Anonymous Communication -- a brief survey

1
Anonymous Communication -- a brief survey

• Pan Wang
• North Carolina State University

2
Outline

• Why anonymous communication
• Definitions of anonymities
• Traffic analysis attacks
• Some anonymous communication protocols for
  Internet
• Some anonymous communication schemes for MANET
  and sensor networks
• Potential research problems

3
Why Anonymous Communication

• Privacy issue
• Some covert missions may require anonymous
  communication
• In hostile environments, end-hosts may need
  hidden their communications to against being
  captured

4
Anonymity in terms of unlinkability

• Sender anonymity
• A particular message is not linkable to any
  sender and that to a particular sender, no
  message is linkable
• Recipient anonymity
• A particular message cannot be linked to any
  recipient and that to a particular recipient, no
  message is linkable
• Relationship anonymity
• The sender and the recipient cannot be identified
  as communicating with each other, even though
  each of them can be identified as participating
  in some communication.
• A. Pfizmann and M. Waidner, Networks without User
  Observability. Computers Security 6/2 (1987)
  158-166

5
Traffic Analysis Attacks against an Anonymous
Communication System

• Contextual attacks
• Communication pattern attacks
• Packet counting attacks
• Intersection attack
• Brute force attack
• Node flushing attack
• Timing attacks
• Massage tagging attack
• On flow marking attack

6
Some Anonymous Communication Protocols for
Internet

• Mix-NET
• Feb 1981, D. Chaum
• Crowd
• June 1997, Michael K. Reiter and Aviel D. Rubin
• Tarzan
• Nov 2002, Michael J. Freedman and Robert Morris
• K-Anonymous Message Transmission
• Oct, 2003, Luis von Ahn, Andrew Bortz and
  Nicholas J. Hopper

7
Mix-NET

• Basic idea
• Traffic sent from sender to destination should
  pass one or more Mixes
• Mix relays data from different end-to-end
  connections, reorder and re-encrypt the data
• So, incoming and outgoing traffic cannot be
  related
• D. Chaum, Untraceable Electric Mail, Return
  Address and Digital Pseudonyms, Communication of
  A.C.M 24.2 (Feb 1981), 84-88

8
Mix-NET (cont-1)
9
Mix-NET (cont-2)

• MIX1

• MIX2

• MIX3

Trust one mix server the entire Mix-NET
provides anonymity
10
Crowds

• P2P anonymizer network for Web Transactions
• Uses a trusted third party (TTP) as centralized
  crowd membership server (blender)
• Provides sender anonymity and relationship
  anonymity
• M. Reiter and A. Rubin, Crowd Anonymity for
  Web Transactions. ACM Transactions on Information
  and System Security, 1(1) June 1998

11
Crowd (cont)
A nodes decide randomly whether to forward the
request to another node or to send it to the
server
Webserver
12
Tarzan

• All nodes act as relays, Mix-net encoding
• Each node selects a set of mimics
• Tunneling data traffic through mimics
• Exchanging cover traffic with mimics
• Constant packet sending rate and uniformed packet
  size
• Network address translator
• Anonymity against corrupt relays and global
  eavesdropping
• M. Freedman and R. Morris, Tarzan A Peer-to-Peer
  Anonymizing Network Layer, CCS 2002, Washington DC

13
Tarzan (cont-1)
14
Tarzan (Cont-2)
15
k-Anonymous Message Transmission

• Based on secure multiparty sum protocol
• Local group broadcast
• The adversaries, trying to determine the
  sender/receiver of a particular message, cannot
  narrow down its search to a set of k suspects
• Robust against selective non-participations
• L.Ahn, A.Bortz and N.Hopper, k-Anonymous Message
  Transmission, CCS 2003, Washington DC

16
k-Anonymous Message Transmission (cont)

• Group-D

• Group-S

17
Some anonymous communication schemes for MANET
and sensor networks

• Anonymous on demand routing (ANODR)
• Jun 2003, Jiejun Kong and Xiaoyan Hong
• Phantom flooding protocol
• Jun 2005, Pandurang Kamat, Yanyong Zhang, Wade
  Trappe and Celal Ozturk

18
ANODR

• Assuming salient adversaries
• Broadcast with trapdoor
• Route pseudonym
• J.Kong and X.Hong, ANODR Anonymous On Demand
  Routing with Untraceable for Mobile Ad-hoc
  Networks, MobiHoc, 2003, Annapolis, MD

19
ANODR (cont)
20
Source-Location Privacy in Sensor network

• Network model
• A sensor reports its measurement to a centralized
  base station (sink)
• Attack model
• Adversaries may use RF localization to hop-by-hop
  traceback to the sources location
• Why location privacy

21
Phantom Flooding Protocol

• Random work plus local broadcast
• P. Kamat, et. al., Enhancing Source-Location
  Privacy in Sensor Network Routing, ICDCS 2005,
  Columbus, OH

22
Potential Research Problems

• Anonymity vs accountability
• Detect malicious users
• Efficiency vs anonymity
• More?

23
Questions?