Peer-to-peer name resolution protocol (PNRP) security infrastructure and method

• US 7,299,351 B2
• Filed: 09/19/2001
• Issued: 11/20/2007
• Est. Priority Date: 09/19/2001
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Huitema, Christian, Miller, John L., Gavrilescu, Alexandru
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Ho; Thomas M
• Application Number:
  US09/956,260
• Publication Number:
  US 20030056094A1
• Time in Patent Office: 2,253 Days
• Field of Search: 713155-158, 726/5, 726/18, 726/19, 380/277, 380/285
• US Class Current: 713/156
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks

Abstract

A method for use in a peer-to-peer communication system to ensure valid connections are made in a secure manner includes the steps of receiving an address record for a peer node which includes an ID certificate. The ID certificate is validated and checked to verify that the ID certificate has not expired. Further, the method determines if the node from whom the address record was received is to be trusted, and the number of instances of the IP address included in the certificate is already stored in cache. When the foregoing are completed successfully, i.e. the certificate is valid, not expired, has been supplied by a trusted neighbor, and does not point to an IP address that already exists for different ID'"'"'s multiple times, the method opportunistically verifies ownership of the ID certificate at the peer node'"'"'s IP address. That is, the verification of ownership only occurs when the advertiser of the ID is the owner of that ID (or when the ID is to be used). If any of the above cannot be completed successfully, the address record is discarded.

Claims

1. A method of providing a security infrastructure for use in a peer-to-peer network without employing a single network wide certification authority or a network wide hierarchy of certification authorities, the method comprising at a first node:

receiving a record from a second node;

validating the ID certificate of the second node;

validating the expiration date of the ID certificate of the second node;

verifying ownership of the ID certificate at the second node'"'"'s IP address if the second node is a neighbor of the first node;

managing a trustworthiness metric of a neighbor of the first node wherein for each neighbor of the first node, a separate trustworthiness metric is maintained; and

limiting the number of records pointing to the same peer IP address to a percentage of the size of a cache.

2. The method of claim 1, wherein validating the ID certificate of the second node comprises of:

obtaining a public key P.sub.ID of the second node;

hashing the P.sub.ID;

comparing the hash of the P.sub.ID to an identity of the second node contained in the ID certificate; and

decrementing the trustworthiness metric of the second node if the hash of the P.subID does not equal the identity of the second node contained in the ID certificate.

3. The method of claim 1, wherein validating the expiration date of the ID certificate of the second node comprises decrementing the trustworthiness metric of the second node if the expiration date has expired.

4. The method of claim 1, further comprising checking if the trustworthiness metric of the second node is below a predetermined level, and decrementing the trustworthiness metric of the second node if its trustworthiness metric is below the predetermined level.

5. The method of claim 1, wherein limiting the number of records pointing to the same peer IP address to a percentage of the size of a cache comprises determining if a number of entries in the cache that point to the IP address of the second node'"'"'s ID certificate exceeds a predetermined limit and decrementing the trustworthiness metric of the second node if the number of entries exceeds the predetermined limit.

6. The method of claim 1, wherein verifying ownership of the ID certificate at the second node'"'"'s IP address if the second node is a neighbor of the first node comprises:

determining that the second node is not an owner of the ID certificate and not a neighbor of the first node; and

storing the second node'"'"'s record in the cache along with an identification of the peer from whom the ID certificate was received.

7. The method of claim 1, wherein verifying ownership of the ID certificate at the second node'"'"'s IP address if the second node is a neighbor of the first node comprises the steps of:

determining that the second node is an owner of the ID certificate and a neighbor of the first node;

encrypting a challenge with P.sub.ID to form an encrypted challenge;

sending the encrypted challenge to the IP address of the second node;

incrementing the trustworthiness metric of the second node, marking that ID ownership verification has been performed for the second node, and storing the second node'"'"'s record in the cache if the challenge in decrypted form is received from the second node; and

decrementing the trustworthiness metric of the second node if the challenge in decrypted form is not received from the second node.

8. A computer-readable medium having computer-executable instructions for performing the steps of claim 1.

24. The method of claim 1, wherein managing the trustworthiness metric of a neighbor of the first node comprises at least one of:

incrementing the neighbor'"'"'s trustworthiness metric when the ownership of the ID certificate at the neighbor is verified;

decrementing the neighbor'"'"'s trustworthiness metric when the ownership of the ID certificate at the neighbor fails to be verified;

decrementing the neighbor'"'"'s trustworthiness metric when ownership of the ID certificate at the neighbor node is not verified within a predetermined time limit;

decrementing the neighbor'"'"'s trustworthiness metric when the neighbor sends a record signed by a third node, and the ownership of the ID certificate at the third node fails to be verified;

decrementing the neighbor'"'"'s trustworthiness metric when the number of records pointing to the neighbor'"'"'s peer IP address exceeds a percentage of the size of the cache; and

deleting all records in the cache for the neighbor if the neighbor'"'"'s trustworthiness metric falls below a predetermined level and refusing new advertisements from the neighbor until a predetermined time limit has expired.

9. A method of providing a security infrastructure for use in a peer-to-peer network without employing a single network wide certification authority or network wide hierarchy of certification authorities, the method comprising at a first node:

A. receiving an address record from a second node, the record including an ID certificate;

B. validating the ID certificate;

C. verifying that the ID certificate has not expired;

D. determining that the second node is to be trusted by checking the level of the trustworthiness metric for the second node;

E. determining that the number of records in a cache for the second node is less than a predetermined limit; and

F. when steps B. thru E. are completed successfully,

a. selectively verifying ownership of the ID certificate at the second node'"'"'s IP address;

b. incrementing a trustworthiness metric for the second node if it is a neighbor of the first node;

c. adding the second node'"'"'s record to the cache; and

G. when any of steps B. thru F. are not completed successfully, discarding the address record and decrementing the trustworthiness metric for the second node.

10. The method of claim 9, wherein step B. comprises the steps of:

obtaining a public key P.sub.ID of the second node;

hashing the P.sub.ID;

verifying that the hash of the P.sub.ID equals an identity of the second node contained in the ID certificate.

11. The method of claim 9, wherein step F. a. comprises the steps of:

determining that is an owner of the ID certificate and a neighbor of the first node;

encrypting a challenge with a public key P.sub.ID to form an encrypted challenge;

sending the encrypted challenge to the IP address of the second node;

receiving the challenge in decrypted form from the second node.

12. A computer-readable medium having computer-executable instructions for performing the steps of claim 9.

13. A method of processing a peer-to-peer query in a security infrastructure for use in a serverless peer to peer network wherein each individual peer node is authorized and able to certify only its own identity,

the peer-to-peer query comprising a request from a neighbor node to a first node to find an owner of an identity contained in the query for purposes of verifying the identity,

the method comprising:

A. receiving the query containing the identity from a neighbor node at a first node;

B. checking to see if a valid and verified record of the neighbor node is stored in a cache;

C. when a valid and verified record of the neighbor node is not stored in the cache, or when a valid and verified record of the neighbor node is stored in the cache and a predetermined amount of time has passed since the last ownership check for the neighbor node,

validating an ID certificate of the neighbor node and

verifying ownership of the ID certificate at the neighbor node'"'"'s IP address;

D. when the neighbor node is not an originator of the query, validating an ID certificate of the originator;

E. comparing the identity contained in the query to the identity of the first node;

F. when the identity of the first node matches the identity contained in the query, returning the record of the first node to the neighbor node; and

G. when the identity of the first node does not match the identity contained in the query, forwarding the query to a third peer node.

14. The method of claim 13 wherein the step of forwarding the query to a third peer node comprises the steps of:

H. searching the cache to find a record for a suitable peer node to which to forward the query;

I. determining if authentication of the record of the suitable peer node is valid;

J. when authentication of the record of the suitable peer node is not valid, performing authentication of record; and

K. when the authentication of the record is not successful, repeating steps H. thru J.

15. The method of claim 13, wherein validating an ID certificate of the neighbor node comprises:

obtaining a public key P.sub.ID of the neighbor node;

hashing the P.sub.ID;

comparing the hash of the P.sub.ID to an identity of the neighbor node contained in the ID certificate; and

decrementing a trustworthiness metric of the neighbor node if the hash of the P.sub.ID does not equal the identity of the neighbor node contained in the ID certificate.

16. The method of claim 13, wherein verifying the ownership of the ID certificate at the IP address of the neighbor node comprises:

encrypting a challenge with a public key P.sub.ID of the neighbor node to form an encrypted challenge;

sending the encrypted challenge to the IP address of the neighbor node;

incrementing the trustworthiness metric of the neighbor node, marking that ID ownership verification has been performed for the neighbor node, and storing the neighbor node'"'"'s record in the cache if the challenge in decrypted form is received from the neighbor node; and

decrementing the trustworthiness metric of the neighbor node if the challenge in decrypted form is not received from the neighbor node.

17. The method of claim 13, wherein the step of validating an ID certificate of the originator node comprises the steps of:

obtaining a public key P.sub.ID of the originator node;

hashing the P.sub.ID of the originator node;

comparing the hash of the P.sub.ID an identity of the originator node contained in the ID certificate; and

decrementing the trustworthiness metric of the neighbor node if the challenge in decrypted form is not received from the neighbor node.

18. A computer-readable medium having computer-executable instructions for performing the steps of claim 13.

19. A method of processing a response to a peer-to-peer query in a security infrastructure for use in a serverless peer to peer network wherein each individual peer node is authorized and able to certify only its own identity,

the peer-to-peer query comprising a request from a first node to a neighbor node to find an owner of an identity contained in the query for purposes of verifying the identity,

the method comprising at the first node:

A. receiving the response from the neighbor node, the response comprising a result and a next hop node;

B. checking to see if a valid and verified record of the neighbor node is stored in a cache;

C. when a valid and verified record of the neighbor node is not stored in the cache, or when a valid and verified record of the neighbor node is stored in the cache and a predetermined amount of time has passed since the last ownership check for the neighbor node,

validating an ID certificate of the neighbor node and

verifying ownership of the ID certificate at the neighbor node'"'"'s IP address;

D. when the neighbor node is not the result of the query, validating an ID certificate of the result; and

E. when the ID certificate of the result is validated, forwarding the result to the next hop node identified in the response.

20. The method of claim 19, wherein validating an ID certificate of the neighbor node comprises:

obtaining a public key P.sub.ID of the neighbor node;

hashing the P.sub.ID;

comparing the hash of the P.sub.ID to an identity of the neighbor node contained in the ID certificate, and

decrementing a trustworthiness metric of the neighbor node if the hash of the P.subID does not equal the identity of the neighbor node contained in the ID certificate.

21. The method of claim 19, wherein verifying ownership of the ID certificate at the neighbor node'"'"'s IP address comprises:

encrypting a challenge with a public key P.sub.ID of the neighbor node to form an encrypted challenge;

sending the encrypted challenge to the IP address of the neighbor node;

incrementing the trustworthiness metric of the neighbor node, marking that ID ownership verification has been performed for the neighbor node, and storing the neighbor node'"'"'s record in the cache if the challenge in decrypted form is received from the neighbor node; and

decrementing the trustworthiness metric of the neighbor node if the challenge in decrypted form is not received from the neighbor node.

22. The method of claim 19, wherein the step of validating an ID certificate of the result comprises:

obtaining a public key P.sub.ID of the result;

hashing the P.sub.ID;

verifying that the hash of the P.sub.ID equals an identity of the result contained in the ID certificate.

23. A computer-readable medium having computer-executable instructions for performing the steps of claim 19.