Acorn: providing network-level security in P2P overlay architectures

• US 20070149279A1
• Filed: 12/22/2005
• Published: 06/28/2007
• Est. Priority Date: 12/22/2005
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Guo, Katherine, Norden, Samphel
• Granted Patent: US 8,856,310 B2
• Time in Patent Office: Days
• US Class Current: 463/29
• CPC Class Codes: A63F 13/12 involving interaction between a plurality of game devices, e.g. transmisison or distribution systems protocols for networked virtual reality, networked games H04L29/06034
• CPC Class Codes: A63F 13/30 Interconnection arrangements between game servers and game devices; Interconnection arrangements between game devices; Interconnection arrangements between game servers
• CPC Class Codes: A63F 13/34 using peer-to-peer connections
• CPC Class Codes: A63F 13/75 Enforcing rules, e.g. detecting foul play or generating lists of cheating players
• CPC Class Codes: A63F 2300/408 Peer to peer connection
• CPC Class Codes: A63F 2300/5586 for enforcing rights or rules, e.g. to prevent foul play
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: H04H 20/63 to plural spots in a confined site, e.g. MATV [Master Antenna Television]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1048 Departure or maintenance mechanisms
• CPC Class Codes: H04L 67/1051 Group master selection mechanisms
• CPC Class Codes: H04L 67/1063 Discovery through centralising entities
• CPC Class Codes: H04L 67/1076 Resource dissemination mechanisms or network resource keeping policies for optimal resource availability in the overlay network
• CPC Class Codes: H04L 67/1089 Hierarchical topologies
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04N 21/2223 : being a public access point, e.g. for downloading to or uploading from clients arrangements specially adapted to plural spots in a confined site in broadcast systems H04H20/63

Abstract

To address the problem of providing network-based security to mitigate and detect cheating in peer-to-peer (P2P) gaming architecture, an architecture suite called architectures with coordinator obfuscation for resilient P2P gaming networks (ACORN) is presented that uses a combination of low overhead, per-packet access authentication, moving-coordinator and cheat detection mechanisms to effectively mitigate security threats.

Claims

1. A method for providing network-based security, comprising:

moving a coordinator functionality between members of a set of candidate coordinator nodes in a network, without notifying a plurality of clients in the network; and

flexibly adapting the frequency with which the coordinator functionality is moved.

2. The method of claim 1, further comprising:

performing cheat detection.

3. The method of claim 2, wherein cheat detection is performed by using a k-window mechanism.

4. The method of claim 2, wherein cheat detection is performed by using a checkpointing mechanism.

5. The method of claim 1, wherein moving the coordinator functionality is triggered by one of the following:

a move event, a leave event, or a fail event.

6. The method of claim 1, further comprising:

generating an ID number; and

mapping the ID number to an address of a new coordinator, without notifying all of the clients;

wherein the coordinator functionality is moved to the new coordinator.

7. A system for providing network-based security, comprising:

a central server for providing a plurality of services;

a plurality of clients, each client being capable of connecting to the central server to access one of the services, each client being capable of joining and leaving a network;

a current coordinator having a coordinator functionality in the network, the current coordinator receives a plurality of update messages from the clients and communicates the update messages to the clients; and

a coordinator access point (CAP) for moving the coordinator functionality between members of a set of candidate coordinator nodes in the network and for cheat detection.

8. The system of claim 7, wherein the services provided by the central server are gaming services and further wherein the clients represent game players.

9. The system of claim 7, further comprising:

a plurality of transit nodes for routing in the network.

10. The system of claim 7, further comprising:

a coordinator mapping table (CMT) for mapping a plurality of ID sequence numbers to a plurality of keys used for routing; and

a coordinator key table (CKT) for mapping the keys to a plurality of Internet protocol (IP) addresses.

11. The system of claim 10, wherein the CAP selects the set of candidate coordinator nodes, assigns a unique set of the keys to each member of the set, and stores a mapping of keys to members of the set in the CKT.

12. The system of claim 10, wherein the CAP constructs the CMT and multicasts the CMT to all the clients.

13. The system of claim 10, wherein the CAP generates a seed and multicasts the seed to all the clients.

14. The system of claim 13, wherein each client uses the seed to generate the ID sequence numbers.

15. The system of claim 10, wherein the clients do not know the IP address of the current coordinator.

16. The system of claim 10, wherein the clients use one of the keys to forward messages to the current coordinator.

17. A computer readable medium storing instructions for performing a method for providing network-based security, the method comprising:

moving a coordinator functionality between members of a set of candidate coordinator nodes in a network, without notifying a plurality of clients in the network; and

flexibly adapting the frequency with which the coordinator functionality is moved.

18. The computer readable medium of claim 17, further comprising:

performing cheat detection.

19. The computer readable medium of claim 17, wherein cheat detection is performed by using a k-window mechanism.

20. The computer readable medium of claim 17, wherein cheat detection is performed by using a checkpointing mechanism.