I thought I was being clever - overly engineering a (just for my learning) mobile app that is scaled out using only distributed technologies (AWS Lambda, S3, and Dynamo DB in this case). I want to allow apps to register themselves in the database, but I'm trying to limit the database queries and writes that I need to perform in case someone tries to make my costs very high by spamming me with database activity. I experimented with a proof-of-work scheme where an api/service call handler generates a signed assignment (all in memory, no database) that the mobile app then has to perform which is later verified by another api call before writing the new registration to the database. Fine, I'll do the work, but they have to do more work which isn't much of a burden for the cooperating client, but which might be a deterrent for a malicious client.
But then I realized that without tracking the submissions, the malicious client can do the work for real the once, but then just spam me for the remainder of the assignment validity window (before it expires) and still require my database lookups. The window before expiration would have to be at least the worst case of my worst-performing supported client hardware which would leave plenty of time for trouble.
Further, because my database is merely eventually consistent, I don't know how to avoid double-issued requests to isolated replication nodes in any case.
There's no shared state or even host affinity between the event-driven lambda api processing. Dynamo DB is (I think) only eventually consistent. MemCache or Redis (offered by ElastiCache).
These are relevant:
- http://people.cs.pitt.edu/~mehmud/docs/abliz09tourpuzzle.pdf
- http://www.cypherspace.org/hashcash/hashcash.ps
- http://jorgenmodin.net/index_html/proof-of-work-to-prevent-dos-and-ddos-attacks-of-web-pages
Is there any benefit at all to adding a proof-of-work? Or is any additional complexity merely deferring 100% of the problem that is unavoidable (while also introducing new points of failure)?
Are there any anonymous registration schemes that are compatible with eventual consistency and requiring more of the registrant than the registry?