Distributed File Integrity Checking via Peer-to-Peer Hash Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional host-based file integrity checkers are vulnerable to compromise by malware, as the signature data is stored locally, allowing malicious programs to alter signatures and disrupt detection processes.
Innovation Solution
A distributed file integrity checking system using peer-to-peer networking, where a distributed hash table stores file signature data across multiple nodes, enabling cooperative intrusion detection and reducing the likelihood of successful attacks by distributing the database across potentially hundreds or thousands of peer computers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature data is stored locally on the host computer, then the integrity checking process can operate independently and quickly, but the system becomes vulnerable to compromise by malware that can alter the signatures
Solution Approach 1:
The patent divides the centralized signature database into distributed segments stored across multiple peer nodes in a peer-to-peer network. Each node holds a portion of the signature data, so no single point of compromise exists. This segmentation resolves the vulnerability where local storage allows malware to alter all signatures at once.
Solution Approach 2:
The patent introduces peer nodes as intermediaries between the host computer and the signature database. Instead of direct local storage or centralized storage, signatures are retrieved through the peer-to-peer network from distributed peer nodes, adding a layer of security where compromise of one intermediary does not affect the entire system.
2Device complexity
If signature data is stored on a centralized database on one computer, then the integrity checking process is simplified, but the system becomes vulnerable to single-point compromise
Solution Approach 1:
The centralized database is segmented into distributed storage across multiple peer nodes. Each peer node stores a subset of signature data, transforming the single-point-of-failure architecture into a distributed resilient system where the whole remains functional even if individual segments are compromised.
Solution Approach 2:
The patent changes the architectural parameter from centralized to distributed storage. This fundamental parameter change transforms the system from vulnerable to resilient, while the peer-to-peer protocol maintains operational simplicity comparable to centralized systems.
3Object-affected harmful factors
If malware is installed on the host, then it can alter local signatures to prevent detection, but a distributed system requires compromise of multiple nodes for successful attack
Solution Approach 1:
By segmenting the signature database across multiple peer nodes, the system requires proportional scaling of the attack surface. To compromise the integrity checking, an attacker must compromise a significant portion of the peer network rather than a single host, making successful intrusion significantly more difficult.
Solution Approach 2:
The distributed architecture预先 (in advance) prevents successful single-point compromise attacks. The system is designed so that even if malware is present on individual hosts, the distributed verification across multiple peers provides preliminary protection against undetected intrusion.
4Reliability
If a peer-to-peer distributed system is used, then the system becomes resilient to single-point compromise, but the complexity of the integrity checking process increases
Solution Approach 1:
Each peer node in the network serves multiple functions: storing signature data, verifying integrity of other nodes, and participating in the distributed verification process. This multi-functionality reduces overall system complexity compared to having separate dedicated components for each function.
Solution Approach 2:
The peer-to-peer network is self-organizing and self-maintaining, with nodes automatically participating in the distributed hash table and integrity verification processes without requiring centralized management. This self-service characteristic reduces operational complexity despite the distributed architecture.
Data Source
AI summary
A distributed file integrity checking system is described. The described peer integrity checking system (PICS) may negate an attack by storing a properties database amongst nodes of a peer-to-peer network of hosts, some or all of which co-operate to protect and watch over each other.