CDN-on-Demand: An Affordable DDoS Defense via Untrusted Clouds

Yossi Gilad; Amir Herzberg; Michael Sudkovitch; Michael Goberman

doi:10.14722/ndss.2016.23109

CDN-on-Demand: An Affordable DDoS Defense via Untrusted Clouds

Yossi Gilad, Amir Herzberg, Michael Sudkovitch, Michael Goberman

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

41 Scopus citations

Abstract

We present CDN-on-Demand, a software-based defense that administrators of small to medium websites install to resist powerful DDoS attacks, with a fraction of the cost of comparable commercial CDN services. Upon excessive load, CDNon- Demand serves clients from a scalable set of proxies that it automatically deploys on multiple IaaS cloud providers. CDN-on- Demand can use less expensive and less trusted clouds to minimize costs. This is facilitated by the clientless secure-objects, which is a new mechanism we present. This mechanism avoids trusting the hosts with private keys or user-data, yet does not require installing new client programs. CDN-on-Demand also introduces the origin-connectivity mechanism, which ensures that essential communication with the content-origin is possible, even in case of severe DoS attacks. A critical feature of CDN-on-Demand is in facilitating easy deployment. We introduce the origin-gateway module, which deploys CDN-on-Demand automatically and transparently, i.e., without introducing changes to web-server configuration or website content. We implement CDN-on-Demand and evaluate each component separately as well as the complete system.

Original language	English
Title of host publication	23rd Annual Network and Distributed System Security Symposium, NDSS 2016
Publisher	The Internet Society
ISBN (Electronic)	189156241X, 9781891562419
DOIs	https://doi.org/10.14722/ndss.2016.23109
State	Published - 2016
Event	23rd Annual Network and Distributed System Security Symposium, NDSS 2016 - San Diego, United States Duration: 21 Feb 2016 → 24 Feb 2016

Publication series

Name	23rd Annual Network and Distributed System Security Symposium, NDSS 2016

Conference

Conference	23rd Annual Network and Distributed System Security Symposium, NDSS 2016
Country/Territory	United States
City	San Diego
Period	21/02/16 → 24/02/16

Bibliographical note

Publisher Copyright:
© 2016 Internet Society.

Funding

This work was supported by grant 1354/11 from the Israeli Science Foundation (ISF), and by grants from the Check Point Institute for Information and Security (CPIIS) and the Ministry of Science, Technology and Space, Israel.

Funders	Funder number
Ministry of Science, Technology and Space
Israel Science Foundation
Check Point Institute for Information Security, Tel Aviv University

Access to Document

10.14722/ndss.2016.23109

Cite this

@inproceedings{ded8ccf3ad2547e48872be4a82168c2a,

title = "CDN-on-Demand: An Affordable DDoS Defense via Untrusted Clouds",

abstract = "We present CDN-on-Demand, a software-based defense that administrators of small to medium websites install to resist powerful DDoS attacks, with a fraction of the cost of comparable commercial CDN services. Upon excessive load, CDNon- Demand serves clients from a scalable set of proxies that it automatically deploys on multiple IaaS cloud providers. CDN-on- Demand can use less expensive and less trusted clouds to minimize costs. This is facilitated by the clientless secure-objects, which is a new mechanism we present. This mechanism avoids trusting the hosts with private keys or user-data, yet does not require installing new client programs. CDN-on-Demand also introduces the origin-connectivity mechanism, which ensures that essential communication with the content-origin is possible, even in case of severe DoS attacks. A critical feature of CDN-on-Demand is in facilitating easy deployment. We introduce the origin-gateway module, which deploys CDN-on-Demand automatically and transparently, i.e., without introducing changes to web-server configuration or website content. We implement CDN-on-Demand and evaluate each component separately as well as the complete system.",

author = "Yossi Gilad and Amir Herzberg and Michael Sudkovitch and Michael Goberman",

note = "Publisher Copyright: {\textcopyright} 2016 Internet Society.; 23rd Annual Network and Distributed System Security Symposium, NDSS 2016 ; Conference date: 21-02-2016 Through 24-02-2016",

year = "2016",

doi = "10.14722/ndss.2016.23109",

language = "אנגלית",

series = "23rd Annual Network and Distributed System Security Symposium, NDSS 2016",

publisher = "The Internet Society",

booktitle = "23rd Annual Network and Distributed System Security Symposium, NDSS 2016",

}

Gilad, Y, Herzberg, A, Sudkovitch, M & Goberman, M 2016, CDN-on-Demand: An Affordable DDoS Defense via Untrusted Clouds. in 23rd Annual Network and Distributed System Security Symposium, NDSS 2016. 23rd Annual Network and Distributed System Security Symposium, NDSS 2016, The Internet Society, 23rd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, United States, 21/02/16. https://doi.org/10.14722/ndss.2016.23109

CDN-on-Demand: An Affordable DDoS Defense via Untrusted Clouds. / Gilad, Yossi; Herzberg, Amir; Sudkovitch, Michael et al.
23rd Annual Network and Distributed System Security Symposium, NDSS 2016. The Internet Society, 2016. (23rd Annual Network and Distributed System Security Symposium, NDSS 2016).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - CDN-on-Demand

T2 - 23rd Annual Network and Distributed System Security Symposium, NDSS 2016

AU - Gilad, Yossi

AU - Herzberg, Amir

AU - Sudkovitch, Michael

AU - Goberman, Michael

PY - 2016

Y1 - 2016

N2 - We present CDN-on-Demand, a software-based defense that administrators of small to medium websites install to resist powerful DDoS attacks, with a fraction of the cost of comparable commercial CDN services. Upon excessive load, CDNon- Demand serves clients from a scalable set of proxies that it automatically deploys on multiple IaaS cloud providers. CDN-on- Demand can use less expensive and less trusted clouds to minimize costs. This is facilitated by the clientless secure-objects, which is a new mechanism we present. This mechanism avoids trusting the hosts with private keys or user-data, yet does not require installing new client programs. CDN-on-Demand also introduces the origin-connectivity mechanism, which ensures that essential communication with the content-origin is possible, even in case of severe DoS attacks. A critical feature of CDN-on-Demand is in facilitating easy deployment. We introduce the origin-gateway module, which deploys CDN-on-Demand automatically and transparently, i.e., without introducing changes to web-server configuration or website content. We implement CDN-on-Demand and evaluate each component separately as well as the complete system.

AB - We present CDN-on-Demand, a software-based defense that administrators of small to medium websites install to resist powerful DDoS attacks, with a fraction of the cost of comparable commercial CDN services. Upon excessive load, CDNon- Demand serves clients from a scalable set of proxies that it automatically deploys on multiple IaaS cloud providers. CDN-on- Demand can use less expensive and less trusted clouds to minimize costs. This is facilitated by the clientless secure-objects, which is a new mechanism we present. This mechanism avoids trusting the hosts with private keys or user-data, yet does not require installing new client programs. CDN-on-Demand also introduces the origin-connectivity mechanism, which ensures that essential communication with the content-origin is possible, even in case of severe DoS attacks. A critical feature of CDN-on-Demand is in facilitating easy deployment. We introduce the origin-gateway module, which deploys CDN-on-Demand automatically and transparently, i.e., without introducing changes to web-server configuration or website content. We implement CDN-on-Demand and evaluate each component separately as well as the complete system.

UR - http://www.scopus.com/inward/record.url?scp=85089309388&partnerID=8YFLogxK

U2 - 10.14722/ndss.2016.23109

DO - 10.14722/ndss.2016.23109

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85089309388

T3 - 23rd Annual Network and Distributed System Security Symposium, NDSS 2016

BT - 23rd Annual Network and Distributed System Security Symposium, NDSS 2016

PB - The Internet Society

Y2 - 21 February 2016 through 24 February 2016

ER -

CDN-on-Demand: An Affordable DDoS Defense via Untrusted Clouds

Abstract

Publication series

Conference

Bibliographical note

Funding

Access to Document

Other files and links

Fingerprint

Cite this