Subject: [saag] Client Puzzles for mitigating DoS attacks

From: Yoav Nir <[email-masked]>
Date: Mon, 17 Feb 2014 09:22:37 +0000

Hi all,

Several years ago, I brought up at IPsec list ([1]) the idea of standardizing an extension to mitigate DoS attacks against IKE gateways, although the technique could equally be applied to other protocols ([2]).

The idea is that when a server (or VPN gateway) is under load from a lot of clients initiating connections, it requires any clients attempting to connect to perform some calculation (usually a partial break of a hash function) before being to connect. This is an enhancement to the stateless cookie mechanism that is in use in IKE, because the client is required to solve the puzzle to find the cookie.

At the time, I was told (off-list IIRC) that there were patents held by Sun that covered this technology ([2]), and ultimately, the IPsecME group did not take up this work item.

Although pervasive surveillance is all the rage these days. DoS and DDoS are an important threat to Internet-facing servers all over the world, and I was wondering if we can take this on. Sun has merged with Oracle, and neither has ever been a patent troll. I'm asking on this list in hopes that somebody here knows who to approach to ask Oracle to release this technology for royalty-free use in implementations of IETF protocols.

So if anyone on this list has these connections, I'd be very grateful for your help.

Thanks

Yoav

[1] http://www.ietf.org/mail-archive/web/ipsec/current/msg02765.html
[2] https://www.usenix.org/legacy/events/sec2001/full_papers/dean/dean.pdf
[3] http://www.google.com/patents/us6944663