Securing The Reputation Management in WINNOWING P2P Scheme. Nawaf Almudhahka Matthew Locklear

Transcription

1 Securing The Reputation Management in WINNOWING P2P Scheme Nawaf Almudhahka Matthew Locklear

2 Agenda Overview Motivation Assumptions & Threat Model Approach Security Analysis of TVC Model Description Results Conclusion Future Work Questions

3 Overview WINNOWING is DHT-Based P2P file sharing system in which the peers maintains index records (file related info). The index records are maintained Index Nodes (IN hereafter) and have two types: 1. Content record: <H(file), publisher info(ip, clientid, TCP_port) > Keyword record: <H(keyword), H(file), metadata> 2. The value H(file) is the content key, while the value H(keyword) is the keyword key.

4 Overview An owner of a file should place a request to the content IN and the keyword IN before publishing a file. The INs verify that the publisher is from a live (nonspoofed) IP. Also, the keyword owning IN verify the contents of the content key H(file) with the content key owning IN to ensure that the publisher is not sending bogus content. This verification is done by searching for the content key and waiting for a valid reply.

5 Overview Downloader Keyword Key IN Publisher Content Key IN KW PUB RQ PUB VER RQ PUB VER RES CONT PUB RQ PUB VER RQ PUB VER RES LOC VER RQ LOC VER RES CON PUB RES

6 Overview Downloader Keyword Key IN Publisher Content Key IN KW SEARCH KW RES CONT SEARCH CONT DONWLOAD CONT RES FB REQ FB RES FB REQ FB RES

7 Issues in WINNOWING The user feed back records are maintained and distributed to potential downloaders by the IN itself. Therefore, there are no guarantees on the integrity and the trustworthiness of the score published by the IN. User feedback records might be forged by the adverse IN to reflect positive feedback. Adverse IN might advertise positive reputation (i.e. high scores) about it self.

8 Issues in WINNOWING The scheme uses Imbalanced User Feedback Mechanism (IUF) in which the downloader vote negatively by sending a big file (few megabytes). This mechanism aims to: Penalize the adverse IN which publishes bogus index records by exhausting its bandwidth when receiving the negative votes from the downloaders. Discourage the downloaders from voting negatively to reduce the impact of Reverse Voting attacks in damaging the reputation of a benign IN. What if an adversary with super bandwidth resources used that mechanism to exhaust an IN bandwidth and buffer resources?

9 Motivation 1. Reputation counts a lot in P2P systems! It is the critical success factor to secure the P2P network against the polluters. Assign the responsibility of maintaining the user feedback records (votes) to a trusted entity. Secure storage for the downloaders votes. Trusted issuance of reputation reports (score certificates).

10 Motivation 2. Bandwidth penalty is costly. It affects all hosts in the domain (not only the bad guy) and it hurts a lot if employed in performing DoS attacks. Reduce the threat of employing the IUF mechanism in launching DoS attacks while preserving the same penalizing Impact. Let the downloader pay a cost of a resource that does not directly affect the IN (i.e. other than bandwidth). Penalize the IN that receives a negative vote without affecting its bandwidth.

11 Assumptions & Threat Model Active Members Attacks Downloader/Benign Voter IN Insertion Benign IN Reverse Voting Adverse Voter DoS Adverse IN Score Forgery

12 Assumptions & Threat Model Attack IN Insertion Reverse Voting Score Forgery DoS Committer Adverse IN Adverse Voter(s) Adverse IN Adverse Voter(s) Victim Downloader Benign IN Downloader Benign IN

13 Index Node Insertion Adverse IN Potential Downloaders An adverse IN distributes bogus index records in the P2P system.

14 Reverse Voting Adverse IN Colluding Voters A single or multiple colluding voters target a benign index node by voting negatively to it aiming to decrease its score and hurt its reputation in the system.

15 Reverse Voting Benign IN Colluding Voters A single or multiple colluding voters target a benign index node by voting negatively to it aiming to decrease its score and hurt its reputation in the system.

16 Score Forgery Victim Downloader Adverse IN Potential Downloaders An adverse index node forges the negative vote records it has received so it reflects a good score (and hence, reputation) to the potential downloaders and attracts them to its bogus index records.

17 Approach Introduce Trusted Voting Center (TVC) that is responsible for the following: Receiving, storing, and maintaining the downloader votes for a group of INs. Producing score certificates periodically and distributed them on the relevant INs. Preserving the penalty concept introduced by WINNOWING on both: negative voters and INs.

18 Approach TVC addresses the main three issues in WINNOWING s reputation management: Minimize the potential of DoS and Reverse Voting attacks. Guarantees the integrity of votes and scores. Reduce the impact of IN Insertion.

19 Assumptions (TVC) It is sufficiently secure server that cannot be compromised by the adversaries in the system. It has sufficient bandwidth, memory, and computational resources. The TVC uses PKC to sign the score reports that it generates, which protects these score reports against. The overall system is assumed to be sufficiently synchronized with an authentic global time service.

20 TVC Overview TVC Downloader Publisher CONT DNLD USR FEEDBACK REQ Content Key IN CLIENT PUZZLE PUZZLE SOL, VOTE SCORE READY ANNOUNCEMENT, CLEINT PUZZLE PUZZLE SOLUTION SCORE CERTIFICATE

21 Voting Process Voting Request Received Previously voted for the same index node Create and send the puzzle to the voter. Set puzzle hardness as default. No Positive Check the requested vote type. Yes Puzzle solution received. Retrieve User's History and set the puzzle hardness Negative Puzzle Solution Timed-out? No Verify the solution. Incorrect Correct Yes Compare the sent vote type with the requested vote type. Mismatch Ignore the Vote Match Process the Vote Update the User Profile Record a bad behavior incident.

22 Score Reporting 1: Retrieve the Index Node Score 2: Set the certificate validity and the puzzle hardness based on the Index Node score. 4: Inform the Index Node about the certificate and send the puzzle to it. 3: Issue a digitally signed score certificate 5: Puzzle solution received. 6: Verify the solution. Correct Incorrect 7a: Send the certificate. 7b: Don t send the certificate. 8: Wait for the new cycle.

23 Score Reporting Adverse IN Users TVC T 0 T 1 T 2 T 3

24 Security Analysis of TVC Resilience to IN Insertion Attack Resilience to Reverse Voting Attack DoS Mitigation

25 Security Analysis of TVC 1. Resilience to IN Insertion Attack: Adverse INs eventually converge to a low score due to guaranteed integrity of votes. Eventually filters out bogus index records due to zero-validity score threshold. TVC signature of score certificates prevents forgery of certificates.

26 Security Analysis of TVC 2. Resilience to Reverse Voting Attack: TVC ensures votes are from a live IP and are unique per index record. Very limited impact if colluders try to boost an adverse IN score or reduce benign IN score. Negative votes result in high computational cost.

27 Security Analysis of TVC 3. DoS Mitigation: TVC preserves the server resources by only processing unique votes from legitimate voters. The vote message is of a small size (~1 KB) which adversely reduces the impact of DoS on the server. Increased computational cost towards voters for successive bad behaviors.

28 Model Description Resilience to IN Insertion Attack Reduction in DL Failures Due to Adverse IN Analytical Model Resilience to Reverse Voting Attack Benign IN Reputation Protection Analytical Model DoS Mitigation OPNET Simulation

29 Model Description 1. Reduction in Download Failures Due to Adverse IN Global time interval i. IN starts with perfect score of 100. Peer arrivals to system Poisson distributed with mean λ per interval. All arrivals in valid interval seek to download from adverse IN. All downloads attempted via adverse IN fail. AIAD scoring scheme employed.

30 Model Description Pwilling neg Pwilling neg. vs. Score Score

31 Model Description

32 Results download failures DL Failures Due to Adverse Index Node Winnowing Scenario TVC Scenario, λ = 25 TVC Scenario, λ = 30 TVC Scenario, λ = time Consistent DL failures due to adverse IN in WINNOWING. DL failures in TVC decrease and eventually cease once zero-validity score threshold reached.

33 Results score Benign Index Node Score TVC Scenario, k = 45 Winnowing Scenario, k = 45 TVC Scenario, k = 60 Winnowing Scenario, k = 60 TVC Scenario, k = 75 Winnowing Scenario, k = time Liar farm remains effective in WINNOWING scheme TVC allows for quick recovery of IN score after liar farm exhausts votes

34 Results Computational cost vs. bandwidth cost results in a fruitful impact on server resources. Service queue size exponentially smaller in TVC.

35 Conclusion 1. TVC guarantees integrity of users votes and IN score reports. Mitigates long-term effects of IN Insertion Attack. 2. TVC guarantees isolation and effective lock-out against adverse voters Adversely decreases effects of Reverse Voting Attack. 3. TVC client puzzle approach guarantees all votes received from live IPs. Dramatically reduces effectiveness of DoS Attack. Requires exponentially more colluding users to be as effective as the DoS against WINNOWING scheme.

36 Future Work 1. Performing more advanced analysis to make adaptive and more efficient decisions in dealing with voter feedback. 2. Enabling the joint detection of colluding voters based on group behavioral patterns: Isolate potentially large liar farm before benign IN s reputation is corrupted. 3. Dealing with scalability issues with a large number of peers in single server system: How to map index nodes to multiple TVCs in larger systems?

37 Thank You Questions & Comments