Robust peer-to-peer networks and methods of use thereof

• US 20080072037A1
• Filed: 09/05/2006
• Published: 03/20/2008
• Est. Priority Date: 09/05/2006
• Status: Active Grant

• Current Assignee: Panasonic Holdings Corporation
• Original Assignee: Panasonic Corporation (Panasonic Holdings Corporation)
• Inventors: Narayanan, Sathya, Shim, Eunsoo
• Granted Patent: US 8,041,942 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method of authentication of peers of a peer-to-peer network includes a certificate issuer tracking at most a predetermined number of node IDs for each peer on the peer-to-peer network, a requesting peer requesting from the certificate issuer a certificate for authenticating a communicating peer and each certificate issued listing at least one node ID of the predetermined number of node IDs assigned for the communicating peer.

Claims

1. A method of authentication of peers of a peer-to-peer network;

comprising the steps of;

a) tracking by a certificate issuer at most a predetermined number of node IDs for each peer on the peer-to-peer network;

b) requesting, by a requesting peer, a certificate for authenticating a communicating peer; and

c) listing in each certificate issued at least one node ID of the predetermined number of node IDs assigned for the communicating peer.

2. The method of claim 1, further comprising the steps of:

d) adding a new node ID of a peer that is on the peer-to-peer network or that is joining the peer-to-peer network; and

e) notifying a certificate issuer of the new node ID of the peer, wherein step (a) of tracking the predetermined number of node IDs for each peer on the peer-to-peer network includes adding tracking information of the peer to reflect the new node ID.

3. The method of claim 1, further comprising after step (b) the step of:

if the number of node IDs for the communicating peer is less than the predetermined number of node IDs, issuing, by a certificate issuer, the certificate that lists the node IDs assigned to the communicating peer.

4. The method of claim 1, further comprising after step (b) the step of:

if the number of node IDs for the communicating peer equals the predetermined number of node IDs, declining by a certificate issuer to issue the certificate.

5. The method of claim 4, further comprising the step of:

if the certificate is not issued by the certificate issuer, rejecting, by the requesting peer, a request from the communicating peer.

6. The method of claim 1, further comprising the step of:

if the number of node IDs for the communicating peer equals the predetermined number of node IDs, rejecting, by the requesting peer, a request from the communicating peer.

7. The method of claim 1, wherein step (b) of requesting the certificate for authenticating the communicating peer includes one of:

(1) requesting the certificate from a certificate issuer;

(2) requesting the certificate from a storage peer, different from the certificate issuer, that stores the certificate in the peer-to-peer network;

or (3) requesting the certificate from the communicating peer.

8. A method of verifying that a node ID of a claimant node corresponds to a locator address of the source in a peer-to-peer network using a verifier node;

comprising the steps of;

a) sending a notification message from a claimant node that includes the node ID and locator address of the claimant node;

b) receiving, by the claimant node, a first message via a first path of the peer-to-peer network;

c) receiving, by the claimant node, at least one further message via at least one further path different from the first path;

d) sending, by the claimant node, a response to the first message and the at least one further message;

e) receiving, by the claimant node, an other message indicating whether the claimant node is authenticated to the peer-to-peer network.

9. The method of claim 8, wherein the first message is sent using the node ID of the claimant node and the at least one further message is sent using the locator address of the claimant node.

10. The method of claim 8, further comprising the steps of:

sending, by the verifier node, the first message and the at least one further message including;

generating a random or quasi-random bit string, as a token;

splitting the token into a first component part and at least one other component part;

providing the first message and the at least one further message based of the first component part and the at least one other component part of the split token;

wherein step (d) of sending the response includes joining the received component parts of the split token to reconstruct the token; and

transmitting the reconstructed token.

11. The method of claim 8, further comprising the steps of:

determining, by the verifier node, if the response to the first message and to the at least one further message is correct;

if the response to the first message and to the at least one further message is correct, storing the node ID and locator address sent in step (a) in the verifier node, as a binding placement record, for use by other nodes of the peer-to-peer network; and

sending the other message to notify the claimant node that the claimant node is authenticated to the peer-to-peer network.

12. The method of claim 8, further comprising the steps of:

receiving, by a reception node, the notification message,

sending, by the reception node, a test message to the locator address indicated by the notification message,

receiving, by the reception node, a response to the test message;

determining if the response to the test message indicates that the node ID of a node at the locator address is the node ID indicated by the notification message,

if the node ID of the node at the locator address is the node ID indicated by the notification message, sending, by the reception node, a lookup request for a binding placement record corresponding to the locator address sent in the notification message,

if the lookup request fails, requesting placement of the binding placement record corresponding to the node ID and locator address sent in the notification message.

13. The method of claim 11, further comprising the steps of:

setting a time-to-live for each binding placement record; and

discarding each binding placement record after the set time-to-live has been exceeded.

14. The method of claim 13, further comprising the steps of:

establishing a refresh period;

communicating, by the claimant node to the verifier node, during the refresh period a refresh message; and

reset the time-to-live for a binding placement record corresponding to the claimant node.

15. The method of claim 11, further comprising the steps of:

establishing a threshold number of binding placement records having a common locator address for storage in the verifier node; and

discarding any new binding placement record request when the stored number of binding placement records is at or exceeds the threshold number.

16. A system for verifying that node IDs correspond to locator addresses of nodes in a peer-to-peer network, comprising:

a claimant node which is configured to send a notification message that includes the node ID and locator address of the claimant node;

a verifier node which is configured to receive the node ID and locator address of the claimant node via the notification message, as a request for a binding placement record, to send a first message via a first path of the peer-to-peer network and to send at least one further message via at least one further path different from the first path, wherein

the claimant node is configured to send a response to the first message and the at least one further message; and

the verifier node is configured to determine if the response to the first message and the at least one further message is correct and if the response to the first message and the at least one further message is correct, the verifier node is configured to store the node ID and locator address sent by the claimant node in the verifier node, as a binding check, for use by other nodes of the peer-to-peer network.

17. The system of claim 16, further comprising:

a reception node which is configured to receive the notification message, to send a test message to the locator address indicated by the notification message, and to receive a response to the test message such that if the response to the test message indicates the node ID of a node at the locator address is the node ID indicated by the notification message, the reception node is configured to send a lookup request to verify a binding placement record corresponding to the node ID and locator address sent in the notification message.

18. The system of claim 16, further comprising:

a reception node to receive the notification message from the claimant node and to provide to the verifier node the node ID and locator address of the claimant node.

19. A method of storing resources on peers in a peer-to-peer network, each peer managing resources with resource keys in a respective range of a key space, the method comprising the steps of:

a) generating a first resource key based on a key generation function using a resource name;

b) storing a resource at a peer in the peer-to-peer network corresponding to the first resource key;

c) deterministically changing the resource name;

d) generating a further resource key based on the key generation function using the deterministically changed resource name; and

e) storing the resource at another peer in the peer-to-peer network corresponding to the further resource key.

20. The method of claim 19, the method further comprising the step of:

f) repeating steps (c) through (e) a predetermined number of times to store the resource at a predetermined number of respective different peers.

21. The method of claim 20, wherein the key generation function includes at least one of:

(1) secure hash algorithm (SHA-1);

(2) advanced encryption standard (AES);

(3) data encryption standard (DES);

(4) triple data encryption algorithm (TDES);

or (5) message-digest algorithm 5 (MD5).

22. The method of claim 19, wherein steps (a) and (d) of generating the first and further resource key include generating the first and the further resource keys using a resource name and a random or pseudo-random bit string.

23. The method of claim 22, wherein steps (c) of deterministically changing the resource name includes at least one of:

(1) rotating the resource name and/or bit string in a predetermined manner;

(2) scrambling the resource name and/or bit string in a predetermined manner;

or (3) combining the resource name and/or bit string in a predetermined manner using another function.

24. A method for retrieving resources from peers in a peer-to-peer network, each peer managing resources with resource keys in a respective range of a key space, each resource being stored at a plurality of peers using a corresponding plurality of different resource keys, the method comprising the steps of:

a) generating a plurality of resource keys based on a key generation function using a resource name of a resource to be retrieved;

b) determining at least one selected peer based on the plurality of generated resource keys;

c) routing a request for the resource to be retrieved to the at least one selected peer through the peer-to-peer network;

d) determining an availability of the resource at the at least one selected peer; and

e) if the resource to be retrieved is not available at the at least one selected peer;

selecting at least one other peer and routing a further request for the resource to be retrieved to the at least one other selected peer.

25. The method of claim 24, wherein:

step (b) of determining the at least one selected peer includes the steps of;

establishing from the plurality of generated resource keys a selected set of peers responsible for managing the resource to be retrieved;

determining which one or ones of the selected set of peers are fewer than a predetermined number of hops away from the peer routing the request for the resource, wherein the at least one selected peer is one or more peers of the selected set of peers that are fewer than the predetermined number of hops away from the peer routing the request for the resource.

26. A peer-to-peer network with a plurality of peers, comprising:

a first peer having a first node ID generated by a first node ID generating function and a second node ID generated by a second node ID generating function; and

a second peer having a third node ID generated by the first node ID generating function and a fourth node ID generated by the second node ID generating function such that the first peer communicates with the second peer on the peer-to-peer network using both the first and second node IDs.

27. The peer-to-peer network of claim 26, further comprising:

one or more further peers having first and second further node IDs generated by the first and second node ID generating functions, respectively, each of the first peer, second peer and one or more further peer being configured to communicate with any other peer on the peer-to-peer network via the node IDs generated by the first node ID generating function and/or the second node ID generating function.

28. The peer-to-peer network of claim 26, wherein:

the first peer has one or more further node IDs generated by one or more further node ID generating functions; and

the second peer has one or more other node IDs generated by the one or more further node ID generating functions such that the first peer communicates with the second peer on the peer-to-peer network using any two of the first node ID, the second node ID or the one or more further node IDs.

29. The peer-to-peer network of claim 28, wherein:

one of the node IDs of at least one set of the plurality of peers is associated with a first topology of the peer-to-peer network; and

another one of the node IDs of the at least one set of the plurality of peers is associated with a second topology different from the first topology.

30. The peer-to-peer network of claim 29, wherein the first and second peers communicate via links established according to either or both of the first or second topologies.

31. A multiple topology peer-to-peer network with a plurality of peers, comprising:

a first peer having a first node ID generated by a first node ID generating function and associated with first and second topologies of the peer-to-peer network, the first and second topologies being different from each other; and

a second peer having a second node ID generated by the first node ID generating function and associated with the first and second topologies of the peer-to-peer network such that the first and second peers communicate via links established according to either or both of the first or second topologies.