Sanctuary Trail: Refuge from Internet DDoS Entrapment

Abstract. We propose STRIDE, a new Internet ar-chitecture that provides strong DDoS defense mecha-nisms for both public services and private end-to-end communication. This new architecture presents several novel concepts including long-term static paths, band-width allocation through a top-down topology discov-ery protocol, dynamic bandwidth allocation via network capabilities, and differentiated packet prioritization. In concert, these mechanisms provide 1) a strong static-class bandwidth guarantee, 2) strongly guaranteed ca-pability establishment for private end-to-end communi-cation, and a linear waiting time guarantee in the num-ber of malicious source domains for capability establish-ment for public services, and 3) globally fair bandwidth allocation for capability-protected flows. STRIDE ad-dresses the denial-of-capability problem and defends against a Coremelt attack by preventing a botnet from crowd-ing out other flows on bottleneck network links. We demonstrate these properties through formal analysis and simulation. 1