Towards an IPv6-Based Security Framework for Distributed Storage Resources

Abstract

Abstract. Some security problems can be often solved through authorization rather than authentication. Furthermore, certificate-based authorization approach can alleviate usual drawbacks of centralized systems such as bottlenecks or single point of failure. In this paper, we propose a solution that could bring an appropriate security architecture to the Internet Backplane Protocol (IBP), a distributed shared storage protocol. The three basic building blocks are IPsec, Simple Public Key Infrastructure (SPKI) certificates and Crypto-Based Identifiers (CBID). CBID allows entities to prove ownership of their identifiers, SPKI allows entities to prove that they have been authorized to performs specific actions while IPsec provides data origin authentication and confidentiality. We propose to use them to bring some level of 'opportunistic' security in the absence of any trusted central authority. This is particularly tailored to ad-hoc environments where collaborations might be very short-termed.

Crypto-based identifiers (CBIDs)

“…Other applications which are not discussed include securing neighbor discovery [Arkko et al 2002;Aura 2004;Montenegro et al 2003], opportunistic encryption [Castelluccia and Montenegro 2002a] and securing internet storage facilities [Bassi et al 2003], for example.…”