Abstract
Proof-of-work (PoW) schemes implemented in client puzzle protocols (CPPs) have been proposed as a protection from Denial-of-Service (DoS) attacks against internet facing servers. A CPP designed to thwart attacks against a certain client-server protocol is layered independently on top of this protocol or is integrated into it. Such a general solution requires a great deal of standardization. On the other hand, different web applications that may also become targets of DoS attacks can be protected by different schemes, which greatly reduces standardization requirements and makes implementations substantially easier. In the present study, we discuss the utility of CPPs as a practical layer of protection of web applications against DoS and other automated threat events. We define several requirements that must be met by such CPPs, and we propose a general concept and a particular PoW algorithm that fulfills these requirements. The general concept includes recursive definition of sub-puzzles and partial server-side solution verification. The proposed PoW algorithm is based on this concept and on hash inversion/collision tasks. We also introduce a few prototype implementations of this algorithm in JavaScript, WebAssembly, Python, and C, and we present the results of some benchmark tests comparing the performances of these implementations on different hardware. These results show that CPPs can provide an effective layer of mitigation against certain automated threats to web applications.
Highlights
Proof of work (PoW) as a concept has become widely known as a mechanism for achieving consensus in cryptocurrency systems
Long before rising to prominence with the Bitcoin boom, PoW schemes implemented in client puzzle protocols (CPPs) have been proposed as a deterrent to SPAM [4], [5] and as a protection from Denial-of-Service (DoS) attacks against internet facing servers [6], [7]
We investigated the effectiveness of PoW and CPPs as mitigation against automated threats to web applications
Summary
Proof of work (PoW) as a concept has become widely known as a mechanism for achieving consensus in cryptocurrency systems. Long before rising to prominence with the Bitcoin boom, PoW schemes implemented in client puzzle protocols (CPPs) have been proposed as a deterrent to SPAM [4], [5] and as a protection from Denial-of-Service (DoS) attacks against internet facing servers [6], [7]. In the latter case, the client must solve a puzzle in order to be granted access to a service or data provided by the server.
Sign-in/Register to view highlights & summary Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
