A look at LionShare

Peer-to-peer (P2P) technologies have been continually vilified, not to mention legally challenged, by the entertainment industry and other groups as a haven for anonymously sharing digital content illegally. The LionShare project seeks to legitimize P2P as an academic resource by doing away with anonymous file-sharing and adding features appropriate to an educational environment. LionShare is in development at Penn State University thanks to a grant from the Andrew W. Mellon Foundation. To get up to speed on LionShare, we talked with four members of the LionShare team, project leader Mike Halm and LionShare developers Alex Valentine, Lorin Metzger and Derek Morr.

The major influence for the LionShare project was the Visual Image User Study (VIUS) that was completed last September. LionShare came from a proof-of-concept prototype developed during work on VIUS. The project now has a $1.1 million grant from the Andrew W. Mellon Foundation to develop LionShare 1.0. The grant started last year on October 1, and the team plans to have the 1.0 release ready by September 30, 2005. The first public release alpha went live at the end of September.

LionShare differs from traditional P2P networks in a number of ways. First and foremost, LionShare is designed to be a private, secure network. LionShare users will communicate with "PeerServers" to provide file sharing even when users are not online and for centralized management. The PeerServers will allow users to make files available to others authorized to retrieve the files, or even just as a backup of local files they wish to have available from multiple locations. Morr did note that the software will feature user quotas, to ensure that users do not abuse the backup features.

The software will also feature collaboration tools, such as P2P chat, not present in some file sharing utilities. Authentication will not be required for a user to search the network, but authentication will be necessary to actually retrieve or share files. The LionShare white paper also calls for the LionShare client to provide organizational features as well as search and retrieval capability already present in clients like LimeWire. The LionShare will allow users to search their own filesystems, though Morr pointed out that LionShare's organizational features are not as comprehensive as tools like Beagle or Apple's SpotLight.

At this point, however, LionShare's codebase is still in an alpha state. Morr said that the current alpha that's available on the website is missing the security components that will set LionShare apart from other P2P networks. Metzger noted that the next release should have the security integration, though the release will still be an alpha release.

LionShare is based on the LimeWire 4.0 codebase using a modified Gnutella protocol, and is entirely written in Java. The client and server software are available under the GNU General Public License, while the SASL-CA software is under a BSD-type license. At this point, the LionShare team said that there are "some discussions here and there" between the LionShare developers and the LimeWire developers, but not a "concrete, everyday partnership," but that the LimeWire developers are pleased to see their codebase being used in other projects.

Since the LionShare source code is available, how will the developers ensure that others aren't able to utilize the source to build anonymous LionShare client software? According to Morr, it wouldn't matter if someone were to tamper with the client software. "In order to get any kind of public file, you have to certify or authenticate...the other end wouldn't authorize you to access the file."

In addition to requiring authentication, LionShare is designed to allow file restriction based on identity or user roles. Users will be able to set Access Control Lists (ACLs) to restrict sharing of a file to individual users, groups or to all authenticated members. Morr said that the attributes will come from the authentication servers, so that the institutions running LionShare servers will be able to fine-tune the criteria for file sharing. One potential hurdle for educational institutions looking to join a LionShare network is the lack of a standardized schema for ACLs. Morr acknowledged that each institution was likely to have its own schema at the moment, that wouldn't be compatible with other institutions. However, a standardized LDAP schema for higher education called eduPerson is being developed by Internet2, a partner organization for LionShare.

Morr also pointed out that LionShare was designed to allow users to authenticate against a number of different sources. He said that the project was doing a lot of work to make LionShare work with "whatever authentication you have," including LDAP directories and Kerberos sources. Morr said that LionShare should be compatible with Microsoft's Active Directory as well, though they haven't tested that as of yet.

We also asked whether LionShare would protect authorized users from accidentally sharing sensitive or personal files with the wrong set of users. For example, could LionShare prevent a user from accidentally sharing all of their files with all authenticated LionShare users? The LionShare developers said that they had thought about this, and would try to solve the problem with by having "a good UI" that would let users know that they were sharing files.

Whether LionShare will catch on beyond the academic setting is anyone's guess. There are valid reasons for integrating authentication into P2P for academic or business uses, but that approach will become unwieldy for larger P2P uses such as downloading Linux ISOs. We'll be watching the development of LionShare with interest, and are looking forward to further releases to evaluate how useful the project will be in the long run.

---

(Log in to post comments)