/[gzz]/gzz/Documentation/misc/hemppah-progradu/masterthesis.tex
ViewVC logotype

Diff of /gzz/Documentation/misc/hemppah-progradu/masterthesis.tex

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.173 by hemppah, Fri Mar 21 16:23:01 2003 UTC revision 1.174 by hemppah, Mon Mar 24 10:15:32 2003 UTC
# Line 845  systems are the lack of keyword searches Line 845  systems are the lack of keyword searches
845    
846  \section{Security problems in Peer-to-Peer}  \section{Security problems in Peer-to-Peer}
847    
848  In this section we discuss security problems related to Peer-to-Peer domain.  In this section we describe security problems related to Peer-to-Peer domain. First, we discuss attacks
849    and lack of trust in Peer-to-Peer systems. Then, we describe anonymity, access control, hostile entities
850    and secure query routing problems. Finally, we briefly cover external security threats.
851    
852  \subsection{Attacks}  \subsection{Attacks}
853    
854    As stated in \cite{naor03simpledht}, an important aspect is that when it comes to different attack models in
855    any Peer-to-Peer system, there should be a clear distinction between attacks on the
856    algorithms assuming the construction of the overlay is correct, and attacks on the construction itself. Clearly, Sybil
857    and Spam attacks belong to the first category, and the rest of the attacks to the latter category.
858    
859  There are five known attack models against Peer-to-Peer systems: the Sybil attack \cite{douceur02sybil},  There are five known attack models against Peer-to-Peer systems: the Sybil attack \cite{douceur02sybil},
860  the Fail-stop attack, the Spam attack \cite{naor03simpledht}, the Byzantine attack \cite{357176} and \cite{296824}, and  the Fail-stop attack, the Spam attack \cite{naor03simpledht}, the Byzantine attack \cite{357176} and \cite{296824}, and
861  the Distributed Denial of Service attack.  the Distributed Denial of Service attack.
862    
863  In the Sybil attack model \cite{douceur02sybil}, a hostile entity presents multiple  In the Sybil attack model \cite{douceur02sybil}, a hostile entity presents multiple
864  entities. Therefore, one hostile entity can control a large fraction of Peer-to-Peer system. Possible solution against  entities, i.e., when a peer selects a subset of entities to perform a operation, a peer can select the same
865  the Sybil attack would be that the system could distinguish entities of the system reliably. Unfortunately,  hostile entity multiple times. Therefore, one hostile entity can control a large fraction of Peer-to-Peer system thereby
866  currently there are no realizable techniques for this task. Partial solutions for the Sybil attack is to replicate  repressing the redundancy of the system. Unfortunately, currently there are no realizable techniques for against the Sybil
867  and fragment data items randomly among several participating peers. However, this suggestion assumes that two different  attack: without a centralized authority, Sybil attacks are always possible in a Peer-to-Peer
868  remote entities are actually different; Sybil attacks are still possible and therefore would need centralized  system except under extreme and unrealistic assumptions of resource parity and coordination among entities \cite{douceur02sybil}.
869  authority for reliable authentication. Without centralized authority,  Castro et al. \cite{castro02securerouting} suggest the use of cryptographic content hashes in the creation process of peer identifier
870  Sybil attacks are always possible in a Peer-to-Peer system except under extreme and unrealistic assumptions of  against the Sybil attack. According to authors, in this technique the IP address of a peer can be verified by the other peer.
871  resource parity and coordination among entities \cite{douceur02sybil}.  They call this method as a one form of \emph{self-certifying data}.
872    
873    
874  In the Fail-stop attack model, cited in \cite{naor03simpledht}, a faulty peer is deleted from the Peer-to-Peer system.  In the Fail-stop attack model, cited in \cite{naor03simpledht}, a faulty peer is deleted from the Peer-to-Peer system. Thus,
875  The reason for the faultiness of a peer can be a software failure or a hostile attack.  a specific data item can be lost from the system temporaraly (or permanently). The reason for the faultiness of a peer can be a
876  The Byzantine attack model \cite{357176} is closely related to Fail-stop model. Byzantine model can be seen as more  software failure or a hostile attack. The Byzantine attack model \cite{357176} is closely related to Fail-stop model. The Byzantine model can
877  severe than Fail-stop model as there are no restrictions over the behavior of faulty peers. A practical  be seen as more severe than Fail-stop model as there are no restrictions over the behavior of faulty peers; for instance,
878  solution for the Byzantine failures have been proposed by Castro et al. \cite{296824}.  the cooperation between multiple malicious faulty peers is possible  \cite{357176}. A practical solution for the Byzantine failures have been
879    proposed by Castro et al. \cite{296824}.
880    
881  The Spam generating attack \cite{naor03simpledht} is an another known attack model against Peer-to-Peer system. In the Spam  The Spam generating attack \cite{naor03simpledht} is an another known attack model against Peer-to-Peer system. In the Spam
882  attack, a hostile or faulty peer may produce false information of the data, or refuses to (or is not able to) reply to requests.  attack, a hostile or faulty peer may produce false information of the data, or refuses to (or is not able to) reply to requests.
# Line 877  sent to the network while increasing the Line 886  sent to the network while increasing the
886  the previously mentioned solution doesn't work. Naor et al. \cite{naor03simpledht} have proposed a partial solution against Spam attack  the previously mentioned solution doesn't work. Naor et al. \cite{naor03simpledht} have proposed a partial solution against Spam attack
887  in a \emph{faulty} peer environment (not hostile).  in a \emph{faulty} peer environment (not hostile).
888    
889  Traditional overloading of targeted peers is the best known form of distributed Denial of Service attack (DDoS) (see, e.g., \cite{372148}).  Overloading of targeted peers is a form of Distributed Denial of Service attack (DDoS) (see, e.g., \cite{372148}). For instance,
890  For example, a hostile entity can attempt to burden targeted peers with garbage network packets. As an implication, peers may act  a hostile entity can attempt to burden targeted peers with garbage network packets. As a consequence, peers may act incorrectly or
891  incorrectly or stop working. The DDoS attack may be very severe, especially if the rate of replication and caching  stop working. Daswani et al. \cite{daswani02queryflooddos} suggest efficient load balancing
892  in the Peer-to-Peer system is low. This may lead to data loss in the Peer-to-Peer system. Daswani et al.  policies for Peer-to-Peer system in order to prevent massive system failures. They suggest a traffic model
893  \cite{daswani02queryflooddos} suggest efficient load balancing  that can be used to understand the effects of DDoS attacks. Sit et al. \cite{sit02securitycons}
 policies for Peer-to-Peer system in order to prevent massive system failures. Sit et al. \cite{sit02securitycons}  
894  suggest that identifier assignment algorithm for peers would assign identifier with respect to network topology  suggest that identifier assignment algorithm for peers would assign identifier with respect to network topology
895  and replicas should be located physically to different locations.  and replicas should be located physically to different locations.
896    
 As stated in \cite{naor03simpledht}, an important aspect is that when it comes to different attack models in  
 any Peer-to-Peer system, there should be a clear distinction between attacks on the  
 algorithms assuming the construction of the overlay is correct, and attacks on the construction itself. Clearly, Sybil  
 and Spam attacks belong to the first category, and the rest of the attacks to the latter category.  
897    
898  \subsection{Trust, data authenticity and integrity}  \subsection{Trust management, data authenticity and integrity}
899    
900  Trust in Peer-to-Peer systems is based on \emph{reputation}. Proposed reputation methods focus either  According to \cite{aberer01trust}, mutual trust ''...allows agents to cooperate in a game-theoretic situation that corresponds
901  on the semantic properties or the data management properties of the trust model. Some research has been  to the repeated prisoners dilemma and leads in the long term to an increased aggregated utility for the participating agents''.
902  done on reputation models in Peer-to-Peer systems, such as \cite{aberer01trust}, \cite{cornelli02reputableservents}.  They define \emph{trust management} as a mechanism that allows to establish mutual trust. Furthermore, \emph{reputation} is a measure
903  One implementation include Advogato \cite{advogatourl}. None of the current proposals or implementations  that is derived from knowledge on interactions in the past \cite{aberer01trust} In this subsection, we discuss mechanisms to maintain
904  based on reputation address trust in a reliable, practical way.  trust in Peer-to-Peer systems.
905    
906    Trust in Peer-to-Peer systems is based on \emph{reputation}. Little research has been done on reputation models in Peer-to-Peer
907    systems, such as \cite{aberer01trust}, \cite{cornelli02reputableservents}. In \cite{aberer01trust}, authors present a scalable
908    trust management model, which can be used in Peer-to-Peer enviroment. Authors in \cite{cornelli02reputableservents}
909    suggest techniques to keep track and share information about the reputation of a peer with others peers.
910    
 Optimal solution for trust in Peer-to-Peer systems would be certificate based security models.  
911  Quite recently, widely used Public Key Infrastructure (PKI) has been deployed in distributed  Quite recently, widely used Public Key Infrastructure (PKI) has been deployed in distributed
912  systems \cite{rivest96sdsi}, \cite{spkiworkinggroup}. PKI is a reliable technology for securing  systems \cite{rivest96sdsi}, \cite{spkiworkinggroup}. PKI is a reliable technology for securing
913  data in rather \emph{static} computing systems, such as the Internet. However, in Peer-to-Peer  data in computing systems, such as the Internet. However, in Peer-to-Peer
914  networks, the problem of key-based security mechanism is the maintenance of the keys as participating  networks, the problem of key-based security mechanism may be the maintenance of keys as participating
915  peers constantly join and leave the system. These include the revocation of keys and the distribution of  peers constantly join and leave the system, i.e., the revocation of keys and the
916  new keys in a hostile environment.  distribution of new keys in a hostile environment \cite{KohMau99}.
917    
918  ConChord \cite{ajmani02conchord} is the first Peer-to-Peer system which has a support for PKI based  ConChord \cite{ajmani02conchord} is the first Peer-to-Peer system which has a support for PKI based
919  security infrastructure. Still, however, ConChord \cite{ajmani02conchord} is in early phase of development and lacks  security infrastructure. Still, however, ConChord \cite{ajmani02conchord} is in early phase of development and lacks
# Line 913  important features of PKI to be fully us Line 921  important features of PKI to be fully us
921  (SDSI) \cite{rivest96sdsi} and Simple Public Key Infrastructure (SPKI) \cite{spkiworkinggroup} may be a problem for  (SDSI) \cite{rivest96sdsi} and Simple Public Key Infrastructure (SPKI) \cite{spkiworkinggroup} may be a problem for
922  Peer-to-Peer systems, in which hierarchy is intentionally missing.  Peer-to-Peer systems, in which hierarchy is intentionally missing.
923    
924  For data integrity, on the other hand, there are few working solutions. Cryptographic content hashes  For data integrity, on the other hand, there are working techniques. Cryptographic content hashes
925  \cite{fips-sha-1}, their variations \cite{merkle87hashtree} and implementation techniques \cite{mohr02thex}  \cite{fips-sha-1}, their variations \cite{merkle87hashtree} and implementation techniques \cite{mohr02thex}
926  are efficient and reliable methods for identifying the integrity of data in Peer-to-Peer systems. One  are efficient and reliable methods for identifying the integrity of data in Peer-to-Peer systems.
 possible application of cryptographic content hashes may be in the creation process of peer identifier, in which  
 the IP address of a peer can be verified by the other peer. This is one form of \emph{self-certifying data}.  
   
927    
928  \subsection{Anonymity}  \subsection{Anonymity}
929    
930  According to \cite{dingledine00free}, there exist several kinds of anonymity. Author-anonymity is a form  According to \cite{dingledine00free}, there exist several kinds of anonymity: author-anonymity,
931  of anonymity in which no one can link the author to a specific document. In publisher-anonymity system,  publisher-anonymity, reader-anonymity, peer-anonymity and query-anonymity. Author-anonymity is a form
932  no one is able to link the publisher to a specific document. Reader-anonymity means that a specific  of anonymity in which no one can link the author (who created the document) to a document.
933  document cannot be linked to the readers of a document. This form of anonymity protects the privacy of  In publisher-anonymity system, no one is able to determine the publisher (how published the document into
934  the users of the system. Furthermore, peer-anonymity means that no peer can be linked to a specific document, i.e.,  the system) of a document. Reader-anonymity means that a document cannot be linked to its readers.
935  no one is able to determine the peer, where the document was originally published. Document-anonymity  With peer-anonymity, no one is able to determine the peer, where the document was originally published.
936  means that a peer doesn't know which data it is currently hosting. Finally, query-anonymity is a form  Document-anonymity means that a peer doesn't know which data it is currently hosting. Query-anonymity is a form
937  of document-anonymity; when other peers perform data lookups, a peer doesn't know which data it serves  of document-anonymity; when other peers perform data lookups, a peer doesn't know which data it serves
938  to the data lookup originators. As the authors cite in \cite{dingledine00free}, some forms of anonymity  to the data lookup originators. As the authors cite in \cite{dingledine00free}, some forms of anonymity
939  may imply each other and possible issues raised by this property is one area of future work.  may imply each other and possible issues raised by this property is one area of future work.
940    
 With regard to anonymity in Peer-to-Peer systems, much research has been done both at the network  
 level layer \cite{tarzan:ccs9} and at the application level layer \cite{reiter98crowds}, \cite{mixminionurl}.  
 Anonymity outside of Peer-to-Peer context has also been researched \cite{352607}, \cite{293447}.  
   
941  Obviously, existance of several types of anonymity often conflicts with other key properties of  Obviously, existance of several types of anonymity often conflicts with other key properties of
942  Peer-to-Peer systems. Let us consider anonymity and efficient data lookup. In efficient data lookup, we must know  Peer-to-Peer systems. Let us consider anonymity and efficient data lookup. In efficient data lookup, we must know
943  the peers responsible for given data. Of course, when we know the peers responsible  the peers responsible for given data. Of course, when we know the peers responsible
944  for the data, the anonymity of peer is lost. Fortunately, there are partial solutions to these kinds of  for the data, the anonymity of peer is lost. Fortunately, there are partial solutions to these kinds of
945  situations, such as pseudonymity which is a partial form of anonymity. For instance, pseudonymity can be used for  situations, such as pseudonymity which is a partial form of anonymity \cite{daswani03openproblems}.
946  addressing peer-anonymity by providing anonymous-like identifiers to peers (e.g., peer identifiers of a tightly  For instance, pseudonymity can be used for addressing peer-anonymity by providing anonymous-like identifiers to
947  structured system).  peers (e.g., peer identifiers of a tightly structured system).
948    
949  Anonymity is widely used in a Peer-to-Peer system in which data publication and non-censorship are important properties  Anonymity is widely used in a Peer-to-Peer system in which data publication and non-censorship are important. These include
950  of the system. These include  Forwarding proxies are used in Freenet \cite{clarke00freenet}, Crowds \cite{reiter98crowds} and Free Haven \cite{dingledine00free}
951  Freenet \cite{clarke00freenet}, Publius \cite{pub00}, Free Haven \cite{dingledine00free}, Crowds \cite{reiter98crowds},  in order to provide various types of anonymity. Tangler \cite{502002} and Publius \cite{pub00} use cryptographic sharing methods
952  Tangler \cite{502002} and upcoming Mnet \cite{mneturl}. Forwarding proxies are used in Freenet, Crowds and  to split data into fragments \cite{Shamir1979a}. Mix mailer networks, such as \cite{mixminionurl}, are commonly used in
953  Free Haven in order to provide various types of anonymity. Tangler and Publius use cryptographic  distributed systems, which are able to provide some level of anonymity.
 sharing methods to split data into fragments \cite{Shamir1979a}. Mix mailer networks, such as  
 \cite{mixminionurl}, are commonly used in distributed systems, which are able to provide some level  
 of anonymity.  
954    
955  Even if many existing Peer-to-Peer systems are able to provide some of the types of anonymity, there is no  Even if many existing Peer-to-Peer systems are able to provide some of the types of anonymity, there is no
956  such a system which is able to provide all kinds of anonymity as listed above. Specifically, the conflicts  such a system which is able to provide all kinds of anonymity as listed above. Specifically, the conflicts

Legend:
Removed from v.1.173  
changed lines
  Added in v.1.174

savannah-hackers-public@gnu.org
ViewVC Help
Powered by ViewVC 1.1.26