CAN RESIDENTIAL WIRELESS LANS PLAY A ROLE IN 4G? *

Transcription

1 CAN RESIDENTIAL WIRELESS LANS PLAY A ROLE IN 4G? * Elias C. Efstathiou and George C. Polyzos Mobile Multimedia Laboratory Department of Computer Science Athens University of Economics and Business Athens 10434, Greece {efstath, polyzos}@aueb.gr Abstract We present a P2P scheme that could fuel the deployment of free public wireless LANs (WLANs) in cities; these WLANs would complement existing and future cellular networks. We call our scheme the P2P Wireless Network Confederation (P2PWNC). Unlike existing approaches, P2PWNC does not rely on central planning or altruistic groups. In P2PWNC, wireless service is provided to those who provide service to others based on an algorithm that detects non simultaneous exchanges, which runs in isolation on every peer. This indirect reciprocity algorithm resists the Sybil attack and promotes cooperation without relying on trusted authorities, persistent identities, or tamperproof modules. In this paper, we present P2PWNC as another component of the emerging 4G landscape. 1. Introduction 1 The market for IEEE wireless LANs (WLANs) is growing fast. Worldwide, thousands of WLAN hotspots are providing Internet access to the public. Cellular network operators are collaborating with public hotspot operators to form roaming associations [1]. WLAN clients are being integrated into cell phones [2]. Municipalities are also deploying and operating citywide WLANs: the City of Philadelphia announced its relevant business * This research is supported by the project "Mobile Multimedia Communications" (EP ), funded by the research program "Herakleitos--Fellowships for Research at the Athens University of Economics and Business," which is co-financed by the Ministry of National Education and Religious Affairs of Greece and the European Union, through the program "EPEAEK II." model (labeled Cooperative Wholesale ) on April 2005 [3]. Smaller towns, especially in rural areas, have already succeeded in offering inexpensive (even free) wireless broadband access to their inhabitants [4]. Today, it is generally accepted that WLAN and 3G technologies will coexist, and that this coexistence will be one of the defining characteristics of the 4G wireless landscape. Even with all the publicity that is currently surrounding WLAN technologies, there is still not enough emphasis being placed on the fact that public WLANs can be deployed by practically anyone. A WLAN access point is an inexpensive device that operates in unlicensed frequency bands. A broadband Internet subscriber that attaches an access point to his home Internet connection can cover his own home and a substantial part of the area surrounding it with WLAN signals. We shall attempt to make a prediction: in the near future, most WLAN signals will come from residential WLANs that are attached to home broadband connections, i.e. not from hotspots that are controlled by commercial operators. Today, these spillover signals are generally considered a security risk and owners of home WLANs are advised to secure their networks against outsiders by using cryptographic methods at the link or at higher layers (e.g. through the use of IPsec, TLS/SSL, or application-level encryption). Currently, at least in metropolitan areas, numerous WLAN access points are in operation. Recently, a U.S. company [5] announced its Wi-Fi Positioning System (WPS). Unlike GPS, which uses dedicated satellites and does not function indoors, the WPS system relies on a database that stores the geographical locations of thousands of WLAN access

2 points across 25 major U.S. cities. A WPS-enabled device (an IEEE enabled device can become WPS-enabled with a simple software update) can detect nearby access points, identify them using their Service Set beacons, and use triangulation techniques and the WLAN location information in the database in order to pinpoint a person s geographical location with a 20-meter accuracy. This database of accesspoint locations is constantly being updated and contains access points owned and operated not only by public hotspot operators but also access points that are part of home and office networks. Therefore, residential WLANs are already being used to provide a public service, and without necessarily their owners explicit consent. Our proposal in this paper is to take the idea of relying on residential WLANs to its logical conclusion. We shall present a scheme that can explicitly take advantage of a city s residential WLANs, uniting them in a citywide ad hoc roaming association. We call the scheme Peer-to-Peer Wireless Network Confederation (P2PWNC). In the P2PWNC scheme, a city s broadband Internet subscribers are given incentives to share their Internet connections with their peers, i.e. with other broadband subscribers. The sharing of Internet connections with passersby incurs both direct and indirect costs, so, in exchange, a participating peer who shares his connection earns the right to access the broadband connections owned by other P2PWNC peers whenever he happens to be away from his own home connection. All connection sharing is enabled by WLAN technology: peers within range of a peer s residential WLAN can access that peer s Internet connection using any mobile WLAN client such as a WLAN-enabled cell phone. Participating peers can thus rely on P2PWNC and use it as a low-cost alternative to standard (2G/3G) cellular service. With appropriate security software (e.g. VPN software than forwards all traffic through a trusted home server), and with the appropriate Voice-over-IP functionality, the videophones of the near future could use any access point that participates in a city s P2PWNC system in order to access the Internet and make or receive calls. All this would happen practically for free, as long as the peer owns a P2PWNC-enabled home access point that extends the same courtesy to his P2PWNC peers who request it, which is the characteristic of most of the successful peer-to-peer schemes (P2P) that are in operation today. Unlike the WPS location service we described above, making an access point part of a P2PWNC system incurs costs, as we mentioned above. P2PWNC is a P2P scheme that relies on the sharing of resources, (here: wireless bandwidth and bandwidth to the Internet) and has many similarities to common P2P file sharing schemes. As in most P2P schemes that assume selfish peers, cooperation among peers must somehow be encouraged. This is necessary because altruism alone will probably not be enough: each peer that participates in P2PWNC faces both real costs (if he is on a metered Internet connection for example), and opportunity costs (e.g. increased delay for one s own traffic due to the forwarding of traffic for others, the possibility of exposure to security risks, and others). The altruistic peers that do not care about these costs are probably few in number compared to the set of potential P2PWNC participants. 2. System requirements Cooperation in P2PWNC is promoted through an incentive-based mechanism. However, most of the relevant mechanisms proposed in the literature cannot be applied directly because of three additional design constraints that we choose to place on a P2PWNC system. These three constraints are presented below. 1) P2PWNC peer identities are zero-cost. Peers do not have to possess identities that are certified by a Trusted Third Party, which can somehow be linked to their real-world identity. P2PWNC peers simply create their own identities locally. This means that a P2PWNC system can be fully self-organized, which could make its spontaneous deployment in densely populated urban areas more likely. All peers in P2PWNC have equivalent roles and no authorities are assumed (not even distributed ones). This absence of any hierarchical structure is what will probably distinguish P2PWNC and other 4G systems from the telecommunication architectures of today. Zero-cost identities encourage fast system growth; however, it is known that collusion-based attacks can be trivially launched in electronically mediated communities when a logically centralized authority is absent [6]. A

3 peer can generate any number of unique identities and collude with himself in order to build an arbitrary-sized virtual coalition that could launch massive collusion-based attacks. We shall return to this issue in Section 4. 2) P2PWNC must be able to handle asymmetry of interest and untraceable defections (a defection is simply a refusal to cooperate). This means that it may be common in P2PWNC for a peer A to consume resources from a peer B and never get the chance to repay B, but only other peers. Also, it may be common for a peer C not to provide resources to peer D, but peer D may have no way of knowing that C could have provided resources. These two problems mean that strategies which belong to the popular Tit- For-Tat family of strategies (originally studied by Axelrod [7]) cannot be used to promote cooperation in the P2PWNC setting because peers may not interact repeatedly and symmetrically, and because only positive (i.e. cooperative) actions can be reliably traced. 3) Peer selfishness not only discourages peers from sharing the higher-level P2PWNC resource (wireless bandwidth and bandwidth to the Internet). Peer selfishness may also affect the P2PWNC system at a lower level. The operation of P2PWNC relies on accounting information that circulates through the system and is stored by the peers themselves. It is normally assumed that peers do not use tamperproof software or hardware; therefore, peers can always choose to be uncooperative at this accounting sublayer by trying to save the storage space and the bandwidth that would be required in order to respond to accounting queries. P2PWNC is designed in such a way, therefore, so that peers store and communicate accounting information only when it is in their interest. The issue of providing appropriate incentives at the accounting level is frequently overlooked in other pure (i.e. fully distributed) P2P system proposals [8, 9]. 3. System entities A P2PWNC system is composed of WLAN Access Points (APs) and WLAN clients. We assume that each peer owns and operates one AP, which is attached to an always-on broadband Internet connection. Also, each peer owns a mobile WLAN client, which he uses to access the Internet through APs that belong to other peers. We assume a peer can communicate, securely, using his client, with his AP over the Internet. For example, the two devices may share a common secret key and the client should also be aware of the AP s public IP address whether dynamic or static. Each peer generates a unique identity for himself; this identity is a locally generated publicprivate key pair. The public key (PK) is stored in the AP and in the client. The private key (SK, or secret key) is stored in the client only. Peers use their SKs to sign receipts whenever they consume WLAN resources from other peers. A receipt is a record of the corresponding WLAN session. Receipts contain: The PK of the providing peer. The PK of the consuming peer. A timestamp, noting the WLAN session s start time. The total amount of (egress and ingress) traffic forwarded by the providing AP during the entire session. The consuming peer s signature signing all the above. This signature is a hash of the above 4 fields, encrypted with the consuming peer s SK. Receipts are generated as follows: during a WLAN session, the AP periodically (e.g. once a minute) sends Receipt Requests to all connected clients. If a client wishes to continue with its WLAN session, it must sign a receipt. The providing peer s PK is included in Receipt Requests, and the client can calculate all the remaining receipt data. Upon receiving a receipt, the AP will: Verify the signature using the consuming peer s PK (included in the receipt). Verify that the amount of traffic corresponds to the amount of traffic forwarded in that session so far.

4 Verify that the timestamp is correct and equal to the session s start time. APs and clients can agree on the timestamp because we assume they are loosely synchronized. Receipts represent the proofs that peers use in order to show to other peers that they now deserve to be served because they contributed their resources in the (recent) past. Peers cannot take advantage of more than one receipt from the same session because all these receipts have the same timestamp. However, zero-cost identities present a serious problem: peers can easily generate any number of fake identities and fake receipts without doing any useful work for the system. Below we will give a brief overview of a family of strategies that peers can follow in order to avoid servicing this type of colluders. These strategies provide peers with the appropriate incentives to cooperate in order to raise their standing and receive service from other peers in the future (who will, in turn, service them for the exact same reason). 4. Peer strategy A typical strategy from the strategy family we referred to previously (first mentioned in [9]) is this: Peer P (provider), upon receiving a request from peer C (consumer), accesses the P2PWNC receipt graph, and cooperates (i.e. offers service) with a probability equal to: P = min{ 1, maxflow(p to C) / maxflow(c to P) } where maxflow() is the result of the Maximum Flow graph algorithm. A family of strategies that are based on maxflow has been shown [9, 10] to promote cooperation and to be collusion-resistant under specific collusion scenarios. Our ongoing work addresses additional collusion scenarios and other more sophisticated attacks. In the P2PWNC receipt graph, vertices are peer public keys (PKs) and edges point from the consuming peer to the providing peer. An edge s weight is the amount of traffic recorded on the corresponding receipt. A chain of receipts starting from P and ending at C indicates that P has consumed, directly or indirectly, from C in the past; therefore, C should be rewarded for his contribution to the community. Also, all the signatures on the receipt chain that is part of the maxflow can be verified: P verifies the signature on the first receipt using his own PK, and then uses the providing peer s PK in each receipt to verify the signature on the next receipt. Essentially, by taking indirect consumption into account in this manner, the asymmetry of interest problem is mitigated [9]. How do we realize the receipt graph in a distributed manner? Because of peer selfishness at the accounting level (see Section 2), it is difficult for peers to share a global view of the receipt graph; however, it is possible for each peer to have a partial view of it. More specifically, each peer AP maintains 3 receipt repositories: IR (incoming receipts), OR (outgoing receipts), and RR (random receipts). IR and OR contain receipts for sessions in which the peer was directly involved as provider (IR) or consumer (OR). When a peer C visits peer P (actually, visits P s AP) and requests service, C communicates to P s AP the contents of C s IR and RR repositories; the maxflow algorithm is then run on the combined repositories. P then uses C s IR and RR to populate his own RR repository. Performing this gossiping has been shown [10] to be in the interest of C. For gossiping to work, a peer s client must also communicate regularly with the peer s AP in order to report new outgoing receipts, and in order to receive updates of IR and RR. All three repositories have a maximum size. During repository updates, if their size limit is reached, the oldest receipt is replaced. IR s and RR s size is important because their contents are also communicated to clients. However, if we use an Elliptic Curve Cryptography-based signature scheme, a receipt can be less than 100 bytes long, which means that even cell phone P2PWNC clients can carry thousands of receipts. In conclusion, the P2PWNC distributed accounting mechanism uses clients to circulate

5 accounting data, exploiting their mobility, much like a similar algorithm that was first presented in [11]. Thus, no communication between (distrusting) P2PWNC APs is required. 5. Simulation results We used the evolutionary learning framework established in [9] to evaluate the maxflow strategy presented above and its partial view of the receipt graph. We let the peers be randomly paired for games, which are grouped in rounds. In each round, all peers get one chance to provide service, and lose 1 point if they do so, and one chance to consume, and gain 7 points if the providing peer cooperates 1. Every peer follows a strategy, and can change his strategy (evolve) at the end of each round with probability p learn = In that case, he will pick the strategy (from the 3 available, see below) that currently has the highest rating, and will adopt it with probability proportional to the difference in rating between that strategy and his own strategy. A strategy s rating is the average of the running averages of scores per round of its followers, with each term weighted according to how many rounds a peer has been using the strategy [9]. The 3 available strategies are: and only attempt to consume. For the measurements below, each data point corresponds to 500 rounds of play, with the population always starting from 1/3 AC followers, 1/3 NC followers, and 1/3 maxflow followers, who may then change their behavior according to the social learning process described above. All WLAN sessions are assumed to be equivalent, meaning that receipt (edge) weights always equal 1. We varied the population size from 100 to 1000 peers. We set the size of OR and IR to 20 receipts (which is extremely small, corresponding to approximately 4kB of information), and we used two RR sizes: 0 and 20. RR size 0 means that no secondhand information is available to peers and that peers rely solely on their own first-hand observations. RR size 20 means that clients carry the same amount of first-hand (IR) and second-hand (RR) information 40 receipts total (approx. 4kB); we see (Figure 1, below) that cooperation levels improve considerably with this extra second-hand information: the maximum mean overall score per round is 6 (7 minus 1), and is achieved if everybody always cooperates. As populations increase, it is difficult to maintain this level of cooperation (since IR and RR sizes remain the same), however, we see that second-hand information, even if only partial, can improve the level of cooperation. Always Cooperate (AC) Never Cooperate (NC), and the maxflow-based strategy. Their only difference is that AC followers cooperate irrespectively of what the maxflow algorithm outputs, and NC followers never cooperate 1 These numbers are not completely arbitrary: for cooperation to be established at equilibrium, the cost of performing a cooperative act (in absolute terms) needs to be less than the benefit of being on the receiving side of a cooperative act. If these values were the same, peers would be indifferent regarding longterm cooperation because this type of costly cooperation would not improve their evolutionary fitness in the long run. We borrow these specific numbers from [9]. Results would be qualitatively the same for a wide range of benefit-to-cost ratios that are higher than 1:1. These numbers should capture the realworld costs of offering access over the residential WLAN and the benefit of not having to pay cellular operators for their services. Mean Score / Round The value of second-hand information RR =0 RR = Population (in hundreds) Figure 1: As population size increases, cooperation levels fall, but with the addition of second-hand information peers are able to maintain higher cooperation levels.

6 6. Related work and conclusions We presented a scheme that explicitly takes advantage of residential WLANs and gives incentives to their owners to share these WLANs among each other. In the near future, in dense urban areas where most households will own a broadband Internet connection and a home WLAN, such a scheme will allow users to exploit the underused resources of their peers instead of having to resort to the services of commercial 3G and hotspot operators. We believe that this peer-to-peer sharing of network resources, which has similarities to multi-hop network traffic forwarding (though in P2PWNC there is always only one intermediate relaying node), will be an important feature of emerging 4G wireless architectures. An earlier version of the peer strategy appears in [10]. The idea of using mobile clients to circulate data comes from [11]; there, it is used as a way to merge the PGP-like certificate repositories that mobile nodes are carrying. The theoretical work in [9] provided many insights and linked Axelrod s work on cooperation theory [8] with current research on pure peer-to-peer systems. Currently, we are analyzing the robustness of the system to several types of collusion-based attacks, as well as to Sybil attacks; we are also implementing a P2PWNC AP on top of the Linux-based Linksys WRT54GS AP to be used as reference implementation of the specific P2PWNC protocol that we are designing. We believe that the particular Linksys model, currently retailing for less than $70, is indicative of a wide range of AP devices that can be upgraded to run P2PWNC protocols with simple firmware updates. On the client side, supporting P2PWNC protocols is more straightforward (even small mobile clients like smart phones are, in general, more powerful than the Linksys AP). We believe that by specifying an open client-to-ap P2PWNC protocol, vendors of WLAN access points and clients will include the P2PWNC algorithm in their future firmware and driver updates. [2] The Motorola CN620 handset. [3] Wireless Philadelphia. [4] Municipal Wireless. [5] Skyhook Wireless. [6] J. Douceur, The Sybil attack, in Proc. IPTPS 02. [7] R. Axelrod, The Evolution of Cooperation, Basic Books, [8] S. Lee, R. Sherwood, B. Bhattacharjee, Cooperative peer groups in NICE, in Proc. IEEE INFOCOM [9] M. Feldman, K. Lai, I. Stoica, J. Chuang, Robust incentive techniques for peer-to-peer networks, in Proc. ACM EC 04. [10] E.C. Efstathiou and G.C. Polyzos, Self-organized peering of wireless LAN hotspots, European Transactions on Telecommunications (special issue on Self-Organization in Mobile Networking, in press). [11] S. Capkun, L. Buttyan, J.-P. Hubaux, Selforganized public key management for mobile ad hoc networks, IEEE Transactions on Mobile Computing, 2(1), References [1] Wireless Broadband Alliance.