ReDS: A Framework for Reputation-Enhanced DHTs

Distributed Hash Tables (DHTs) such as Chord and Kademlia offer an efficient solution for locating resources in peer-to-peer networks. Unfortunately, malicious nodes along a lookup path can easily subvert such queries. Several systems, including Halo (based on Chord) and Kad (based on Kademlia), mitigate such attacks by using a combination of redundancy and diversity in the paths taken by redundant lookup queries. Much greater assurance can be provided, however. We describe Reputation for Directory Services (ReDS), a framework for enhancing lookups in redundant DHTs by tracking how well other nodes service lookup requests. We describe how the ReDS technique can be applied to virtually any redundant DHT including Halo and Kad. We also study the collaborative identification and removal of bad lookup paths in a way that does not rely on the sharing of reputation scores — we show that such sharing is vulnerable to attacks that make it unsuitable for most applications of ReDS. Through extensive simulations we demonstrate that ReDS improves lookup success rates for Halo and Kad by 80% or more over a wide range of conditions, even against strategic attackers attempting to game their reputation scores and in the presence of node churn.

💡 Research Summary

Distributed Hash Tables (DHTs) such as Chord and Kademlia are widely used for locating resources in peer‑to‑peer (P2P) systems because they provide logarithmic‑time lookups without central coordination. However, the very decentralisation that makes DHTs attractive also opens the door to routing attacks: a malicious node that lies on a lookup path can return incorrect values, drop the request, or otherwise degrade the success probability of the operation. Existing mitigation techniques—most notably Halo (a Chord‑based system) and Kad (a Kademlia‑based system)—address this problem by issuing multiple redundant lookups along diverse paths. While redundancy improves resilience, it does not eliminate the risk when a substantial fraction of the network is compromised or when attackers strategically position their nodes on the most frequently traversed routes.

The paper introduces Reputation for Directory Services (ReDS), a framework that augments any redundant DHT with a lightweight, locally‑maintained reputation system. The core idea is simple: each node records the outcome of every lookup it participates in and uses this history to compute a trust score for each of its neighbours. A successful lookup (i.e., the final result matches the expected key) generates a positive feedback entry for every intermediate node; a failed lookup or a detected misbehaviour generates a negative entry. These feedbacks are aggregated using an exponentially weighted moving average (EWMA) so that recent behaviour has more influence while still preserving a memory of past interactions.

ReDS does not rely on global reputation dissemination. Instead, each node updates its own view of neighbours based solely on direct observations. This design choice eliminates the attack surface associated with reputation sharing, where Sybil or colluding adversaries could fabricate high scores for malicious peers or launch “reputation‑gaming” attacks. By keeping reputation strictly local, a malicious node can only improve its score by actually behaving correctly for a sufficient number of lookups, which inevitably reduces its ability to launch large‑scale attacks.

The framework modifies the lookup algorithm in two stages. First, a candidate set of next‑hop nodes is assembled using the underlying DHT’s routing tables (finger tables in Chord, k‑buckets in Kademlia). Second, the candidates are ranked by their reputation scores; the top‑N nodes are kept for diversity, and a node is selected from this subset with a probability proportional to its reputation. This approach preserves the redundancy and path diversity of the original systems while biasing the selection toward trustworthy peers. The authors demonstrate concrete integration steps for both Halo and Kad: in Halo, each finger entry is annotated with a reputation weight, and the lookup routine prefers higher‑weight fingers; in Kad, the distance metric (XOR) is combined with the reputation weight to rank bucket entries.

A comprehensive simulation campaign evaluates ReDS under a wide range of adverse conditions. The authors vary the proportion of malicious nodes (10 %–30 %), the attack strategy (random placement, strategic placement on high‑traffic fingers/k‑buckets, Sybil attacks), and churn rates (nodes joining and leaving with an average session time of 30 minutes). Across all scenarios, ReDS consistently raises the lookup success probability by at least 80 % compared with the baseline redundant DHTs. Notably, even when attackers concentrate their nodes on the most popular routing entries, the reputation‑guided selection quickly learns to avoid those paths, and the success rate remains substantially higher than in the non‑reputation case. The simulations also show that attempts to game the reputation system are self‑defeating: an attacker that occasionally behaves correctly to boost its score will soon be penalised when it resumes malicious activity, causing its reputation to decay rapidly and leading to its exclusion from future lookup paths.

The paper discusses several practical considerations. Because reputation is computed locally, new nodes start with no history and may initially be treated conservatively; this “cold‑start” effect can be mitigated by assigning a modest default score or by allowing a short observation window before making strong decisions. The memory and CPU overhead of maintaining per‑neighbour EWMA scores is modest (the authors report less than 5 % additional resource consumption in their experiments). The authors also acknowledge that a massive, coordinated influx of malicious nodes could cause a temporary dip in performance, but the feedback loop restores stability as honest nodes accumulate positive evidence.

In conclusion, ReDS offers a pragmatic, deployment‑friendly enhancement to existing DHTs. By coupling redundancy with a locally‑derived reputation metric, it dramatically improves resilience against routing attacks without requiring major protocol redesigns or centralized trust authorities. Future work suggested by the authors includes exploring boot‑strapping mechanisms for new nodes, extending reputation to account for load‑balancing and latency, and investigating integration with blockchain‑based immutable audit logs to further harden the system against sophisticated adversaries.