Abstract. P2P computing offers a new interesting field for security researchers. Being highly distributed and lacking centralised, trusted entities for bootstrapping security mechanisms, these systems demand novel approaches for decentralised security solutions.Recently, a new class of P2P-applications has arisen: P2P-based voice and video streaming systems. The properties of these novel applications impose new, interesting security challenges which have only been started to be addressed by researchers. This paper presents a summary of existing work in the area, derives and discusses open research problems, and finally outlines approaches towards potential solutions for securing P2P-based voice and video streaming applications.
MotivationFor many years, distributed computer systems have been dominated by the client-server paradigm. In recent years, however, a new paradigm appeared for distributed systems: Peer-to-Peer (P2P) computing. In networks based on this new paradigm, all entities are considered equal and provide equivalent services to other entities. At the same time, all entities can use services from all other participants of the network.P2P computing offers a new interesting field for security researchers. Lacking centralised, trusted entities for bootstrapping security mechanisms, these systems demand novel approaches for decentralised security solutions. Lately, a new class of P2P-applications has arisen: P2P-based voice and video streaming systems. Examples for such systems are P2P-Voice-over-IP applications like Skype [32] or P2PSIP [30] as well as P2P-video-streaming applications like PPlive [22] or Zattoo [37]. We subsume these applications as Real-Time Communication Applications (RTC-applications for short).RTC-applications have some important differences to other P2P-applications, e.g., file-sharing. These differences result in specific security requirements. For instance, users expect to reach a telephone callee within seconds, or to switch a TV-channel within milliseconds. In P2P-networks infiltrated by attackers (which can drop or misroute messages), it is challenging to meet these real-time requirements. In contrary, for filesharing it is perfectly acceptable for the user if it takes