Gie robust Operatios Ad Adersarial Strategies

Transcription

1 Perforace ealuatio of large-scale dyaic systes Eauelle ceaue, Roaric Ludiard, Bruo ericola To cite this ersio: Eauelle ceaue, Roaric Ludiard, Bruo ericola. Perforace ealuatio of largescale dyaic systes. CM IGMETRIC Perforace Ealuatio Reiew, CM, 2012, 39 (4), pp < / >. <hal > HL Id: hal ubitted o 30 ep 2012 HL is a ulti-discipliary ope access archie for the deposit ad disseiatio of scietific research docuets, whether they are published or ot. The docuets ay coe fro teachig ad research istitutios i Frace or abroad, or fro public or priate research ceters. L archie ouerte pluridiscipliaire HL, est destiée au dépôt et à la diffusio de docuets scietifiques de ieau recherche, publiés ou o, éaat des établisseets d eseigeet et de recherche fraçais ou étragers, des laboratoires publics ou priés.

2 Perforace Ealuatio of Large-scale Dyaic ystes Eauelle ceaue IRI / CNR Rees, Frace eauelle.aceaue@irisa.fr Roaric Ludiard INRI Rees Bretage-tlatique Rees, Frace roaric.ludiard@iria.fr Bruo ericola INRI Rees Bretage-tlatique Rees, Frace bruo.sericola@iria.fr BTRCT I this paper we preset a i-depth study of the dyaicity ad robustess properties of large-scale distributed systes, ad i particular of peer-to-peer systes. Whe desigig such systes, two ajor issues eed to be faced. First, populatio of these systes eoles cotiuously (odes ca joi ad leae the syste as ofte as they wish without ay cetral authority i charge of their cotrol), ad secod, these systes beig ope, oe eeds to defed agaist the presece of alicious odes that try to subert the syste. Gie robust operatios ad adersarial strategies, we propose a aalytical odel of the local behaior of clusters, based o Marko chais. This local odel proides a ealuatio of the ipact of alicious behaiors o the correctess of the syste. Moreoer, this local odel is used to ealuate aalytically the perforace of the global syste, allowig to characterize the global behaior of the syste with respect to its dyaics ad to the presece of alicious odes ad the to alidate our approach. 1. INTRODUCTION The adoptio of peer-to-peer oerlay etworks as a buildig block for architectig Iteret scale systes has firstly raised the attetio of akig these systes resiliet to odes-drie dyaics. This dyaics that represets the propesity of thousads or illios of odes to cotiuously joi ad leae the syste, ad which is usually called chur if ot efficietly aaged, quickly gies rise to dropped essages ad data icosistecy, ad thus to a icreasig latecy ad badwidth due to repairig echaiss. The other fudaetal issue faced by ay practical ope syste is the ieitable presece of alicious odes [1, 2, 3]. Guarateeig the lieess ad safety of these systes requires their ability to self-heal or at least to self-protect agaist this adersity. Malicious odes ca deise coplex strategies to subert the syste. I particular these attacks aied at exhaustig key resources of hosts (e.g., badwidth, CPU processig, TCP coectio resources) to diiish their capacity to proide or receie serices [4]. Differet approaches hae bee proposed to face adersarial settig, each oe focusig o a particular adersary strategy. Regardig eclipse attacks, a ery coo techique, called costraied routig table, relies o the uiqueess ad ipossibility of forgig odes idetifiers. It cosists i selectig eighbors based o their idetifiers so that all of the are close to soe particular poits i the idetifier space [1]. uch a approach has bee ipleeted ito seeral oerlays (e.g., [5, 6, 7]). To preet essages fro beig isrouted or dropped, the seial works o routig security by Castro et al. [1] ad it ad Morris [8] cobie routig failure tests ad redudat routig as a solutio to esure robust routig. Their approach has the bee successfully ipleeted i differet structured-based oerlays (e.g., [9, 10, 11]). Howeer all these solutios assue that alicious odes are uiforly distributed i the syste. ctually, alicious odes ay cocetrate their power to attack soe regio of the oerlay [12, 13]. These targeted attacks require additioal echaiss to be tolerated or at least to be cofied. ctually, it has bee show [14] that structured oerlays caot surie targeted attacks if the adersary ay keep sufficietly log its alicious peers at the sae positio i the oerlay. Ideed, oce alicious peers hae succeeded i sittig i a focused regio of the oerlay, they ca progressiely gai the quoru withi this regio by siply waitig for hoest peers to leae their positio, leadig to the progressie isolatio of hoest peers. The two fudaetal properties that preet peers isolatio are the guaratee that the distributio of peers idetifiers is rado, ad that peers caot stay foreer at the sae positio i the syste [12]. I the preset work, we preset a i-depth study of the dyaic ad robustess aspects of large-scale distributed systes. We iestigate adersarial strategies that ai at isolatig hoest odes i cluster-based oerlays. We propose a aalytical odel of the local behaior of clusters, based o Marko chais. This local odel proides a ealuatio of the power of alicious behaiors. We use this local odel to ealuate aalytically the perforace of the global syste, allowig to characterize the global behaior of the syste with respect to its dyaics ad to the presece of alicious odes ad the to alidate our approach. Our aalysis shows that i) by gatherig odes i clusters, ii) by preetig odes to stay ifiitely log at the sae positio i the oerlay ad iii) by itroducig radoess i the operatios of the oerlay, the ipact of the adersary o the cluster correctess is ery liited. I particular we show that the adersary has o icetie to trigger topological operatios o the syste which cofies its ipact o particular regios of the syste. The curret work exteds the study doe i [13], where the focus was placed o the local behaior of a cluster rather tha o the global behaior of the syste as doe i the preset work. pecifically, [13] studies accordig to differet leels of adersity i the cluster, the ipact of radoized operatios o the tie spet by a cluster i safe ad corrupted states, ad o the proportio of clusters that split or 1

3 erge i a safe or corrupted state. The ai lessos draw fro that study is that a sall aout of radoizatio is sufficiet to defed agaist alicious odes, ee whe they collude together to icrease their power. This result is iterestig because it otably decreases the coplexity of the oerlay operatios. The reaider of this paper is as follows: I ectio 2, we briefly preset the ai features of structured based oerlays. I ectio 3 we preset a aalytical odel of the local behaior of a cluster based o Marko chais. ectio 4 uses this odel to ealuate the perforace of the global oerlay. This aalysis is applied to a large scale dyaic syste preseted i ectio 5. ectio 6 cocludes. 2. CLUTER-BED YTEM 2.1 elf-orgaizatio of Nodes We cosider a dyaic syste populated by a large collectio of odes i which each ode is assiged a uique ad peraet rado idetifier fro a -bit idetifier space. Node idetifiers (siply deoted ids i the followig) are deried by applyig soe stadard strog cryptographic hash fuctio o odes itrisic characteristics. The alue of (160 for the stadard H1 hash fuctio) is chose to be large eough to ake the probability of idetifiers collisio egligible. Each applicatio-specific object, or data-ite, of the syste is assiged a uique idetifier, called key, selected fro the sae -bit idetifier space. Each ode p ows a fractio of all the data ites of the syste. The syste is subject to chur, which is classically defied as the rate of turoer of odes i the syste [15]. For scalability reasos, each ode locally kows oly a sall set of odes existig withi the syste. This set is typically called the ode s local iew or the ode s eighborhood. The particular algorith used by odes to build their local iew ad to route essages iduces the resultig oerlay topology. tructured oerlays (also called Distributed Hash Tables (DHTs)) build their topology accordig to structured graphs (e.g., hypercube, torus). pecifically, odes self-orgaize withi the structured graph accordig to a distace fuctio D based o their ids, plus possibly other criteria such as geographical distace. Fially, the appig betwee odes ad data deries fro the sae distace fuctio D. I cluster-based oerlays, clusters of odes substitute for odes at the ertices of the structured graph. Each ertex of the structured graph is coposed of a set or cluster of odes. Clusters i the oerlay are uiquely idetified. Cluster size s eoles accordig to joi ad leae eets. Howeer for robustess ad scalability reasos, s is both lower ad upper bouded. The lower boud i satisfies soe costrait based o the assued failure odel, while the upper boud ax is typically i O(log N) where N is the curret uber of odes i the oerlay. Nodes joi the clusters accordig to distace D. For istace i PeerCube [10], p jois the (uique) cluster whose idetifier is a prefix of p s idetifier. Oce a cluster size exceeds ax, this cluster splits ito two saller clusters, each oe populated with the odes that are closer to each other accordig to distace D. Nodes ca freely leae their cluster. Oce a cluster udershoots its iial size i, this cluster erges with the closest cluster i its eighborhood. I the followig we assue that joi ad leae eets hae a equal chace to occur i ay cluster. 2.2 Malicious Behaiors We assue the presece of alicious odes (also called Byzatie odes i the distributed coputig couity) that try to subert the whole syste by exhibitig udesirable behaiors [8, 16]. I our cotext this aout to deisig strategies to take the cotrol of clusters so that all the queries that go through these cotrolled clusters ca be deiated toward alicious odes (this refers to eclipse attacks [1, 8]), ad all the data objects stored at these clusters ca be aipulated. They ca agify their ipact by colludig ad coordiatig their behaior. We odel these strategies through a strog adersary that cotrols these alicious peers. strog adersary is a adersary allowed to deiate arbitrarily far fro the protocol specificatio. We assue that the adersary has large but bouded resources i that it caot cotrol ore tha a fractio µ (0 < µ < 1) of alicious odes i the whole etwork. Note that i the followig we ake a differece betwee the whole syste ad the oerlay. The syste U ecopasses all the odes that at soe poit ay participate to the oerlay (i.e, U cotais up to 2 odes), while the oerlay N cotais at ay tie the subset of participatig odes (i.e, N size is equal to N 2 ). Thus, while µ represets the assued fractio of alicious odes i U, the goal of the adersary is to populate the oerlay with a larger fractio of alicious odes i order to subert its correct fuctioig. Fially, a ode which always follows the prescribed protocols is said to be hoest. Note that hoest odes caot a priori distiguish hoest odes fro alicious oes. 2.3 Operatios of the Oerlay Fro the applicatio poit of iew, two key operatios are proided by the syste: the joi operatio that eables a ode to joi the closest cluster i the syste to itself accordig to distace D, ad the leae operatio, idicatig that soe ode leaes its cluster. Note that other operatios are also proided to the applicatio (e.g., the lookup(k) operatio that eables a ode to search for key k, ad the put(x) operatio, which allows it to isert data x i the syste), howeer they hae o ipact o the dyaic of the syste ad a ior oe o its robustess. Thus we oly cocetrate o aalyzig ad ealuatig the dyaics ad robustess of the syste through the joi ad leae operatios. Now, fro the topology structure poit of iew, two operatios ay result i a topology odificatio ad thus ust be take ito accout to ealuate the dyaics of the syste, aely the split ad the erge operatios. Whe the size of a cluster exceeds ax, this cluster splits ito two ew clusters, ad whe the size of a cluster goes below i, this cluster erges with other clusters to guaratee the cluster resiliecy. Note that for robustess reasos, a cluster ay hae to teporarily exceed its axial size ax before beig able to split ito two ew clusters. This guaratees that resiliecy of both ew clusters is et, i.e., both clusters sizes are at least equal to i. For the tie beig, we do ot eed to go further ito the details of these operatios, howeer ectio 5 will precise the. 3. MODELING THE CLUTER BEHVIOUR We odel the effect of joi ad leae eets i a cluster usig a hoogeeous discrete-tie Marko chai deoted by X {X, 0}. Marko chai X represets the eolutio of the uber of hoest ad alicious odes i 2

4 the cluster. The ipact of alicious odes o the cluster correctess is applicatio depedet. For istace a ecessary ad sufficiet coditio to preet agreeet aog a set of odes is that strictly ore tha a third of the populatio set is alicious [17]. I this ectio, the coditios uder which cluster correctess holds are luped i predicate correct. This predicate will be explicit i ectio 5 where the applicatio is described. Thus we defie the state of a cluster as safe if predicate correct holds, while it is defied as attacked otherwise. Marko chai X alterates betwee the set of all the safe states, deoted by, ad the set of all the attacked states, deoted by, util eterig the absorbig state (cf. Figure 1). This state, deoted by a, represets the logical disappearace of a cluster fro the graph. This occurs whe the cluster either splits ito two a saller clusters (i.e., it has reached its axial size ax) or erges with its 1 closest eighbor (i.e., it has reached its iial Figure 1: ggregated iew size i). of Marko chai X. The trasitio atrix of X, deoted by P, is partitioed with respect to the decopositio of the state space Ω a ( P P P a ) P P P P a where P UV is the sub-atrix of diesio U V cotaiig the trasitios fro states of U to states of V, with U, V {,, a}. We siply write P U for P UU. I the sae way, the iitial probability distributio α is partitioed by writig α (α α α a), where α a 0 ad the sub-ector α U cotais the iitial probabilities of states U {, }. 4. MODELING THE OVERLY NETWORK 4.1 Notatios We cosider a oerlay populated with clusters deoted by D 1,..., D ad subject to joi ad leae eets. Each cluster D i ipleets the sae joi, leae, split ad erge operatios. We assue that joi ad leae eets are uiforly distributed throughout the oerlay. pecifically, whe a joi or leae eet occurs i the oerlay it affects cluster D i with probability p i 1/. Thus we cosider, for 1, Marko chais X (1),..., X () idetical to X, i.e., with the sae state space Ω, the sae trasitio probability atrix P ad the sae iitial probability distributio α. Howeer these chais are ot idepedet sice, at each istat, oly oe Marko chai, chose with probability 1/, is allowed to ake a trasitio. We deote by N () () () ad N () the respectie uber of safe ad polluted clusters just after the -th joi or leae eet, i.e., the respectie uber of Marko chais that are i set ad i set at istat. More forally, these rado ariables are defied, for 0, by N () () h1 () 1 (h) {X ad N } () h1 1 {X (h) }, where otatio 1 {} represets the idicator fuctio, which is equal to 1 if coditio is true ad 0 otherwise. We deote by 1 (resp. 1 ) the colu ector of diesio whose ith etry is equal to 1 (resp. 0) if i ad 0 (resp. 1) if i. We deote by T the sub-atrix of P cotaiig the trasitios betwee the states of, i.e., the atrix obtaied fro P by reoig the row ad the colu correspodig to the absorbig state a. The diesio of T is thus. Fially, we defie α T (α α ). I [13], we studied the expectatios of both rado ariables N () () ad N () (). I what follows we focus o their joit distributio. 4.2 Focus o the First Topological Chage We study the eolutio of the Marko chais i the set of safe states ad i the set of polluted states at tie respectiely whe oe of the Marko chais are absorbed at tie. For 0,...,, we are iterested i the probability () defied by p () p () () P{N () () (), N () }, which represets the probability that Marko chais are i polluted states at tie ad oe of the Marko chais are absorbed at tie. For eery 0 ad l 1, we defie the set,l as,l { ( 1,..., l ) N l l }. The probability p () () is gie by the followig theore where, as usual, we take as coetio that a epty product is equal to 1. We itroduce the otatio ad q (k) P{X k } α T T k 1 q (k) P{X k } α T T k 1. Theore 1. For eery 0 ad 0,...,, we hae p () () (1) 1! q ( r) q ( r)., 1!! r1 r+1 Proof. We itroduce the set H {1,..., } ad, for 0,...,, the set H() of all subsets of H with eleets, i.e. H() {C H C }. It is easily checked that H(). With this otatio, we hae p () () P{X (r) r C, X (r) r H\C}. C H() The probability ass distributio, used to choose at each istat the Marko chai that has to do a trasitio, beig uifor, all the probabilities i the aboe su are equal. We thus hae, by takig C {1,..., } ad usig Theore 3

5 1 of [18], p () () P{X (1) 1,..., X ()!, 1!! which copletes the proof., X (+1) q ( r) r1,..., X () } r+1 q ( r), Theore 2 gies a recurrece relatio to copute the probabilities p () () with a polyoial coplexity. Theore 2. For eery 0,..., 1, we hae p () () ( 1 l ad, for, ( p () () l ) ( 1 ) l ( 1 1 ) l q (l)p ( 1) ( l), ) l ( 1 1 ) l q (l)p ( 1) 1 ( l). Proof. Extractig i the su (1) the idex, reaig it l ad usig Theore 1 for itegers 1 ad l, we get, for 0,..., 1, p () () 1 q (l) l ( l)! 1 q ( r) q ( r) 1! 1! r1 r+1 ( 1) l q (l) ( l 1 ) p ( 1) ( l) l ( ) l q (l)p ( 1) ( l). l l, 1 1 The secod part of the proof is obtaied siilarly. Let Θ be the first istat at which oe of the Marko chais X (1),..., X () gets absorbed. This rado ariable is defied by Θ if{ 0 r such that X (r) a}. The rado ariable Θ has bee studied i [18]. I particular we hae show that its distributio is gie for eery k 0 ad u 1,..., 1 by P{Θ > k} k k ( u l ) l ( 1 u ) k l P{Θ u > l}p{θ u > k l}. By takig 2 ad u 2 1, we hae P{Θ 2 > k} 1 k k P{Θ 2 k l 2 1 > l}p{θ 2 1 > k l}. (2) Relatio (2) is particularly iterestig for ery large alues of. Ideed, the coplexity for the coputatio of the distributio ad the expectatio of Θ is i O(log 2 ). Note also that this relatio ca be split ito 2 idetical sus plus the cetral ter correspodig to l k/2 whe k is ee. We study here the expected uber of Marko chais which are i a safe state ad i a attacked state at tie respectiely whe oe of the Marko chais are absorbed at tie. The quatity E(N () ()1 {Θ >}) is the expected uber of Marko chais that are i a safe state at tie, for Θ >. I the sae way, we defie the expected alue E(N () ()1 {Θ >}) for attacked states. Reark that, for eery 0,...,, we hae (N () () () (), N () ) (N (), Θ > ). Usig this reark, we obtai the followig result. Theore 3. For eery 0, we hae E(N () ()1 {Θ >}) (3) l ( ) l q (l)p{θ 1 > l}. l E(N () ()1 {Θ >}) (4) l ( ) l q (l)p{θ 1 > l}. l Proof. Fro the preious reark, we get E(N () ()1 {Θ >}) P{N () (), Θ > } p () () 1 ( )p () (). Usig the first relatio of Theore 2, this leads to E(N () ice ()1 {Θ >}) l ( ) l 1 q (l) p ( 1) ( l). l 1 p ( 1) 0 ( l) P{Θ 1 > l, N () ( l) 1 } P{Θ 1 > l}, we get the desired result. Relatio (4) is obtaied usig the sae lies. It has bee show i [18] that for all k 0 li P{Θ > k} (αt T 1)k 4

6 where 1 is the colu ector cotaiig oly oes with appropriate diesio deteried by the cotext. Usig this result ad Relatios (3) ad (4) we get li li E(N () ()1 {Θ >}) q (0)(α T T 1) α 1(α T T 1) E(N () ()1 {Θ >}) q (0)(α T T 1) α 1(α T T 1). 5. PPLICTION Iteret growth i recet years has otiated a icreasig research i peer-to-peer systes to ipleet differet applicatios such as file sharig, large scale distributio of data, streaig, ad ideo-o-dead. ll these applicatios share i coo large data ad the ecessity of durable access to the. Ipleetig these applicatios oer a peer-to-peer syste allows to potetially beefit fro the ery large storage space globally proided by the ay uused or idle achies coected to the etwork. This has led for the last few years to the deployet of a rich uber of large scale storage architectures. Typically, reliable storage aouts to replicatig data sufficietly eough so that despite adersarial behaiors replicas are still reachable. Gie the specificities of the P2P paradig, the replicatio schea ust guaratee a low essage oerhead (oe caot afford to store ay copies of ery large origial data), ad low badwidth requireets (upo upredictable joi ad leae of odes it is eetually ecessary to recreate ew copies of the data to keep a certai uber of replicas). Rateless erasure codig [19, 20, 21] (also called Foutai codig) eets these costraits. pecifically, a object is diided ito k equal size fragets, ad recoded ito a potetially uliited uber of idepedet check blocks. Fudaetal property of erasure codig is that oe ay recoer a iitial object by collectig k distict check blocks geerated by differet sources, with k k(1 + ɛ) with ɛ arbitrarily sall. We propose to take adatage of cluster-based oerlays to store these check blocks. pecifically, each of these pieces of data is assiged a uique idetifier, called key, selected fro the sae -bit idetifier space as odes oe (cf. ectio 2). Each piece of data o is the disseiated to the cluster D i whose label is closer to o key. To take adatage of the atural redudacy preset i each cluster while efficietly hadlig the chur of the syste, the populatio of each cluster is orgaized ito two sets: the core set ad the spare set. Mebers of the core set are priarily resposible for hadlig essages routig, ad clusters operatios. Maageet of the core set is such that its size is aitaied to costat i. This costat is defied accordig to the assued proportio of alicious odes i the syste. pare ebers are the copleet uber of odes i the cluster. ize s of the spare set is such that 0 s ax i. For scalability reasos, ax is i O(log N) where N is the curret uber of odes i the oerlay. I cotrast to core ebers, spare ebers are ot ioled i ay of the oerlay operatios, howeer they are i charge of data storage. To hadle alicious behaiors, robust joi, leae, split ad erge operatios are desiged as detailed i ectio 5.1. I additio to robust operatios, we propose to liit the lifetie of ode idetifiers ad to radoize their coputatio. This is achieed by addig a icaratio uber t 0 to the fields that appear i the ode certificate (certificates are acquired at trustworthy Certificatio uthorities (Cs)), ad by hashig this certificate to geerate the iitial ode idetifier id 0. The icaratio uber liits the lifetie of idetifiers ad thus the positio of the odes i the oerlay. The curret icaratio k of ay ode p ca be coputed as k (t t 0)/l, where t is the curret tie, ad l is the legth of the lifetie of each ode icaratio. Thus, the k th icaratio of ode p expires whe its local clock reads t 0 + kl. t this tie p ust rejoi the syste usig its (k + 1) th icaratio. By the properties of hash fuctios, this guaratees that odes are regularly pushed toward upredictable ad rado positios of the oerlay. t ay tie, ay ode ca check the alidity of the idetifier of ay other ode q i the syste, by siply calculatig the curret icaratio k of q ad geeratig the correspodig idetifier. This leads to the followig property. Property 1 (Liited ojour Tie). Let D i be soe cluster of the syste ad p soe peer i the oerlay. The q belogs to D i at tie t if ad oly if id q atches the label of D i accordig to distace D (we say that q is alid for D i). 5.1 Robust Operatios To protect the syste agaist the presece of alicious odes i the oerlay, we propose to take adatage of odes role separatio at cluster leel to desig robust operatios. Briefly, the joi operatio is desiged so that brute force deial of serice attacks are discouraged. The Leae operatio ipedes the adersary fro predictig what is goig to be the copositio of the core set after a gie sequece of joi ad leae eets triggered by its alicious odes. Fially, as both erge ad split operatios iduce topological chages i the oerlay, ad ore iportatly ay hae a ifluece o the subset of the idetifier space the adersary ay gai cotrol oer 1, these operatios hae bee desiged so that the adersary has, i expectatio, o iterest to trigger the. pecifically, these four operatios ake up the oerlay protocol ad are specified as follows joi(p): whe a ode p jois the syste, it jois the spare set of the closest cluster i the syste (accordig to distace D). Core ebers of this cluster update their spare iew to reflect p s isertio (ote that the spare iew update does ot eed to be tightly sychroized at all core ebers). leae(p): Whe a ode p leaes a cluster either p belogs to the spare set or to the core set. I the forer case, core ebers siply update their spare iew to reflect p s departure, while i the latter case, the core iew aiteace procedure is triggered. This procedure cosists i replacig p with oe ode radoly chose fro the spare set. split(d i): whe a cluster D i has reached the coditios to split ito two saller clusters D j ad D k, core sets of both D j ad D k are built. Priority is gie 1 Ideed, a erge operatio doubles the subset of the idetifier space a cluster is resposible for, while a split operatio diides it per two. 5

7 (s, x, y) 0 < s < p j p l 1 {x>c} 1{x c} 1 p c p c 1 {s>1} 1 {s1} 1 {s< 1} 1 {s 1} (s,x,y) (s+1,x,y) 1 p p (s+1,x,y+1) (s-1,x,y) 1-p s p s (s,x,y) d y 1-d y (s-1,x,y-1) 1 {x>c} 1 {x c} 1-p c p c (s,x,y) d x 1-d x p (s+1,x,y+1) (s,x,y) 1-p p (s+1,x,y+1) 1-p (s+1,x,y) (s-1,x+1,y-1) 1 {y>0} 1 {y0} p s (s-1,x,y) (s-1,x+1,y-1) 1 ps (s-1,x,y) 1 {x 1 c} 1 {x 1>c} p s 1 ps 1 {y0} 1 {y>0} (s-1,x+1,y-1) (s-1,x,y) (s-1,x-1,y) (s-1,x,y-1) Probabilities Value Meaig of the probability µ ratio of Byzatie peers i the uierse U ax axial size of a cluster i size of the core set of a cluster ( i is a syste paraeter) ax i s curret size of the spare set x uber of alicious peers i the spare set y uber of alicious peers i the core set d probability that the lifetie of a gie peer idetifier has ot expired (per uit of tie) p j (resp. p l ) 1/2 joi (resp. leae) eet probability p c i/( i + s) probability for a peer to belog to the cluster core set p µ probability that the joied peer is alicious p c x/ i probability for a core eber to be alicious p s y/s probability for a spare eber to be alicious 1 d x probability that Property 1 is satisfied i the core set durig oe uit of tie 1 d y probability that Property 1 is satisfied i the spare set durig oe uit of tie 1 {} 1 if coditio is true, 0 otherwise represets the idicator fuctio Figure 2: Trasitio diagra for the coputatio of the trasitio probability atrix P. 6

8 to core ebers of D i ad copletio is doe with radoly chose spares i D i. This rado choice is hadled through a Byzatie-tolerat cosesus ru aog core ebers of D i. pares ebers of D j (resp. D k ) are populated with the reaiig spares ebers of D i that are closer to D j tha to D k (resp. closer to D k tha to D j). erge(d j, D k ): whe soe cluster D j has reached the coditios to erge (i.e., its spare set is epty), it erges with the closest cluster D k to D j. The created cluster D i is coposed by a core set whose ebers are the core set ebers of D k ad by a spare set whose ebers are the uio of the spare ebers of D k ad the core set ebers of D j. 5.2 pecificatio of the dersarial Behaior Based o the operatios described here aboe, we iestigate how alicious odes could proceed to coproise clusters correctess. Correctess of ay cluster D i is jeopardized as soo as D i core set is populated by ore tha a quoru c of alicious odes where c ( i 1)/3. s a cosequece of assigig a iitial uique rado ode id to odes ad of periodically pushig the to rado regios i the oerlay, the strategy of the adersary to icrease the global represetatio of alicious idetifiers is a cobiatio of the followig two actios axiizig the uber of alicious odes that sit i the whole oerlay, ad iiizig the likelihood that ay attacked cluster D i switches back to a safe state. Note that there is a trade-off betwee these two strategies. Ideed, while i the forer case, the adersary ais at triggerig as ay joi operatios as possible for its alicious odes to be preset ito the clusters, i the latter case, the adersary has o iterest to let clusters grow i such a way that these clusters will udergo a split operatio (cf. ectio 5.1). Ideed, the outcoe of a split operatio caot icrease the subset of idetifiers space the adersary has gaied cotrol oer at best, it keeps it the sae. Thus whe a attacked cluster D i is close to split, the adersary does ot trigger ayore alicious joi operatios that would lead alicious odes to joi D i, ad preets hoest odes fro joiig D i wheeer the size s of the spare set satisfies s > 1. This guaratees that D i will ot grow because of hoest peers, while iiizig the likelihood that D i udergoes a erge operatio as well. The reaso is that by costructio of the erge operatio (cf. ectio 5.1), whe D i triggers a erge operatio with its closest eighbor the all the ebers of D i are pushed to the spare set of the ew created cluster which clearly deters the adersary fro triggerig erge operatios. This leads to the followig rule Rule 1 (dersarial Joi trategy). Let D i be a cluster such that at tie t its core set cotais l > c alid alicious odes. y joi eet issued by ode q ad receied at D i at tie t is discarded if (q is hoest ad s > 1) or (s ax i 1). To suarize, the strategy of the adersary is to axiize the whole subset of the idetifiers space it has gaied cotrol oer. This is achieed by first eer askig its alicious peers to leae their cluster except if Property 1 does ot hold, ad secod by haig the axial uber of alicious peers joi the syste except if Rule 1 holds. 5.3 Modelig the Eolutio of the Cluster We ca ow istatiate Marko chai X {X, 0} (itroduced i ectio 3), with the specificities of our applicatio cotext. pecifically, for 1, the eet X (s, x, y) represets the state of a cluster after the -th trasitio (i.e., the -th joi or leae eet), so that the size of the spare set is equal to s, the uber of alicious peers i the core set is equal to x ad the uber of alicious peers i the spare set is equal to y. The state space Ω of X is defied by Ω {(s, x, y) 0 s, 0 x i, 0 y s}, where ax i. Predicate correct holds iff x c. The subset of safe states is defied by {(s, x, y) 0 < s <, 0 x c, 0 y s}, while the subset of attacked states is defied by {(s, x, y) 0 < s <, c + 1 x i, 0 y s}. Coputatio of trasitio atrix P is illustrated i Figure 2. I this tree, each edge is labelled by a probability ad each leaf represets the state of the cluster. This figure shows all the states that ca be reached fro state (s, x, y) ad the correspodig trasitio probabilities. Trasitio probabilities deped o i) the type of eet that occurs (joi or leae eet fro the core or the spare set), ii) the type of odes ioled i this operatio (hoest or alicious), ad iii) the ratio of alicious odes already preset i the core set. The probability associated with each oe of these states is obtaied by suig the products of the probabilities discoered alog each path startig fro the root to the leaf correspodig to the target state. For istace, the brach o the ery right of the tree correspods to the situatio i which cluster D i is attacked ad oe of its alicious core eber p is o ore alid. By Property 1, p leaes D i, howeer as D i is attacked, the adersary bias the core aageet procedure by replacig p with aother alicious peer fro D i spare set. tate (s 1, x, y 1) is reached. Modelig ad coputatio of Property 1 is as follows. Let d be the probability (per uit of tie) that the liited lifetie of soe peer p has ot expired. Hece d is hoogeeous to a frequecy, ad d t represets the probability that the lifetie of a gie peer idetifier has ot expired durig t uits of tie. The the probability that for all the peers belogig to a set of size z Property 1 holds is equal to d z. 5.4 Iitial Distributios I the experiets coducted for this work, we cosider two iitial probability distributios. The first oe, deoted by α (1), is such that the cluster starts fro a edia size ad fro a failure free state. Naely, { 1 if (s, x, y) ( (s,x,y), 0, 0) 2 0 otherwise. α (1) The secod probability distributio, deoted by α (2), is such that the cluster starts fro a edia size ad the uber of alicious odes i both the core ad spare sets follow a bioial distributio. We hae α (2) (s,x,y) ( i ) x µ x (1 µ) i x s y µ y (1 µ) s y for (, x, y) 2 0 otherwise. 7

9 P {Θ > } , α α (1) 512, α α (1) 1024, α α (1) 2048, α α (1) 4096, α α (1) 256, α α (2) 512, α α (2) 1024, α α (2) 2048, α α (2) 4096, α α (2) P {Θ > } , α α (1) 512, α α (1) 1024, α α (1) 2048, α α (1) 4096, α α (1) 256, α α (2) 512, α α (2) 1024, α α (2) 2048, α α (2) 4096, α α (2) Nuber of Eets (a) i 7, ax 14, ad d 30% Nuber of Eets (b) i 10, i 20, ad d 30% P {Θ > } 1.0 d0%, α α (1) d30%, α α (1) d50%, α α (1) d90%, α α (1) d99.9%, α α (1) d0%, α α (2) d30%, α α (2) d50%, α α (2) d90%, α α (2) d99,9%, α α (2) P {Θ > } 1.0 d0%, α α (1) d30%, α α (1) d50%, α α (1) d90%, α α (1) d99.9%, α α (1) d0%, α α (2) d30%, α α (2) d50%, α α (2) d90%, α α (2) d99,9%, α α (2) Nuber of Eets (c) i 7, ax 14, ad Nuber of Eets (d) i 10, ax 20, ad 4096 Figure 3: P{Θ > } (Relatio (2)) as a fuctio of,, d ad for the two iitial distributios α (1) ad α (2) 5.5 Experietal Results I the reaiig of this ectio, experiets are coducted with a proportio µ 25% of alicious odes i the syste (cf. ectio 2), a core set size i {7, 10}, a axial cluster size ax {14, 20}, ad a uber of clusters {256,..., 4096}. Regardig the sojour tie d of odes, it aries fro 0% (odes hae to leae whe they are asked to do so) to 99.9% (odes ca stay alost ifiitely log at the sae positio i the syste, ee if they receie a request to leae). We first show i Figure 3 the distributio of the first istat at which oe of the Marko chais gets absorbed as a fuctio of, for differet alues of, ad startig fro differet iitial states. I Figure 3(a), i 7 ad ax 14, which gies a uber N of odes i the syste aryig i [1792, 57344], while i Figure 3(b), i 10 ad ax 20 leadig to N [2560, 81920]. I both Figures 3(a) ad 3(b), the distributio of Θ is plotted for the two iitial distributios α (1) ad α (2) ad the sojour tie d of odes is set to 30%. s expected, the total uber of joi ad leae eets that eed to be triggered before the first cluster splits or erges icreases with the size of the syste. This is easily explaied by the fact that eets are uiforly distributed oer the clusters ad thus the probability for a eet to reach a particular cluster decreases as the syste size grows. The secod obseratio cocers the ery low ipact of the iitial probability distributio o the distributio of Θ. This result, while ituitiely surprisig, is justified by the fact that d is relatiely sall (d 30%) which preets alicious odes fro stayig ifiitely log i the sae cluster. Cosequetly, the atural chur of the syste oerpasses the ifluece of alicious odes. Fially, by coparig both Figures 3(a) ad 3(b), we obsere that a sall icrease i (i.e., fro 7 to 10) sigificatly augets the first istat at which the first topological chage occurs (i.e., a split or erge operatio), which is ery iterestig because it proides a trade-off betwee the cost iplied by the aageet of core sets ad the oe iplied by topological operatios. deeper iestigatio ito the ifluece of the iitial distributio α o the distributio of Θ is show i Figures 3(c) ad 3(d). The first reark is that for α α (1) all the cures obtaied for the differet alues of d coicide, eaig that ee if alicious odes ay take adatage of loger sojour ties i the sae cluster, it takes too uch tie for the to successfully attack the cluster (due to the desig of the robust joi ad leae operatios), ad thus they caot preet the cluster fro splittig ad/or ergig i respose to the atural chur of the syste (cf. ectio 5.1). Now for α α (2), the ipact of d o the distributio of Θ() is 8

10 1.0 d0% d30% d50% d90% d99.9% 1.0 d0% d30% d50% d90% d99.9% E(N () ()1 {Θ>})/ E(N () ()1 {Θ>})/ Nuber of Eets Nuber of Eets (a) i 7, ax 14, ad α α (1) (b) i 10, ax 20, ad α α (1) 0.7 d0% d30% d50% d90% d99.9% 0.7 d0% d30% d50% d90% d99.9% E(N () ()1 {Θ>})/ E(N () ()1 {Θ>})/ Nuber of Eets Nuber of Eets (c) i 7, ax 14, ad α α (2) (d) i 10, ax 20, ad α α (2) Figure 4: E(N () ()1 {Θ>} ) as a fuctio of ad d. ll these experiets are ru with 4097 clusters sigificat. Ideed, as clusters start fro a failure-proe state, this helps the adersary i reachig ore quickly a attacked state, ad thus i preetig topological chages fro occurrig. Figure 4 depicts the expected proportio of safe clusters after the -th trasitio for a large uber of clusters ( 4096), for a sojour tie d aryig fro 0% to 99.9%, ad for both iitial distributios α. Let us obsere first that whe α α (1) (cf. Figures 4(a)) ad 4(b)), the expected proportio of safe clusters is ery high, ee for ery large alues of d. This result cobied with the preious obsered oes cofirs the ipact of the joi ad leae operatios o the icapability of the adersary to attack clusters before the first topological chage. Ideed, additioal graphs (ot show here for space reasos) show that the expected proportio of attacked clusters is ery close to 0% which is alidated by the relatio E(N () ()1 {Θ>} ) + E(N () ()1 {Θ>} ) P{Θ > }. Now, whe clusters start i a failure-proe state, i.e., α α (2), Figures 4(c) ad 4(d) first show that the iitial proportio of safe clusters is equal to 75% (which is i accordace with the iitial proportio µ of alicious odes i the syste). ecod, if we copare the cures got with α α (1) ad with α α (2) i presece of a ery low iduced chur (i.e., d 90%), the we obsere that for a gie, the expected proportio of safe clusters is larger whe the syste starts fro a failureproe eiroet (i.e., α α (2) ) tha whe it starts fro a failure-free oe. While first itriguig, this result is explaied by the fact that the populatio of alicious odes is iitially larger ad as oe of the leae eets requested for the gie rise to the correspodig leae operatios, a larger uber of eets eed to be triggered before the first cluster splits or erges. This is a ery iterestig result as it says that cobiig robust operatios with a ery low aout of iduced chur is sufficiet to keep the clusters i a safe state despite the presece of a large proportio of alicious odes. Fially, ad siilarly to Figure 3, icreasig (as show i Figures 4(b) ad 4(d)) augets sigificatly the tie before the first split or erge operatio occurs. 6. CONCLUION I this paper we hae iestigated the power of alicious odes i their capability to subert large scale dyaic systes. Gie a adersarial objectie, here axiizig the whole subset of the idetifier space alicious odes succeed i takig cotrol oer, we hae aalytically ealuated the tie (i ters of joi ad leae triggered eets) it takes for the adersary to corrupt part of the syste prior to the first topological eet. igificace of such a aalysis was to 9

11 deterie whether robust operatios are capable to preet pollutio fro propagatig to ew clusters, which would ieluctably lead to the progressie subersio of the syste. Restrictig the aalysis to the occurrece of the first topological operatio is justified by the fact that topological eets occurs rarely (i.e., they require a lot of joi ad leae operatios). It is also sufficiet to accurately aalyze the behaior of the syste as by costructio of the proposed robust operatios, the adersary has o icetie to prooke the triggerig of topological operatios. Results of the aalysis are extreely positie. First they show that by siply icreasig the differece betwee the core ad the spare sets, the tie that elapses before the first topological operatios is sigificatly augeted. ecod they deostrate that pushig odes to rado positios i the syste, ee ery ifrequetly, splits adersarial coalitios. Fially, they show that ee whe the adersary has succeeded i attackig a cluster, the adersary is icetiized to keep their desity low. Thus, pollutio caot propagate to safe clusters i their iciity. s a future work, we ited to exted the proposed aalysis by cosiderig ay kid of graphs, iposig solely that the graph fored by correct odes is coected. Oe of the issues that we will hae to address is the costructio of a uifor ode saplig algorith that guaratees that ay correct ode i the graph has a equal probability to appear i ay routig table of ay other correct ode. The presece of a oisciet adersary akes the issue challegig essetially because such a algorith caot rely ayore o the uifor distributio of ode idetifiers. 7. REFERENCE [1] M. Castro, P. Druschel,. Gaesh,. Rowstro, ad D.. Wallach. ecure routig for structured peer-to-peer oerlay etworks. I Proceedigs of the yposiu o Operatig ystes Desig ad Ipleetatio (ODI), [2]. igh, T. Nga, P. Drushel, ad D. Wallach. Eclipse attacks o oerlay etworks: Threats ad defeses. I Proceedigs of the Coferece o Coputer Couicatios (INFOCOM), [3] M. riatsa ad L. Liu. Vulerabilities ad security threats i structured peer-to-peer systes: quatitiatie aalysis. I Proceedigs of the 20th ual Coputer ecurity pplicatios Coferece (CC), [4] N. Naouo ad K. W. Ross. Exploitig p2p systes for DDo attacks. I Proceedigs of the Iteratioal Coferece o calable Iforatio ystes (Ifoscale), [5]. Ratasay, P. Fracis, M. Hadley, R. Karp, ad. heker. scalable cotet-addressable etwork. I Proceedigs of the CM IGCOMM, [6] I. toica, D. Libe-Nowell, R. Morris, D. Karger, F. Dabek, M. F. Kaashoek, ad H. Balakrisha. Chord: scalable peer-to-peer lookup serice for iteret applicatios. I Proceedigs of the CM IGCOMM, [7] P. Druschel ad. Rowstro. Past: large-scale, persistet peer-to-peer storage utility. I Proceedigs of the Workshop o Hot Topics i Operatig ystes (HotO), [8] E. it ad R. Morris. ecurity cosideratios for peer-to-peer distributed hash tables. I Proceedigs of the Iteratioal Workshop o Peer-to-Peer ystes (IPTP), [9]. Fiat, J. aia, ad M. Youg. Makig chord robust to Byzatie attacks. I Proceedigs of the ual Europea yposiu o lgoriths (E), [10] E. ceaue, F. Brasileiro, R. Ludiard, ad. Raoaja. PeerCube: a hypercube-based p2p oerlay robust agaist collusio ad chur. I Proceedigs of the Iteratioal Coferece o elf-daptie ad elf-orgaizig ystes (O), [11] K. Hildru ad J. Kubiatowicz. syptotically efficiet approaches to fault-tolerace i peer-to-peer etworks. I Proceedigs of the Iteratioal yposiu o Distributed Coputig (DIC), [12] B. werbuch ad C. cheideler. Towards scalable ad robust oeray etworks. I Proceedigs of the Iteratioal Workshop o Peer-to-Peer ystes (IPTP), [13] E. ceaue, R. Ludiard, B. ericola, ad F. Troel. Perforace aalysis of large scale peer-to-peer oerlays usig arko chais. I Proceedigs of the 41st IEEE/IFIP Iteratioal Coferece o Depedable ystes ad Networks (DN), [14] B. werbuch ad C. cheideler. Group spreadig: protocol for proably secure distributed ae serice. I Proceedigs of the 31rst Iteratioal Colloquiu o utoata, Laguages ad Prograig (ICLP), [15] P. B. Godfrey,. heker, ad I. toica. Miiizig chur i distributed systes. I Proceedigs of the CM IGCOMM, [16] J. Douceur. The sybil attack. I Proceedigs of the Iteratioal Workshop o Peer-to-Peer ystes (IPTP), [17] L. Laport, R. hostak, ad M. Pease. The Byzatie geerals proble. CM Trasactios o Prograig Laguages ad ystes, 4, [18] E. ceaue, F. Castella, R. Ludiard, ad B. ericola. Marko chais copetig for trasitios: pplicatio to large scale distributed systes. Methodology & Coputig i pplied Probability, DOI: /s [19] M. Luby. Lt codes. I Proceedigs of the 43rd IEEE ual yposiu o Foudatios of Coputer ciece, [20] P. Mayouko. Olie codes. Research Report TR , New York Uiersity, [21]. hokrollahi. Raptor codes. IEEE/CM Trasactios o Networkig, pages ,