Presentation given by Roland Dobbins covering our recent draft of use case scenarios for use in DDoS Open Threat Signaling. This presentation was given on Nov. 3rd, 2015 at IETF 94 in Yokohama, Japan.

1. DOTS WG
draft-ietf-dots-use-cases-00
DDoS Open Threat
Signaling (DOTS)
Working Group
Roland
Dobbins
–
Arbor
Networks
Stefan
Fouant
–
Corero
Network
Security
Daniel
Migault
–
Ericsson
Robert
Moskowitz
–
HTT
ConsulAng
Nik
Teague
–
Verisign
Liang
‘Frank’
Xia
–
Huawei

2. DOTS WG2
IntroducAon
&
Context

3. DOTS WG3
draft-ietf-dots-use-cases-00 Summary
• Provides example use-cases for DOTS (actually, categories).
• All examples can be CE/PE or PE/PE.
• Room for wide variation within each category (see 4.1.1).
• All DOTS communications in each example can be directly
between DOTS servers and DOTS clients, or mediated by
DOTS relays.
• DOTS relays can forward messages between DOTS clients
and servers using either stateless transport, stateful transport,
or a combination of the two.
• DOTS relays can aggregate service requests, status
messages, and responses.
• DOTS relays can filter service requests, status messages, and
responses

4. DOTS WG4
draft-ietf-dots-use-cases-00 Summary (cont.)
• Use-cases in -00 are not exhaustive, are illustrative.
• Use-cases in -00 focus on DDoS mitigation using dedicated
mitigation devices. S/RTBH, flowspec, OpenFlow, etc. can
also be used to leverage network infrastructure for DDoS
mitigation.
• 4.1.1 use-case in this presentation illustrates full DOTS
communications cycle, variants.
• Other use-cases in this presentation are summarized ‘diffs’
illustrating DOTS communications model in widely varying
circumstances.
• Use-cases in this presentation focus on protecting servers
under DDoS attack on destination networks. DOTS can also
be used to suppress attack traffic on origin networks or as it
traverses intermediary networks.

5. DOTS WG5
4.1
-­‐
Primary
Use
Cases

6. DOTS WG6
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.1
–
CPE
or
PE
MiAgators
Request
Upstream
DDoS
MiAgaAon

7. DOTS WG7

8. DOTS WG8

9. DOTS WG9

10. DOTS WG10

11. DOTS WG11
DDoS
a&ack
ini+ated.

12. DOTS WG12
A&ack
mi+gated
on-­‐prem.

13. DOTS WG13
On-­‐prem
mi+ga+on
capacity
exceeded.

14. DOTS WG14
On-­‐prem
mi+ga+on
capacity
exceeded.

15. DOTS WG15
DOTS
client
signals
for
upstream
mi+ga+on.

16. DOTS WG16
DOTS
server
acknowledges
mi+ga+on
request,
mi+ga+on
ini+ated.

17. DOTS WG17
Mi+ga+on
in
progress.

18. DOTS WG18
Status
messages
exhanged
during
mi+ga+on
–
efficacy,
mi+ga+on
status,
etc.

19. DOTS WG19
A&ack
terminated.

20. DOTS WG20
Mi+ga+on
status
change
message
transmi&ed.

21. DOTS WG21
Mi+ga+on
termina+on
service
request.

22. DOTS WG22
Mi+ga+on
termina+on
service
acknowledgement.

23. DOTS WG23
Mi+ga+on
terminated,
return
to
status
quo
ante.

24. DOTS WG24
DOTS
communica+on
rela+onships.

25. DOTS WG25
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.1
–
VariaAon
with
DOTS
Relay
MediaAng
CommunicaAons

26. DOTS WG26

27. DOTS WG27

28. DOTS WG28
Mi+ga+on
in
progress.

29. DOTS WG29
Mi+ga+on
in
progress.

30. DOTS WG30
DOTS
communica+on
rela+onships.

31. DOTS WG31
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.1
–
VariaAon
with
Overlay
DDoS
MiAgaAon
Service
Provider

32. DOTS WG32

33. DOTS WG33
Mi+ga+on
in
progress.

34. DOTS WG34
DOTS
communica+on
rela+onships.

35. DOTS WG35
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.1
–
VariaAon
with
MulAple
Upstream
DDoS
MiAgaAon
Providers

36. DOTS WG36

37. DOTS WG37
Mi+ga+on
in
progress.

38. DOTS WG38
Mi+ga+on
status
messaging
between
providers.

39. DOTS WG39
DOTS
communica+on
rela+onships.

40. DOTS WG40
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.2
–
Network
Infrastructure
Device
Requests
Upstream
DDoS
MiAgaAon

41. DOTS WG41

42. DOTS WG42
Mi+ga+on
in
progress.

43. DOTS WG43
DOTS
communica+on
rela+onships.

44. DOTS WG44
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.3
–
AYack
Telemetry
DetecAon/
ClassificaAon
System
Requests
Upstream
DDoS
MiAgaAon

45. DOTS WG45

46. DOTS WG46
Mi+ga+on
in
progress.

47. DOTS WG47
DOTS
communica+on
rela+onships.

48. DOTS WG48
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.4
–
Targeted
Service/ApplicaAon
Requests
Upstream
DDoS
MiAgaAon

49. DOTS WG49

50. DOTS WG50
Mi+ga+on
in
progress.

51. DOTS WG51
DOTS
communica+on
rela+onships.

52. DOTS WG52
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.5
–
Manual
Web
Portal
Request
to
Upstream
MiAgator

53. DOTS WG53

54. DOTS WG54
Mi+ga+on
in
progress.
HTTP/S
between
Web
browser
&
DOTS
client
on
Web
portal.

55. DOTS WG55
Mi+ga+on
in
progress.
HTTP/S
between
Web
browser
&
DOTS
client
on
Web
portal.

56. DOTS WG56
Communica+on
rela+onships.
DOTS
on
upstream
mi+ga+on
network
only.

57. DOTS WG57
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.6
–
Manual
Mobile
Device
ApplicaAon
Request
to
Upstream
MiAgator

58. DOTS WG58

59. DOTS WG59
Mi+ga+on
in
progress.

60. DOTS WG60
DOTS
communica+on
rela+onships.

61. DOTS WG61
s
ReflecAon/AmplificaAon
DDoS
AYacks
4.1.7
–
Unsuccessful
CPE
or
PE
MiAgator
Request
for
Upstream
DDoS
MiAgaAon

62. DOTS WG62

63. DOTS WG63
Mi+ga+on
in
progress.

64. DOTS WG64
Another
a&ack
ini+ated,
different
target.

65. DOTS WG65
Mi+ga+on
service
request
refused
due
to
mi+ga+on
capacity
constraints.

66. DOTS WG66
DOTS
communica+on
rela+onships.

67. DOTS WG67
4.2
-­‐
Ancillary
Use
Cases

68. DOTS WG68
4.2.1 – Auto-Registration
• Beyond attack mitigation requests, responses, and status
messages, DOTS can also be useful for administrative
tasks.
• Administrative tasks are a significant barrier to effective
DDoS mitigation.
• DOTS clients with appropriate credentials can auto-register
with DOTS servers on upstream mitigation networks.
• This helps with DDoS mitigation service on-boarding,
moves/adds/changes.

69. DOTS WG69
4.2.2 – Automatic Provisioning of DDoS Countermeasures
• DDoS countermeasure provisioning today is a largely
manual process, errors and inefficiency can be problematic.
• This can lead to inadequately-provisioned DDoS mitigation
services which often are not optimized for the assets under
DDoS protection. Mitigation rapidity, efficacy suffers.
• On-boarding organizations during an attack – an all-too-
common situation – can be very challenging.
• The ‘self-descriptive’ nature of DOTS registration and
mitigation status requests can be leveraged to automate the
countermeasure selection, provisioning, and tuning process.
• Mitigation efficacy feedback from DOTS clients to DOTS
servers during an attack can be leveraged for real-time
mitigation tuning and optimization.

70. DOTS WG70
4.2.3 – Informational DDoS Attack Notification to Third Parties
• In addition to service requests from organizations under
attack to upstream mitigators, DOTS can be used to send
DDoS attack notification and status messages to interested
and authorized third parties.
• It may be beneficial in some circumstances to automatically
provide attack notifications and status messages econdary
or tertiary ‘backup’ mitigation providers, security
researchers, vendors, law enforcement agencies, regulatory
agencies, etc.
• Any such sharing of information with third parties should
only take place in accordance with all relevant laws,
regulations, contractual obligations, privacy and
confidentiality agreements.

71. DOTS WG71
s
ReflecAon/AmplificaAon
DDoS
AYacks
Next
Steps
for
Use-­‐Cases
Drac

72. DOTS WG72
To-Do List for draft-dots-ietf-use-cases-01
• Fix typos (doh!).
• Remove duplicative verbiage.
• Wordsmith phrasing for clarity.
• Present use-cases via ‘diffs’ – i.e., refer to commonalities
with other use-cases, emphasize specific factors unique to
each use-case.
• Reconcile definitions of terminology with dots-ietf-
requirements draft.
• Add use-cases illustrating suppression of DDoS attack traffic
on origin networks, filtering on intermediate networks.
• Add use-cases illustrating specific PE-PE scenarios (e.g.,
‘overflow’ requests for additional DDoS mitigation capacity,
etc.).

73. DOTS WG73
Request for Feedback from WG Participants
• What should we add?
• What should we remove?
• What should we change?
• Should we include variations (via ‘diffs’)
on each use-case similar to what was
done with 4.1.1 in this presentation?
• Other input?

74. DOTS WG
This Presentation – http://bit.ly/1N6u8za

75. DOTS WG
Thank you!
DDoS Open Threat Signaling
(DOTS) Working Group
Roland
Dobbins
–
Arbor
Networks
Stefan
Fouant
–
Corero
Network
Security
Daniel
Migault
–
Ericsson
Robert
Moskowitz
–
HTT
ConsulAng
Nik
Teague
–
Verisign
Liang
‘Frank’
Xia
–
Huawei