A Scalable Method to Protect From IP Spoofing

摘要

Denial of Service (DoS) attacks present a serious problem for Internet communications. The problem is aggravated when the attacker(s) spoof their IP addresses. The Implicit Token Scheme (ITS), presented in [5], is an efficient method to defend against IP spoofing. ITS, however, requires perimeter routers to maintain state information for thousands of simultaneous connections. In this paper we add a component to ITS to improve its scalability using Bloom filters. It is found that implementing ITS using Bloom filters is simple, saves a substantial amount of router memory, and does not impose large strain on routers. The efficiency of the method is demonstrated through simulations by using real-world Internet data.