A Practical System for Guaranteed Access in the Presence of DDoS Attacks and Flash Crowds
Yi-Hsuan Kung, Taeho Lee, Po-Ning Tseng, Hsu-Chun Hsiao, Tiffany, Hyun-Jin Kim, Soo Bum Lee, Yue-Hsun Lin, Adrian Perrig

TL;DR
The paper introduces RainCheck Filter (RCF), a lightweight system that guarantees bounded waiting times for clients during DDoS attacks and flash crowds without maintaining per-client state, enhancing server resilience.
Contribution
RCF is a novel, practical primitive that ensures fair and bounded access during floods by using cryptographic rainchecks, requiring minimal deployment effort.
Findings
RCF guarantees bounded waiting times under attack conditions.
Simulations show RCF outperforms existing schemes in predictability.
Implementation demonstrates easy integration with web servers.
Abstract
With the growing incidents of flash crowds and sophisticated DDoS attacks mimicking benign traffic, it becomes challenging to protect Internet-based services solely by differentiating attack traffic from legitimate traffic. While fair-sharing schemes are commonly suggested as a defense when differentiation is difficult, they alone may suffer from highly variable or even unbounded waiting times. We propose RainCheck Filter (RCF), a lightweight primitive that guarantees bounded waiting time for clients despite server flooding without keeping per-client state on the server. RCF achieves strong waiting time guarantees by prioritizing clients based on how long the clients have waited-as if the server maintained a queue in which the clients lined up waiting for service. To avoid keeping state for every incoming client request, the server sends to the client a raincheck, a timestamped…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
