ICMP Traceback Packet Authentication

1
ICMP Traceback Packet Authentication

• Eunjong Kim
• Colorado State University
• kimeu_at_cs.colostate.edu

2
ICMP Traceback
Packet Identification Link(AS7 AS6)
Packet Identification Link( )
Packet Identification Link(AS8 AS7)
3
Enhanced ICMP Traceback
4
iTrace Packet Authentication

• Weak Authentication
• No PKI (Public Key Infrastructure) based
  authentication
• Not much performance overhead
• TESLA keys (using time differences)
• One-way accumulator (to provide originator
  validation)
• Does not waste unnecessary resources
• Rabins Information Dispersal Technique.
• n out of m packets regenerate the original packet
• Guarantee the message integrity
• Tolerant to packet loss
• Robust to false origin or packet dropping attacks
  
• Bogus iTrace message attack.
• Our validation is based on actual data traffic
• Not easy to make since false routers can not see
  the real data traffic. (easy to detect)