Design and Implementation of a Gnutella-based Reputation Management System

Abstract

Peer to peer (P2P) networks have introduced a new paradigm in content distribution. Such systems have shifted the paradigm from a client-server model into a client-client model. The tremendous success of such systems has proven that purely distributed search systems are feasible and that they may change the way we interact on the Internet. Most P2P protocols have been designed with minimum or no emphasis on security - Gnutella being one such open protocol standard. In this work, we focus on providing security over Gnutella by establishing trust between the entities (peers) in a P2P network using reputations and by ensuring integrity, authentication and non-repudiation of messages exchanged. Reputation systems collect, distribute and aggregate feedback about past behavior of the participants. Such systems help in establishing trust amongst strangers, detecting misbehaving nodes and isolating them. In this work, we analyze some existing reputation-based protocols in P2P networks. Among these protocols, we choose two approaches that are more specific and relevant to P2P networks. We compare these two protocols, namely, P2PRep and RCert in terms of security and performance. While P2PRep uses a broadcast polling mechanism and client-side storage to manage reputations, RCert uses unicast messages and server-side (local) storage of reputation content. Based on an analysis of the two approaches, we choose to enhance RCert. We identify the shortcomings and vulnerabilities of this protocol and propose an extension to RCert. We then provide the details of the design and implementation of our enhanced protocol - GTKgREP on Gtk-Gnutella, a unix-based Gnutella servent. We provide an assessment of the overheads associated with this protocol.