821 |
|
|
822 |
\chapter{Open Problems in Peer-to-Peer} |
\chapter{Open Problems in Peer-to-Peer} |
823 |
|
|
824 |
In this chapter, we discuss open problems in Peer-to-Peer research. |
In this chapter we discuss open problems in Peer-to-Peer research. |
825 |
Note that the open problems list considered here is not meant |
Note that the unsolved problems considered do not represent |
826 |
to be an exhaustive survey of \emph{all} open problems in Peer-to-Peer domain; |
an exhaustive survey of \emph{all} unsolved problems in Peer-to-Peer domain. In this chapter |
827 |
we focus our attention to some issues related to security, scalability, usability and performance. |
we focus our attention on some issues related to security, scalability, usability and performance. |
828 |
|
|
829 |
|
|
830 |
\section{Overview} |
\section{Overview} |
831 |
|
|
832 |
Partly due to the non-maturity of modern Peer-to-Peer technology, there are several |
Partly due to the non-maturity of modern Peer-to-Peer technology, there are several |
833 |
open problems to be solved. Also, many techniques developed for traditional distributed |
problems to be solved. Also, many techniques developed for traditional distributed |
834 |
systems may no longer apply with Peer-to-Peer systems, e.g., load balancing techiques \cite{byers03dhtbalancing}. |
systems may no longer apply with Peer-to-Peer systems, e.g., load balancing techiques \cite{byers03dhtbalancing}. |
835 |
|
|
836 |
Different problems apply to both the loosely structured and the tightly structured approach. |
Different problems apply to both the loosely structured and the tightly structured approach. |
837 |
For instance, since the introduction of Gnutella \cite{gnutellaurl}, the main concern has been the scalability problem of loosely structured |
For instance, since the introduction of Gnutella \cite{gnutellaurl}, the main concern has been the scalability problem of loosely structured |
838 |
systems. However, the scalability problem of the loosely structured is often misunderstood; |
systems. However, the scalability problem of the loosely structured is often misunderstood; |
839 |
\emph{the network overlay} of loosely structured systems is scalable, but the \emph{data lookup model} is not as |
\emph{the network overlay} of loosely structured systems is scalable, but the \emph{data lookup model} is not, because |
840 |
the data lookup process creates lot of extra network traffic (e.g., \cite{yang02improvingsearch}). |
the data lookup process creates lot of extra network traffic (e.g., \cite{yang02improvingsearch}). |
841 |
|
|
842 |
In tightly structured systems the main concern is to make overlay's data lookup process |
In tightly structured systems the main objective is to make overlay's data lookup process |
843 |
more fault tolerant against hostile attacks (e.g., \cite{castro02securerouting}). Other key problems in tightly structured |
more fault tolerant against hostile attacks (e.g., \cite{castro02securerouting}). Other key problems in tightly structured |
844 |
systems are the lack of keyword searches \cite{harren02complex, ansaryefficientbroadcast03}, support for heterogeneous peers |
systems are the lack of keyword searches \cite{harren02complex, ansaryefficientbroadcast03}, support for heterogeneous peers |
845 |
\cite{rowston03controlloingreliability} and load balancing \cite{balakrishanarticle03lookupp2p, byers03dhtbalancing}. |
\cite{rowston03controlloingreliability} and load balancing \cite{balakrishanarticle03lookupp2p, byers03dhtbalancing}. |
846 |
|
|
847 |
\section{Security problems} |
\section{Security problems} |
848 |
|
|
849 |
In this section we describe security problems related to Peer-to-Peer domain. First, we discuss attacks |
In this section we describe security problems related to the Peer-to-Peer domain. First, we discuss well-known attacks |
850 |
and lack of trust in Peer-to-Peer systems. Then, we describe anonymity, access control, hostile entities |
on Peer-to-Peer systems. Then, we discuss the common lack of trust in Peer-to-Peer system, and related issues of anonymity, access control, hostile entities |
851 |
and secure query routing problems. Finally, we briefly cover external security threats. |
and secure query routing. Finally, we briefly cover external security threats. |
852 |
|
|
853 |
\subsection{Attacks} |
\subsection{Attacks} |
854 |
|
|
861 |
the Distributed Denial of Service attack. |
the Distributed Denial of Service attack. |
862 |
|
|
863 |
In the Sybil attack model \cite{douceur02sybil}, a hostile entity presents multiple |
In the Sybil attack model \cite{douceur02sybil}, a hostile entity presents multiple |
864 |
entities, i.e., when a peer communicates with a subset of other participating entities to perform an operation, a peer communicates |
entities, i.e., when a peer communicates with a subset of other participating entities to perform an operation whereas a peer communicates |
865 |
only with the same hostile entity. Hostile entity can control a large fraction of Peer-to-Peer system while |
only with the same hostile entity. A hostile entity can control a large fraction of a Peer-to-Peer system while |
866 |
repressing the redundancy of the system. Authors argue in \cite{douceur02sybil} that without a centralized authority, Sybil attacks are always possible in a Peer-to-Peer |
repressing the redundancy of the system. Authors argue in \cite{douceur02sybil} that without a centralized authority, Sybil attacks are always possible in a Peer-to-Peer |
867 |
system except under extreme and unrealistic assumptions of resource parity and coordination among entities. Unrealistic assumptions include: all entities |
system except under extreme and unrealistic assumptions of resource parity and coordination among entities. Unrealistic assumptions include: all entities |
868 |
should be nearly homogeneous, all identities can be validated simultaneously by all |
should be nearly homogeneous; all identities can be validated simultaneously by all |
869 |
entities across the system and when accepting identities that are not directly validated, the required number of certificates exceeds |
entities across the system; and, when accepting identities that are not directly validated, the required number of certificates exceeds |
870 |
the number of systemwide failures \cite{douceur02sybil}. Castro et al. \cite{castro02securerouting} suggest the use of cryptographic content hashes in the |
the number of systemwide failures \cite{douceur02sybil}. Castro et al. \cite{castro02securerouting} suggest the use of cryptographic content hashes in the |
871 |
creation process of peer identifier against the Sybil attack. According to authors, in this technique the IP address of a peer can be verified by the other peer. |
creation process of peer identifier against the Sybil attack. According to the authors, in this technique the IP address of a peer can be verified by the other peer. |
872 |
They call this method as a one form of \emph{self-certifying data}. |
They characterize this method as a form of \emph{self-certifying data}. |
873 |
|
|
874 |
In the Fail-stop attack model, cited in \cite{naor03simpledht}, a faulty peer is deleted from the Peer-to-Peer system. Thus, |
In the Fail-stop attack model, cited in \cite{naor03simpledht}, a faulty peer is deleted from the Peer-to-Peer system. Thus, |
875 |
a specific data item can be lost from the system temporarily (or permanently). The reason for the faultiness of a peer can be a |
a specific data item can be lost from the system temporarily or permanently. The reason for the faultiness of a peer can be a |
876 |
software failure or a hostile attack. The Byzantine attack model \cite{357176} is closely related to Fail-stop model. In the Byzantine attack model |
software failure or a hostile attack. The Byzantine attack model \cite{357176} is closely related to the Fail-stop model. In the Byzantine attack model, |
877 |
$3f + 1$ is the minimum number of peers that allow system to provide the safety and liveness properties when up to $f$ peers are faulty \cite{357176}. |
$3f + 1$ is the minimum number of peers that allow the system to provide the safety and liveness properties when up to $f$ peers are faulty \cite{357176}. |
878 |
The Byzantine model can be seen as more severe than Fail-stop model as there are no restrictions over the behavior of faulty peers, e.g., the cooperation |
The Byzantine model can be seen as more severe than the Fail-stop model because there are no restrictions over the behavior of faulty peers, e.g., the cooperation |
879 |
between multiple \emph{malicious} faulty peers is possible \cite{357176}. A practical solution for the Byzantine failures have been |
between multiple \emph{malicious} faulty peers is possible \cite{357176}. Castro et al. \cite{296824} have proposed a practical solution for the Byzantine failures. |
880 |
proposed by Castro et al. \cite{296824}. Authors use in their work replication algorithm to tolerate Byzantine faults and cryptographic |
The authors use in their work replication algorithm to tolerate Byzantine faults and cryptographic |
881 |
certificate techniques to prevent spoofing and replays to detect corrupted messages. |
certificate techniques to prevent spoofing and replays to detect corrupted messages. |
882 |
|
|
883 |
The Spam generating attack \cite{naor03simpledht} is another known attack model against Peer-to-Peer system. In the Spam |
The Spam generating attack \cite{naor03simpledht} is another known attack model against a Peer-to-Peer system. In the Spam |
884 |
attack, a hostile or faulty peer may produce false information of the data, or refuses to (or is not able to) reply to requests. |
attack, a hostile or faulty peer may produce false data information, or refuses to (or is not able to) reply to requests. |
885 |
Naor et al. \cite{naor03simpledht} have proposed a partial solution against Spam attack in a \emph{faulty} peer environment (not hostile). |
Naor et al. \cite{naor03simpledht} have proposed a partial solution against Spam attack in a \emph{faulty} peer environment (not hostile). |
886 |
|
|
887 |
Overloading of targeted peers is a form of Distributed Denial of Service attack (DDoS) (see, e.g., \cite{372148}). For instance, |
Overloading of targeted peers is a form of Distributed Denial of Service attack (DDoS) (see, e.g., \cite{372148}). For instance, |