing mechanism and a scalable architecture that guarantees fair bandwidth sharing and reduces router state requirements during DoS attacks.
Findings
Reduces router state from per-host to per-AS
Proves fair resource allocation for legitimate senders
Demonstrates effectiveness through implementation and simulations
Abstract
Denial of Service (DoS) attacks frequently happen on the Internet, paralyzing Internet services and causing millions of dollars of financial loss. This work presents NetFence, a scalable DoS-resistant network architecture. NetFence uses a novel mechanism, secure congestion policing feedback, to enable robust congestion policing inside the network. Bottleneck routers update the feedback in packet headers to signal congestion, and access routers use it to police senders' traffic. Targeted DoS victims can use the secure congestion policing feedback as capability tokens to suppress unwanted traffic. When compromised senders and receivers organize into pairs to congest a network link, NetFence provably guarantees a legitimate sender its fair share of network resources without keeping per-host state at the congested link. We use a Linux implementation, ns-2 simulations, and theoretical…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Traffic and Congestion Control · Network Security and Intrusion Detection · Software-Defined Networks and 5G
