On the privacy of peer-assisted distribution of security patches

Di Wu, Cong Tang, Prithula Dhungel, Nitesh Saxena, Keith W. Ross

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    When a host discovers that it has a software vulnerability that is susceptible to an attack, the host needs to obtain and install a patch. Because centralized distribution of patches may not scale well, peer-to-peer (P2P) approaches have recently been suggested. There is, however, a serious privacy problem with peer-assisted patch distribution: when a peer A requests a patch from another peer B, it announces to B its vulnerability, which B can exploit instead of providing the patch. Through analytical modeling and simulation, we show that a large majority of vulnerable hosts will typically become compromised with a basic design for peer-assisted patch distribution. We then study the effectiveness of two different approaches in countering this privacy problem. The first approach utilizes special-purpose peer nodes, referred to as honeypots, that discover and blacklist malicious peers listening for patch requests from susceptible hosts. In the second approach, the patches are requested through an anonymizing network, hiding the identities of susceptible hosts from malicious peers. Using analytical models and simulation, we show that, honeypots do not completely solve the privacy problem; in contrast, an anonymizing network turns out to be more suitable for security patch distribution.

    Original languageEnglish (US)
    Title of host publication2010 IEEE 10th International Conference on Peer-to-Peer Computing, P2P 2010 - Proceedings
    DOIs
    StatePublished - 2010
    Event2010 IEEE 10th International Conference on Peer-to-Peer Computing, P2P 2010 - Delft, Netherlands
    Duration: Aug 25 2010Aug 27 2010

    Publication series

    Name2010 IEEE 10th International Conference on Peer-to-Peer Computing, P2P 2010 - Proceedings

    Other

    Other2010 IEEE 10th International Conference on Peer-to-Peer Computing, P2P 2010
    CountryNetherlands
    CityDelft
    Period8/25/108/27/10

    ASJC Scopus subject areas

    • Computational Theory and Mathematics
    • Computer Science Applications
    • Theoretical Computer Science

    Fingerprint Dive into the research topics of 'On the privacy of peer-assisted distribution of security patches'. Together they form a unique fingerprint.

    Cite this