Preventing Ddos Attacks with P2P Systems Through Robust Membership Management

Preventing DDoS Attacks with P2P Systems through Robust Membership Management Xin Sun, Ruben Torres and Sanjay Rao School of Electrical and Computer Engineering, Purdue University West Lafayette, IN 47907 {sun19, rtorresg, sanjay}@ecn.purdue.edu ABSTRACT in a safe, secure and robust manner, and understand We show that malicious nodes in a peer-to-peer system may their impact on an Internet environment already suf- impact the external Internet environment, by causing large- fering from several security problems. Peer-to-peer sys- scale distributed denial of service attacks on nodes not even tems enable rapid deployment by moving functionality part of the overlay system. This is in contrast to attacks that to end-systems. However, they are vulnerable to insider disrupt the normal functioning, and performance of the over- attacks coming from (potentially colluding) attackers lay system itself. We formulate several principles critical that infiltrate the overlay or compromise member nodes. to the design of membership management protocols robust Several recent works [8,12,28,29,34] have studied how to such attacks. We show that (i) pull-based mechanisms malicious nodes in a peer-to-peer system may disrupt are preferable to push-based mechanisms; (ii) it is critical the normal functioning, and performance of the system to validate membership information received by a node, and itself. In this paper, however, we focus on attacks where even simple probe-based techniques can be quite effective; malicious nodes in a peer-to-peer system may impact (iii) validating information by requiring corroboration from the external Internet environment, by causing large- multiple sources can provide good security properties with scale distributed denial of service (DDoS) attacks on insignificant performance penalties; and (iv) it is important nodes not even part of the overlay system. In particu- to bound the number of distinct logical identifier (e.g. IDs in lar, an attacker could subvert membership management a DHT) corresponding to the same physical identifier (e.g., mechanisms, and force a large fraction of nodes in the IP address), which a participating node is unable to vali- system to believe in the existence of, and communicate date. We demonstrate the importance of these principles in with a potentially arbitrary node in the Internet. Such the context of the Kad system for file distribution, and ESM attacks may be hard to detect as the packets arriving at system for video broadcasting. To our knowledge, this is a victim are not distinguishable from normal protocol the first systematic study of issues in the design of member- packets. These attacks may be viewed as a particu- ship management algorithms in peer-to-peer systems so they lar kind of reflector attacks [23], however the scale and may be robust to attacks exploiting them for DDoS attacks unique properties of peer-to-peer systems make them on external nodes. worthy of study in their own right. We show that a potential attacker can launch attacks of hundreds of megabits a second on an external node, 1. INTRODUCTION by exploiting popularly deployed file distribution sys- Peer-to-peer systems are rapidly maturing from being tems such as eMule [13], and the extensively deployed narrowly associated with copyright violations, to a tech- video broadcast system ESM [10]. While recent work nology that offers tremendous potential to deploy new [5,22] has presented attacks exploiting the Gnutella and services over the Internet. The recently released Win- Overnet systems, we show that the problem is far more dows Vista is equipped with its own, under-the-hood critical than these works demonstrate, and is general P2P networking system [2], and several commercial ef- to a wider range of systems. We believe these attacks forts are exploring the use of peer-to-peer systems for are merely the tip of the iceberg, and unless the chal- live media streaming and video distribution [3,6,14,24, lenges are systematically addressed, there is potential 33,36]. Recent studies [9] indicate that over 60% of net- for catastrophic consequences on the Internet akin to work traffic is dominated by peer-to-peer systems, and the congestion collapse in the mid 80’s or the large-scale the emergence of these systems has drastically affected worm outbreaks in the last decade. traffic usage and capacity engineering. We present the first systematic study of issues in the With the proliferation of peer-to-peer systems, it be- design of membership management algorithms in peer- comes critical to consider how they can be deployed to-peer systems so they may be robust to such exploits. 1 In this paper, we focus on DDoS attacks triggered B M by exploiting the membership management algorithms , F Q E C of peer-to-peer systems. The membership management R P, S , F E Q R E , V algorithms in a peer-to-peer system enable a node to R P ES R join the group, and maintain information about other REQ, F A C members, even though nodes may join or leave the sys- RESP,I Index A I for F tem. To scale to large group sizes, typical nodes main- R R R EQ E EQ , F tain knowledge of only a small subset of group mem- SP , , F So bers. While a large number of peer-to-peer systems ur ce s Index V have emerged in recent years, two of the most com- I for F mon approaches for membership management involve the use of distributed hash tables (DHTs) [20, 25, 26, a) b) 30,38], and gossip-based algorithms. While popular file- distribution systems like BitTorrent [7] and eMule [13] Figure 1: a) Kad search mechanism. b) Redi- originally relied on centralized servers (trackers) for group rection attack management, more recent versions use decentralized mechanisms based on DHTs. Many other systems such as ESM and CoolStreaming [10,37] employ gossip-like mech- We show that pull-based approaches, where informa- anisms to maintain group membership information. tion conveyed by a member is always in response to To demonstrate the generality of the issues discussed, a prior solicitation, are preferable to push-based ap- we consider peer-to-peer systems targeted at applica- proaches where a member may disseminate member- tions with very contrasting properties very different mem- ship information to other members in an unsolicited bership management designs. In particular, we con- fashion. We evaluate techniques for validating group sider file distribution and video broadcasting applica- membership information communicated from one node tions. Video broadcast applications are distinguished to another. These techniques include direct validation by their stringent real-time constraints requiring timely through probes, and techniques where information can and continuously streaming delivery. Both applications be used only if it is validated from multiple nodes. While are bandwidth-intensive, and large scale, corresponding the latter technique is inspired by prior analytical work to tens of thousands of users simultaneously participat- on Byzantine-tolerant gossip algorithms [17–19, 21], we ing in the application. study the costs in convergence/performance, and bene- The particular systems we consider in this work in- fits in terms of enhanced security properties in the con- clude Kad [13] for file distribution and ESM [10] for text of an actual system. Finally, we show that it is video broadcasting. Kad is a DHT based on Kadem- important to bound the number of distinct logical iden- lia [20], which is supported by the popular eMule [13] tifier (e.g. IDs in a DHT) corresponding to the same clients and other eMule-like clients such as aMule [4] physical identifier (e.g., IP address), which a participat- and xMule [35]. To the extend of our knowledge, Kad ing node is unable to validate. is the largest DHT currently used, with more than one Based on the principles above, we implement several million concurrent peers [31]. ESM is a video broadcast- refinements to the membership management algorithms ing system that employs gossip-based membership algo- in Kadand ESM. We conduct detailed evaluation stud- rithms. It is one of the first operationally deployed sys- ies of the systems with the various refinements using tems and has seen significant real-world deployment [10]. controlled experiments on Planetlab. Overall, our re- We are motivated to use these systems given their ex- sults demonstrate their effectiveness in minimizing the tensive deployment, the contrasting applications they vulnerability of the systems to DDoS attacks without represent, and the different yet representative member- significant degradation in application performance. ship algorithms they employ. The rest of the paper is organized as follows. Sec- tion 2 describes the rationale for choosing the Kadand 2.1 DHT-Based File Distribution:Kad ESM systems, and the vulnerabilities. Section 3 presents In Kad, users and files have IDs that are globally results demonstrating the feasibility of DDoS attacks on unique and randomly chosen from the same ID space these systems. Section 4 describes issues important in of 128 bits. Each node maintains a routing table with the design of resilient membership management algo- a subset of peers that are part of the system. For any rithms. Section 5 describes our methodology to evalu- given file, there are “index-nodes” which maintain a list ate the issues, and Section 6 presents results. of members who own that file. Index nodes are not dedicated nodes but regular participants, who have an 2. VULNERABILITIES IN P2P SYSTEMS ID close to a file ID. For example, in Figure 1.a), node 2 A wishes to download a file F. A must first discover Baseline 1000 Attraction the index-node I, and obtain from it a list of members Multifake 100 Combination having the file.

Load more