Search

A relatively simple safety-belt mechanism for improving DNS system availability and efficiency is proposed here. While it may seem ambitious, a careful examination shows it is both feasible and beneficial for the DNS system. The mechanism called "DNS Real-time Update" (DNSRU), a service that facilitates real-time and secure updates of cached domain records in DNS resolvers worldwide, even before the expiration of the corresponding Time To Live (TTL) values. This service allows Internet domain owners to quickly rectify any erroneous global IP address distribution, even if a long TTL value is associated with it. By addressing this critical DNS high availability issue, DNSRU eliminates the need for short TTL values and their associated drawbacks. Therefore, DNSRU DNSRU reduces the traffic load on authoritative servers while enhancing the system's fault tolerance. In this paper we show that our DNSRU design is backward compatible, supports gradual deployment, secure, efficient, and feasible.

We investigate the effect of omnipresent cloud storage on distributed computing. We specify a network model with links of prescribed bandwidth that connect standard processing nodes, and, in addition, passive storage nodes. Each passive node represents a cloud storage system, such as Dropbox, Google Drive etc. We study a few tasks in this model, assuming a single cloud node connected to all other nodes, which are connected to each other arbitrarily. We give implementations for basic tasks of collaboratively writing to and reading from the cloud, and for more advanced applications such as matrix multiplication and federated learning. Our results show that utilizing node-cloud links as well as node-node links can considerably speed up computations, compared to the case where processors communicate either only through the cloud or only through the network links. We provide results for general directed graphs, and for graphs with ``fat'' links between processing nodes. For the general case, we provide optimal algorithms for uploading and downloading files using flow techniques. We use these primitives to derive algorithms for \emph{combining}, where every processor node has an input value and the task is to compute a combined value under some given associative operator. In the case of fat links, we assume that links between processors are bidirectional and have high bandwidth, and we give near-optimal algorithms for any commutative combining operator (such as vector addition). For the task of matrix multiplication (or other non-commutative combining operators), where the inputs are ordered, we present sharp results in the simple ``wheel'' network, where procesing nodes are arranged in a ring, and are all connected to a single cloud node., Comment: Full version. Proceedings version in SSS 2021

This work presents a new distributed Byzantine tolerant federated learning algorithm, HoldOut SGD, for Stochastic Gradient Descent (SGD) optimization. HoldOut SGD uses the well known machine learning technique of holdout estimation, in a distributed fashion, in order to select parameter updates that are likely to lead to models with low loss values. This makes it more effective at discarding Byzantine workers inputs than existing methods that eliminate outliers in the parameter-space of the learned model. HoldOut SGD first randomly selects a set of workers that use their private data in order to propose gradient updates. Next, a voting committee of workers is randomly selected, and each voter uses its private data as holdout data, in order to select the best proposals via a voting scheme. We propose two possible mechanisms for the coordination of workers in the distributed computation of HoldOut SGD. The first uses a truthful central server and corresponds to the typical setting of current federated learning. The second is fully distributed and requires no central server, paving the way to fully decentralized federated learning. The fully distributed version implements HoldOut SGD via ideas from the blockchain domain, and specifically the Algorand committee selection and consensus processes. We provide formal guarantees for the HoldOut SGD process in terms of its convergence to the optimal model, and its level of resilience to the fraction of Byzantine workers. Empirical evaluation shows that HoldOut SGD is Byzantine-resilient and efficiently converges to an effectual model for deep-learning tasks, as long as the total number of participating workers is large and the fraction of Byzantine workers is less than half (<1/3 for the fully distributed variant)., Comment: 12 pages, 2 figures

This paper exposes a new vulnerability and introduces a corresponding attack, the NoneXistent Name Server Attack (NXNSAttack), that disrupts and may paralyze the DNS system, making it difficult or impossible for Internet users to access websites, web e-mail, online video chats, or any other online resource. The NXNSAttack generates a storm of packets between DNS resolvers and DNS authoritative name servers. The storm is produced by the response of resolvers to unrestricted referral response messages of authoritative name servers. The attack is significantly more destructive than NXDomain attacks (e.g., the Mirai attack): i) It reaches an amplification factor of more than 1620x on the number of packets exchanged by the recursive resolver. ii) In addition to the negative cache, the attack also saturates the 'NS' section of the resolver caches. To mitigate the attack impact, we propose an enhancement to the recursive resolver algorithm, MaxFetch(k), that prevents unnecessary proactive fetches. We implemented the MaxFetch(1) mitigation enhancement on a BIND resolver and tested it on real-world DNS query datasets. Our results show that MaxFetch(1) degrades neither the recursive resolver throughput nor its latency. Following the discovery of the attack, a responsible disclosure procedure was carried out, and several DNS vendors and public providers have issued a CVE and patched their systems.

A new scalable ISP level system architecture to secure and protect all IoT devices in a large number of homes is presented. The system is based on whitelisting, as in the Manufacturer Usage Description (MUD) framework, implemented as a VNF. Unlike common MUD suggestions that place the whitelist application at the home/enterprise network, our approach is to place the enforcement upstream at the provider network, combining an NFV (Network Function Virtualization) with router/switching filtering capabilities, e.g., ACLs. The VNF monitors many home networks simultaneously, and therefore, is a highly-scalable managed service solution that provides both the end customers and the ISP with excellent visibility and security of the IoT devices at the customer premises. The system includes a mechanism to distinguish between flows of different devices at the ISP level despite the fact that most home networks (and their IoT devices) are behind a NAT and all the flows from the same home come out with the same source IP address. Moreover, the NFV system needs to receive only the first packet of each connection at the VNF, and rules space is proportional to the number of unique types of IoT devices rather than the number of IoT devices. The monitoring part of the solution is off the critical path and can also uniquely protect from incoming DDoS attacks. To cope with internal traffic, that is not visible outside the customer premise and often consists of P2P communication, we suggest a hybrid approach, where we deploy a lightweight component at the CPE, whose sole purpose is to monitor P2P communication. As current MUD solution does not provide a secure solution to P2P communication, we also extend the MUD protocol to deal also with peer-to-peer communicating devices. A PoC with a large national level ISP proves that our technology works as expected.

We think of a tournament $T=([n], E)$ as a communication network where in each round of communication processor $P_i$ sends its information to $P_j$, for every directed edge $ij \in E(T)$. By Landau's theorem (1953) there is a King in $T$, i.e., a processor whose initial input reaches every other processor in two rounds or less. Namely, a processor $P_{\nu}$ such that after two rounds of communication along $T$'s edges, the initial information of $P_{\nu}$ reaches all other processors. Here we consider a more general scenario where an adversary selects an arbitrary series of tournaments $T_1, T_2,\ldots$, so that in each round $s=1, 2, \ldots$, communication is governed by the corresponding tournament $T_s$. We prove that for every series of tournaments that the adversary selects, it is still true that after two rounds of communication, the initial input of at least one processor reaches everyone. Concretely, we show that for every two tournaments $T_1, T_2$ there is a vertex in $[n]$ that can reach all vertices via (i) A step in $T_1$, or (ii) A step in $T_2$ or (iii) A step in $T_1$ followed by a step in $T_2$. }

Until now, distributed algorithms for rational agents have assumed a-priori knowledge of $n$, the size of the network. This assumption is challenged here by proving how much a-priori knowledge is necessary for equilibrium in different distributed computing problems. Duplication - pretending to be more than one agent - is the main tool used by agents to deviate and increase their utility when not enough knowledge about $n$ is given. The a-priori knowledge of $n$ is formalized as a Bayesian setting where at the beginning of the algorithm agents only know a prior $\sigma$, a distribution from which they know $n$ originates. We begin by providing new algorithms for the Knowledge Sharing and Coloring problems when $n$ is a-priori known to all agents. We then prove that when agents have no a-priori knowledge of $n$, i.e., the support for $\sigma$ is infinite, equilibrium is impossible for the Knowledge Sharing problem. Finally, we consider priors with finite support and find bounds on the necessary interval $[\alpha,\beta]$ that contains the support of $\sigma$, i.e., $\alpha \leq n \leq \beta$, for which we have an equilibrium. When possible, we extend these bounds to hold for any possible protocol., Comment: This paper is the full version of the DISC 2018 paper. arXiv admin note: substantial text overlap with arXiv:1711.04728

In this paper we present three attacks on private internal networks behind a NAT and a corresponding new protection mechanism, Internal Network Policy, to mitigate a wide range of attacks that penetrate internal networks behind a NAT. In the attack scenario, a victim is tricked to visit the attacker's website, which contains a malicious script that lets the attacker access the victim's internal network in different ways, including opening a port in the NAT or sending a sophisticated request to local devices. The first attack utilizes DNS Rebinding in a particular way, while the other two demonstrate different methods of attacking the network, based on application security vulnerabilities. Following the attacks, we provide a new browser security policy, Internal Network Policy (INP), which protects against these types of vulnerabilities and attacks. This policy is implemented in the browser just like Same Origin Policy (SOP) and prevents malicious access to internal resources by external entities.

Is there an equilibrium for distributed consensus when all agents except one collude to steer the decision value towards their preference? If an equilibrium exists, then an $n-1$ size coalition cannot do better by deviating from the algorithm, even if it prefers a different decision value. We show that an equilibrium exists under this condition only if the number of agents in the network is odd and the decision is binary (among two possible input values). That is, in this framework we provide a separation between binary and multi-valued consensus. Moreover, the input and output distribution must be uniform, regardless of the communication model (synchronous or asynchronous). Furthermore, we define a new problem - Resilient Input Sharing (RIS), and use it to find an {\em iff} condition for the $(n-1)$-resilient equilibrium for deterministic binary consensus, essentially showing that an equilibrium for deterministic consensus is equivalent to each agent learning all the other inputs in some strong sense. Finally, we note that $(n-2)$-resilient equilibrium for binary consensus is possible for any $n$. The case of $(n-2)$-resilient equilibrium for \emph{multi-valued} consensus is left open.

This paper studies a variant of the \emph{leader election} problem under the \emph{stone age} model (Emek and Wattenhofer, PODC 2013) that considers a network of $n$ randomized finite automata with very weak communication capabilities (a multi-frequency asynchronous generalization of the \emph{beeping} model's communication scheme). Since solving the classic leader election problem is impossible even in more powerful models, we consider a relaxed variant, referred to as \emph{$k$-leader selection}, in which a leader should be selected out of at most $k$ initial candidates. Our main contribution is an algorithm that solves $k$-leader selection for bounded $k$ in the aforementioned stone age model. On (general topology) graphs of diameter $D$, this algorithm runs in $\tilde{O}(D)$ time and succeeds with high probability. The assumption that $k$ is bounded turns out to be unavoidable: we prove that if $k = \omega (1)$, then no algorithm in this model can solve $k$-leader selection with a (positive) constant probability., Comment: To appear in DISC 2018

The question of what global information must distributed rational agents a-priori know about the network in order for equilibrium to be possible is researched here. Until now, distributed algorithms with rational agents have assumed that $n$, the size of the network, is a-priori known to the participants. We investigate the above question, considering different distributed computing problems and showing how much each agent must a-priori know about $n$ in order for distributed algorithms to be equilibria. The main tool considered throughout the paper is the advantage an agent may gain by duplication- pretending to be more than one agent. We start by proving that when no bound on $n$ is given equilibrium for Coloring and Knowledge Sharing is impossible. %We prove that when agents have no a-priori knowledge on $n$, or even a known bound, equilibrium for both Knowledge Sharing and Coloring is impossible. We provide new algorithms for both problems when $n$ \emph{is} a-priori known to all agents, thus showing that there are algorithms in which the only way for an agent to gain an advantage is duplication. We further show that for each distributed problem there is an a-priori known range, an upper and a lower bound on $n$, such that if the actual $n$ is guaranteed to lay in that range, equilibrium is possible. By providing equilibria for a specific range, and impossibility results for any larger range, we prove the tight range necessary for equilibrium in: Leader Election, Knowledge Sharing, Coloring, Partition and Orientation.

This paper introduces the atomic Write and Read Next ($\text{WRN}_{k}$) deterministic shared memory object, that for any $k\ge3$, is stronger than read-write registers, but is unable to implement $2$-processor consensus. In particular, it refutes the conjecture claiming that every deterministic object of consensus number $1$ is computationally equivalent to read-write registers., Comment: 8 pages

Efficient algorithms and techniques to detect and identify large flows in a high throughput traffic stream in the SDN match-and-action model are presented. This is in contrast to previous work that either deviated from the match and action model by requiring additional switch level capabilities or did not exploit the SDN data plane. Our construction has two parts; (a) how to sample in an SDN match and action model, (b) how to detect large flows efficiently and in a scalable way, in the SDN model. Our large flow detection methods provide high accuracy and present a good and practical tradeoff between switch - controller traffic, and the number of entries required in the switch flow table. Based on different parameters, we differentiate between heavy flows, elephant flows and bulky flows and present efficient algorithms to detect flows of the different types. Additionally, as part of our heavy flow detection scheme, we present sampling methods to sample packets with arbitrary probability $p$ per packet or per byte that traverses an SDN switch. Finally, we show how our algorithms can be adapted to a distributed monitoring SDN setting with multiple switches, and easily scale with the number of monitoring switches.

Motivated by a recent new type of randomized Distributed Denial of Service (DDoS) attacks on the Domain Name Service (DNS), we develop novel and efficient distinct heavy hitters algorithms and build an attack identification system that uses our algorithms. Heavy hitter detection in streams is a fundamental problem with many applications, including detecting certain DDoS attacks and anomalies. A (classic) heavy hitter (HH) in a stream of elements is a key (e.g., the domain of a query) which appears in many elements (e.g., requests). When stream elements consist of a pairs, () a distinct heavy hitter (dhh) is a key that is paired with a large number of different subkeys. Our dHH algorithms are considerably more practical than previous algorithms. Specifically the new fixed-size algorithms are simple to code and with asymptotically optimal space accuracy tradeoffs. In addition we introduce a new measure, a combined heavy hitter (cHH), which is a key with a large combination of distinct and classic weights. Efficient algorithms are also presented for cHH detection. Finally, we perform extensive experimental evaluation on real DNS attack traces, demonstrating the effectiveness of both our algorithms and our DNS malicious queries identification system.

Pheromones are a chemical substance produced and released by ants as means of communication. In this work we present the minimum amount of pheromones necessary and sufficient for a colony of ants (identical mobile agents) to deterministically find a food source (treasure), assuming that each ant has the computational capabilities of either a Finite State Machine (FSM) or a Turing Machine (TM). In addition, we provide pheromone-based foraging algorithms capable of handling fail-stop faults. In more detail, we consider the case where $k$ identical ants, initially located at the center (nest) of an infinite two-dimensional grid and communicate only through pheromones, perform a collaborative search for an adversarially hidden treasure placed at an unknown distance $D$. We begin by proving a tight lower bound of $\Omega(D)$ on the amount of pheromones required by any number of FSM based ants to complete the search, and continue to reduce the lower bound to $\Omega(k)$ for the stronger ants modeled as TM. We provide algorithms which match the aforementioned lower bounds, and still terminate in optimal $\mathcal{O}(D + D^2 / k)$ time, under both the synchronous and asynchronous models. Furthermore, we consider a more realistic setting, where an unknown number $f < k$ of ants may fail-stop at any time; we provide fault-tolerant FSM algorithms (synchronous and asynchronous), that terminate in $\mathcal{O}(D + D^2/(k-f) + Df)$ rounds and emit no more than the same asymptotic minimum number of $\mathcal{O}(D)$ pheromones overall.

Using elementary distributed computing techniques we suggest an explanation for two unexplained phenomena in regards to ant colonies, (a) a substantial amount of ants in an ant colony are idle, and (b) the observed low survivability of new ant colonies in nature. Ant colonies employ task allocation, in which ants progress from one task to the other, to meet changing demands introduced by the environment. Extending the biological task allocation model given in [Pacala, Gordon and Godfray 1996] we present a distributed algorithm which mimics the mechanism ants use to solve task allocation efficiently in nature. Analyzing the time complexity of the algorithm reveals an exponential gap on the time it takes an ant colony to satisfy a certain work demand with and without idle ants. We provide an $O(\ln n)$ upper bound when a constant fraction of the colony are idle ants, and a contrasting lower bound of $\Omega(n)$ when there are no idle ants, where $n$ is the total number of ants in the colony.

In the {\em Musical Chairs} game $MC(n,m)$ a team of $n$ players plays against an adversarial {\em scheduler}. The scheduler wins if the game proceeds indefinitely, while termination after a finite number of rounds is declared a win of the team. At each round of the game each player {\em occupies} one of the $m$ available {\em chairs}. Termination (and a win of the team) is declared as soon as each player occupies a unique chair. Two players that simultaneously occupy the same chair are said to be {\em in conflict}. In other words, termination (and a win for the team) is reached as soon as there are no conflicts. The only means of communication throughout the game is this: At every round of the game, the scheduler selects an arbitrary nonempty set of players who are currently in conflict, and notifies each of them separately that it must move. A player who is thus notified changes its chair according to its deterministic program. As we show, for $m\ge 2n-1$ chairs the team has a winning strategy. Moreover, using topological arguments we show that this bound is tight. For $m\leq 2n-2$ the scheduler has a strategy that is guaranteed to make the game continue indefinitely and thus win. We also have some results on additional interesting questions. For example, if $m \ge 2n-1$ (so that the team can win), how quickly can they achieve victory?, Comment: arXiv admin note: substantial text overlap with arXiv:1106.2065

We consider the problem of computing a maximal independent set (MIS) in an extremely harsh broadcast model that relies only on carrier sensing. The model consists of an anonymous broadcast network in which nodes have no knowledge about the topology of the network or even an upper bound on its size. Furthermore, it is assumed that an adversary chooses at which time slot each node wakes up. At each time slot a node can either beep, that is, emit a signal, or be silent. At a particular time slot, beeping nodes receive no feedback, while silent nodes can only differentiate between none of its neighbors beeping, or at least one of its neighbors beeping. We start by proving a lower bound that shows that in this model, it is not possible to locally converge to an MIS in sub-polynomial time. We then study four different relaxations of the model which allow us to circumvent the lower bound and find an MIS in polylogarithmic time. First, we show that if a polynomial upper bound on the network size is known, it is possible to find an MIS in O(log^3 n) time. Second, if we assume sleeping nodes are awoken by neighboring beeps, then we can also find an MIS in O(log^3 n) time. Third, if in addition to this wakeup assumption we allow sender-side collision detection, that is, beeping nodes can distinguish whether at least one neighboring node is beeping concurrently or not, we can find an MIS in O(log^2 n) time. Finally, if instead we endow nodes with synchronous clocks, it is also possible to find an MIS in O(log^2 n) time., Comment: arXiv admin note: substantial text overlap with arXiv:1108.1926

We consider synchronous dynamic networks which like radio networks may have asymmetric communication links, and are affected by communication rather than processor failures. In this paper we investigate the minimal message survivability in a per round basis that allows for the minimal global cooperation, i.e., allows to solve any task that is wait-free read-write solvable. The paper completely characterizes this survivability requirement. Message survivability is formalized by considering adversaries that have a limited power to remove messages in a round. Removal of a message on a link in one direction does not necessarily imply the removal of the message on that link in the other direction. Surprisingly there exist a single strongest adversary which solves any wait-free read/write task. Any different adversary that solves any wait-free read/write task is weaker, and any stronger adversary will not solve any wait-free read/write task. ABD \cite{ABD} who considered processor failure, arrived at an adversary that is $n/2$ resilient, consequently can solve tasks, such as $n/2$-set-consensus, which are not read/write wait-free solvable. With message adversaries, we arrive at an adversary which has exactly the read-write wait-free power. Furthermore, this adversary allows for a considerably simpler (simplest that we know of) proof that the protocol complex of any read/write wait-free task is a subdivided simplex, finally making this proof accessible for students with no algebraic-topology prerequisites, and alternatively dispensing with the assumption that the Immediate Snapshot complex is a subdivided simplex.

Humans are very good at optimizing solutions for specific problems. Biological processes, on the other hand, have evolved to handle multiple constrained distributed environments and so they are robust and adaptable. Inspired by observations made in a biological system we have recently presented a simple new randomized distributed MIS algorithm \cite{ZScience}. Here we extend these results by removing a number of strong assumptions that we made, making the algorithms more practical. Specifically we present an $O(\log^2 n)$ rounds synchronous randomized MIS algorithm which uses only 1 bit unary messages (a beeping signal with collision detection), allows for asynchronous wake up, does not assume any knowledge of the network topology, and assumes only a loose bound on the network size. We also present an extension with no collision detection in which the round complexity increases to $(\log^3 n)$. Finally, we show that our algorithm is optimal under some restriction, by presenting a tight lower bound of $\Omega(\log^2 n)$ on the number of rounds required to construct a MIS for a restricted model., Comment: have been submitted for publication

Communication is a crucial ingredient in every kind of collaborative work. But what is the least possible amount of communication required for a given task? We formalize this question by introducing a new framework for distributed computation, called {\em oblivious protocols}. We investigate the power of this model by considering two concrete examples, the {\em musical chairs} task $MC(n,m)$ and the well-known {\em Renaming} problem. The $MC(n,m)$ game is played by $n$ players (processors) with $m$ chairs. Players can {\em occupy} chairs, and the game terminates as soon as each player occupies a unique chair. Thus we say that player $P$ is {\em in conflict} if some other player $Q$ is occupying the same chair, i.e., termination means there are no conflicts. By known results from distributed computing, if $m \le 2n-2$, no strategy of the players can guarantee termination. However, there is a protocol with $m = 2n-1$ chairs that always terminates. Here we consider an oblivious protocol where in every time step the only communication is this: an adversarial {\em scheduler} chooses an arbitrary nonempty set of players, and for each of them provides only one bit of information, specifying whether the player is currently in conflict or not. A player notified not to be in conflict halts and never changes its chair, whereas a player notified to be in conflict changes its chair according to its deterministic program. Remarkably, even with this minimal communication termination can be guaranteed with only $m=2n-1$ chairs. Likewise, we obtain an oblivious protocol for the Renaming problem whose name-space is small as that of the optimal nonoblivious distributed protocol. Other aspects suggest themselves, such as the efficiency (program length) of our protocols. We make substantial progress here as well, though many interesting questions remain open., Comment: 25 pages