Project “anonymity and unobservability in the Internet”

Abstract

Abstract. It is a hard problem to achieve anonymity for real-time services in the Internet (e.g. Web access). All existing concepts fail when we assume a very strong attacker model (i.e. an attacker is able to observe all communication links). We also show that these attacks are realworld attacks. This paper outlines alternative models which mostly render these attacks useless. Our present work tries to increase the efficiency of these measures. 1ÊÊThe perfect system 1.1ÊÊ AttacksThe perfect anonymous communication system has to prevent the following attacks:1. Message coding attack: If messages do not change their coding during transmission they can be linked or traced. 2. Timing attack: An opponent can observe the duration of a specific communication by linking its possible endpoints and waiting for a correlation between the creation and/or release event at each possible endpoint. 3. Message volume attack: The amount of transmitted data (i.e. the message length) can be observed. Thus, a global observer is able to associate a communication relation to a certain client and server. 4. Flooding attack: Each message can only be anonymous in a group of sent messages. All senders of those messages form the anonymity group. Under normal circumstances, each sender should send one message per time interval. However, some of the existing concepts enable an attacker to flood the system in order to separate a certain message. 5. Intersection attack: Because of the on-line/off-line periods of the users an attacker may trace them by observation over a long period. 6. Collusion attack: A corrupt coalition of users or parts of the system may be able to trace certain users. Perfect means that there cannot occur a situation where an opponent gets valuable information concerning any communication relation or communication request from and to a certain user. However, no system can protect from an opponent with unlimited power. Therefore we assume that the opponent may not be able to break into cryptographic functions. Though, we have to consider that parts of the anonymous communication system may act as opponents (insider attacks). 1.2ÊÊ Functions of a perfect systemPrevention of collusion attack. A perfect anonymous communication system will be a distributed system. No central system can protect from a corrupt insider since he has all information concerning the sender and recipient of a communication relation. Thus, he can observe a commu-

Collaborative attack on Internet users' anonymity

“…( An attacker may use various kinds of attacks in order to expose the sender and the recipient such as those described by Berthold et al (2000), Raymond (2001), or Song and Korba (2002). Some of the attacks are categorized as "general traffic analysis attacks".…”

Protecting the Communication Structure in Sensor Networks

“…In all these applications anonymity protects the identity of the sender or receiver and guarantees that both parties involved in a communication transaction remain anonymous to each other. Recent years have seen a flurry of activity and many anonymous communication systems have been developed for the Internet [3,7,8,9,11,32,33,34,41,43,61,62]. Most of the work on anonymity is concerned with sender anonymity, receiver anonymity, and mutual anonymity.…”

Effective Probabilistic Approach Protecting Sensor Traffic

“…The strategies include introducing random delay; buffering messages in a pool, reordering messages and flushing the pool; injecting dummy/decoy packets; and padding each packet to the same length or random lengths. For example, a delay-and-playout technique (traffic mixing) is used in [2] [14]. Serjantov et al [17] classify traffic mixing strategies into two major categories-simple MIXes and pool MIXes.…”

“…Successful correlation between two transmission events reveals the path of a data flow. Solutions studied for wired networks [2][4] [14][17] use traffic mixing techniques including sending messages in reordered batches, sending decoy/dummy messages, and introducing random delays. However, sensor networks have features different from a wired network, requiring reevaluation of the existing work and new designs of anti timing analysis solutions.…”