DNS Authentication as-a-Service Against Amplification Attacks

Presentation pdf 764KB

We present the first defence against DNS-amplification DoS
attacks, which is compatible with the common DNS servers
congurations and with the (important standard) DNSSEC.
We show that the proposed DNS-authentication system is
efficient, and effectively prevents DNS-based amplification
DoS attacks. Our system can easily defend a particular
DNS server; furthermore, we present game-theoretic model
and analysis, predicting wide-spread adoption, sufficient to
reduce the threat of DNS amplification DNS attacks. To fur-
ther reduce costs and provide additional defences for DNS
servers, we show how to deploy our design as a cloud based
service.

Author(s):

Amir Herzberg    
Bar-Ilan University
Israel

Haya Shulman    
Technische Universität Darmstadt
Germany