Organic Techniques for Protecting Virtual Private Network (VPN) Services from Access Link Flooding Attacks

摘要

Distributed Denial-of-Service (DDoS) attacks represent a serious threat to enterprises operating over the Internet. A notable form of DDoS attack is the access link flooding attack that directs spurious packet traffic over the access link connecting an enterprise's network (i.e., an edge network) to the public Internet. Such overloading of the network access link by the attack traffic may result in partial or total denial of service to the subscribers of the edge network. This paper presents several design techniques for protecting edge networks against access link flooding attacks. The approach for survivability employed by these techniques is predicated upon making the failover mechanisms that are invoked by the system upon detection of an attack appear to be an unpredictable process from the perspective of the attacker. A prototype implementation of an operational survivable virtual private network (VPN) service built using these techniques is also described.