Defending web services against denial of service attacks using client puzzles

Proceedings - 2011 IEEE 9th International Conference on Web Services, ICWS 2011

Volumn , Issue , 2011, Pages 25-32

  Suriadi, Suriadi ^a   Stebila, Douglas ^a   Clark, Andrew ^a   Liu, Hua ^a  

^a QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

Author keywords

Client puzzles; Denial of service attacks; Web services

Indexed keywords

DENIAL-OF-SERVICE ATTACK; INTEROPERABILITY; SEMANTICS; WEBSITES;

CLIENT PUZZLES; COMPUTATIONAL RESOURCES; CRYPTOGRAPHICS; DENIALOF- SERVICE ATTACKS; LOOSELY COUPLED; NETWORK TESTBEDS; SERVICE ANALYSIS; WEB SERVICE FRAMEWORKS; WEB-SERVICES ARCHITECTURE; WEBS SERVICES;

WEB SERVICES;

EID: 80053139318     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICWS.2011.22     Document Type: Conference Paper

References (26)

1. OASIS, Web Services Security: SOAP Message Security 1.1 (WS-Security 2004), OASIS, November 2006.
2. W3C, Web Services Policy 1.5 - Framework, W3C, September 2007.
3. M. Jensen, N. Gruschka, and R. Herkenhner, "A survey of attacks on web services," Computer Science - Research and Development, vol. 24, pp. 185-197, 2009, 10.1007/s00450-009-0092-6.
4. S. Padmanabhuni, V. Singh, K. M. S. Kumar, and A. Chatterjee, "Preventing service oriented denial of service (Pre-SODoS): A proposed approach," in Proceedings of the IEEE International Conference on Web Services. Washington, DC, USA: IEEE Computer Society, 2006, pp. 577-584. (Pubitemid 351209897)
5. S. Suriadi, A. Clark, and D. Schmidt, "Validating denial of service vulnerabilities in web services," in Network and System Security, International Conference on Network and System Security. IEEE Computer Society, 2010, pp. 175-182.
6. A. Singhal, T. Winograd, and K. Scarfone, Guide to Secure Web Services - Recommendations of the National Institute of Standards and Technology, National Institute of Standards and Technology, August 2007.
7. M. Powell, "Defending your XML web service against hackers, part I," MSDN, 2001, http://msdn.microsoft.com/library/aa480513.aspx.
8. Layer7 Technologies, "XML threats and web services vulnerabilities: Understanding risk and protection," 2005, http://www.soahub.com/ Architecture/PDF/XML-Threats-Web-Services-Vulnerabilities.pdf.
9. J. Nazario, "Political DDoS: Estonia and beyond," in USENIX Security '08. USENIX, July 2008, http://streaming.linux-magazin.de/events/ usec08/tech/archive/jnazario/.
10. J. Leyden, "Techwatch weathers DDoS extortion attack," The Register, 2009, http://www.theregister.co.uk/2009/01/30/techwatch-ddos/.
11. J. Vijayan, "MasterCard SecureCode service impacted in attacks over WikiLeaks," Computer World, 2010, http://www.computerworld.com/s/article/ 9200541/MasterCard-SecureCode service-impacted-in-attacks-over-WikiLeaks.
12. C. Dwork and M. Naor, "Pricing via processing or combatting junk mail," in Advances in Cryptology - Proc. CRYPTO '92, ser. LNCS, E. F. Brickell, Ed., vol. 740. Springer, 1992, pp. 139-147.
13. A. Juels and J. Brainard, "Client puzzles: A cryptographic countermeasure against connection depletion attacks," in Proc. Internet Society Network and Distributed System Security Symposium (NDSS) 1999. Internet Society, 1999, pp. 151-165. [Online]. Available: http://www.isoc.org/isoc/ conferences/ndss/99/proceedings/
14. T. Aura, P. Nikander, and J. Leiwo, "DOS-resistant authentication with client puzzles," in Security Protocols: 8th International Workshop, ser. LNCS, B. Christianson, B. Crispo, J. A. Malcolm, and M. Roe, Eds., vol. 2133. Springer, 2000, pp. 170-177. (Pubitemid 33347515)
15. J. Smith, J. González Nieto, and C. Boyd, "Modelling denial of service attacks on JFK with Meadows's cost-based framework," in Proc. 4th Australasian Information Security Workshop - Network Security (AISW-NetSec) 2006, ser. CRPIT, R. Buyya, T. Ma, R. Safavi-Naini, C. Steketee, and W. Susilo, Eds., vol. 54. Australian Computer Society, 2006, pp. 125-134. [Online]. Available: http://crpit.com/confpapers/CRPITV54Smith.pdf
16. D. Stebila and B. Ustaoglu, "Towards denial-of-service-resilient key agreement protocols," in Proc. 14th Australasian Conference on Information Security and Privacy (ACISP) 2009, ser. LNCS, C. Boyd and J. González Nieto, Eds., vol. 5594. Springer, 2009, pp. 389-406.
17. T. J. McNevin, J.-M. Park, and R. Marchany, "pTCP: A client puzzle protocol for defending against resource exhaustion denial of service attacks," Department of Electrical and Computer Engineering, Virginia Tech, Technical Report TR-ECE-04-10, October 2004. [Online]. Available: http://www.arias.ece.vt.edu/publications/TechReports/mcNevin-2004-1.pdf
18. D. Dean and A. Stubblefield, "Using client puzzles to protect TLS," in Proc. 10th USENIX Security Symposium, 2001. [Online]. Available: http://www.usenix.org/events/sec01/dean.html
19. J. Rangasamy, D. Stebila, C. Boyd, and J. González Nieto, "An integrated approach to cryptographic mitigation of denial of service attacks," in 6th ACM Symposium on Information, Computer and Communications Security (ASIACCS) 2011. ACM, 2011, pp. 114-123.
20. D. Stebila, L. Kuppusamy, J. Rangasamy, C. Boyd, and J. Gonzalez Nieto, "Stronger difficulty notions for client puzzles and denial-of-service- resistant protocols," in Progress in Cryptography - CT-RSA 2011: The Cryptographers' Track at RSA Conference 2011, ser. LNCS, A. Kiayias, Ed., vol. 6558. Springer, 2011, pp. 284-301.
21. N. Gruschka and N. Luttenberger, "Protecting web services from DoS attacks by SOAP message validation," in Security and Privacy in Dynamic Environments, ser. IFIP International Federation for Information Processing, S. Fischer-Hbner, K. Rannenberg, L. Yngstrm, and S. Lindskog, Eds. Springer Boston, 2006, vol. 201, pp. 171-182, 10.1007/0-387-334068-15. (Pubitemid 44920652)
22. R. Bebawy, H. Sabry, S. El-Kassas, Y. Hanna, and Y. Youssef, "Nedgty: Web services firewall," in IEEE International Conference on Web Services. Los Alamitos, CA, USA: IEEE Computer Society, 2005, pp. 597-601. (Pubitemid 44460253)
23. Y.-S. Loh, W.-C. Yau, C.-T. Wong, and W.-C. Ho, "Design and implementation of an XML firewall," in 2006 International Conference on Computational Intelligence and Security, vol. 2, November 2006, pp. 1147-1150. (Pubitemid 351222214)
24. C. Pinzón, J. De Paz, J. Bajo, and J. Corchado, "A multiagent solution to adaptively classify SOAP message and protect against DoS attack," in Current Topics in Artificial Intelligence, ser. Lecture Notes in Computer Science, P. Meseguer, L. Mandow, and R. Gasca, Eds. Springer Berlin / Heidelberg, 2010, vol. 5988, pp. 181-190, 10.1007/978-3-642-142642-19.
25. C. G. Yee, W. H. Shin, and G. S. V. R. K. Rao, "An adaptive intrusion detection and prevention (ID/IP) framework for web services," in Proceedings of the 2007 International Conference on Convergence Information Technology, ser. ICCIT '07. Washington, DC, USA: IEEE Computer Society, 2007, pp. 528-534.
26. X. Ye, "Countering DDoS and XDoS attacks against web services," in IEEE/IFIP International Conference on Embedded and Ubiquitous Computing. Los Alamitos, CA, USA: IEEE Computer Society, 2008, pp. 346-352.