Robust Mixing for Structured Overlay Networks

1
Robust Mixing for Structured Overlay Networks

• Christian Scheideler
• Institut für Informatik
• Technische Universität München

2
Motivation

• Peer-to-peer systems have attracted a lot of
  attention in recent years
• Many scientific peer-to-peer systems use overlay
  networks based on virtual space

3
Motivation

• V set of peers, U virtual space
• Each v 2 V mapped to region R(v) ½ U
• Family F of functions fU ! U
• v,w edge , F(R(v)) Å R(w) F(R(w)) Å R(v)
  

4
Example

• Let U0,1).
• Region selection Karger et al. 97- nodes v 2
  V ! random points xv 2 U- R(v) xv, succ(xv))
  (regions form partition of U)
• Family F of functions Naor Wieder 03- f0 x
  ! x/2- f1 x ! (x1)/2

5
Scalability and Robustness

• Scalability
• Network has (poly-)logarithmic diameter
• Peers have (poly-)logarithmic degree
• Robustness
• Network can handle large fraction of adversarial
  peers (i.e. honest peers form single connected
  component)! join-leave attacks

6
Join-Leave Model

• n honest peers
• ?n adversarial peers, ?lt1
• Operations
• Join(v) peer v joins the system
• Leave(v) peer v leaves the system
• Goal maintain scalability and robustness for
  any sequence of polynomially many adversarial
  rejoin (leavejoin) requests

7
More specific goal

• n honest peers, ?n adversarial peers
• U0,1), region selection via Karger et al.(
  R(v) xv, succ(xv)) )
• For any interval I ½ 0,1) of size (c log n)/n
• Balancing condition ?(log n) peers in I
• Majority condition honest peers in majority

8
How to satisfy conditions?

• Chord uses cryptographic hash function to map
  peers to points in 0,1)
• randomly distributes honest peers
• does not randomly distribute adversarial peers

9
How to satisfy conditions?

• CAN map peers to random points in 0,1)

10
How to satisfy conditions?

• Group spreading AS04
• Map peers to random points in 0,1)
• Limit lifetime of peers

Too expensive!
11
How to satisfy conditions?

• Rule that works k-cuckoo rule

n honest ?n adversarial
evict k/n-region
? lt 1-1/k
Rejoin leave and join via k-cuckoo rule
12
Analysis of k-cuckoo rule

• k-region region of size k/n starting at integer
  multiple of k/n
• R fixed set of c log n consec. k-regions
• New node not yet replaced after joining
• ?gt0 small constant
• Lemma R has at most c log n new nodes.
• Lemma Sum of ages of k-regions in R in (1 ?)
  (c log n)n/k, w.h.p.

13
Analyis of k-cuckoo rule

• R fixed set of c log n consecutive k-regions
• T(?/?)log3 n
• ?gt0 small constant
• Lemma In any time interval of size T, (1?)kT
  honest nodes and (1?)?kT adv. nodes evicted,
  w.h.p.
• Lemma R has (1 ?)(c log n)k old honest and
  lt(1?)(c log n)?k old adv. nodes, w.h.p.

14
Analysis of k-cuckoo rule

• honest nodes in R gt(1-?)(c log n)k
• adversarial nodes in Rlt(1?)(c log n)?k (c
  log n)
• Theorem When using the k-cuckoo rule with
  ?lt1-1/k, the balancing and majority conditions
  are satisfied for poly many adversarial rejoin
  requests, w.h.p.

15
Limitation of k-cuckoo rule

• Only works for any sequence of rejoin requests of
  adversarial peers.
• Does not work for any sequence of rejoin
  requests.
• Example adversary orders all peers in a region
  of size O(log n / n) to leave

16
k-flipevict rule

• Join as before (k-cuckoo rule)
• Leave choose random k-region among c log n
  neighboring k-regions, flip it with random k
  region

n honest ?n adversarial
flip
17
k-flipevict rule

• Leave why flip neighboring k-region???
• Any k-region O(log n)-region may lose too many
  peers

18
k-flipevict rule

• Leave why flip neighboring k-region???
• k-region of leaving peer k-regions in O(log
  n)-region may become too young
• Age distribution
• O(log n) attempts to replace k-region with
  k-region of age O(n/log n)

O(log n)-regions
age
19
k-flipevict rule

• Leave why flip neighboring k-region???
• Focus on region R of c log n k-regions
• At most c log n new nodes in R
• lt(1?)c log n nodes left k-regions before they
  joined R, w.h.p.
• lt(1?)c log n nodes left k-regions after they
  joined R, w.h.p.
• Total age of k-regions gt (1-?)(c log n)(n/k)

20
Analysis of k-flipevict rule

• honest nodes in R gt(1-?)(c log n)k (1?)(c
  log n)2
• adversarial nodes in Rlt(1?)(c log n)?k (c
  log n)
• Theorem When using the k-flipevict rule with
  ?lt1-3/k, the balancing and majority conditions
  are satisfied for poly many rejoin requests,
  w.h.p.

21
Conclusion

• Light-weight perturbation rules against
  join-leave attacks possible
• Recent paper at SPAA 06
• Problems in real worldDoS-attacks, random
  number generation
• RNG to appear at OPODIS 06
• DoS ???

22
Questions?