‘SECURITY ISSUES OF P2P COMPUTING’ Presented By Sravan K Abbaraju CS - 843

Introduction Definition Users share information No centralized Server Scalable & Fault tolerant Applications beyond file sharing like multicast systems, anonymous communication systems, and web caches May be already running on your network

Different P2P Frameworks Centralized Frameworks – Controls network access & directs communication e.g.: Napster Decentralized Frameworks – A user has no control over which clients are allowed e.g.: Gnutella, Searching takes a long time Controlled Decentralized Frameworks – server operators control which clients are allowed to access a server e.g.: Morpheus, judicious use of metadata (XML descriptors)to describe the contents of files. Speed of query engine is high

Notes: A firewall is a process that filters traffic between a protected "inside" network and a less trustworthy "outside" network. A firewall implements security policy. An example would be preventing all access from outside coming in and but allowing traffic to go out or to permit access only from certain places, from certain users on certain activities. In implementing a firewall, two approaches are taken. The first is to allow all services to pass by default with the exception of those services that have been identified as disallowed. The second is the classic model used in all areas of information security. It is a stringent approach, allowing access only to identified services. In implementing a firewall, all traffic to and from a network has to pass through a specific entry/exit point. The result of all this would be a process that prevents unwanted and unauthorized communication into or out of the network.

Notes: Firewalls are not exclusive to the Internet. In a company with multiple LAN's, the administrator of LAN 1 may know that his LAN is secure but can he really be sure of LAN2 in another department is secure. Typically, anything outside an immediate LAN should be deemed "untrustworthy". In effect, any point of entry into a trusted network is justification to a firewall.

Notes: What is required are ways to implement security when information traverses the local "trusted" boundaries and ventures on into the unknown. What we need are tools that help us implement security. One of these tools is firewall.

Notes: This is by far the most secure configuration. Notice once again, the screening router and the proxy firewall are on their own LANs. This configuration combines packet filtering and proxy servers. The router filters and blocks inherently dangerous packets. It rejects or accepts packets based on the following criteria: 1. If the traffic is originating from outside the system, only traffic addressed to the application gateway is passed on. 2. The proxy server filters the traffic based on defined proxies. 3. All traffic from within the system can only come from the proxy server.

Distributed computing uses of P2P  Sharing of unused computing resources  Distributed computing (also referred to as grid computing) harnesses the idle processing cycles of the PCs on a network e.g.: (15 teraflop machine)  If taken to its logical conclusion, one can imagine a world where many personal files may no longer be on your hard drive, or even on a central server somewhere on the Internet, but on somebody else's hard drive in, say, Topeka (presumably encrypted and secure). And they will stay on that computer only as long as there is room for it there; they'll be moved around by an intelligent, almost self- regulating, network as the need arises.

Pros and Cons of P2P Advantages: Scalability Strong Affinity groups Low Costs Disadvantages: Image of p2p Technology Limitations Security

P2P THREAT Old friends such as Worm and Viruses e.g.: Gnuman/W32 worm, Hello.exe virus Bugs in AOL (AIM) DOS, password and data theft Violating intellectual property laws Violating corporate security policies Defeat “one way only” firewall behavior-Rendezvous server

Other issues related to P2P Rather than being designed specifically for the purpose of sharing unlawful music, these systems provide a powerful platform for the construction of a variety of decentralized services, including network storage, content distribution, web caching, searching and indexing, and application-level multicast Ejecting misbehaving nodes Storage Distributed Auditing Fairness issues Trust issues

Conclusion While the issues, surrounding peer-to-peer computing will not be resolved any time in the near future, and there will continue to be significant legal and regulatory battles over the rights of copyright holder, this new technology offers both benefits and worries to the content and code community. Business uses within firewalls should not be tarred with the same brush as uncontrolled file sharing.

References 1. Michael Hurwicz, Network Magazine "http: // :// magazine.com/article", John Leyden, "Security fears are barrier for P2P networking take-off", The Register, white paper, July 31, Dan S Wallach, “A Survey of peer – to – peer security issues”, Rice University, Houston, A. S. Tanenbaum: "Computer Networks", Prentice-Hall International, 1996.