Subject: [ppsp] Re: Re: RE: ***SPAM*** 8.537 (5) 答复: Adding the security requirement for dataintergri

From: Ning Zong <[email-masked]>
Date: Wed, 30 Mar 2011 23:21:34 +0200

I will do it later.

Hi Lingli,
    I think it would be more suitable to add some words in the requirement draft rather than in the PS draft because we are missing one requirement item in the former draft. In the PS draft,what we need is a general discription on the problem rather than the requirements.
    Thanks.

BR
Yunfei

zhangyunfei
2011-03-31

发件人： Schmidt, Christian 1. (NSN - DE/Munich)
发送时间： 2011-03-30 16:23:30
收件人： ext 邓灵莉/denglingli; Ning Zong; zhangyunfei; [email-masked]
抄送： Carl Williams
主题： RE: [ppsp] ***SPAM*** 8.537 (5) 答复: Adding the security requirement for dataintergri

Hi Lingli Deng, Yunfei and Ning Zong,
I like your proposal. Perhaps one minor think, what do you mean with
in case of distrustful tracker/peer distribution
 
Am I right, that you do not mean, that the distribution is distrustful, but the tracker or one or more peers? What about
in case of distrustful tracker/peers
 
BR
Christian

From: [email-masked] [mailto:[email-masked]] On Behalf Of ext ???/denglingli
Sent: Wednesday, March 30, 2011 3:55 AM
To: 'Ning Zong'; 'zhangyunfei'; [email-masked]
Cc: 'Carl Williams'
Subject: [ppsp] ***SPAM*** 8.537 (5) 答复: Adding the security requirement for data intergrity check in the PPSPrequirement draft
 
Hi Yunfei, Ning Zong and Christian
 
I agree with Christian’s initial proposal for the peer protocol security issues to 
address the integrity check requirement as follows: (with minor modification 
according to some later discussion)
 
Current text:
 
   Similar to the behaviour in the tracker-peer interaction, malicious
   peers may also create fake information on chunk availability and
   exchange it with other peers. Some techniques to check the data
   integrity (e.g., using checksum) may be useful for detecting the data.
   But this part is out of scope of PPSP.
 
Proposed new text:   
 
   Similar to the behaviour in the tracker-peer interaction, malicious
   peers may also create fake information on chunk availability and
   exchange it with other peers. 
 
   Malicious peers can also modify stream contents. Some techniques 
   are available and useful to check the data integrity (e.g., using checksum).
   The related information can be received from the tracker/peer via the 
tracker/peer protocol.   Additional mechanism will be needed to ensure the
authenticity of the checksum information in case of distrustful tracker/peer 
distribution. The selection of a certain mechanism for this purpose is out of 
scope for PPSP.
 
BR
Lingli Deng
 
发件人: [email-masked] [mailto:[email-masked]] 代表 Ning Zong
发送时间: 2011年3月29日 16:48
收件人: zhangyunfei; [email-masked]
抄送: Carl Williams
主题: Re: [ppsp] Adding the security requirement for data intergrity check in the PPSPrequirement draft
 
Hi，all,
 
I agree this data integrity check is important. Just want to hear more opinion on whether to put each kind of secury check as separated requirement item?
Thanks.
 
BR,
Ning Zong

Hi all,
    As has added in the new version of problem statement on the security treat from the malicious peer to report fake information, shall we add the security requirement for data integrity check in the PPSP requirement draft?
    I notice that the current requirment draft has mentioned the requirement to detect the malicious peers, but regarding data integrity check, current draft doesn't include the requirement.
 
BR
Yunfei

zhangyunfei
2011-03-29