Hang with your buddies to resist intersection attacks

Abstract

Some anonymity schemes might in principle protect users from pervasive network surveillance-but only if all messages are independent and unlinkable. Users in practice often need pseudonymity-sending messages intentionally linkable to each other but not to the sender-but pseudonymity in dynamic networks exposes users to intersection attacks. We present Buddies, the first systematic design for intersection attack resistance in practical anonymity systems. Buddies groups users dynamically into buddy sets, controlling message transmission to make buddies within a set behaviorally indistinguishable under traffic analysis. To manage the inevitable tradeoffs between anonymity guarantees and communication responsiveness, Buddies enables users to select independent attack mitigation policies for each pseudonym. Using trace-based simulations and a working prototype, we find that Buddies can guarantee non-trivial anonymity set sizes in realistic chat/microblogging scenarios, for both short-lived and long-lived pseudonyms.

Anonymous Communication on the Internet

“…Intersection attacks are passive attacks which try to eavesdrop on traffic and find out the receiver of traffic. To defend against intersection attacks a system needs to implement some sort of buddies' architecture (Wolinsky et al, 2013).…”

“…In this attack it is assumed that a network user is typically in contact with a relative small number of other communicating parties (Danezis & Serjantov, 2005). Resistance against intersection attacks is obtained by the use of an extended anonymous communication scheme called Buddies architecture (Wolinsky, Syta, & Ford, 2013). In this communication architecture communication parties are dynamically grouped in buddy sets, for which communication is controlled in order to make buddies in a set indistinguishable from each other when network traffic is analyzed.…”

Riposte: An Anonymous Messaging System Handling Millions of Users

“…If an adversary can observe traffic patterns across many epochs, as the set of online clients changes, the adversary can make statistical inferences about which client is sending which stream of messages [39][40][41]. These "intersection" or "statistical disclosure" attacks affect many anonymity systems and defending against them is an important, albeit orthogonal, problem [41,42]. Even so, intersection attacks typically become more difficult to mount as the size of the anonymity set increases, so Riposte's support for very large anonymity sets makes it less vulnerable to these attacks than are many prior systems.…”

TARANET: Traffic-Analysis Resistant Anonymity at the Network Layer

“…Clients can minimize their risk by being online not only when they are actively communicating, but in general this attack is difficult to defend against through technical means. For further defenses, TARANET could be enhanced using existing solutions, such as dummy connections [15], or with the Buddies system [68], which allows clients to control which subset of pseudonyms appears online for a particular session. We leave analysis and evaluation of integration with such systems to future work.…”