Marginal probability packet marking method based on digital signature technology of combined public key

Abstract

The invention discloses a marginal probability packet marking method based on digital signature technology of combined public key, relating to the technology of locating an attack source by adding marks in a data packet in the filed of communication network security. A data packet from a local area network is sampled with a set probability, the sampled data packet is marked by ID information of a brink router, and digital signature based on the combined public key is carried out to guarantee the creditability of the marks. The location of the brink router is implemented by fetching the ID information of the brink router from the attack data packet having credible marks. The method has the advantages of simple implementation, compatibility with the existing protocol, quick tracking speed, postmortem analysis permission, no increase of extra network load, application to DDoS attack location, high security and the like, and is particularly applied to real-time or non-real-time tracking location of each attack source when low-speed or high-speed network suffers from flood attacks.

Description

technical field [0001] The invention relates to an edge probability packet marking method based on combined public key digital signature technology in the field of communication network security, and is especially suitable for real-time or non-real-time tracking and positioning of attack sources when low-speed / high-speed networks are attacked by DoS / DDoS. Background technique [0002] The basic idea of ​​the probabilistic packet marking (abbreviated as PPM) method proposed by Savage et al. in 2000 is that the intermediate router will mark the data packet with probability every time it receives a data packet, and the information content of the marking is the IP address information of the router. Victims can locate the ingress edge router at the attack end by collecting a large number of marked attack packets. Later, some improved algorithms of PPM reduced the number of marked attack packets required for positioning to a certain extent through certain measures, but the overall...

AI Technical Summary

Problems solved by technology

Source tracing requires a large number of marked attack packets, and the calculation is complex

[0006] 2. Not robust against multiple attacks

It is difficult to defend against multi-source DDoS attacks. When the number of attack sources exceeds 20, the calculation intensity required to reconstruct the attack path and the false reconstruction rate are very high.

Images