IP fast hopping protocol design
Vladimir V. Krylov, Kirill I. Kravtsov · 2014
Denial-of-Service attacks are the largest threat to Internet and the Internet of Things despite the fact that a large number of defense approaches has been proposed by the research community. In this paper we introduce IP Fast Hopping, effective network layer software solution against DDoS attacks. Our technology hides real IP address of a server behind a large pool of IP addresses belongs to a number of routers in different networks. Our method provides a network layer approach to prevent unauthorized access to a server that sometimes is important for the Internet of Things. Our approach implies real-time changing of server's IP address according to a schedule which is available only for authorized clients (so, our method is not applicable for publicly available Internet resources). This schedule is unique for each client connection and each entry in this schedule is being calculated dynamically on both edges of secured connection independently using a special pseudo-random function. To implement this requirement, during connection establishing between a new authorized client and the server, the client receives initial server's IP (which will be used for high level protocols on client side), pool of IP addresses (unordered set of IP address related to a set of "edge" routers) and unique session ID. The special network layer software installed on client's terminal changes destination IP address of the packet on an address from the IP pool according to value of a special pseudo-random function with the following arguments: session unique ID and time of packet's creation (value of timestamp field into TCP header). After that, this packet is being traversed to one of "edge" routers according to common switching protocols. The router checks (using the same pseudo-random function) that destination address is correct and, if yes, redirects this packet to real server IP or, otherwise, drops the packet. The same procedure is applied for server's responses to clients.