Mitigating brute-force attacks on Bloom-filter based forwarding

Abstract

The in-packet Bloom filter forwarding mechanism is a source routing approach used in Information-centric networking (ICN). This mechanism is vulnerable to brute-force attacks that can be used for distributed denial-of-service (DDoS) attacks and unsolicited messages (spam). In this paper we analytically calculate the probability of brute-force attacks and determine the time required by the attacker to launch a successful attack. We find that using scenarios reported by other researchers this type of attacks is achievable in few seconds, which is unacceptable. The paper proposes a solution to mitigate the brute-force attacks by significantly increasing the time before a successful attack. Consequently, it is possible to change link identifiers before the attacker can adapt to the changes. We evaluate the proposed solution in terms of network security and scalability.