Security analysis of Bloom filter based multicast forwarding.

Xiaohua Tian,Jiaqi Liu,Wei Liu,Yu Cheng,Lijun Ou,Zilong Zhao
DOI: https://doi.org/10.1145/3063955.3063994
2017-01-01
Abstract:Bloom filter (BF) based forwarding is an effective approach to implement scalable multicasting. The forwarding BF carried by each packet can encode either multicast tree or destination IP addresses, which are termed as tree oriented approach (TOA) and destination oriented approach (DOA), respectively. Studies have indicated that TOA based protocols have serious vulnerabilities under some distributed denial-of-service (DDoS) attacks, and raised doubt about deployability of BF based multicasting. However, security analysis for DOA based protocols is still unavailable, and the fundamental effect of in-packet routing information on security performance of BF based multicast protocols is yet to be revealed. In this paper, we present a systematic analysis of security performance of BF based multicasting. Important DDoS attacks and the corresponding defending mechanisms are studied in the context of DOA. We have positive findings that DOA, with convenient enhancement, has a robust performance in resisting a variety of DDoS attacks that can deny service of TOA based protocols. Moreover, we reveal that TOA based protocols are prone to flow duplication attack when applied in the data center network (DCN). We propose a dynamic-sized BF mechanism to defend against flow duplication attack for TOA based protocols in the DCN. Simulation results are presented to validate our theoretical analysis.
What problem does this paper attempt to address?