Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

Peer 2 peerP2PIm@gesResearch Staff : Frédéric Cuppens, Nor a Cuppens-Boulahia, Fabien AutrelKeywords : Peer to Peer, Access and Usage Controls, Digital Rights Management (DRM), File SharingApplications : Video on Demand, Video Live, IPTV, games.Partners & Funding : Thomson R&D France, Thomson Broadcast & Multimedia, Mitsubishi Electric,Devoteam, France Telecom, Marsouin, IRISA, IPdiva, TMG. It is funded by the DGEIntroductionPeer-to-peer refers to a class of systems andapplications that employ distributed resourcesto perform a function in a decentralizedmanner. The resources encompass inparticular computing power, data, networkbandwidth and computers. The critical functioncan be distributed computing, data/contentsharing, communication and collaboration, orplatform services.The objective of the P2Pim@ges projectrelates to the definition and the developmentof a legal delivery system of music and videocontents by using techniques of peer to peer(P2P). Even if the concept of P2P becameincreasingly popular these last years (In 2004,in a tier-1 ISP, P2P file sharing accounted formore than 60% of traffic in the USA and morethan 80% of the traffic in Asia), it remainedconfined to a more or less legal use ofdownloading files. The objective ofP2Pim@age project is to study this technologyin order to make of it a new electronic deliverysystem of contents.RealizationSERES brings to the project its expertise in thefield of the security of systems and networks,in particular its work related to the expressionand the deployment of security policies incollaborative networks such as peer to peer,and its knowledge of expression andinterpretation digital rights languages andmanagement of super distribution.A first step towards securing P2Pim@gesystem was to perform a risk assessment. Wehave specified the different actors ofP2Pim@ges system. We classified P2P-specificattacks according to their intent, target andgravity (see Fig.1). Illicit Modification ofContent by a Peer, Reverse Engineering andCloning for Intellectual Property Theft, Obtainthe Private Key of the Certification Server,Attacks on Data Related to Legal Issues,Intrusion and Takeover of the ManagementServer are The Top 5 of attacks that we haveto mitigate.Fig.1: P2Pim@ges actors and relevant attacksHowever, P2P systems are exposed to anunusually broad range of attacks because oftheir lack of central control or administration.So, besides the need to be robust againstfaults and sudden departure of nodes, as theyare currently being designed, P2P systems alsoneed to be robust against security threats.SERES coordinates and contributes to thesecurity tasks of P2Pim@age to bring togethera broad range of techniques, none whollyoriginal, that can help to resist on attacks onP2Pim@ge system, identify synergies amongthem, and specify how they can beimplemented.Some security requirements have also beenspecified. They rest on P2Pim@ge client,content and network, privacy and legalaspects, DRM usage and agnosticity.We shall use risk analysis and securityrequirements results as inputs to the other58 Pracom’s Annual Report 2008