DAMUP: Practical and privacy-aware cloud-based DDoS mitigation
Su-Chin Lin, Po‐Wei Huang, Hsin‐Yi Wang, Hsu‐Chun Hsiao · 2018
Cloud-based DDoS mitigation techniques have been widely deployed. However, existing approaches severely violate user privacy as they intercept HTTPS to uncover non-volumetric attacks. This paper presents DAMUP, DDoS Attack Mitigation Upholding Privacy. DAMUP is a practical and privacy-aware solution that empowers the cloud to blindly filter encrypted traffic while remaining deployable on the current Internet. The main idea underlying DAMUP is to encode the server's filtering policy, e.g., client's priority level or rate limit, into cryptographic tokens that can be stapled to an encrypted connection and be efficiently verified by the cloud. DAMUP is designed to be deployable on the current Internet because it requires no modification to the Internet architecture. For example, DAMUP leverages the Server Name Indication field in the TLS handshake to exchange tokens, and uses SOCKS proxy to override DNS. Our evaluation shows that DAMUP can significantly improve the connection success rate from 11.4% to 99.8% under HTTP(S) floods.