NDLI: On improving resistance to Denial of Service and key provisioning scalability of the DTLS handshake

Content Provider	Springer Nature Link
Author	Tiloca, Marco Gehrmann, Christian Seitz, Ludwig
Copyright Year	2016
Abstract	DTLS is a transport layer security protocol designed to provide secure communication over unreliable datagram protocols. Before starting to communicate, a DTLS client and server perform a specific handshake in order to establish a secure session and agree on a common security context. However, the DTLS handshake is affected by two relevant issues. First, the DTLS server is vulnerable to a specific Denial of Service (DoS) attack aimed at forcing the establishment of several half-open sessions. This may exhaust memory and network resources on the server, so making it less responsive or even unavailable to legitimate clients. Second, although it is one of the most efficient key provisioning approaches adopted in DTLS, the pre-shared key provisioning mode does not scale well with the number of clients, it may result in scalability issues on the server side, and it complicates key re-provisioning in dynamic scenarios. This paper presents a single and efficient security architecture which addresses both issues, by substantially limiting the impact of DoS, and reducing the number of keys stored on the server side to one unit only. Our approach does not break the existing standard and does not require any additional message exchange between DTLS client and server. Our experimental results show that our approach requires a shorter amount of time to complete a handshake execution and consistently reduces the time a DTLS server is exposed to a DoS instance. We also show that it considerably improves a DTLS server in terms of service availability and robustness against DoS attack.
Starting Page	173
Ending Page	193
Page Count	21
File Format	PDF
ISSN	16155262
Journal	International Journal of Information Security
Volume Number	16
Issue Number	2
e-ISSN	16155270
Language	English
Publisher	Springer Berlin Heidelberg
Publisher Date	2016-03-25
Publisher Place	Berlin, Heidelberg
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Security DTLS Denial of Service Key provisioning Data Encryption Computer Communication Networks Operating Systems Coding and Information Theory Management of Computing and Information Systems Communications Engineering, Networks
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Information Systems Safety, Risk, Reliability and Quality Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

A multi-layer framework for puzzle-based denial-of-service defense

Zheng and Seberry’s public key encryption scheme revisited

Denial of service attacks and defenses in decentralized trust management

Computer security

Relations between the security models for certificateless encryption and ID-based key agreement

Broadcast encryption with dealership

Security in cloud computing

A survey of certificateless encryption schemes and security models

Improving the ISO/IEC 11770 standard for key management techniques

On improving resistance to Denial of Service and key provisioning scalability of the DTLS handshake

Similar Documents

A multi-layer framework for puzzle-based denial-of-service defense

Zheng and Seberry’s public key encryption scheme revisited

Denial of service attacks and defenses in decentralized trust management

Computer security

Relations between the security models for certificateless encryption and ID-based key agreement

Broadcast encryption with dealership

Security in cloud computing

A survey of certificateless encryption schemes and security models

Improving the ISO/IEC 11770 standard for key management techniques

On improving resistance to Denial of Service and key provisioning scalability of the DTLS handshake