Zero-setup Intermediate-rate Communication Guarantees in a Global Internet

Zero-setup Intermediate-rate Communication Guarantees in a Global Internet

Speakers: Marc Wyss, Doctoral Student, ETH Zurich; Adrian Perrig

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=lV1y8TSrslo

Overview

In an increasingly interconnected world, the availability of critical network services is paramount. However, volumetric Distributed Denial of Service (DDoS) attacks pose a significant and persistent threat, capable of overwhelming network infrastructure and disrupting legitimate communication. This talk by Marc Wyss, a doctoral student at ETH Zurich, co-authored with Adrian Perrig, introduces Zane, a novel system designed to provide proactive and immediate communication guarantees specifically for short-lived, intermediate-rate traffic in the face of such attacks.

Zane targets a crucial class of network interactions, including everyday activities like DNS lookups (often just a few packets) and accessing websites (ranging from hundreds of kilobits per second to a few megabits per second). Unlike traditional reactive DDoS mitigation strategies that detect and then block malicious traffic, Zane offers a proactive approach, ensuring forwarding guarantees from the outset. This work is particularly significant because it addresses the limitations of existing solutions, which are often either too expensive, introduce unacceptable latency, or incur substantial setup overhead, making them impractical for the dynamic and ephemeral nature of intermediate-rate communications.

The core innovation of Zane lies in its ability to deliver these guarantees with zero setup overhead for the end-user, leveraging a combination of pre-allocated low rates at routers, robust source authentication, and secure routing primitives from the SCION future internet architecture. By focusing on availability rather than just detection and reaction, Zane offers a foundational shift in how critical network traffic can be protected, ensuring that essential services remain accessible even under sustained attack.

Background

▶ Watch: Introduction and problem: protecting intermediate-rate communication (0:00)

The internet, while robust in many aspects, remains vulnerable to attacks that exploit its fundamental design. Volumetric DDoS attacks, which aim to flood networks, routers, and links with vast amounts of traffic, are a prime example. These attacks cause congestion, leading to legitimate traffic being dropped and services becoming unavailable. The speakers highlighted that protecting short-lived, intermediate-rate communication—such as DNS queries, which are often just a few packets, or typical website access, which involves data rates from hundreds of kilobits per second to a few megabits per second—is particularly challenging in this threat landscape.

Existing solutions for ensuring communication availability have significant limitations:

• Leased lines and private backbones offer high availability but are prohibitively expensive for most applications and users.
• Over-provisioning of network capacity can absorb some attack volume but ultimately only shifts the problem, not fundamentally solves it, as attackers can scale their efforts.
• Rerouting and scrubbing centers can filter malicious traffic but introduce additional latency, which is undesirable for time-sensitive applications and can impact user experience.
• Per-flow fairness mechanisms are often vulnerable to source address spoofing and Command and Control (C&C) attacks, where attackers can masquerade as legitimate sources or coordinate large botnets.
• Many systems, including pushback mechanisms, are reactive. They attempt to detect malicious traffic and then block it. This approach inherently suffers from detection delay and the potential for misclassifications, where legitimate traffic might be mistakenly dropped.
• More recently proposed bandwidth reservation systems, while effective for long-lived communication like video streaming or conferencing, come with substantial setup overhead. This overhead makes them unsuitable for short-lived, bursty traffic where the cost of setup outweighs the benefit for brief communication sessions.

In summary, the problem statement articulated by the speakers is that the current state of network security and availability solutions leaves a critical gap for protecting the vast majority of everyday internet interactions—those that are short-lived, of intermediate rate, and susceptible to volumetric DDoS attacks without incurring prohibitive costs, latency, or setup complexities. This observation underscored the need for a fundamentally different approach, which Zane aims to provide.

Key Findings

▶ Watch: Three core insights for Zane: pre-allocation, authentication, secure routing (2:27)

The development of Zane was guided by three core insights that address the limitations of existing systems and form the foundation of its proactive communication guarantees:

1. Pre-allocation of Low Rates at Routers to Avoid Setup Overhead: The first insight recognized that for intermediate-rate traffic aggregates, a relatively low, pre-allocated bandwidth rate at network routers is often sufficient. By pre-allocating these rates, the system can provide immediate forwarding guarantees without requiring any per-flow or per-session setup. This eliminates the substantial overhead typically associated with bandwidth reservation systems, making it viable for short-lived communications. The concept is that an operator would allocate a certain rate (e.g., 1 gigabit per second) for traffic originating from a specific network and then isolate this traffic from other sources. This low-rate allocation is deemed adequate for the target traffic profile.

1. Network Bandwidth Isolation Requiring Source Authentication: To effectively implement network bandwidth isolation, it is crucial to prevent attackers from claiming traffic originates from a legitimate network to deplete its allocated bandwidth. This necessitates robust source authentication. Zane relies on EPIC (Efficient Packet IDentification and Cryptography), a system where every router can verify the authenticity of every packet's length and origin. A prerequisite for EPIC is path transparency, meaning end hosts must learn the identities of on-path networks to know which networks to authenticate their traffic to. This ensures that only genuinely authorized traffic consumes the guaranteed bandwidth.

1. Secure Routing as Essential for Communication Availability: The third insight emphasizes that secure routing is fundamental to providing any forwarding guarantees. If routing mechanisms are insecure, an attacker could easily hijack or blackhole communication, rendering any bandwidth guarantees meaningless. For this reason, Zane leverages the SCION (Scalability, Control, and Isolation On Next-generation networks) future internet architecture. SCION is designed to prevent hijacking attacks by design, offering intrinsic routing security. Crucially, SCION also provides the necessary path transparency required by EPIC. Furthermore, Zane leverages SCION's concept of Isolation Domains (ISDs), which are trust-based groupings of networks, to enable efficient and scalable management of bandwidth allocations.

These three core insights—pre-allocation without setup, source authentication for isolation, and secure routing—culminated in the design of Zane, a system that proactively protects short-lived, intermediate-rate communication against volumetric DDoS attacks.

Technical Deep Dive

▶ Watch: Memory-optimized token bucket for scaling to 100,000 networks (5:50)

Zane is architected as a two-part system designed to operate collaboratively across the network: the Zane Router component and the Zane Gateway. Together, these components implement proactive bandwidth isolation and authentication from the network edge to the core.

The Zane Router

The Zane Router is deployed within the network core, typically by network operators. Its primary function is to implement bandwidth isolation for traffic originating from different networks. An operator configures a specific guaranteed rate for each source network, for instance, 1 gigabit per second per network. If a source network sends traffic below its configured rate, that traffic is guaranteed to be forwarded. However, if traffic exceeds the guaranteed rate, only the initial portion (e.g., the first 1 Gbps) is guaranteed, while the excess traffic is handled on a best-effort basis. This ensures that legitimate traffic within the allocated budget is always prioritized.

Implementing such fine-grained bandwidth isolation efficiently is a significant challenge, especially for an internet-scale deployment with tens of thousands of networks. A naive approach using per-network queues would not scale due to excessive memory requirements. Zane addresses this by employing a more optimized design: it uses one priority queue for all traffic, combined with per-network token buckets. Each token bucket is responsible for tracking the rate compliance of traffic from a specific source network.

The memory overhead for a standard token bucket can range from 20 to 60 bytes. Zane introduces a memory-optimized token bucket that reduces this footprint to only 8 bytes per bucket. This optimization is critical for scalability. Furthermore, Zane leverages SCION's Isolation Domains (ISDs). ISDs are trust-based groupings of networks within the SCION architecture. By allowing operators to configure rates at the level of these groups of networks rather than just individual networks, Zane can achieve remarkable scalability. For example, it can configure rates for up to 100,000 networks while requiring only 5.3 kilobytes of memory for its token bucket state. The process of checking rate compliance for any given packet is extremely efficient, requiring only tens of nanoseconds.

The Zane Gateway

The Zane Gateway is deployed at the edge of the network, specifically within source networks. Its purpose is twofold: to distribute the network-level guaranteed rates to individual end hosts within that network and to implement bandwidth isolation for end hosts residing in the same network.

An operator configures specific guaranteed rates for individual IP addresses or IP address ranges within their network (e.g., 1 megabit per second for a particular IP address). The Gateway then plays a crucial role in authorizing and authenticating traffic that complies with these rates. This authorization allows devices further along the forwarding path, such as Zane Routers, to verify the authenticity and rate compliance of the traffic. If an end host attempts to overuse its guaranteed rate, the overuse traffic is either not authorized or is completely dropped, depending on the operator's configured policy. This mechanism prevents a single malicious or misbehaving end host from consuming the guaranteed bandwidth allocated to its entire network or other hosts within it.

Proactive Security Model

Zane's security model is inherently proactive, a significant departure from many reactive security systems. Instead of detecting malicious traffic after it has entered the network and then attempting to block it, Zane provides immediate forwarding guarantees that are independent of the attacker's traffic patterns.

• Attacks from other networks:
• If an attack consists of unauthenticated traffic, it is forwarded with strictly lower priority at Zane Routers. This means it does not affect the forwarding guarantees provided to authenticated, legitimate traffic.
• If an attack uses authenticated traffic, it still cannot deplete the forwarding guarantees provided to a legitimate network. This is due to the combination of source authentication (via EPIC) and bandwidth isolation implemented at the Zane Router. The attacker's authenticated traffic would be capped at its own network's allocated rate, preventing it from overwhelming others.
• Attacks from other end hosts in the same network: These attacks are effectively mitigated through the bandwidth isolation enforced by the Zane Gateway. An overusing host's traffic is either unauthorized or dropped, preventing it from impacting other legitimate hosts within its network.

This proactive design ensures that the availability of short-lived, intermediate-rate communication remains robust, even under sustained volumetric DDoS attacks, by guaranteeing resources upfront and verifying authenticity throughout the path.

Demo / Proof of Concept

▶ Watch: Zane Gateway: distributing and enforcing end-host bandwidth guarantees (6:16)

The practical viability and performance of Zane were rigorously demonstrated through its implementation and deployment on SCIONLab, a global research testbed specifically designed for the SCION future internet architecture. This deployment showcased the seamless integration of Zane into the existing SCION ecosystem, with no observed issues during a three-month testing period.

A critical aspect of the demonstration was proving the feasibility of incremental deployment. This is vital for any new network technology, as it allows for gradual adoption without requiring a "flag day" or a complete overhaul of existing infrastructure. Zane successfully demonstrated incremental deployment both at the level of whole networks and for individual routers, indicating that operators can adopt Zane components progressively.

To validate its high-performance capabilities, a high-speed version of both the Zane Router and Gateway was implemented using DPDK (Data Plane Development Kit). This specialized framework is widely used in network applications for achieving high packet processing rates. The DPDK-optimized Zane implementation demonstrated an impressive 160 gigabits per second forwarding capacity on commodity hardware. This performance figure highlights Zane's ability to handle substantial network traffic volumes, making it suitable for deployment in high-capacity network environments.

Further analysis of the high-speed Gateway's performance revealed that it scales linearly with the number of dedicated CPU cores. This linear scalability is a highly desirable property for network devices, as it allows operators to easily increase performance by simply adding more processing resources or by deploying additional gateways in parallel to distribute the load. The correct traffic scheduling and bandwidth isolation mechanisms were also verified, confirming that Zane effectively enforces its promised guarantees even at high throughputs. These demonstrations provided strong evidence of Zane's technical soundness, scalability, and readiness for real-world application.

Defensive Implications

▶ Watch: SCIONLab deployment, incremental rollout, and high-speed performance (8:50)

Zane presents a paradigm shift for network defenders, moving from reactive DDoS mitigation to proactive communication guarantees. The implications for enhancing network resilience and availability are substantial:

• Proactive DDoS Protection: Defenders can adopt Zane to establish a baseline of guaranteed availability for critical, short-lived, intermediate-rate traffic. This means that essential services like DNS resolution, API calls, and web access will maintain a minimum level of service quality even when under volumetric DDoS attack, rather than waiting for detection and response.
• Leveraging SCION and EPIC: For organizations considering future internet architectures, Zane provides a compelling use case for SCION and EPIC. SCION's inherent secure routing capabilities prevent hijacking, while EPIC's source authentication is fundamental to Zane's bandwidth isolation. Deploying or integrating with SCION-based infrastructure could provide foundational security benefits beyond just DDoS protection.
• Granular Bandwidth Control: Network operators gain granular control over bandwidth allocation, not just at the network level but also down to individual end hosts within an autonomous system. This allows for precise resource management and prevents internal over-consumption from affecting critical external communications.
• Complementary to Existing Systems: Zane is not designed to replace all existing DDoS solutions. Instead, it can coexist with current bandwidth reservation systems. While Zane protects setup-critical, short-lived traffic, traditional reservation systems can continue to protect long-lived, high-bandwidth applications like video conferencing or streaming. This layered approach offers comprehensive protection.
• Foundation for Highly Available Applications: By ensuring the availability of underlying communication, Zane can serve as a foundation for building inherently highly available applications. For instance, it can significantly enhance the resilience of DNS systems, which are frequent targets of DDoS attacks and critical for virtually all internet services.
• Cost-Effective Scalability: The memory-optimized design (8 bytes per token bucket, 5.3 KB for 100,000 networks) and high-speed DPDK implementation (160 Gbps on commodity hardware) suggest that Zane can offer robust protection without requiring exorbitant hardware investments, providing a scalable and cost-effective solution for network operators.

In essence, Zane empowers defenders to move beyond simply reacting to threats towards architecting networks that are resilient by design, ensuring that essential communication flows are always protected.

Key Takeaways

• Proactive Communication Guarantees: Zane provides immediate, proactive forwarding guarantees for short-lived, intermediate-rate network traffic, such as DNS and website access, effectively mitigating volumetric DDoS attacks without requiring reactive detection.
• Zero-Setup Overhead: By pre-allocating low rates at routers and leveraging SCION's architecture, Zane eliminates the substantial setup overhead that makes traditional bandwidth reservation systems impractical for ephemeral communications.
• Leveraging SCION and EPIC: The system relies heavily on the SCION future internet architecture for secure routing and path transparency, and EPIC for robust source authentication, ensuring that only legitimate and authorized traffic consumes guaranteed bandwidth.
• Scalable Bandwidth Isolation: Zane employs a highly optimized router design utilizing a single priority queue with memory-efficient (8-byte) per-network token buckets and leverages SCION's Isolation Domains (ISDs) to scale bandwidth allocation to 100,000 networks with minimal memory overhead (5.3 KB).
• End-Host Protection and Performance: A dedicated Gateway component extends bandwidth isolation to individual end hosts within a network. The system demonstrates high performance with a DPDK implementation achieving 160 Gbps forwarding on commodity hardware, scaling linearly with dedicated CPU cores.
• Complementary Defensive Strategy: Zane can coexist with and complement existing bandwidth reservation systems, providing a layered approach where Zane protects setup-critical, short-lived traffic, while other systems handle long-lived communications, fostering a foundation for highly available applications like DNS.

About the Speaker(s)

Marc Wyss is a doctoral student at ETH Zurich, where his research focuses on critical aspects of internet communication guarantees and security. His work, including the Zane system, aims to address fundamental challenges in network availability and resilience in the face of modern threats like volumetric DDoS attacks.

Adrian Perrig is associated with ETH Zurich and is a collaborator on the Zane project. While the transcript does not provide specific details about his title, his involvement with advanced network architectures and security, particularly SCION, is evident through his co-authorship and the foundational role of SCION in Zane.