臺灣博碩士論文加值系統

在TCP裡，錯誤的逾期會造成相當大的傷害，而已經存在有兩種類的方法來減輕這個問題，我們稱他們為保守措施與積進措施，在保守措施裡有用到一個保守重送逾期值(RTO, Retransmission Timeout) minRTO，當根據RTT (Round Trip Time) 所估算出來的RTO小於 minRTO 時，RTO就會被設為minRTO，這樣的做法會讓RTO變成是可預測的，進而可能被攻擊者利用。TCP低速阻斷服務攻擊(Low-Rate TCP Targeted Denial-of-Service Attack) 就是屬於這種攻擊，在本論文裡，我們提出了四種方法來處裡這個問題，在不改變保守RTO的前提下，我們讓RTO變得不可預測，我們也做了分析和實驗來顯示我們的方法在遭預這種攻擊時可以存活下來。在我們的方法裡，當遭遇攻擊時能達到的平均流量會比改善前多出許多，另一方面，在平常的狀況下，我們的方法幾會不會影響TCP的表現。我們也分析了TCP低速阻斷服務攻擊是如何影響TCP的運作即使在攻擊沒有成功時。

Spurious timeout is very harmful to TCP. Two kinds of approaches were proposed to mitigate this problem, conservative approach and aggressive approach. In conservative approach, a conservative RTO (Retransmission Timeout), minRTO, is used. When RTO estimate form RTT (Round Trip Time) is less than minRTO, it is set to minRTO. This makes RTO become predictable and may be exploited by attackers. Low-Rate TCP Targeted Denial of Service is such kind of attack. In this thesis, we propose four schemes to deal with this problem. We make RTO unpredictable and keep conservative property. Analysis and experiment will be made to show that our schemes survive the attack. In our scheme, much better throughput is gained under attack. Besides, in usual condition, our schemes affect TCP performance only slightly. We will also analysis how Low-Rate TCP Targeted Denial of Service damages TCP operation inherently and how to gain the best throughput even if it is not achieved successfully.

1. Introduction 1
1.1. Background 2
1.1.1. TCP Retransmission Timeout (RTO) 2
1.1.2. Spurious Timeout 3
1.2. Contribution 4
1.3. Synopsis 4
2. Related Work 5
2.1. Conservative RTO 5
2.2. Low-Rate TCP Targeted DoS 6
3. Proposed Scheme 8
3.1. Definitions 8
3.2. Random-Delay Scheme 9
3.2.1. Fixed Random-Delay Retransmission 9
3.2.2. Geometric Random-Delay Retransmission 11
3.3. Random-Timeout Scheme 13
3.3.1. Fixed Random-Timeout 13
3.3.2. Geometric Random-Timeout 15
4. Analysis 17
4.1. Security and Performance 17
4.2. Experiment 18
4.2.1. Environment 18
4.2.2. Experiment Result 19
4.3. Discussion 25
5. Conclusion 28
Reference 29

[1] J. Postel, “Transmission Control Protocol,” RFC793, September 1981
[2] M. Allman, V. Paxson, “On Estimating End-to-End Network Path Properties,” ACM SigCOMM, September 1999
[3] V. Paxson and M. Allman, “Computing TCP’s retransmission timer,” November 2000. Internet RFC 2988
[4] R. Ludwing, and R. H. Katz, “The Eifel Algorithm: Making TCP Robust Against Spurious Retrasmissions, ACM Computer Communication Review,” vol. 30(1), January 2000.
[5] R. Ludwig, K. Sklower, “The Eifel Retrasmission Timer,” ACM Computer Communication Review, vol. 30(1), July 2000.
[6] P. Sarolahti, M. Kojo, and K. Raatikainen, “F-RTO: An Enhanced Recovery Algorithm for TCP Retransmission Timeouts,” ACM Computer Communication Review, vol. 33, April 2003
[7] A. Gurtov and R. Ludwig, “Response to Spurious Retransmission Timeouts,” in Proceedings of IEEE Infocom 2003
[8] P. Sarolahti, “Congestion Control on Spurious TCP Retransmission Timeouts,” In Proceedings of IEEE Globecom 2003,December 2003.
[9] S. Floyd, J. Mahdavi, M. Mathis, and M. Podolsky, “An Extension to the Selective Acknowledgment (SACK) Option for TCP,” RFC 2883, July 2000
[10] M. Allman, V. Paxson, “W. Stevens, TCP Congestion Control,” RFC2581, April 1999
[11] V. Jacobson, M. J. Karels, “Congestion Avoidance and Control, ACM SIGCOMM,” August 1988
[12] M. Allman, “A Web Server’s View of the Transport Layer,” ACM Computer Communication Review, vol. 30(5), October 2000
[13] J. C. Bolot, “Characterizing End-to-End Packet Delay and Loss in the Internet,” Journal of High Speed Networks, vol. 2(2), September 1993
[14] D. Loguinov and H. Radha, “Measurement Study of Low-bitrate Internet Video Streaming,” In Proceedings of ACM SIGCOMM Internet Measurement Workshop, November 2001
[15] J. J. Wang, R. H. Katz, J. Giese, “Policy-Enabled Handoffs Across Heterogeneous Wireless Networks,” In Proceedings of the 2nd IEEE Workshop on Mobile Computing Systems and Applications, February 1999
[16] A. Kuzmanovic and E. W. Knightly, “Low-Rate TCP-Targeted Denial of Service Attacks (The Shrew vs. the Mice and Elephants),” In Proceedings of ACM DIGCOMM 2003, Karlsruhe, Germany, Aug. 2003