A Proposal for DoS-Defensive Internet Key Exchange

A variety of DoS attacks are incapacitating the Net infrastructures. IKEs can be easily targeted by these attacks because they force to process heavy computations, and an IKE is the beginning handshake procedure for secure communications. This paper analyzes existing DoS resistant protocols that have several inappropriateness to apply an IKE and points out DoS vulnerability of three IKE candidates. It proposes a new DoS defensive IKE against CPU and memory exhaustion DoS attacks. Moreover, the proposed IKE enhances a capacity of the responder that may be a heavily loaded web-server or a mobile device.