1

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the Authentication Server against DDOS and although is not a project requirement, i am very curious about how it should be done. The Authentication Server receives the username and password in order to authenticate a user, what countermeasures should be implemented to avoid an attack?

Thank you.

2

Most distributed denial-of-service (DDOS) attacks are simple "throw data at the server faster than its connection can handle" attacks, and consequently cannot be dealt with at the application level. Rather, they're mitigated at the ISP level, typically by blocking the attacking computers.

Non-distributed attacks, on the other hand, can be mitigated at the application level. Look for ways that a client can make the server use far more resources (CPU, memory, etc.) dealing with a request than the client uses in making them: those are the possible attack vectors. Once you've identified them, you can figure out how to deal with them through techniques such as rate-limiting, making the server more efficient, or shifting load to the client.

1

I've been searching, and I found that to resist distributed denial of service (DDoS) attacks a set of techniques are used on networks attached to the Internet, to protect the target and relay networks. This is done by passing network traffic addressed to the attacked network through high-capacity networks with "traffic scrubbing" filters.

DDoS mitigation requires correctly identifying incoming traffic to separate human traffic from human-like bots and hijacked browsers.

The process is done by comparing signatures and examining different attributes of the traffic, including IP addresses, cookie variations, http headers, and Javascript footprints.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.