In peer-to-peer systems, attrition attacks include both traditional, network-level denial of service attacks as well as application-level attacks in which malign peers conspire to waste loyal peers' resources. We describe several defenses for LOCKSS, a peer-to-peer digital preservation system, that help ensure that application-level attacks even from powerful adversaries are less effective than simple network-level attacks, and that network-level attacks must be intense, wide-spread, and prolonged to impair the system.
The previous version of the LOCKSS protocol used rate-limiting, inherent intrusion detection through bimodal system behavior, and churning of friends into the reference list to prevent poll samples from being influenced by nominated peers. These techniques are effective in defending against adversaries attempting to modify content without being detected or trying to trigger intrusion detection alarms to discredit the system @cite_21 . The previous version of the protocol, however, did not tolerate attrition attacks well. An attrition adversary with about 50 nodes of computational power was able to bring a system of 1000 peers to a crawl. By further leveraging the rate-limitation defense to provide admission control, compliance enforcement, and desynchronization of poll invitations raise the computational power an adversary must use to equal that used by the defenders.
@cite_21
2144552569
The LOCKSS project has developed and deployed in a world-wide test a peer-to-peer system for preserving access to journals and other archival information published on the Web. It consists of a large number of independent, low-cost, persistent web caches that cooperate to detect and repair damage to their content by voting in "opinion polls." Based on this experience, we present a design for and simulations of a novel protocol for voting in systems of this kind. It incorporates rate limitation and intrusion detection to ensure that even some very powerful adversaries attacking over many years have only a small probability of causing irrecoverable damage before being detected.