A Client Bootstrapping Protocol for DoS Attack Mitigation on Entry Point Services in the Cloud

<div>Architecture of a moving target defense system with a cloud-computing platform as a mediator. <svg height="11.927pt" id="M13" style="vertical-align:-3.291101pt" version="1.1" viewbox="-0.0498162 -8.6359 51.7875 11.927" width="51.7875pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M645 631C614 643 545 666 457 666C215 666 23 519 23 283C23 90 158 -16 337 -16C412 -16 489 2 522 10C543 39 590 127 606 167L580 181C519 89 459 18 348 18C201 18 122 136 122 287C122 464 244 632 435 632C544 632 602 595 608 472L639 475C643 526 645 581 645 631Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,8.619,3.132)"><path d="M389 0V32C297 38 291 46 291 118V635C234 613 175 595 109 583V556L161 554C203 552 207 547 207 497V118C207 46 201 38 110 32V0H389Z"></path></g><g transform="matrix(.013,0,0,-0.013,13.565,0)"><path d="M95 130C70 130 46 113 46 88C46 72 54 64 59 64C93 55 121 33 121 -3C121 -41 93 -68 44 -88L55 -117C117 -98 186 -56 186 22C186 91 131 130 95 130Z"></path></g><g transform="matrix(.013,0,0,-0.013,18.709,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,23.852,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,28.995,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,34.171,0)"><path d="M95 130C70 130 46 113 46 88C46 72 54 64 59 64C93 55 121 33 121 -3C121 -41 93 -68 44 -88L55 -117C117 -98 186 -56 186 22C186 91 131 130 95 130Z"></path></g><g transform="matrix(.013,0,0,-0.013,39.314,0)"><path d="M645 631C614 643 545 666 457 666C215 666 23 519 23 283C23 90 158 -16 337 -16C412 -16 489 2 522 10C543 39 590 127 606 167L580 181C519 89 459 18 348 18C201 18 122 136 122 287C122 464 244 632 435 632C544 632 602 595 608 472L639 475C643 526 645 581 645 631Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,47.933,3.132)"><path d="M329 433H203L239 587L230 596L147 534L123 433H57L30 395L34 388H115L61 129C37 16 59 -12 85 -12C147 -12 222 58 260 98L241 125C212 95 160 62 144 62C132 62 127 71 138 126L192 386L305 394L329 433Z"></path></g></svg> are awaiting registration by communicating their intents through the notification service. The controller sends a client-proxy-assignment to each approved awaiting client using a notification. Proxy listeners only respond to registered clients <span class="nowrap"><svg height="14.0461pt" id="M14" style="vertical-align:-3.9436pt" version="1.1" viewbox="-0.0498162 -10.1025 55.462 14.0461" width="55.462pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M645 631C614 643 545 666 457 666C215 666 23 519 23 283C23 90 158 -16 337 -16C412 -16 489 2 522 10C543 39 590 127 606 167L580 181C519 89 459 18 348 18C201 18 122 136 122 287C122 464 244 632 435 632C544 632 602 595 608 472L639 475C643 526 645 581 645 631Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,8.684,-5.741)"><path d="M527 299L515 337L338 293L325 475H286L273 293L96 337L84 299L252 231L156 77L188 53L305 192L423 53L455 77L358 231L527 299Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,8.619,3.784)"><path d="M389 0V32C297 38 291 46 291 118V635C234 613 175 595 109 583V556L161 554C203 552 207 547 207 497V118C207 46 201 38 110 32V0H389Z"></path></g><g transform="matrix(.013,0,0,-0.013,14.763,0)"><path d="M95 130C70 130 46 113 46 88C46 72 54 64 59 64C93 55 121 33 121 -3C121 -41 93 -68 44 -88L55 -117C117 -98 186 -56 186 22C186 91 131 130 95 130Z"></path></g><g transform="matrix(.013,0,0,-0.013,19.906,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,25.05,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,30.193,0)"><path d="M113 -12C146 -12 170 11 170 46C170 78 146 103 114 103S58 78 58 46C58 11 82 -12 113 -12Z"></path></g><g transform="matrix(.013,0,0,-0.013,35.369,0)"><path d="M95 130C70 130 46 113 46 88C46 72 54 64 59 64C93 55 121 33 121 -3C121 -41 93 -68 44 -88L55 -117C117 -98 186 -56 186 22C186 91 131 130 95 130Z"></path></g><g transform="matrix(.013,0,0,-0.013,40.512,0)"><path d="M645 631C614 643 545 666 457 666C215 666 23 519 23 283C23 90 158 -16 337 -16C412 -16 489 2 522 10C543 39 590 127 606 167L580 181C519 89 459 18 348 18C201 18 122 136 122 287C122 464 244 632 435 632C544 632 602 595 608 472L639 475C643 526 645 581 645 631Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,49.196,-5.741)"><path d="M527 299L515 337L338 293L325 475H286L273 293L96 337L84 299L252 231L156 77L188 53L305 192L423 53L455 77L358 231L527 299Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,49.131,3.784)"><path d="M504 89L488 119C453 85 428 69 416 69C408 69 405 75 412 102L462 304C492 438 460 451 436 451S388 441 356 423C311 397 229 336 170 256H168L189 340C208 418 200 451 177 451C144 451 82 413 24 352L40 322C65 345 98 369 108 369C114 369 119 363 112 335L28 -3L36 -12C54 -3 83 4 112 10C125 73 138 122 153 174C205 258 328 382 376 382C395 382 399 369 384 305L330 93C312 25 323 -12 351 -12C378 -12 439 21 504 89Z"></path></g></svg>.</span> Application servers are not publicly accessible. A proxy machine in the proxy pool awaits assignments of clients when the number of clients surpasses client proxy capacities. Network access control rules are set by the controller to allow/deny access to proxies.</div>

Security and Communication Networks

fig1

Figure 1

Figure 1: A Client Bootstrapping Protocol for DoS Attack Mitigation on Entry Point Services in the Cloud 