ACORN: providing network-level security in P2P overlay architectures
View Patent ↗To address the problem of providing network-based security to mitigate and detect cheating in peer-to-peer (P2P) gaming architecture, an architecture suite called architectures with coordinator obfuscation for resilient P2P gaming networks (ACORN) is presented that uses a combination of low overhead, per-packet access authentication, moving-coordinator and cheat detection mechanisms to effectively mitigate security threats.
1. A method for providing network-based security in a network including a coordinator access point (CAP), a set of candidate coordinator nodes and a plurality of clients, the method comprising:
moving a coordinator functionality between members of the set of candidate coordinator nodes without notifying the clients, wherein the coordinator functionality is scheduled to be moved between members of the set of candidate coordinator nodes periodically, each of the candidate coordinator nodes capable of hosting a coordinator functionality, the coordinator functionality adapted for handling messages associated with the clients; and
wherein the coordinator access point (CAP) enables communication between clients and coordinator nodes and dynamically implements network security measures including acting as a trusted intermediary between clients and coordinator nodes.
2. The method of claim 1 , further comprising:
performing cheat detection.
3. The method of claim 2 , wherein cheat detection is performed by using a k-window mechanism.
4. The method of claim 2 , wherein cheat detection is performed by using a checkpointing mechanism.
5. The method of claim 1 , wherein moving the coordinator functionality is triggered by one of the following: a move event, a leave event, or a fail event.
6. The method of claim 1 , further comprising:
generating an ID number; and
mapping the ID number to an address of a new coordinator node, without notifying the clients;
wherein the coordinator functionality is moved to the new coordinator node.
7. A system for providing network-based security in a network, comprising:
a central server for providing a plurality of services;
a plurality of clients, each client being capable of connecting to the central server to access one of the services, each client being capable of joining and leaving the network;
a set of candidate coordinator nodes, wherein each of the candidate coordinator nodes is capable of hosting a coordinator functionality in the network including acting as a trusted intermediary between clients and coordinator nodes, wherein the coordinator functionality is adapted for handling messages associated with the clients; and
a coordinator access point (CAP) for enabling communication between clients and coordinator nodes and moving the coordinator functionality between members of the set of candidate coordinator nodes without notifying the clients, wherein the coordinator functionality is scheduled to be moved between members of the set of candidate coordinator nodes periodically.
8. The system of claim 7 , wherein the services provided by the central server are gaming services and further wherein the clients represent game players.
9. The system of claim 7 , further comprising:
a plurality of transit nodes for routing in the network.
10. The system of claim 7 , further comprising:
a coordinator mapping table (CMT) for mapping a plurality of ID sequence numbers to a plurality of keys used for routing messages in the network; and
a coordinator key table (CKT) for mapping the keys to a plurality of Internet protocol (IP) addresses of the respective candidate coordinator nodes.
11. The system of claim 10 , wherein the CAP:
selects the set of candidate coordinator nodes;
assigns a unique set of the keys to each candidate coordinator node in the set of candidate coordinator nodes; and
stores, in the CKT, a mapping of the unique sets of keys to the respective candidate coordinator nodes to which the unique sets of keys have been assigned.
12. The system of claim 10 , wherein the CAP constructs the CMT and multicasts the CMT to all the clients.
13. The system of claim 10 , wherein the CAP generates a seed and multicasts the seed to all the clients.
14. The system of claim 13 , wherein each client uses the seed to generate the ID sequence numbers.
15. The system of claim 10 , wherein the clients do not know the IP address of a current coordinator node.
16. The system of claim 10 , wherein the clients use one of the keys to forward messages to a current coordinator node.
17. A non-transitory computer readable storage medium storing instructions, which, when executed by a processor, cause the processor to perform a method for providing network-based security in a network including a set of candidate coordinator nodes and a plurality of clients, the method comprising:
moving a coordinator functionality between members of the set of candidate coordinator nodes without notifying the clients, wherein the coordinator functionality is scheduled to be moved between members of the set of candidate coordinator nodes periodically, each of the candidate coordinator nodes capable of hosting a coordinator functionality including acting as a trusted intermediary between clients and coordinator nodes, the coordinator functionality adapted for handling messages associated with the clients; and
wherein a coordinator access point (CAP) enables communication between clients and coordinator nodes.
18. The non-transitory computer readable storage medium of claim 17 , further comprising:
performing cheat detection.
19. The non-transitory computer readable storage medium of claim 17 , wherein cheat detection is performed by using a k-window mechanism.
20. The non-transitory computer readable storage medium of claim 17 , wherein cheat detection is performed by using a checkpointing mechanism.