Subject: [Dots] Fwd: SAAG IETF 100 Agenda

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 7 Nov 2017 10:04:02 -0500

Hello,

SAAG will have a guest speaker presenting their DDoS research and it
may be of interest to DOTS participants.  The abstract is included
below.

Best regards,
Kathleen

---------- Forwarded message ----------
From: Kathleen Moriarty <[email-masked]>
Date: Tue, Nov 7, 2017 at 10:02 AM
Subject: SAAG IETF 100 Agenda
To: "[email-masked]" <[email-masked]>

Hello,

The SAAG agenda has been posted.  Since SecDispatch will follow SAAG
in the same session, SAAG will be shorter then normal and we have one
invited speaker, Min Suk KANG.

Agenda:
https://datatracker.ietf.org/meeting/100/materials/agenda-100-saag/

Abstract for invited talk:
Title: Inter-domain DDoS mitigations: potentials, challenges, and solutions

Abstract: Distributed denial-of-service (DDoS) attacks have plagued
the Internet for a few decades. Particularly, volumetric DDoS attacks
have shown a tremendous increase in volume in the past few years,
often flooding one or more upstream ASes of a target network. Academic
community also has warned about new volumetric attack vectors (e.g.,
link-flooding attacks [Studer and Perrig, 2009] [Kang et al. 2013]);
yet, it has been shown that single-domain mitigations have limited
defense capability [Kang et al. 2016]. To that end, ASes in practice
have begun to collaborate and outsource packet filtering to
neighboring ASes (see the recent inter-domain packet filtering system
between AT&T and CenturyLink [Levy et al., 2017]) and an IETF standard
working group, called DDoS Open Threat Signaling or DOTS, has been
formed.

Although collaborative packet filtering between two ASes has great
potentials and often is necessary for DDoS mitigations, there exist
several fundamental concerns for designing a secure collaborative
packet filtering between mutually distrusting ASes. In this talk, we
argue that three security properties are desired for secure
inter-domain packet filtering: (1) fairness guarantees (i.e., both
ASes can equally contribute to filtering operations); (2) privacy
guarantees (i.e., one AS cannot learn the other AS’s filtering policy
beyond what is already known); and (3) accountable packet filtering
(i.e., collaborating ASes can prove if a packet has been dropped as a
result of the collaborative packet filtering). We present a prototype
for an ongoing project on a secure inter-domain collaborative packet
filtering system that exploits a trusted hardware commodity server
platform (i.e., Intel SGX) and supports line-rate (e.g., 10 Gbps)
rate-limiting operations.

[Studer and Perrig, 2009] Ahren Studer and Adrian Perrig. "The
Coremelt Attack." ESORICS. 2009.
[Kang et al., 2013] Min Suk Kang, Soo Bum Lee, and Virgil D. Gligor.
"The crossfire attack." IEEE Symposium on Security and Privacy (SP),
2013.
[Kang et al., 2016] Min Suk Kang, Virgil D. Gligor, and Vyas Sekar.
"SPIFFY: Inducing Cost-Detectability Tradeoffs for Persistent
Link-Flooding Attacks." NDSS. 2016.
[Levy et al., 2017] Nimrod Levy, Don Smith, and John Schiel.
“Operationalizing ISP cooperation during DDoS attacks.” NANOG 71,
October 3, 2017.

--

Best regards,
Kathleen

-- 

Best regards,
Kathleen