Large-scale peer-to-peer systems face security threats from faulty or hostile remote computing elements. To resist these threats, many such systems employ redundancy. However, if a single faulty entity can present multiple identities, it can control a substantial fraction of the system, thereby undermining this redundancy. One approach to preventing these "Sybil attacks" is to have a trusted agency certify identities. This paper shows that, without a logically centralized authority, Sybil attacks are always possible except under extreme and unrealistic assumptions of resource parity and coordination among entities.

The Sybil Attack

Peer-to-peer file-sharing networks are currently receiving much attention as a means of sharing and distributing information. However, as recent experience shows, the anonymous, open nature of these networks offers an almost ideal environment for the spread of self-replicating inauthentic files.We describe an algorithm to decrease the number of downloads of inauthentic files in a peer-to-peer file-sharing network that assigns each peer a unique global trust value, based on the peer's history of uploads. We present a distributed and secure method to compute global trust values, based on Power iteration. By having peers use these global trust values to choose the peers from whom they download, the network effectively identifies malicious peers and isolates them from the network.In simulations, this reputation system, called EigenTrust, has been shown to significantly decrease the number of inauthentic files on the network, even under a variety of conditions where malicious peers cooperate in an attempt to deliberately subvert the system.

/pdf/the-eigentrust-algorithm-for-reputation-management-in-p2p-hmpmn26kxv.pdf

The Eigentrust algorithm for reputation management in P2P networks

Distributed denial-of-service (DDoS) is a rapidly growing problem. The multitude and variety of both the attacks and the defense approaches is overwhelming. This paper presents two taxonomies for classifying attacks and defenses, and thus provides researchers with a better understanding of the problem and the current solution space. The attack classification criteria was selected to highlight commonalities and important features of attack strategies, that define challenges and dictate the design of countermeasures. The defense taxonomy classifies the body of existing DDoS defenses based on their design decisions; it then shows how these decisions dictate the advantages and deficiencies of proposed solutions.

/pdf/a-taxonomy-of-ddos-attack-and-ddos-defense-mechanisms-3fjlj0hhjy.pdf

A taxonomy of DDoS attack and DDoS defense mechanisms

Sensor networks hold the promise of facilitating large-scale, real-time data processing in complex environments, helping to protect and monitor military, environmental, safety-critical, or domestic infrastructures and resources, Denial-of-service attacks against such networks, however, may permit real world damage to public health and safety Without proper security mechanisms, networks will be confined to limited, controlled environments, negating much of the promise they hold The limited ability of individual sensor nodes to thwart failure or attack makes ensuring network availability more difficult To identify denial-of-service vulnerabilities, the authors analyzed two effective sensor network protocols that did not initially consider security These examples demonstrate that consideration of security at design time is the best way to ensure successful network deployment

/pdf/denial-of-service-in-sensor-networks-1r5u4tlto6.pdf

Denial of service in sensor networks

The information-centric networking (ICN) concept is a significant common approach of several future Internet research activities. The approach leverages in-network caching, multiparty communication through replication, and interaction models decoupling senders and receivers. The goal is to provide a network infrastructure service that is better suited to today?s use (in particular. content distribution and mobility) and more resilient to disruptions and failures. The ICN approach is being explored by a number of research projects. We compare and discuss design choices and features of proposed ICN architectures, focusing on the following main components: named data objects, naming and security, API, routing and transport, and caching. We also discuss the advantages of the ICN approach in general.

A survey of information-centric networking

This memo specifies the details of the Host Identity Protocol (HIP).
HIP allows consenting hosts to securely establish and maintain shared
IP-layer state, allowing separation of the identifier and locator
roles of IP addresses, thereby enabling continuity of communications
across IP address changes. HIP is based on a Sigma-compliant Diffie-
Hellman key exchange, using public key identifiers from a new Host
Identity namespace for mutual peer authentication. The protocol is
designed to be resistant to denial-of-service (DoS) and man-in-the-
middle (MitM) attacks. When used together with another suitable
security protocol, such as the Encapsulated Security Payload (ESP), it
provides integrity protection and optional encryption for upper- layer
protocols, such as TCP and UDP. This memo defines an Experimental
Protocol for the Internet community.

Host Identity Protocol

This memo describes a snapshot of the reasoning behind a proposed new
namespace, the Host Identity namespace, and a new protocol layer, the
Host Identity Protocol (HIP), between the internetworking and
transport layers. Herein are presented the basics of the current
namespaces, their strengths and weaknesses, and how a new namespace
will add completeness to them. The roles of this new namespace in the
protocols are defined. The memo describes the thinking of the authors
as of Fall 2003. The architecture may have evolved since. This
document represents one stable point in that evolution of
understanding. This memo provides information for the Internet
community.

Host Identity Protocol (HIP) Architecture

A large fraction of today's Internet applications are internally publish/subscribe in nature; the current architecture makes it cumbersome and inept to support them. In essence, supporting efficient publish/subscribe requires data-oriented naming, efficient multicast, and in-network caching. Deployment of native IP-based multicast has failed, and overlay-based multicast systems are inherently inefficient. We surmise that scalable and efficient publish/subscribe will require substantial architectural changes, such as moving from endpoint-oriented systems to information-centric architectures.In this paper, we propose a novel multicast forwarding fabric, suitable for large-scale topic-based publish/subscribe. Due to very simple forwarding decisions and small forwarding tables, the fabric may be more energy efficient than the currently used ones. To understand the limitations and potential, we provide efficiency and scalability analysis via simulations and early measurements from our two implementations. We show that the system scales up to metropolitan WAN sizes, and we discuss how to interconnect separate networks.

/pdf/lipsin-line-speed-publish-subscribe-inter-networking-9msg3xq56v.pdf

LIPSIN: line speed publish/subscribe inter-networking

Denial of service by server resource exhaustion has become a major security threat in open communications networks. Public-key authentication does not completely protect against the attacks because the authentication protocols often leave ways for an unauthenticated client to consume a server's memory space and computational resources by initiating a large number of protocol runs and inducing the server to perform expensive cryptographic computations. We show how stateless authentication protocols and the client puzzles of Juels and Brainard can be used to prevent such attacks.

/pdf/dos-resistant-authentication-with-client-puzzles-iunzqo4x6d.pdf

DOS-Resistant Authentication with Client Puzzles

IPv6 nodes use the Neighbor Discovery Protocol (NDP) to discover other
nodes on the link, to determine their link-layer addresses to find
routers, and to maintain reachability information about the paths to
active neighbors. If not secured, NDP is vulnerable to various
attacks. This document specifies security mechanisms for NDP. Unlike
those in the original NDP specifications, these mechanisms do not use
IPsec. [STANDARDS-TRACK]

Pekka Nikander

Papers

Host Identity Protocol

Host Identity Protocol (HIP) Architecture

LIPSIN: line speed publish/subscribe inter-networking

DOS-Resistant Authentication with Client Puzzles

SEcure Neighbor Discovery (SEND)