@conference {19040,
	title = {Portcullis: protecting connection setup from denial-of-capability attacks},
	series = {SIGCOMM {\textquoteright}07},
	year = {2007},
	month = {2007},
	pages = {289 - 300},
	publisher = {ACM},
	organization = {ACM},
	abstract = {Systems using capabilities to provide preferential service to selected flows have been proposed as a defense against large-scale network denial-of-service attacks. While these systems offer strong protection for established network flows, the Denial-of-Capability (DoC) attack, which prevents new capability-setup packets from reaching the destination, limits the value of these systems. Portcullis mitigates DoC attacks by allocating scarce link bandwidth for connection establishment packets based on per-computation fairness. We prove that a legitimate sender can establish a capability with high probability regardless of an attacker{\textquoteright}s resources or strategy and that no system can improve on our guarantee. We simulate full and partial deployments of Portcullis on an Internet-scale topology to confirm our theoretical results and demonstrate the substantial benefits of using per-computation fairness.},
	keywords = {network capability, per-computation fairness},
	isbn = {978-1-59593-713-1},
	url = {http://doi.acm.org/10.1145/1282380.1282413},
	author = {Parno, Bryan and Wendlandt, Dan and Elaine Shi and Perrig, Adrian and Maggs, Bruce and Hu, Yih-Chun}
}
