Peer-assisted content distribution in Akamai netsession

Abstract

Content distribution systems have traditionally adopted one of two architectures: infrastructure-based content delivery networks (CDNs), in which clients download content from dedicated, centrally managed servers, and peer-topeer CDNs, in which clients download content from each other. The advantages and disadvantages of each architecture have been studied in great detail. Recently, hybrid, or "peer-assisted", CDNs have emerged, which combine elements from both architectures. The properties of such systems, however, are not as well understood.In this paper, we discuss the potential risks and benefits of peer-assisted CDNs, and we study one specific instance, Akamai's NetSession system, to examine the impact of these risks and benefits in practice. NetSession is a mature system that has been operating commercially since 2010 and currently has more than 25 million users in 239 countries and territories. Our results show that NetSession can deliver several of the key benefits of both infrastructure-based and peer-to-peer CDNs-for instance, it can offload 70-80% of the traffic to the peers without a corresponding loss of performance or reliabilityand that the risks can be managed well.This suggests that hybrid designs may be an attractive option for future CDNs.

Anonymity in Peer-assisted CDNs: Inference Attacks and Mitigation

“…Previous studies have shown advantages of peerassisted CDNs: they can significantly reduce the cost of all parties including Internet Service Providers (ISPs) [48,53]. For example, NetSession has over 25 million users in 239 countries and territories, and offloads 70−80% of the traffic to peers without the trade-off of reliability [77]. In peer-assisted CDNs, the peers are the clients that fetch and distribute content, e.g., browsers in Maygh [76] and client programs in NetSession [2].…”

“…The victim's peer randomly fetched part of resources (unknown to the attacker) from the remote server. To infer what content the victim has requested, we located the adversarial node nearby the victim's peer in the same local area network (LAN), and used Wireshark [28] to eavesdrop on the network traffic from/to the con-2 Previous work [76,77] mentions that peers can learn the IP addresses of the connect peers in numerous peer-assisted CDNs, e.g., NetSession, FireCoral, FlowerCDN and Maygh. Thus, these services are conceptually vulnerable to inference attacks too.…”

“…In contrast to traditional infrastructure-based CDNs, peer-assisted CDNs offload content delivery tasks on clients (peers) to save the bandwidth of servers [48,53], and reduce the latency of fetching content at the client side. For instance, NetSession can offload 70 − 80% of the traffic to the peers [77]. For the thorough evaluation on Etsy, Maygh is able to reduce the 95th-percentile bandwidth due to image content at the operator by over 75% [76].…”

“…For instance, Akamai NetSession can offload over 70% of the traffic to peers with high reliability [77]. On the other hand, in contrast to infrastructure-based systems in which trusted centralized servers are deployed, untrusted peers in peer-assisted CDNs can easily join the system.…”

“…On the other hand, in contrast to infrastructure-based systems in which trusted centralized servers are deployed, untrusted peers in peer-assisted CDNs can easily join the system. The compromised or malicious peers can then a) modify content and inject unauthorized content; b) delay or deny content delivery to other peers; c) misreport their contributions to manipulate the accounting for commercial services [29,77]; d) infer which peer they deliver/fetch a resource to/from, and what content the peers have requested.…”