Universities Tapped To Build Secure Net

Wes Felter writes "InfoWorld reports that the National Science Foundation (NSF) has enlisted five university computer science departments to develop a secure, decentralized Internet infrastructure. I thought the Internet was already decentralized, so I'm curious about what exactly they're fixing. The article quotes Frans Kaashoek from MIT PDOS, which is working on decentralized software such as Chord."

Comments

How so?

[YanceyAI]

But what is really exciting is that if we succeed, we could change the world.

If they do succeed, how exactly have the changed the world? Am I missing the point? Do I just not get it? Won't they just have changed the Internet...and in a way that would be seamless to most users? Isn't the general consensus that we are not all that vunerable.

DNS and IP allocation not decentralized

[Bookwyrm]

Neither the DNS system (root servers), or the allocation/control of IP address(ing) is decentralized -- they may be heirarchial, but both still have a root.

It will be interesting to see if IPv6 will use geographic hierarchies for routing, or even relaxes the hierarchial assignment-scheme at all. If your IPv6 suffix is static/fixed (based on your MAC address, say), and your IPv6 prefix is from the current network/area you are in, that will be an interesting tool to let people track devices as they move around/between networks.

Current Internet not *that* decentralized

[Duderstadt]

Quoth the poster:

I thought the Internet was already decentralized, so I'm curious about what exactly they're fixing.

Not quite. The primary vulnerability lies within the Root DNS servers, which contain all DNS information for the entire Internet*. IIRC, there are only eleven or twelve of them. And because each replicates its data set to all other Root servers, catastrophic failure of one would bring down all of the others.

If that ever happens, you can pretty much say goodbye to the Net, at least temporarily.

*Actually, I think they hold the addresses of all Local DNS servers, which is basically the same thing.

Re:Current Internet not *that* decentralized

[Alien Being]

This is informative?

The "root servers" contain the locations of the "top level domain (TLD) servers". They can answer queries such as "where is the DNS for .com?"

The TLD servers contain locations of the "next-to-top level domain servers. They can answer queries such as "where is the DNS for IBM.com?"

IBM's own DNS can answer the question "where is www.ibm.com?".

The system is already decentralized to the point that an attacker would have to hit numerous targets to have any significant effect. The only "central point" is the "source files" that feed the upper-level DN servers. Decentralizing those sources would turn the Net into anarchy. "I'm the DNS for .com", "no, I'm the DNS for .com".

I suppose you *could* decentralize the sources, but you would need to implement a system of trust which would have its own center.

Re:Current Internet not *that* decentralized

[gclef]

13 actually. And the replication doesn't quite work the way you claim: the 13 are all actually secondaries to a "hidden" primary.

The main problem with that system, though, is that one mistake on the hidden primary (which has happened) screws up the entire system. And, yes, many many zones were hosed for a while as Network Solutions tried to figure out what the hell they did. And, of course, there's only 13 machines to DoS before all DNS becomes totally useless.

NIIIP

[Gaggme]

The infrastructure of the internet has evolved out of the past few decades yet many key parts are still integral to the existance of the Internet.

After 9/11 several security consultants met in a Senate hearing and demonstrated in a simulation, how the removal of a few key segments could cripple internet traffic (granted some of the plan involved small amount of urban sabatoge).

The internet if scaled down could be compareable to the P2P networks. 90% of content on the internet is provided by less than 10% of computers connected.

The people at http://www.niiip.org/ have amazing documents with regard to security and how the infrastructure of the internet works. Well worth a read.

Another good spot for information, though slightly tainted, is http://www.iisweb.com/. They offer a skewed view of security, as well as some examples of "Worse Case Senarios"

Replication has its own dangers

[fleabag]

The idea that just because storage is distributed, then it is secure, is only partially true.

If your data is distributed, and one server gets taken out, then fine, you still have service, and the downed server can be re-synched.

If your data is distributed, and someone updates it, then the update is faithfully replicated - even if it is wrong. I work for a company that has its Lotus Notes address database distributed across > 50 locations. One of these would probably survive World War III. Unfortunately, a few years ago, none of them survived a deletion, followed by automatic replication. Took us down for a day, becuase the tapes were only in 1 location.

Of course, you could skip the replication. The you have the non-trivial problem of finding the latest version.

Re:What's new about it

[Salamander]

The Rice connection almost certainly has to do with Peter Druschel and Pastry (for which the other PI seems to be Antony Rowstron of Microsoft Research, interestingly enough). I'm not totally sure of the ICSI connection, but they seem to be closely affiliated with UCB and I know that Ion Stoica works in these areas. OceanStore, CFS/SFS, Pastry, Kademlia - it's definitely a pretty good collection. A lot of the top people in DHT/DOLR (Distributed Hash Table, Distributed Object Location and Routing) research are involved, and I'd love to know how they plan to converge their various efforts toward a common solution.

Re:Obviously then...

[pe1rxq]

Or something really decentralized...
Most of the internet indeed is decentralized, but take out the root servers and the internet is gone...

Jeroen