Due to advantages such as quick connection establishment and multiple streaming over a single connection, QUIC was included in the new standard of HTTP 3.0 as an alternative transport layer protocol. Since QUIC operates on UDP, however, QUIC flows can be blocked by existing countermeasures against UDP flooding attacks, even if transmission rates are fairly controlled by congestion control algorithms, such as TCP. In this paper, we confirm that such a problem arises in real-world Internet environment and design effective approaches to avoid it. In the first approach, the gateway router dynamically sets the rate limit for the QUIC flow, based on the expected next CWND size estimated by the receiver using a built-in congestion control algorithm. The second approach leverages the proactive dropping of packets (or ECN marking) to distinguish whether the flow is a self-regulated QUIC flow or an unresponsive UDP attack/selfish flow. Simulation studies using the ns-3 simulator confirm that the proposed approaches can selectively allow QUIC flows regardless of their short-term transmission rates while preserving the effectiveness of existing countermeasures against UDP flooding attacks.

In the medical domain, computer systems in digital healthcare have increased connectivity continuously and the DICOM Message Service Element (DIMSE) protocol has a critical role in exchanging biomedical imaging data among different digital healthcare systems. As the data communication technology is used to handle sensitive information such as patient information (e.g., patient’s name, date of birth, and address) and medical images (e.g., ultrasound, X-ray, and MRI), it has emerged as a major target for security attacks. In this work, we study security concerns on the message exchange method used in the DIMSE protocol. It is important to know which DIMSE services are available on a given healthcare IT system to an adversary and we observe that the DIMSE protocol can be implemented in various ways across products, with each supporting different DIMSE services as well. We present DIMScern, a framework for discerning DIMSE services on remote medical devices. To show the effectiveness of DIMScern, we evaluate our framework on multiple DIMSE implementations, including commercial products and libraries, and identify the supported DIMSE services of them. We demonstrate that DIMScern successfully identifies medical services that are supported differently across 22 healthcare IT systems in a remote environment.