防御拒绝服务攻击的身份认证方案

针对安全协议存在的拒绝服务攻击隐患,文中提出了发起者身份认证方案.方案借鉴Cookie机制和Client Puzzle方法的思想,通过在C00kie中嵌入puzzle的方法,采用强认证和弱认证相结合的模式进行设计.实验结果表明,该方案在不改变安全协议系统结构的前提下,可以增强其防御计算资源消耗型、存储资源消耗型和虚假网络地址型拒绝服务攻击的能力.该方案适用于安全协议响应方对安全性要求较高,响应方计算能力较强的环境.

An Identity Authentication Solution to Improve Security Protocols on Resisting Denial of Service Attack

To the problem which security protocols were under the threat of denial of service attack,a sponsor identity authentication solution is presented.Based on the idea of Cookie and Client Puzzle,the solution was designed based the way that embedded Puzzle in Cookie and the pattern which connected weak authentication and strong authentication.The experiment result shows that the solution can enhance security protocol's ability on resisting three types of denial of service attack without changing its architecture,which are compute resource exhausting attack,memory resource exhausting attack and the attack with fake network address.The solution's right application environment is in high demand of security and the responder should have powerful compute ability.