Tuesday, December 20, 2005

The Internet Is Broken -- Part 2

We can't keep patching the Internet’s security holes. Now computer scientists are proposing an entirely new architecture.

By David Talbot

Favorite

E-mail

This article -- the cover story in Technology Review’s December-January print issue -- has been divided into three parts for presentation online. This is part 2; part 1 appeared on December 19 and part 3 will appear on December 21.

In part 1, TR Chief Correspondent David Talbot argued that the "Internet has no inherent security architecture -- nothing to stop viruses or spam or anything else. Protections like firewalls and antispam software are add-ons, security patches in a digital arms race." Jonathan Zittrain, cofounder of the Berkman Center for Internet and Society at Harvard Law School, told Talbot that the Internet functions as well as it does only because of "the forbearance of the virus authors themselves." Here's more about why -- and how -- we might start to fix the problem.

Patchwork Problem
The Internet's original protocols, forged in the late 1960s, were designed to do one thing very well: facilitate communication between a few hundred academic and government users. The protocols efficiently break digital data into simple units called packets and send the packets to their destinations through a series of network routers. Both the routers and PCs, also called nodes, have unique digital addresses known as Internet Protocol or IP addresses. That's basically it. The system assumed that all users on the network could be trusted and that the computers linked by the Internet were mostly fixed objects.

The Internet's design was indifferent to whether the information packets added up to a malicious virus or a love letter; it had no provisions for doing much besides getting the data to its destination. Nor did it accommodate nodes that moved -- such as PDAs that could connect to the Internet at any of myriad locations. Over the years, a slew of patches arose: firewalls, antivirus software, spam filters, and the like. One patch assigns each mobile node a new IP address every time it moves to a new point in the network.

[Click here to view graphic representations of David D. Clark’s four goals for a new Internet architecture.]

Clearly, security patches aren't keeping pace. That's partly because different people use different patches and not everyone updates them religiously; some people don't have any installed. And the most common mobility patch -- the IP addresses that constantly change as you move around -- has downsides. When your mobile computer has a new identity every time it connects to the Internet, the websites you deal with regularly won't know it's you. This means, for example, that your favorite airline's Web page might not cough up a reservation form with your name and frequent-flyer number already filled out. The constantly changing address also means you can expect breaks in service if you are using the Internet to, say, listen to a streaming radio broadcast on your PDA. It also means that someone who commits a crime online using a mobile device will be harder to track down.

In the view of many experts in the field, there are even more fundamental reasons to be concerned. Patches create an ever more complicated system, one that becomes harder to manage, understand, and improve upon. "We've been on a track for 30 years of incrementally making improvements to the Internet and fixing problems that we see," says Larry Peterson, a computer scientist at Princeton University. "We see vulnerability, we try to patch it. That approach is one that has worked for 30 years. But there is reason to be concerned. Without a long-term plan, if you are just patching the next problem you see, you end up with an increasingly complex and brittle system. It makes new services difficult to employ. It makes it much harder to manage because of the added complexity of all these point solutions that have been added. At the same time, there is concern that we will hit a dead end at some point. There will be problems we can't sufficiently patch."

The Internet Is Broken -- Part 2

Comments

Current Issue

Magazine Services

Career Resources

MIT Technology Insider

Follow us on Twitter

More Technology News from

Wire Stories

Inside TechnologyReview.com