The Design and Implementation of Network Puzzles

Abstract — Currently, there are no significant disincentives for clients who contribute to the flood of undesirable communication in the Internet. A mechanism for punishing only the malicious is required in order to discourage clients from behaving badly. Towards this goal, client puzzles have been proposed in a number of protocols. To provide coverage across all applications and protocols however, client puzzles must be placed at a layer common to all of them; the network layer. Until now, network layer client puzzles have not been investigated. Puzzles at the network layer can be leveraged against all traffic from malicious clients, making it possible to defend against attacks previously undefendable, as well as making previously voluntary mechanisms mandatory. In this paper, we outline goals which must be met for puzzles to be deployed effectively at the network layer. We describe our new puzzle protocol and puzzle algorithm which achieve these goals. We demonstrate our design with aniptables implementation that supports transparent deployment of network puzzles at arbitrary locations in the network via proxies and firewalls. I