Evaluation of DoS Resistance in Relation to Performance Dynamics Kanta

| In key-agreement protocols, we have a trade-o between security and availability; if authenticated for reasons of security, the protocol would be more vulnerable to a Denial-of-Service (DoS) attack composed of quite a large number of bogus requests which cost an honest responder a lot. DoS-protection strategies such as network ingress ltering and falling-together (FT) mechanism can make the protocol better but we should estimate the availability or server-blocking probability to see how well the trade-o is solved. This paper gives an estimation in a situation where the responder's computational performance depends on the number of on-going processes. The results show that optimized implementation of the FT mechanism can improve the DoS resistance more signi cantly than other heuristics such as memory increase, connection timeout, and packet discarding.