Security Considerations for Peer-to-Peer Distributed Hash Tables

Abstract. Publish/Subscribe is often regarded as a promising paradigm for Future Internet architectures. Its information oriented nature and its particular security features have stimulated current research efforts which aim at applying publish/subscribe principles to a clean-slate Internet architecture. One of the core components of publish/subscribe architectures is the rendezvous network. Any security failure that a rendezvous network may face will probably jeopardize the operation of the whole (inter-)network. In this paper we highlight security requirements and potential security issues of rendezvous networks and we present security solutions that can be applied in order to shield them.

show abstract

“…Nevertheless unreliable nodes may lead to a series of problems. Sit et al [16] classify DHT security attacks into three broad categories:…”

Section: Security Threatsmentioning

confidence: 99%

Towards a Secure Rendezvous Network for Future Publish/Subscribe Architectures

Fotiou

Marias

Polyzos

2010

Future Internet - FIS 2010

View full text Add to dashboard Cite

show abstract

“…However, security protocols like TLS may raise performance issues for the servers [8] when facing a large number of endpoints. Other non-VoIP specific threats have been identified in the VoIP P2P architecture [9] as well as in the VoIP web-based architecture where automated WebPhone account creation may lead to the same undesirable consequences as in WebMail. For the latter, the CAPTCHA 3 protection has showed its limits [10], and even if enhancements are proposed [11], the balance between CAPTCHA robustness and usability is tricky to find [12].…”

Section: Threats and Protection Mechanisms In The Intra-domain Contextmentioning

confidence: 99%

“…Eventually, pre-routing may be achieved during this phase to direct the SIP INVITE request to the right entity in the receiving domain, thus saving processing in intermediary entities. -Insertion of an Identification-Token (IT) inside the SIP-INVITE request which authenticates a given transaction and can be checked straightaway by the receiver 9 , thus limiting DoS risks. -Use of symmetric cryptographic algorithms for performance considerations.…”

Section: Design Principlesmentioning

confidence: 99%

Analysis of Token and Ticket Based Mechanisms for Current VoIP Security Issues and Enhancement Proposal

Battistello

Delétré

2010

Communications and Multimedia Security

View full text Add to dashboard Cite

Abstract. These last few years, the security of VoIP architectures has become a sensitive issue with many vulnerability announcements. This article first aims to distinguish the threats and the applicable protection mechanisms depending on the underlying VoIP architecture. We then investigate the properties of a specific class of existing call establishment mechanisms based on tokens or tickets. In the last section, an enhancement to these mechanisms is proposed which lifts some of the previously seen limitations, especially the DoS risks, the token storage constraint or the transport impact of large tickets.

show abstract

“…We selected the Chord [3] structured overlay to provide lookup services for the Trinity [1] system because Chord has good performance characteristics and provides control over the location of peers within the overlay, making it easier to secure [5,6].…”

Section: Preliminariesmentioning

confidence: 99%

Our Brothers’ Keepers: Secure Routing with High Performance

Brodsky

Lindenberg

2008

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The Trinity [1] spam classification system is based on a distributed hash table that is implemented using a structured peer-to-peer overlay. Such an overlay must be capable of processing hundreds of messages per second, and must be able to route messages to their destination even in the presence of failures and malicious peers that misroute packets or inject fraudulent routing information into the system. Typically there is tension between the requirements to route messages securely and efficiently in the overlay. We describe a secure and efficient routing extension that we developed within the I3 [2] implementation of the Chord [3] overlay. Secure routing is accomplished through several complementary approaches: First, peers in close proximity form overlapping groups that police themselves to identify and mitigate fraudulent routing information. Second, a form of random routing solves the problem of entire packet flows passing through a malicious peer. Third, a message authentication mechanism links each message to it sender, preventing spoofing. Fourth, each peer's identifier links the peer to its network address, and at the same time uniformly distributes the peers in the key-space. Lastly, we present our initial evaluation of the system, comprising a 255 peer overlay running on a local cluster. We describe our methodology and show that the overhead of our secure implementation is quite reasonable.

show abstract

Security Considerations for Peer-to-Peer Distributed Hash Tables

Cited by 258 publications

References 8 publications

Towards a Secure Rendezvous Network for Future Publish/Subscribe Architectures

Towards a Secure Rendezvous Network for Future Publish/Subscribe Architectures

Analysis of Token and Ticket Based Mechanisms for Current VoIP Security Issues and Enhancement Proposal

Our Brothers’ Keepers: Secure Routing with High Performance

Contact Info

Product

Resources

About