[Paper Review] Preserving Peer Replicas By Rate-Limited Sampled Voting in LOCKSS

Petros Maniatis, Mema Roussopoulos+4 more|ArXiv.org|Mar 25, 2003

Internet Traffic Analysis and Secure E-voting31 references3 citations

TL;DR

This paper proposes a rate-limited, sampled voting protocol for the LOCKSS peer-to-peer digital preservation system that enhances resistance to long-term, powerful adversaries by combining rate limitation, intrinsic intrusion detection, and costly operations. The protocol ensures that even with unlimited computational resources, an attacker has only a minimal chance of causing undetected, irreversible corruption over decades, with simulations showing at most a 3.5% increase in corruption probability under worst-case conditions.

ABSTRACT

The LOCKSS project has developed and deployed in a world-wide test a peer-to-peer system for preserving access to journals and other archival information published on the Web. It consists of a large number of independent, low-cost, persistent web caches that cooperate to detect and repair damage to their content by voting in "opinion polls." Based on this experience, we present a design for and simulations of a novel protocol for voting in systems of this kind. It incorporates rate limitation and intrusion detection to ensure that even some very powerful adversaries attacking over many years have only a small probability of causing irrecoverable damage before being detected.

Motivation & Objective

• To address scalability and security limitations in existing LOCKSS opinion poll protocols for long-term digital preservation.
• To design a system resilient against powerful, persistent adversaries capable of subverting peers and launching sustained attacks over decades.
• To eliminate reliance on long-term secrets and stable identities, which are vulnerable in decentralized, long-lived systems.
• To ensure the system detects coherent corruption attempts early while minimizing false positives from random faults.
• To enable large-scale, low-cost deployment of peer-to-peer archival storage with strong reliability and attack resistance.

Proposed method

• The protocol uses rate-limited sampling of peers in opinion polls, restricting how often any single peer can vote to prevent overwhelming the system.
• It incorporates intrinsic intrusion detection by flagging polls with high contestation (close results), which indicate coherent damage from an attacker.
• All system operations, including failure detection and repair, are inherently time-consuming, providing 'inertia' that slows down adversarial actions.
• Peers must provide evidence of recent computational effort to influence poll outcomes, reducing the impact of spoofed identities.
• The system avoids third-party reputation systems and instead relies on direct observation and short-term secrets to validate peer participation.
• Simulations are used to evaluate resistance against three attack types: direct corruption, false alarm generation, and system slowdown.

Experimental results

Research questions

• RQ1 Can a peer-to-peer digital preservation system resist attacks by adversaries with unlimited computational resources over decades?
• RQ2 How can a system detect coherent corruption attempts across replicas without relying on long-term secrets or stable identities?
• RQ3 To what extent does rate limitation and costly operations reduce the effectiveness of adversarial attacks in large-scale, decentralized systems?
• RQ4 What is the maximum increase in corruption probability an attacker can achieve under worst-case conditions, such as controlling one-third of peers?
• RQ5 How does the system balance detection sensitivity to real attacks with resilience to random faults and false positives?

Key findings

• The system resists attacks by adversaries with unlimited sustained effort, preventing them from applying more effective effort than the legitimate peers.
• Even with an attacker controlling one-third of the peers, the probability of a reader receiving a damaged copy increases by no more than 3.5% in the worst case.
• Contested polls—indicative of coherent damage—trigger alarms, enabling detection of attacks before irreversible damage occurs.
• The system produces very few false positives due to random faults, as random damage leads to either landslide agreement or disagreement in polls.
• The protocol successfully scales to large deployments and maintains strong security without relying on long-term secrets or centralized control.
• Simulations confirm that the combination of rate limitation, intrinsic detection, and operational inertia provides robust defense over multi-decade timescales.