Epiphany: A location hiding architecture for protecting critical services from DDoS attacks
Abstract
Critical services operating over the Internet are increasingly threatened by Distributed Denial of Service (DDoS) attacks. To protect them we propose Epiphany, an architecture that hides the service IP addresses so that attackers cannot locate and target them. Epiphany provides service access through numerous lightweight proxies, presenting a wide target to the attacker. Epiphany has strong location hiding properties; no proxy knows the service address. Instead, proxies communicate over ephemeral paths controlled by the service. If a specific proxy misbehaves or is attacked it can be promptly removed. Epiphany separates proxies into setup and data, and only makes setup proxies public, but these use anycast to create distinct network regions. Clients in clean networks are not affected by attackers in other networks. Data proxies are assigned to clients based on their trust. We evaluate the defense properties of Epiphany using simulations and implementations on PlanetLab and a router testbed. © 2012 IEEE.
Publication Title
Proceedings of the International Conference on Dependable Systems and Networks
Recommended Citation
Kambhampati, V., Papadopolous, C., & Massey, D. (2012). Epiphany: A location hiding architecture for protecting critical services from DDoS attacks. Proceedings of the International Conference on Dependable Systems and Networks https://doi.org/10.1109/DSN.2012.6263945
