Distributed Denial-of-Service Open Threat Signaling (DOTS) Data Channel

A distributed denial-of-service (DDoS) attack is an attempt to make machines or network resources unavailable to their intended users. In most cases, sufficient scale can be achieved by compromising enough end-hosts and using those infected hosts to perpetrate and amplify the attack. The victim in this attack can be an application server, a client, a router, a firewall, or an entire network. DDoS Open Threat Signaling (DOTS) defines two channels: signal and data channels (). The DOTS signal channel used to convey that a network is under a DDOS attack to an upstream DOTS server so that appropriate mitigation actions are undertaken on the suspect traffic is further elaborated in . The DOTS data channel is used for infrequent bulk data exchange between DOTS agents in the aim to significantly augment attack response coordination.

| | | DOTS Client | | DOTS Server | | | <======= Data Channel ======> | | +---------------+ +---------------+]]> Section 2 of identifies that the DOTS data channel is used to perform the tasks listed below: Filter management, which enables a DOTS client to install or remove traffic filters dropping or rate-limiting unwanted traffic and permitting white-listed traffic. Sample use cases for populating black- or white-list filtering rules are detailed hereafter: If a network resource (DOTS client) detects a potential DDoS attack from a set of IP addresses, the DOTS client informs its servicing router (DOTS gateway) of all suspect IP addresses that need to be blocked or black-listed for further investigation. The DOTS client could also specify a list of protocols and ports in the black-list rule. That DOTS gateway in-turn propagates the black-listed IP addresses to the DOTS server which will undertake appropriate action so that traffic from these IP addresses to the target network (specified by the DOTS client) is blocked. An enterprise network has partner sites from which only legitimate traffic arrives and the enterprise network wants to ensure that the traffic from these sites is not penalized during DDOS attacks. The DOTS client uses DOTS data channel to convey the white-listed IP addresses or prefixes of the partner sites to its DOTS server. The DOTS server uses this information to white-list flows from such IP addresses or prefixes reaching the enterprise network. Creating identifiers, such as names or aliases, for resources for which mitigation may be requested: The DOTS client may submit to the DOTS server a collection of prefixes it wants to refer to by alias when requesting mitigation, to which the server would respond with a success status and the new prefix group alias, or an error status and message in the event the DOTS client's data channel request failed (see requirement OP-006 in and Section 2 in ). DOTS signal channel session configuration: The DOTS client can use DOTS data channel to configure or to retrieve the DOTS signal channel session behavior using the data channel. The DOTS data channel can be used, for example, to configure the following: Heartbeat intervals: DOTS agents regularly send heartbeats to each other after mutual authentication in order to keep the DOTS signal channel open. The heartbeat interval is conveyed using the DOTS data channel. Acceptable signal loss ratio: Maximum retransmissions, maximum retransmission span and other message transmission parameters for the DOTS signal channel are sent from the DOTS client to the DOTS server using the DOTS data channel.

The DOTS data channel is intended to be used for bulk data exchanges between DOTS agents. Unlike the signal channel, which must operate nominally even when confronted with despite signal degradation due to packet loss, the data channel is not expected to be constructed to deal with attack conditions. As the primary function of the data channel is data exchange, a reliable transport is required in order for DOTS agents to detect data delivery success or failure. Constrained Application Protocol (CoAP) over TLS over TCP is used for DOTS data channel (). COAP was designed according to the REST architecture, and thus exhibits functionality similar to that of HTTP, it is quite straightforward to map from CoAP to HTTP and from HTTP to CoAP.

JSON payloads is used to convey DOTS signal channel session configuration, filtering rules as well as data channel specific payload messages that convey request parameters and response information such as errors. All data channel URIs defined in this document, and in subsequent documents, MUST NOT have a URI containing "/DOTS-signal". A single DOTS data channel between DOTS agents can be used to exchange multiple requests and multiple responses. To reduce DOTS client and DOTS server workload, DOTS client SHOULD re-use the TLS session.

A DOTS client registers itself to its DOTS server(s) in order to set up DOTS related configuration and policy information exchange between the two DOTS agents.

A POST request is used to create identifiers, such as names or aliases, for resources for which a mitigation may be requested. Such identifiers may then be used in subsequent DOTS signal channel exchanges to refer more efficiently to the resources under attack ().

The header fields are described below: Identifier of the policy represented using an integer. This identifier MUST be unique for each policy bound to the DOTS client, i.e., the policy-id needs to be unique relative to the active policies with the DOTS server. This identifier MUST be generated by the client. This document does not make any assumption about how this identifier is generated. This is a mandatory attribute. Name of the alias. This is a mandatory attribute. Valid protocol values include tcp, udp, sctp, and dccp. Protocol values are separated by commas (e.g., "tcp, udp"). This is an optional attribute. The destination port number. Ports are separated by commas and port number range (using "-"). For TCP, UDP, SCTP, or DCCP: the destination range of ports (e.g., 80-8080). This information is useful to avoid disturbing a group of customers when address sharing is in use . This is an optional attribute. The destination IP address or prefix. IP addresses and prefixes are separated by commas. Prefixes are represented using CIDR notation. This is an optional attribute. Fully Qualified Domain Name, is the full name of a system, rather than just its hostname. For example, "venera" is a hostname, and "venera.isi.edu" is an FQDN. This is an optional attribute. Uniform Resource Identifier (URI). This is an optional attribute. E.164 number. This is an optional attribute. In the POST request at least one of the attributes traffic-protocol or destination-protocol-port or destination-ip or FQDN or URI or E.164 MUST be present. shows a POST request to create alias called "https1" for HTTPS servers with IP addresses 2002:db8:6401::1 and 2002:db8:6401::2 listening on port 443.

The DOTS server indicates the result of processing the POST request using CoAP response codes. CoAP 2xx codes are success, CoAP 4xx codes are some sort of invalid requests and 5xx codes are returned if the DOTS server has erred or it is incapable of accepting the alias. Response code 2.01 (Created) will be returned in the response if the DOTS server has accepted the alias. If the request is missing one or more mandatory attributes, then 4.00 (Bad Request) will be returned in the response or if the request contains invalid or unknown parameters then 4.02 (Invalid query) will be returned in the response. The CoAP response will include the JSON body received in the request.

A DELETE request is used to delete an identifier maintained by a DOTS server ().

If the DOTS server does not find the policy number conveyed in the DELETE request in its policy state data, then it responds with a 4.04 (Not Found) error response code. The DOTS server successfully acknowledges a DOTS client's request to remove the identifier using 2.02 (Deleted) response code.

A GET request is used to retrieve the set of installed identifiers from a DOTS server. shows how to retrieve all the identifiers that were instantiated by the DOTS client while shows how to retrieve a specific identifier.

shows response for all identifiers on the DOTS server.

If the DOTS server does not find the policy number conveyed in the GET request in its policy state data, then it responds with a 4.04 (Not Found) error response code.

A POST request is used to convey the configuration parameters for the signaling channel (e.g., maximum retransmissions, maximum retransmission span etc). Message transmission parameters for CoAP are defined in Section 4.8 of . These parameters can be set by the DOTS agent (need not be default). A DOTS client typically uses the same DOTS signaling channel session to convey multiple DOTS signals. The signaling channel session configuration is applicable to all DOTS signal channel sessions between the DOTS agents. TBD: What other message transmission parameters need to conveyed in the POST request ?

The DOTS server indicates the result of processing the POST request using CoAP response codes. CoAP 2xx codes are success, CoAP 4xx codes are some sort of invalid request and 5xx codes are returned if the DOTS server has erred or is incapable of accepting the configuration parameters. Response code 2.01 (Created) will be returned in the response if the DOTS server has accepted the configuration parameters. If the request is missing one or more mandatory attributes then 4.00 (Bad Request) will be returned in the response or if the request contains invalid or unknown parameters then 4.02 (Invalid query) will be returned in the response. The CoAP response will include the JSON body received in the request.

A DELETE request is used to delete DOTS signal channel session configuration ().

A GET request is used to retrieve the set of installed DOTS signal channel session configuration data from a DOTS server. shows how to retrieve the DOTS signal channel session configuration data.

If the DOTS server does not find the policy number conveyed in the GET request in its policy state data, then it responds with a 4.04 (Not Found) error response code.

One of the possible arrangements for a DOTS client to signal filtering rules to a DOTS server via the DOTS gateway is discussed below: The DOTS data channel conveys the filtering rules to the DOTS gateway. The DOTS gateway validates if the DOTS client is authorized to signal the filtering rules and if the client is authorized propagates the rules to the DOTS server. Likewise, the DOTS server validates if the DOTS gateway is authorized to signal the filtering rules. To create or purge filters, the DOTS client sends CoAP requests to the DOTS gateway. The DOTS gateway validates the rules and proxies the requests containing the filtering rules to a DOTS server. When the DOTS gateway receives the associated CoAP response from the DOTS server, it propagates the response back to the DOTS client. The following APIs define means for a DOTS client to configure filtering rules on a DOTS server.

A POST request is used to push filtering rules to a DOTS server ().

The header fields are described below: An identifier of the policy represented as an integer. This identifier MUST be unique for each policy bound to the DOTS client, i.e., the policy-id needs to be unique relative to the active policies with the DOTS server. This identifier MUST be generated by the client. This document does not make any assumption about how this identifier is generated. This is a mandatory attribute. Valid protocol values include tcp, udp, sctp, and dccp. Protocol values are separated by commas (e.g., "tcp, udp"). This is a mandatory attribute. The source port number. Ports are separated by commas and port number range (using "-"). For TCP, UDP, SCTP, or DCCP: the source range of ports (e.g., 1024-65535). This is an optional attribute. The destination port number. Ports are separated by commas and port number range (using "-"). For TCP, UDP, SCTP, or DCCP: the destination range of ports (e.g., 443-443). This information is useful to avoid disturbing a group of customers when address sharing is in use . This is an optional attribute. The destination IP address or prefix. IP addresses and prefixes are separated by commas. Prefixes are represented using CIDR notation. This is an optional attribute. The source IP addresses or prefix. IP addresses and prefixes are separated by commas. Prefixes are represented using CIDR notation. This is an optional attribute. Lifetime of the rule in seconds. Upon the expiry of this lifetime, and if the request is not refreshed, this particular rule is removed. The rule can be refreshed by sending the same message again. The default lifetime of the rule is 60 minutes -- this value was chosen to be long enough so that refreshing is not typically a burden on the DOTS client, while expiring the rule where the client has unexpectedly quit in a timely manner. A lifetime of zero indicates indefinite lifetime for the rule. The server MUST always indicate the actual lifetime in the response. This is an optional attribute in the request. Differentiated services code point (DSCP) value in the IP header of a packet. This is an optional attribute in the request. This is the allowed traffic rate in bytes per second indicated in IEEE floating point format. The value 0 indicates all traffic for the particular flow to be discarded. This is a mandatory attribute. The relative order of two rules is determined by comparing their respective policy identifiers. The rule with lower numeric policy identifier value has higher precedence (and thus will match before) than the rule with higher numeric policy identifier value. shows a POST request to block traffic from an attacker using 2001:db8:abcd:3f01::/64 IPv6 prefix to a network resource reachable at IP address 2002:db8:6401::1 to operate a server on TCP port 443.

The DOTS server indicates the result of processing the POST request using CoAP response codes. CoAP 2xx codes are success, CoAP 4xx codes are some sort of invalid request and 5xx codes are returned if the DOTS server has erred or is incapable of configuring the filtering rules. Response code 2.01 (Created) will be returned in the response if the DOTS server has accepted the filtering rules. If the request is missing one or more mandatory attributes then 4.00 (Bad Request) will be returned in the response or if the request contains invalid or unknown parameters then 4.02 (Invalid query) will be returned in the response. The CoAP response will include the JSON body received in the request.

A DELETE request is used to delete filtering rules from a DOTS server ().

If the DOTS server does not find the policy number conveyed in the DELETE request in its policy state data, then it responds with a 4.04 (Not Found) error response code. The DOTS server successfully acknowledges a DOTS client's request to withdraw the filtering rules using 2.02 (Deleted) response code, and removes the filtering rules as soon as possible.

The DOTS client periodically queries the DOTS server to check the counters for installed filtering rules. A GET request is used to retrieve filtering rules from a DOTS server. shows how to retrieve all the filtering rules programmed by the DOTS client while shows how to retrieve specific filtering rules programmed by the DOTS client.

shows response for all active policies on the DOTS server.

If the DOTS server does not find the policy number conveyed in the GET request in its policy state data, then it responds with a 4.04 (Not Found) error response code.