第讲PP安全探讨.ppt
97页
P2P安全探讨 1 章节内容l6.1 匿名l6.2 声誉和信任l6.3 文件污染l6.4 路由安全l6.5 安全前沿研究2 6.1 匿名l“匿名”的根源可以追溯到“安全散列函数”，包括发送者匿名、接收者匿名、文件标识匿名、关系匿名等lP2P系统天然可用于匿名3 AnonymitylAuthor anonymity: Author anonymity: 分享资源的作者的身份不能够被有心分享资源的作者的身份不能够被有心人知道，即身份和分享的资源不能够有关连性人知道，即身份和分享的资源不能够有关连性lPublisher anonymity: PublisherPublisher anonymity: Publisher的身份不能够和提供的的身份不能够和提供的资源有所关连性资源有所关连性lReader (Requester) anonymity: Reader (Requester) anonymity: 同个网络中的资源任何同个网络中的资源任何人都可以读取，但读取者的信息不能够被公开或得知人都可以读取，但读取者的信息不能够被公开或得知lServer anonymity: Server anonymity: 服务器的信息不能够和提供的资源有服务器的信息不能够和提供的资源有任何的关连性。
任何的关连性lDocument anonymity: Document anonymity: 服务器也不知道储存的内容服务器也不知道储存的内容lQuery anonymity: Query anonymity: 服务器知道请求资源的服务器知道请求资源的IDID，但是不能，但是不能够有第三者去确认此够有第三者去确认此IDID的正确性的正确性 4 匿名的方法l匿名代理：用户通过匿名代理发送消息，但匿名代理安全性以及本身是系统瓶颈，易受攻击l混合中继网mix-net：用户通过一组“混合中继”mix relays结点连接到服务器，核心中继结点是安全隐患（Tor)l随机中继：Freenet，Tarzan(理论上完备细致，但实现极其困难)等5 混合中继网－onion routingl常用的匿名传输代理服务器Tor是基于洋葱路由（Onion Routing)l用户在本机运行一个洋葱代理服务器（onion proxy），这个代理周期性地与其他Tor交流，从而在Tor网络中构成虚拟环路（virtual circuit）同时对于客户端，洋葱代理服务器又作为SOCKS接口一些应用程序就可以将Tor作为代理服务器，网络通讯就可以通过Tor的虚拟环路来进行。
lTor是在7层协议栈中的应用层进行加密（也就是按照‘onion’的模式）而它之所以被称为onion是因为它的结构就跟洋葱相同，你只能看出它的外表而想要看到核心就必须把它层层的剥开l每个router间的传输都经过symmetric key来加密，形成有层次的结构它中间所经过的各节点，都好像洋葱的一层皮，把客户端包在里面，算是保护信息来源的一种方式，这样在洋葱路由器之间可以保持通讯安全6 洋葱路由– Onion routing （ A real-time MIX network ）l一个通用可用于如Internet开放式网络上的匿名通信体系 general purpose infrastructure for anonymous communications over a public network (e.g., Internet)l通过适当的代理支持多类应用如：HTTP，FTP，SMTP…supports several types of applications (HTTP, FTP, SMTP, rlogin, telnet, …) through the use of application specific proxiesl应用数据通过动态建立的匿名连接传输¡anonymous connections through onion routers are built dynamically to carry application datal具有分布式、容错、安全等特性¡distributed, fault tolerant, and secure7 洋葱路由－－网络设置和操作l在邻居路由器间保持长期的socket连接（links)¡long-term socket connections between “neighboring” onion routers are established linksl一个连接link上的两邻居采用两个DES加密key，每个方向一个确保通信安全¡neighbors on a link setup two DES keys using the Station-to-Station protocol (one key in each direction)l多个匿名连接可以复用在一个连接link上，这时每个匿名连接分配一个ACI标识（局部性的标识）。
l消息类似ACM传输，分成48bytes定长信元信元用DES加密传输中来自不同连接的信元mix复用，但保持连接有序6543214321mixing65432143218 Overview of architectureapplication(initiator)application(responder)onion routerentry funnel - multiplexes connections from onion proxiesexit funnel - demultiplexes connections from the OR network - opens connection to responder application and reports a one byte status msg back to the application proxylong-term socketconnectionsapplication proxy - prepares the data stream for transfer - sanitizes appl. data - processes status msg sent by the exit funnel onion proxy - opens the anonymous connection via the OR network - encrypts/decrypts data 9 Onions消息包lonion是多层数据结构，它encapsulate了OR网络中的匿名连接¡it encapsulates the route of the anonymous connection within the OR networkl每层包括：¡backward crypto function (DES-OFB, RC4)后向加密函数¡forward crypto function (DES-OFB, RC4)前向加密函数¡IP address and port number of the next onion router下一跳路由
lTarzan将mix-net的匿名方法扩展到P2P环境中，结点之间通过中继结点序列（这一序列结点构成一条隧道）来通信l实现：发送者匿名、接收者匿名、关系匿名（一对结点之间相互通信的关系不会被其他结点发现）lTarzan: A Peer-to-Peer Anonymizing Network LayerACM CCS 2002 http://pdos.lcs.mit.edu/tarzan/18 lParticipant can communicate anonymously with non-participantlUser can talk to CNN.comUser ? •Nobody knows who user isAnonymity19 The Vision for AnonymizationlThousands of nodes participatelBounce traffic off one another•Mechanism to organize nodes: peer-to-peer•All applications can use: IP layer20 Alternative 1: Proxy ApproachlIntermediate node to proxy trafficlCompletely trust the proxyAUserProxy21 Threat model•Corrupt proxy(s)–Adversary runs proxy(s)–Adversary targets proxy(s) and compromises, possibly adaptively•Network links observed–Limited, localized network sniffing–Wide-spread (even global) eavesdroppinge.g., Carnivore, Chinese firewall, ISP search warrants22 Failures of Proxy ApproachUserProxy•Traffic analysis is easy•Proxy reveals identityProxy23 ProxyFailures of Proxy ApproachUserXXlCNN blocks connections from proxy•Traffic analysis is easy•Adversary blocks access to proxy (DoS)•Proxy reveals identity24 Alternative 2: Centralized MixnetUserRelayRelayRelaylMIX encoding creates encrypted tunnel of relays¡Individual malicious relays cannot reveal identitylPacket forwarding through tunnel Onion Routing, FreedomSmall-scale, static networkRelay25 Failures of Centralized Mixnet •CNN blocks core routersXRelayRelayRelayRelayUser26 RelayFailures of Centralized Mixnet •CNN blocks core routers•Adversary targets core routersRelayRelayRelayRelayRelayRelayUser27 •CNN blocks core routers•Adversary targets core routers•So, add cover traffic between relays–Hides data traffic among coverAlternative 2: Centralized MixnetRelayRelayRelayRelayUserRelay28 Failures of Centralized Mixnet•CNN blocks core routers•Adversary targets core routersRelayRelayRelayRelayRelayRelayUser29 Failures of Centralized Mixnet•CNN blocks core routers•Adversary targets core routers•Still allows network-edge analysisRelayRelayRelayRelayRelayRelayUserRelayRelay30 Failures of Centralized Mixnet•Internal cover traffic does not protect edges•External cover traffic prohibitively expensive?–n2 communication complexityRelayRelayRelayRelayRelayRelayUserRelayRelayRelayRelay31 Tarzan: Me Relay, You Relay•Thousands of nodes participate–CNN cannot block everybody–Adversary cannot target everybody32 Tarzan: Me Relay, You Relay•Thousands of nodes participate•Cover traffic protects all nodes–Global eavesdropping gains little info33 Benefits of Peer-to-Peer Design?????•Thousands of nodes participate•Cover traffic protects all nodes•All nodes also act as relays–No network edge to analyze–First hop does not know he’s first34 1. Contacts known peers to learn neighbor lists2. Validates each peer by directly pingingTarzan: Joining the SystemUser35 Tarzan: Generating Cover TrafficNodes begin passing cover traffic with mimics:¡Nodes send at some traffic rate per time period¡Traffic rate independent of actual demand¡All packets are same length and link encryptedUser36 Tarzan: Selecting tunnel nodesUserTo build tunnel:Iteratively selects peers and builds tunnel from among last-hop’s mimicsPNAT37 But, Adversaries Can Join SystemUserPNAT38 But, Adversaries Can Join SystemUser•Adversary can join more than once by spoofing addresses outside its controlü Contact peers directly to validate IP addr and learn PKPNAT39 But, Adversaries Can Join SystemUser•Adversary can join more than once by running many nodes on each machine it controlsü Randomly select by subnet “domain” (/16 prefix, not IP)PNAT40 But, Adversaries Can Join SystemUser•Adversary can join more than once by running many nodes on each machine it controlsü Randomly select by subnet “domain” (/16 prefix, not IP)PNAT41 Tarzan网络安全模型 l考虑到一个路由器上可能有多个IP地址，从而虚拟地操纵多个Tarzan结点，因此定义了域domain概念，以此标识被某个恶意节点控制的子网。
l如图，恶意的路由器控制了整个域（子网），而一般的恶意结点则不能控制整个域，但它能监听域内其它结点的通信l域的划分粒度通常为＜当前ip/16＞,＜当前ip/24＞42 Tarzan体系架构43 6.2 声誉和信任l匿名隐藏网络行为，而“声誉”与匿名相反，它对“好”的网络行为的鼓励l“信任”往往是基于“声誉”的，很多时候二者不做区分lBittorrent的阻塞算法实质就是采用声誉机制目前对匿名、信任等的研究得到较大的关注44 设计P2P声誉、信任系统涉及的问题l此系统必须是自管辖的(self-policing)，系统本身为其用户定义了共有的行为准则和声誉/信任衡量，即使在没有集中式认证或权威第三方的情况下，系统用户也能总体上遵循并加强这些准则l此系统必须是匿名的，一个用户的声誉应该同一个不透明的ID相关联l不应该给予新来者任何额外的利益，用户的声誉必须通过多次事务中的表现来衡量l应该尽量最小化声誉/信任机制带来的额外开销l应该对恶意结点有较强的容错性45 lCCS02[Damiani et.al.,2002]：提出了一种基于声誉的，在P2P网络中选择可靠资源的方法每个Peer在下载资源前，通过分布式的投票算法(polling algorithm)来评价资源的可靠性，从而限制恶意资源在P2P网络中的传播。
lACM Conference on Electronic Commerce [Xiong and Liu.03] 设计了一个服务于P2P电子商务社群的、基于声誉的信任模型PeerTrust此模型基于事务回馈（transaction feedback）来量化和比较Peer的可信任性(trustworthiness)lBitTorren的阻塞算法是隐匿的声誉方法，但只基于本次下载而不考虑历史行为46 EigenTrust算法－完备的P2P声誉管理lEigenTrust特征信任，www2003[Kamvar et al.2003] Standford UniversitylEigenTrust使用用户间满意度矩阵的特征向量来计算信任值l信任值基础：¡每次事务后，用户要互相评价如用户i从用户j那里下载一个文件后（也可能下载失败），用户i会以一个信任值tr(i,j)来评价这次事务1为成功，-1为不成功（下载失败或非想要的）¡一个用户i对j历史性的评价（称为满意度s)，记为sij47 EigenTrust收集、计算信任值的方法l传递信任值(friends of friends)：用户i信任那些给他提供正确下载的用户，所以也信任这些用户所提供的信任值。
满意度的规范化(normalize)：规范化可以有效地避免恶意结点给予其他结点太高或太低的评价规范后的信任值记为cij, 有∑cij=148 The MathAsk your friends jWhat they think of peer k.And weight each friend’s opinion by how much you trust him..1.5 0 0 0.20 .2 0 .3 0 .5 .1 0 0 0.1.3.2.3.1.1.2i对k的信任通过朋友对k的信任传递lC为矩阵[cij]，CT表示矩阵的转置，ci表示包含cij的向量49 l问你的朋友: t=CTci.l问朋友的朋友: t=(CT)2ci.l重复n次问: t=(CT)nci.，步数n越大，得到的评价越广泛从而越准确l可以证明，当n很大时，每个用户i的信任值向量ti都将趋向于矩阵C的“左主特征向量”（left principal eigenvector)el也就是说，在EigenTrust模型中t是一个全局特征向量，它的每个元素ti代表了整个系统赋予用户j的信任值l因此，每个peer并不需要存储或者计算它自己的信任向量。
因为这是一个全局特征量，统一的¡Therefore, each peer doesn’t have to store and compute its own trust vector. The whole network can cooperate to store and compute t.50 简单的、非分布式算法lInitialize:lRepeat until convergence:51 Simple algorithm pseudocode52 Distributed Algorithm.1.5 0 0 0.20 .2 0 .3 0 .5 .1 0 0 0.1.3.2.3.1.1.2以下算法暂时忽略lie/dishonestFor each peer i { -First, ask peers who know you for their opinions of you. -Repeat until convergence {-Compute current trust value: ti(k+1) = c1j t1(k) +…+ cnj tn(k) -Send your opinion cij and trust value ti(k+1) to your acquaintances.-Wait for the peers who know you to send you their trust values and opinions. }}详细算法及分析请自行参考论文[kamvar et al.,2003]53 计分安全的EigenTrust算法54 6.3 文件污染l文件污染，是指P2P文件共享网络中的恶意用户，可称之为“污染者”，将虚假甚至含有恶意内容的文件贴上某些热门内容的标签进行发布，诱骗其他用户下载，并利用P2P网络的自由共享功能进行更广泛散播的现象。
l案例：¡Overpeer公司于2003年成功地使当时最受欢迎的Kazaa/FastTrack网络上被污染的文件占到总文件数量的一半以上 Titles, versions, copieslThe title is the title of song/movie/software主题（索引）lA given title can have thousands of versions 版本lEach version can have thousands of copies 副本5656 文件污染类型l（1）索引污染是指在P2P网络的索引服务系统中注入大量虚假的记录，这些记录指向不存在的版本和/或副本当用户按照这些记录的指示尝试下载时，将得到“无法连接”的提示如果注入的虚假索引记录足够多，那么没有耐心的用户可能在几次失败的尝试之后放弃下载的努力¡索引污染既可以针对版本也可以针对副本它与普通的版本污染和副本污染的不同之处在于，污染者注入网络中的索引记录指向并不存在的对象，因此污染者并不需要拥有强大的污染服务器来提供大量的上传服务57 l（2）版本污染 实施版本污染的污染者首先针对一个（或同时针对多个）目标关键词制造出大量含有恶意或错误内容的污染版本。
然后污染者将这些版本的索引信息注入目标P2P网络，并在其污染服务器上提供大量可供下载的副本如果没有有效的识别措施和管理机制，网络中的用户在搜索相关主题时就很容易被这些具有大量可下载副本的污染版本所吸引一旦下载了污染版本而又没有及时加以检验，一般用户很可能将该版本的本地副本设置为共享，并提供给其他用户下载如此一来，污染版本将在网络中广泛的传播开来，甚至会超过了正确版本的副本数量，最终将正确副本淹没在污染副本中，使得该主题资源变得不可用58 lP2P共享文件的污染版本有很多不同的表现形式，例如，对于mp3歌曲文件，污染者可以采用截短、插入噪声、插入不可解码的数据片断甚至插入辱骂词句等方式来制造污染版本，而对于可执行文件，则可能是插入蠕虫、木马等恶意代码由于P2P网络中共享资源的多样性，对文件版本的好坏，很难有有效的自动识别措施，因此，版本污染具有很强的隐蔽性，大多数情况下只能依靠人工的识别正是这种人工识别的滞后性，使得P2P网络中被污染的文件版本不仅可以通过污染服务器直接散发，还可以通过正常用户的共享行为得到更加广泛和迅速的传播 59 File Pollution: Infocom 05pollution companypolluted contentoriginal content6060 File Pollutionpollution companypollution serverpollution serverpollution serverpollution serverfile sharingnetwork6161 File PollutionUnsuspecting usersspread pollution !62AliceBob62 File PollutionUnsuspecting usersspread pollution !Yuck6363 Index Poisoning: Infocom 06 index title location bigparty 123.12.7.98smallfun 23.123.78.6heyhey 234.8.89.20file sharingnetwork123.12.7.9823.123.78.6234.8.89.206464 Index Poisoning index title location bigparty 123.12.7.98smallfun 23.123.78.6heyhey 234.8.89.20123.12.7.9823.123.78.6234.8.89.20 index title location bigparty 123.12.7.98smallfun 23.123.78.6heyhey 234.8.89.20bighit 111.22.22.22111.22.22.226565 FastTrack/Kazaa OverlayEach SN maintains a local indexON =ordinary nodeSN = super nodeSNONONON6666 FastTrack QueryON =ordinary nodeSN = super nodeSNONONON67Alice67 FastTrack DownloadON =ordinary nodeSN = super nodeSNONONONHTTP requestfor hash value68Bob68 FastTrack DownloadON =ordinary nodeSN = super nodeSNONONONP2P file transfer6969 Index Poisoning in FastTrack and OvernetlFastTrack/Kazaa¡Advertise to supernodes (target_song, bogus_IP) lfor many bogus IP’s, many versions of target_songlOvernet/E-donkey¡Advertise record: (hash_target_keyword, bogus_version_id)7070 Attacks: How Effective?lFor a given title, what fraction of the “displayed copies” are¡Clean ?¡Poisoned?¡Polluted?lBrute-force approach:¡attempt download all versions¡versions that don’t download are poisoned¡for those versions that download, listen/watch each onelHow do we determine pollution levels without downloading?7171 Solution:lHarvest version ids and copy locations¡FastTrack: Crawl¡Overnet: Insert node, receive publish msg’slHeuristic for classifying versions into poisoned, polluted, clean versions72 Copies at UsersFastTrackOvernetFor certain titles, a tiny fraction of users advertise the majority of the copies7373 6.4 路由安全lJohn R. Douceur. The Sybil Attack. In Proceedings of the IPTPS02 Workshop, Cambridge, MA (USA), March 2002.Atul Singh, Miguel Castro, Peter Druschel, and Antony Rowstron. Defending Against Eclipse Attacks on Overlay Networks. In Proceedings of the European SIGOPS Workshop, Leuven, Belgium, September 2004.Miguel Castro, Peter Druschel, Ayalvadi Ganesh, Antony Rowstron and Dan S. Wallach. Secure routing for structured peer-to-peer overlay networks. OSDI2002.OSDI (even year), SOSP (odd year) 74 Sybil Attack75 Why Use Sybil Attack?ldisruptionlfor-profit motives:¡RIAA美国唱片业协会(Recording Industry Association of America）¡disproportionate access to resources (computation, storage)¡control network76 Eclipse AttacklOverlay network¡Decentralized graph of nodes on edge of network¡Each node maintains a neighbor set¡Typically limited control over membershiplEclipse Attack¡ Malicious nodes conspire to hijack and dominate the neighbor set of correct nodes¡“Eclipse” correct nodes from each other¡Control data traffic through routing77 ExampleAHFCGBDEIB to *C & F controls traffic78 日蚀 79 Secure routing for structured peer-to-peer overlay networkslMiguel Castro, Peter Druschel, Ayalvadi Ganesh, Antony Rowstron and Dan S. Wallach..l The problemlP2P systems: resilient but not securelMalicious nodes:¡fake IDs¡distort routing table entries¡prevent correct message delivery“Techniques to allow nodes to join, to maintain routing state, and to forward messages securely in presence of malicious nodes”81 Sub-problemslSecurely assigning IDs to nodes¡attacker may capture all replicas for an object¡attacker may target a particular victim lSecurely maintaining routing tables¡attackers may populate with faulty entries¡most messages are routed to faulty nodeslSecurely forwarding messages¡even with proper routing tables, faulty nodes can corrupt, drop, misroute messages82 6.5 安全前沿研究l安全会议列表：¡computer security conference ranking and statistic. lCCS:ACM Conference on Computer and Communications Security lSecurity:Usenix Security Symposium lNDSS:ISOC Network and Distributed System Security SymposiumlSigcomm&infocomlIPTPS/IEEE P2P/IEEE Infocom83 论文阅读lCCS2009:¡ShadowWalker: Peer-to-peer Anonymous Communication using Redundant Structured Topologies, Carmela Troncoso and George Danezis 84 lIPTPS2010：：Blindfold: A System to "See No Evil" in Content DiscoveryRyan S. Peterson, Bernard Wong, and Emin Gün Sirer, Cornell University and United Networks, L.L.C. lIPTPS2010：：Strange Bedfellows: Community Identification in BitTorrentDavid Choffnes, Jordi Duch, Dean Malmgren, Roger Guiermà, Fabián Bustamante, and Luís A. Nunes Amaral, Northwestern University 85 lInfocom2010:Identifying Malicious Nodes in Network-Coding Based Peer-to-Peer Streaming NetworkslICCCN '09¡A Systematic Study on Peer-to-Peer BotnetsPing Wang, Lei Wu, Baber Aslam, and Cliff C. Zou86 P2P BotnetlIRClHTTPlP2PHTTP->FFSNIRC->P2P87 Botnet ArchitectureBotmasterBotBotRecruitingRecruitingRecruitingBot88 BotnetsBotnet AdminBotSpammer89 P2P BotnetlStorm(overnet)lNugachelWaleDac90 lWhile IRC bots simply connect to their IRC server, P2P bots must follow a series of steps to connect with their P2P networklThe initial P2P bot code contains a list of possible peers and code that attempts to connect the bot with the P2P networklAfter the bot joins the network, the peer list is updatedlThen the bot searches the network and downloads the secondary injection code (code that instructs the bot to send spam or perform other malicious activities) P2P Botnets9191 P2P Botnet: Storm9292 Effectiveness of Storm93[Smith08]93 Hybrid P2P Botnet94 Botnet Constructionl路由信息的构建时机：New infecton；ReinfectionlNew Infection：A感染B时，把自己的peer list交给B；判断B是servent？如果是就把B加入A的peer list， A加入B的peer listlReinfection：当A试图感染B（A,B都已经是servent bot了）A和B都把对方加进自己的peer list；l然后从自己的peer list中随机抽取R个peer信息发给对方，同时从对方那里接受R个peer信息来充实自己的peer list。
如果peer list满，就做替换l叫做hockey card algorithm95 进一步阅读与实践：l1、匿名通道Tor下载安装运行，理解onion routing技术l2、阅读安全研究前沿的论文l3、IPTPS2010、INFOCOM2010的相关论文96 学期论文idea之三：l匿名¡INFOCOM2009 提出了一种文件检索系统的匿名模式，可考虑引申为优化的结构设计？¡MIX-Crowds, an Anonymity Scheme for File Retrieval Systems lWai Hung Tang (The University of Hong Kong, HK); H. W. Chan (The University of Hong Kong, HK);l信任¡EigenTrust提出了信任度计算算法，IPTPS09提出了EigenSpeed带宽的安全评估算法如何将人与人之间交互的信任引入到算法中？¡IPTPS09 EigenSpeed: Secure Peer-to-peer Bandwidth Evaluationl路由安全¡可否将经济模式引入到安全领域？¡INFOCOM 2009lRouting Fairness in Chord: Analysis and Enhancement 97 。
