RFC 8903

Use Cases for DDoS Open Threat Signaling

📅 published May 2021, from ietf

Internet Engineering Task Force (IETF) 💖 Title Block Tea ✨

Okay bestie, let's get the vibes straight before we dive in 🎀. This one is RFC 8903, called Use Cases for DDoS Open Threat Signaling, and it's published as Informational 🌸, which means it's not a Standards Track spec. It's just here to share knowledge, no cap 🧚.

It was written by R. Dobbins (Netscout, Inc.), D. Migault (Ericsson), R. Moskowitz (HTT Consulting), N. Teague (Iron Mountain Data Centers), L. Xia (Huawei), and K. Nishizuka (NTT Communications) 👑. The date is May 2021 📅, and it's published under ISSN 2070-1721. It doesn't obsolete or update any other RFCs, so it's a clean slate 💅.

Abstract ✨

Okay so the whole DDoS Open Threat Signaling (DOTS) effort is about making protocols so different DDoS Mitigation solutions can actually talk to each other 🫶. This doc gives sample use cases showing how DOTS components interact, what DOTS messages get exchanged, and who's involved in the collab. It's giving "here's the cast and the plot" energy 🎬.

Status of This Memo 📋

Quick legal-ish check 🙈: this is not an Internet Standards Track spec, it's published for info purposes only 🦋. It is still a product of the IETF, reflects IETF community consensus 💜, got public review, and was approved by the Internet Engineering Steering Group (IESG). Just because the IESG approved something doesn't automatically make it a standards candidate, so check Section 2 of RFC 7841 if you're curious about that 🍓.

For the current status, errata, or to send feedback, head to https://www.rfc-editor.org/info/rfc8903 🌈.

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved 🔥.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info), as they stand on the publication date. Read them carefully, because they spell out your rights and restrictions 💅. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, per the Simplified BSD License 🫶.

Table of Contents 🧚

1.  Introduction
2.  Terminology and Acronyms
3.  Use Cases
  3.1.  Upstream DDoS Mitigation by an Upstream Internet Transit
        Provider
  3.2.  DDoS Mitigation by a Third-Party DDoS Mitigation Service
        Provider
  3.3.  DDoS Orchestration
4.  Security Considerations
5.  IANA Considerations
6.  Informative References
Acknowledgments
Authors' Addresses

1. Introduction 🎀

Okay, so right now DDoS attack mitigation is mostly built on siloed, proprietary communication schemes 😭. That means vendor lock-in is basically a side effect. Setting up, provisioning, running, and turning these solutions on is usually super manual and slow ⏳. Trying to coordinate several DDoS Mitigation solutions at the same time is a whole mess, technically and process-wise 💀. All of that adds operational complexity, which can hurt how well mitigations work, since they really need to react fast 🏃‍♀️.

The DOTS effort aims to specify protocols that let different DDoS Mitigation solutions interoperate and integrate more tightly when it comes to detecting attacks, sending mitigation requests, and characterizing attack patterns 🔥.

Since DDoS solutions vary a lot between vendors, the main goal of DOTS is high-level interaction between those different solutions. Think detecting attacks, starting or stopping DDoS Mitigation help, or asking what the status of a mitigation is 💜.

This document gives sample use cases that fed into the requirements in [RFC8612] and the design of the DOTS protocols in [RFC8782][RFC8783] 🦋. These use cases aren't exhaustive, and new ones will probably pop up as DOTS gets adopted and evolves 🌸.

2. Terminology and Acronyms 🍓

This document uses the same terminology and definitions as [RFC8612] 🫶. On top of that, it defines the following terms:

DDoS Mitigation System (DMS): A system that performs DDoS Mitigation ✨. It can be a cluster of hardware and/or software resources, and it might also include an orchestrator that makes decisions, like outsourcing some or all of the mitigation to another DDoS Mitigation System 👑.

DDoS Mitigation: The action the DDoS Mitigation System performs 💅.

DDoS Mitigation Service: A service provided to a customer to mitigate DDoS attacks 🛡️. Each subscription usually involves a Service Level Agreement (SLA) that has to be met 📜. It's the DDoS Service provider's job to set up the DDoS Mitigation System so those SLAs are met 🔥.

DDoS Mitigation Service Provider: The administrative entity that provides the DDoS Mitigation Service 🌈.

Internet Transit Provider (ITP): The entity that delivers traffic to a customer network 🚚. It can be an Internet Service Provider (ISP) or an upstream entity that delivers traffic to the ISP 💖.

3. Use Cases 🦋

(Continued in Part 2 🧚 — stay tuned, bestie!)

3.1. Upstream DDoS Mitigation by an Upstream Internet Transit Provider ✨

Okay bestie, this use case is about how an enterprise or a residential customer network can lean on the relationship it already has with its ITP 💅 to shut down a DDoS attack aimed at its network 🛡️.

The targeted network is called an enterprise network here just to keep things clear, but the exact same scenario works for any downstream network, including residential and cloud hosting networks 🏠☁️.

Since the ITP is the one providing connectivity to the enterprise, it's already on the path of the inbound and outbound traffic and knows the networking parameters of the enterprise's WAN connectivity 🧠. That's lowkey a huge win, because it makes both configuring and spinning up a DDoS Mitigation Service way easier 🙌.

This section looks at two kinds of DDoS Mitigation Service between an enterprise network and an ITP:

  • The upstream ITP may instantiate a DMS when it gets a request from the enterprise network. This usually happens when the enterprise is the one under attack 😭.
  • On the flip side, the ITP may spot an enterprise network as the source of an attack and send a mitigation request to the enterprise DMS so it gets handled right at the source 🔍.

Both scenarios are different, but they have similar interactions between the DOTS client and server. For simplicity, only the first scenario gets the full breakdown here, but the second one is still in scope for DOTS 🎀.

In the first scenario (shown in Figure 1), an enterprise network has self-hosted Internet-facing properties like web servers, authoritative DNS servers, and Voice over IP (VoIP) servers. It runs a DMS to protect those servers and applications from DDoS attacks 🖥️. On top of its on-premise DDoS defenses, the enterprise has contracted with its ITP for DDoS Mitigation Services for when attacks threaten to overwhelm the bandwidth of its WAN link(s) 💪.

       +------------------+        +------------------+
       | Enterprise       |        | Upstream         |
       | Network          |        | Internet Transit |
       |                  |        | Provider         |
       |      +--------+  |        |             DDoS Attack
       |      | DDoS   |  | <=================================
       |      | Target |  | <=================================
       |      +--------+  |        |  +------------+  |
       |                  | +-------->| DDoS       |  |
       |                  | |      |S | Mitigation |  |
       |                  | |      |  | System     |  |
       |                  | |      |  +------------+  |
       |                  | |      |                  |
       |                  | |      |                  |
       |                  | |      |                  |
       |  +------------+  | |      |                  |
       |  | DDoS       |<---+      |                  |
       |  | Mitigation |C |        |                  |
       |  | System     |  |        |                  |
       |  +------------+  |        |                  |
       +------------------+        +------------------+

          * C is for DOTS client functionality
          * S is for DOTS server functionality

Figure 1: Upstream Internet Transit Provider DDoS Mitigation

The enterprise DMS is set up so that if incoming Internet traffic volume goes over 50% of the provisioned upstream Internet WAN link capacity, the DMS will ask the upstream transit provider for DDoS Mitigation help 🙋‍♀️. More sophisticated detection methods may be considered too 🧐.

The requests to trigger, manage, and wrap up a DDoS Mitigation between the enterprise DMS and the ITP all go through DOTS 📨. The enterprise DMS runs a DOTS client, and the ITP runs a DOTS server, which in this example is integrated with its DMS 🔗.

When the enterprise DMS locally detects an inbound DDoS attack going after its resources (like servers, hosts, or applications), it immediately starts a DDoS Mitigation 🚨.

During the attack, the inbound traffic volume to the enterprise network goes past the 50% threshold, so the enterprise DMS escalates the DDoS Mitigation 📈. The enterprise DMS DOTS client signals the DOTS server on the upstream ITP to kick off DDoS Mitigation. The DOTS server replies that it can serve the request, and mitigation starts on the ITP network via the ITP DMS 🙌.

Over the course of the attack, the ITP's DOTS server keeps the DOTS client posted on the mitigation status, statistics about the DDoS attack traffic being mitigated, and related info 📊. Once the attack has ended, or dropped to a level the enterprise DMS can handle on its own, the DOTS server tells the enterprise DMS DOTS client that the attack has subsided 😌.

Then the DOTS client on the enterprise DMS asks the ITP to end the DDoS Mitigation. The ITP's DOTS server gets that request and, once the mitigation has wrapped up, confirms the end of upstream DDoS Mitigation to the enterprise DMS DOTS client 🎉.

Here's the overview of the DOTS communication model for this use case, step by step 📝:

  1. A DDoS attack hits the resources of a network organization (here, the enterprise), which has deployed a DOTS-capable DMS, typically acting as a DOTS client.
  2. The enterprise DMS detects and classifies the attack, then begins the DDoS Mitigation.
  3. The enterprise DMS figures out that its capacity and/or capability to mitigate the attack isn't enough, so it sends a DOTS DDoS Mitigation request via its DOTS client to one or more DOTS servers on the upstream ITP.
  4. The DOTS server that gets the DOTS Mitigation request checks that it's been configured to honor requests from that requesting DOTS client, and if so, orchestrates its own DMS to do the job 🎯.
  5. While the DDoS Mitigation is active, the DOTS server regularly sends DOTS DDoS Mitigation status updates to the DOTS client 🔄.
  6. Once the DOTS server's status update says the attack has ended or subsided, the DOTS client sends a DOTS DDoS Mitigation termination request to the DOTS server 🛑.
  7. The DOTS server terminates the DDoS Mitigation and sends the notification to the DOTS client ✅.

Quick heads-up: communications between the enterprise DOTS client and the upstream ITP DOTS server can happen in band, inside the main Internet WAN link between the enterprise and the ITP 🧵. They can also go out of band over a separate, dedicated wireline network link used only for DOTS signaling 🔌, or out of band over some other form of connectivity, like third-party wireless 4G network connectivity 📱.

Also, a DOTS client that sends a DOTS Mitigation request may be triggered by a network admin who manually confirms the request to the upstream ITP 👩‍💻. In that case, the request may be sent from an application like a web browser or a dedicated mobile application 💻.

One more thing, and it's a big one 👀: when the enterprise is multihomed and connected to multiple upstream ITPs, each ITP can only provide a DDoS Mitigation Service for the traffic it transits. So the enterprise network may be required to coordinate the various DDoS Mitigation Services associated with each link 🧩. More multihoming considerations are discussed in [DOTS-MULTIHOMING] 🌸.

3.2. DDoS Mitigation by a Third-Party DDoS Mitigation Service Provider ✨

okay so this one is lowkey different from 3.1 🎀 because the DDoS Mitigation Service is not coming from an upstream ITP. the traffic is not forwarded through the DDoS Mitigation Service Provider by default 🙈 so to steer the traffic over to them, some network configuration changes are required. this is giving "large enterprise or big data center" energy, as shown in Figure 2, but like the other use cases, it's not exclusively limited to them 💅

Another typical scenario here is a relationship between DDoS Mitigation Service Providers, which forms an overlay of DMS 🫶 when a DDoS Mitigation Service Provider is mitigating a DDoS attack and hits its resource capacity, it may choose to delegate the DDoS Mitigation to another DDoS Mitigation Service Provider. the way they pass the baton is so iconic 👑

      +------------------+        +------------------+
      | Enterprise       |        | Upstream         |
      | Network          |        | Internet Transit |
      |                  |        | Provider         |
      |      +--------+  |        |             DDoS Attack
      |      | DDoS   |  | <=================================
      |      | Target |  | <=================================
      |      +--------+  |        |                  |
      |                  |        |                  |
      |                  |        +------------------+
      |                  |
      |                  |        +------------------+
      |                  |        | DDoS Mitigation  |
      |                  |        | Service Provider |
      |                  |        |                  |
      |  +------------+  |        |  +------------+  |
      |  | DDoS       |<------------>| DDoS       |  |
      |  | Mitigation |C |        | S| Mitigation |  |
      |  | System     |  |        |  | System     |  |
      |  +------------+  |        |  +------------+  |
      +------------------+        +------------------+

          * C is for DOTS client functionality
          * S is for DOTS server functionality

Figure 2: DDoS Mitigation between an Enterprise Network and a Third-Party DDoS Mitigation Service Provider 🦋

so in this setup, an enterprise network has made a prearranged DDoS Mitigation assistance agreement with one or more third-party DDoS Mitigation Service Providers 💜 the whole point is making sure enough DDoS Mitigation capacity and/or capabilities can be turned on when a given DDoS attack threatens to overwhelm the enterprise, or any other DMS, when it tries to handle the attack solo 😭

the prearrangement usually covers the mechanisms used to redirect the traffic to the DDoS Mitigation Service Provider, plus the mechanism to re-inject the traffic back to the Enterprise Network 🌸 redirection typically involves BGP prefix announcement or DNS redirection, while re-injection of the scrubbed traffic can be done with tunneling mechanisms (e.g., GRE). the exact traffic steering mechanisms are out of scope of DOTS but still need to be prearranged 🧚 and in some contexts, those changes could get detected and treated as an attack, so bestie, plan ahead 💀

In some cases, the communication between the enterprise DOTS client and the DOTS server of the DDoS Mitigation Service Provider may go through the ITP carrying the DDoS attack, which would affect that communication 😬 on the other hand, the DOTS client and DOTS server may take a path that is not undergoing a DDoS attack 🌈

     +------------------+        +------------------+
     | Enterprise       |        | Upstream         |
     | Network          |        | Internet Transit |
     |                  |        | Provider         |
     |      +--------+  |        |             DDoS Attack
     |      | DDoS   |  |<----------------+         | ++====
     |      | Target |  |    Mitigated    |         | || ++=
     |      +--------+  |        |        |         | || ||
     |                  |        |        |         | || ||
     |                  |        +--------|---------+ || ||
     |                  |                 |           || ||
     |                  |        +--------|---------+ || ||
     |                  |        | DDoS Mitigation  | || ||
     |                  |        | Service Provider | || ||
     |                  |        |        |         | || ||
     |  +------------+  |        |  +------------+  | || ||
     |  | DDoS       |<------------>| DDoS       |  | || ||
     |  | mitigation |C |        |S | mitigation |<===++ ||
     |  | system     |  |        |  | system     |<======++
     |  +------------+  |        |  +------------+  |
     +------------------+        +------------------+

          * C is for DOTS client functionality
          * S is for DOTS server functionality

Figure 3: Redirection to a DDoS Mitigation Service Provider 🍓

when the enterprise network is under attack, or at least is reaching its capacity or ability to mitigate a given DDoS attack, the DOTS client sends a DOTS request to the DDoS Mitigation Service Provider to start the network traffic diversion (see Figure 3 ✨) and the DDoS Mitigation activities 🔥 ongoing attack and mitigation status messages may be passed between the enterprise network and the DDoS Mitigation Service Provider using DOTS, so they can keep each other in the loop 💖 and once the DDoS attack has stopped, or its severity has subsided, the DOTS client can request that the DDoS Mitigation Service Provider terminate the DDoS Mitigation. bye attack, you're not invited to the party anymore 💅👑

3.3. DDoS Orchestration 🎼

okay so this one is giving conductor energy 🎼✨ In this use case, one or more DDoS telemetry systems or monitoring devices keep watch over a network. That's usually an ISP network, an enterprise network, or a data center 🏢 Once they spot a DDoS attack, these DDoS telemetry systems alert an orchestrator, the one in charge of coordinating all the various DMSs in the domain. The telemetry systems may be configured to send along required information, like a preliminary analysis of what they observed, to the orchestrator 📊

The orchestrator digs into all the sets of information it gets from the DDoS telemetry systems and then kicks off one or more DDoS Mitigation strategies 💅 For example, the orchestrator could pick the DMS in the enterprise network, or one provided by the ITP.

DMS selection and DDoS Mitigation techniques may depend on the type of DDoS attack, so it's not one-size-fits-all 🦋 In some cases, a manual confirmation or selection may also be required before a proposed strategy gets started. The DDoS Mitigation may happen in multiple steps, like configuring the network or updating DDoS Mitigation functions that are already instantiated. And eventually, the coordination of the mitigation may involve external DDoS Mitigation resources, such as a transit provider or a third-party DDoS Mitigation Service Provider 🌐

The communication used to trigger a DDoS Mitigation between the DDoS telemetry and monitoring systems and the orchestrator is performed using DOTS. The DDoS telemetry system implements a DOTS client, while the orchestrator implements a DOTS server 🎀

The communication between a network administrator and the orchestrator is also performed using DOTS 🫶 The network administrator uses, for example, a web interface that talks to a DOTS client, while the orchestrator implements a DOTS server.

The communication between the orchestrator and the DMSs is performed using DOTS too. The orchestrator implements a DOTS client, while the DMSs implement a DOTS server 🧚

The configuration aspects of each DMS, plus the instantiations of DDoS Mitigation functions or network configuration, are not part of DOTS. Similarly, discovering the available DDoS Mitigation functions is not part of DOTS either, so it's out of scope 🙈

          +----------+
          | network  |C            (Enterprise Network)
          | admini-  |<-+
          | strator  |  |
          +----------+  |
                        |
          +----------+  | S+--------------+     +-----------+
          |telemetry/|  +->|              |C   S| DDoS      |+
          |monitoring|<--->| Orchestrator |<--->| mitigation||
          |systems   |C   S|              |<-+  | systems   ||
          +----------+     +--------------+C |  +-----------+|
                                             |    +----------+
          -----------------------------------|-----------------
                                             |
                                             |
             (Internet Transit Provider)     |
                                             |  +-----------+
                                             | S| DDoS      |+
                                             +->| mitigation||
                                                | systems   ||
                                                +-----------+|
          * C is for DOTS client functionality    +----------+
          * S is for DOTS server functionality

                        Figure 4: DDoS Orchestration

The DDoS telemetry systems keep an eye on various aspects of the network traffic and do some measurement tasks 📈

These systems are set up so that when an event or some measurement indicators reach a predefined level, their associated DOTS client sends a DOTS mitigation request to the orchestrator's DOTS server 🚨 The DOTS mitigation request may come with some optional mitigation hints to let the orchestrator know what triggered it. Here's the big deal: something that looks like an attack locally to one telemetry system is not actually an attack when you see it from the broader scope (e.g., of the orchestrator) 👀

When the orchestrator DOTS server gets the DOTS mitigation request from the DDoS telemetry system, it responds with an acknowledgment, which avoids retransmission of the request for mitigation 💌 The orchestrator may begin collecting additional fine-grained and specific information from various DDoS telemetry systems, so it can correlate the measurements and analyze the event. Eventually, the orchestrator may ask the DDoS telemetry system for additional information. However, collecting that information is out of scope of DOTS 🙃

The orchestrator may be configured to start a DDoS Mitigation only after a network administrator approves it ✅ The analysis from the orchestrator is reported to the network administrator via, for example, a web interface. If the network administrator decides to start the mitigation, they trigger the DDoS Mitigation request using, for example, a web interface of a DOTS client that talks to the orchestrator DOTS server. This request is expected to come with a context that gives the orchestrator DOTS server enough information to infer, elaborate, and coordinate the right DDoS Mitigation 🧠

When the orchestrator gets a request to mitigate a DDoS attack aimed at a target, it may evaluate the volume of the attack as well as how valuable the target is 💎 It may select the DDoS Mitigation Service Provider based on the attack severity. It may also coordinate the DDoS Mitigation performed by that provider with other tasks, such as moving the target to another network so new sessions won't be impacted. The orchestrator requests a DDoS Mitigation from the selected DMSs via its DOTS client, as described in Section 3.1 📦

The orchestrator DOTS client gets notified by the selected DMSs when the DDoS Mitigation is effective. Then the orchestrator DOTS server passes that information along to the network administrator 🌸

Same vibe when the DDoS attack stops: the orchestrator DOTS client gets notified, and the orchestrator's DOTS server indicates the end of the DDoS Mitigation to the DDoS telemetry systems as well as to the network administrator 🎉

Here's a plot twist 🌈 In addition to the DDoS orchestration shown in Figure 4, the selected DMS can send a mitigation request back to the orchestrator as an offloading. For example, when the DDoS attack gets severe and the DMS's utilization rate hits its maximum capacity, the DMS can send mitigation requests with additional hints, such as its blocked traffic information, to the orchestrator. Then the orchestrator can take further actions, like asking forwarding nodes (e.g., routers) to filter the traffic 🛑 In this case, the DMS implements a DOTS client, while the orchestrator implements a DOTS server. Similar to other DOTS use cases, the offloading scenario assumes that some validation checks are followed by the DMS, the orchestrator, or both (e.g., to avoid exhausting the resources of the forwarding nodes or inadvertently disrupting legitimate services). These validation checks are part of the mitigation and are therefore out of the scope of the document 🙌

4. Security Considerations 🛡️

The document does not describe any protocol, though there are still a few high-level security considerations to discuss 💜

DOTS is at risk from three primary attacks: DOTS agent impersonation, traffic injection, and signaling blocking. 😭

Impersonation and traffic injection can be mitigated through current secure communications best practices, including mutual authentication 🔐 Preconfigured mitigation steps to take on the loss of keepalive traffic can partially mitigate signal blocking. But in general, it is impossible to comprehensively defend against an attacker that can selectively block any or all traffic 💀 Alternate communication paths that are (hopefully) not subject to blocking by the attacker in question are another potential mitigation.

Additional details of DOTS security requirements can be found in [RFC8612].

Service disruption may be experienced if inadequate mitigation actions are applied. These considerations are out of the scope of DOTS ⚠️

5. IANA Considerations 🌷

This document has no IANA actions ✨

6. Informative References 📚

Acknowledgments 🫶

The authors would like to thank, among others, Tirumaleswar Reddy.K, Andrew Mortensen, Mohamed Boucadair, Artyom Gavrichenkov, Jon Shallow, Yuuhei Hayashi, Elwyn Davies, the DOTS WG Chairs (at the time of writing) Roman Danyliw and Tobias Gondrom, as well as the Security AD Benjamin Kaduk for their valuable feedback 💖

We also would like to thank Stephan Fouant, who was one of the initial coauthors of the documents 🌟

Authors' Addresses 🦋

Roland Dobbins
Netscout, Inc.
Singapore

Email: roland.dobbins@netscout.com


Daniel Migault
Ericsson
8275 Trans Canada Route
Saint Laurent, Quebec 4S 0B6
Canada

Email: daniel.migault@ericsson.com


Robert Moskowitz
HTT Consulting
Oak Park, MI 48237
United States of America

Email: rgm@labs.htt-consult.com


Nik Teague
Iron Mountain Data Centers
United Kingdom

Email: nteague@ironmountain.co.uk


Liang Xia
Huawei
No. 101, Software Avenue, Yuhuatai District
Nanjing
China

Email: Frank.xialiang@huawei.com


Kaname Nishizuka
NTT Communications
GranPark 16F
3-4-1 Shibaura, Minato-ku, Tokyo
108-8118
Japan

Email: kaname@nttv6.jp
📦 where this page comes from