Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 3
    Start by thinking of the why an attacker might want to hack the system, and the build it so those goals are unprofitable to break. That might mean configurable keys, limited visibility, reputation, web of trust or even something like proof of work. But it depends entirely on the application Commented Jan 12, 2021 at 2:58
  • 3
    In other words any secure internet system, including open source ones must assume all other nodes are potentially malicious, and not trust anything without some form of verification. Commented Jan 12, 2021 at 3:00
  • 2
    How does a Client know which Providers exist? How does a Provider know which Servers exist? You can't build those lists by scanning the internet, so those are your first line of defense. Commented Jan 12, 2021 at 6:41
  • @BartvanIngenSchenau I don't need to scan the Internet. I was thinking about initial list of IPs, so Client tries to connect any of Provider IP, and if success, then updates the IP list. Commented Jan 12, 2021 at 13:53
  • @user1937198 I think I understand what you mean. The first thought that comes to my mind is to use some kind of public-key cryptography, maybe RSA, so each node should check public keys of other nodes, and if public keys are invalid, or key owner node has suspicious behavior depending on metrics like count of requests, the node that performs the verification remembers this public key and block all requests signed with this it. That's looks like a good solution. Commented Jan 12, 2021 at 14:11