Balancing accountability and privacy in the network

Abstract

Though most would agree that accountability and privacy are both valuable, today's Internet provides little support for either. Previous efforts have explored ways to offer stronger guarantees for one of the two, typically at the expense of the other; indeed, at first glance accountability and privacy appear mutually exclusive. At the center of the tussle is the source address: in an accountable Internet, source addresses undeniably link packets and senders so hosts can be punished for bad behavior. In a privacy-preserving Internet, source addresses are hidden as much as possible.In this paper, we argue that a balance is possible. We introduce the Accountable and Private Internet Protocol (APIP), which splits source addresses into two separate fields -an accountability address and a return address -and introduces independent mechanisms for managing each. Accountability addresses, rather than pointing to hosts, point to accountability delegates, which agree to vouch for packets on their clients' behalves, taking appropriate action when misbehavior is reported. With accountability handled by delegates, senders are now free to mask their return addresses; we discuss a few techniques for doing so.

SVLAN: Secure & Scalable Network Virtualization

“…To this end, we should not require large amounts of state, e.g., per-host state, on verifiers. In addition, packet verification should not require additional communication overhead (e.g., a challenge-response protocol [2], [39]) for checking the validity of the segments.…”

MorphIT: Morphing Packet Reports for Internet Transparency

“…MorphIT shares a common vision with Network Confessional (NC) [11]: give ISPs an interface for supplying quality-of-service feedback to end users. Both proposals are different from approaches to Internet accountability that either resort to alternative Internet protocols, such as AIP [8] and APIP [32], or alternative designs of the whole Internet architecture, such as SCION [38]. However, unlike our system, NC does not target anonymity guarantees and may interfere with existing anonymous communication systems, Tor [6], by enabling global passive de-anonymization attacks [17,27,31].…”

Do You Know Where Your Headers Are? Comparing the Privacy of Network Architectures with Share Count Analysis

“…We want to support any architecture, and each architecture has a different header format. For example, the Accountable and Private Internet Protocol (APIP) [14] replaces IP's source addresses with two new addresses, a return address and an accountability address. Similarly, the Internet Indirection Infrastructure (i3) [16] uses a flow identifier in place of the ultimate destination.…”

“…Many techniques have been developed to prevent headers from leaking identity information (e.g., mixes, crowds, and onion routing). More recently, a number of network architectures have also focused on improving privacy [9,14,12]. However, none of these solutions can defend against an arbitrary adversary with unlimited capabilities.…”