Towards Scalable and Robust Overlay Networks Christian Scheideler Institut für Informatik...

Towards Scalable and Robust Overlay Networks

Christian Scheideler

Institut für Informatik

Technische Universität München

Baruch Awerbuch

Dept. of Computer Science

Johns Hopkins University

Motivation

• Peer-to-peer systems have attracted a lot of attention in recent years

• Many structured peer-to-peer systems use overlay networks based on virtual space

Example

Chord:

• Each peer assigned to (pseudo-)random point in [0,1)

• Each peer at point x connects to peers closest to x+1/2, x+1/4, x+1/8,…(mod 1)

0 1

Basic Goals

Scalability:

• Network has (poly-)logarithmic diameter

• Peers have (poly-)logarithmic degree

• Join/leave require (poly-)logarithmic work

Robustness:

• Network robust against insider and outsider attacks (minimal goal: honest peers form single connected component)

Join-Leave Attacks

In open peer-to-peer systems

Goal: make abuse of join and leave operations hard

• peers may frequently join and leave• not all peers are honest/reliable

Join-Leave Model

• n honest peers• n adversarial peers, <1

Operations:• Join(v): peer v joins the system• Leave(v): peer v leaves the system

Goal: maintain scalability and robustness for any sequence of polynomially many rejoin (leave+join) requests

Join-Leave Model

Goal: maintain scalability and robustness for any sequence of polynomially many rejoin (leave+join) requests

Adversary can decide adaptively which peer (honest or adversarial) has to rejoin

Rejoin(v1) Rejoin(v2) Rejoin(v3) Rejoin(v4)time

More specific goal

• n honest peers, n adversarial peers

• every peer has point in [0,1) (Chord)

For any interval I ½ [0,1) of size (c log n)/n:

• Balancing condition: (log n) peers in I

• Majority condition: honest peers in majority

0 1I

c log n / n

How to satisfy conditions?

(1) use pseudo-random (cryptographic) hash function to map peers to points in [0,1)

• randomly distributes honest peers• does not randomly distribute adversarial peers

How to satisfy conditions?

(2) map peers to random points in [0,1)

How to satisfy conditions?

(3) Group spreading [AS04]:

• Map peers to random points in [0,1)

• Limit lifetime of peers

Too expensive!

Only adversarial peers rejoin

• Rule that works: k-cuckoo rule [AS06]

evict k/n-region

n honest n adversarial

< 1-1/k

Rejoin: leave and join via k-cuckoo rule

Limitation of k-cuckoo rule

• Only works for any sequence of rejoin requests of adversarial peers.

• Does not work for any sequence of rejoin requests.

Local Load Balancing

• Works quite effectively to maintain overlay network if all peers are honest [KSW05]

Random Filling/Flipping

• Fill position of leaving peer with random peer• Flip k/n-region of leaving peer with random k/n-region

Random-Neighbor-Flipping

• Flip random among c log n neighboring k/n-regions with random k/n-region

flip

Analysisdifficult!

k-cuckoo&flip rule

• Join: as before (k-cuckoo rule)

• Leave: random k/n-region among c log n neighboring

k/n-regions, empty & flip it with random k/n-region

n honest n adversarial

flip

Rejoin viak-cuckoo rule

Main Result

Theorem: For any constants and k with <1/4-(2 log k+1)/k, the cuckoo&flip rule satisfies the balancing and majority conditions for a poly number of rejoin requests, w.h.p.

Proof:via several worst-case high-concentration results for honest and adversarial peers

Conclusions

Algorithmic solutions are possible to counter join-leave attacks with constant factor overhead

Concurrent join-leave operations: fine with rate limit enforced by peers

Massive departure of adversarial peers: not a problem due to balancing condition

Conclusions

Problem: strategy is high-level and only covers legal attacks on overlay network (resp. DoS attacks on one honest node at a time)

Low-level protocols:• Most critical issue is random number gen.• Low-level protocol for that in [AS06b]

(works – unlike VSS - for public channels)

Conclusions

Problem: strategy is high-level and only covers legal attacks on overlay network (resp. DoS attacks on one honest node at a time)

Illegal attacks:• Biggest problem low-level DoS attacks• Only oblivious or relatively weak adaptive

attackers can be handled so far

Questions?