A system and methods utilizing the network layer to provide security in distributed computing systems in order to thwart denial of service attacks. The system and methods of the present invention utilize puzzles placed at the network layer level to protect against denial of service attacks. The system and methods of the present invention advantageously provide a robust and flexible solution to support puzzle issuance at arbitrary points in the network, including end hosts, firewalls, and routers and thereby a defense against denial of service attacks.