Preventing Internet Denial-of-Service With Capabilities

This paper proposes a new approach to preventing and constraining Denial-of-Service (DoS) attacks. Instead of being able to send anything to anyone at any time, in one's architecture, nodes must first obtain "Permission to send" from the destination; a receiver provides tokens, or capabilities, to those senders whose traffic it agrees to accept. The senders then include these tokens in packets. This enables verification points distributed around the network to check that traffic has been certified as legitimate by both endpoints and the path in between, and to cleanly discard unauthorized traffic. The paper shows that the approach addresses many of the limitations of the currently popular approaches to DoS based on anomaly detection, traceback, and pushback.