Trust-based Anonymous Communication: Models and Routing Algorithms

1. Trust-based Anonymous Communication:Models and Routing Algorithms U.S. Naval Research Laboratory U.S. Naval Research Laboratory The Tor Project The Tor Project Aaron Johnson Paul Syverson Roger Dingledine Nick Mathewson 18th ACM Conference on Computer and Communications Security October 17-21, 2011 Chicago, IL

2. Overview • Onion routing provides anonymous communication.

3. Overview • Onion routing provides anonymous communication. ?

4. Overview • Onion routing provides anonymous communication. ? ?

5. Overview ? • Onion routing provides anonymous communication. ? ?

6. Overview ? • Onion routing provides anonymous communication. • It is insecure against an adversary with resources. ?

7. Overview ? • Onion routing provides anonymous communication. • It is insecure against an adversary with resources. • Trust can help avoid such an adversary. • We provide a model of trust. • We design trust-based routing algorithms. ?

8. Overview ? • Onion routing provides anonymous communication. • It is insecure against an adversary with resources. • Trust can help avoid such an adversary. • We provide a model of trust. • We design trust-based routing algorithms. • Improve anonymity with robustness to trust errors. ?

9. Onion Routing

10. Onion Routing Users Onion Routers Destinations A user cryptographically constructs a circuit through the network. Onion-encrypted data is sent and unwrapped along the circuit. The process runs in reverse for return data.

11. Onion Routing • International onion-routing network • Estimated at over 300,000 users daily • ≈2500 onion routers • Uses include torproject.org • - Avoiding censorship • - Gathering intelligence • - Political activism • - Whistleblowing

12. Problem Problem

13. Problem Problem • Adversary may observe or control routers.

14. Problem • Adversary may observe or control routers. • Traffic patterns can link first and last routers.

15. Problem • Adversary may observe or control routers. • Traffic patterns can link first and last routers. First-last Correlation Attack Success 2500 total routers, 900 exit, 800 guard

16. Key Idea: Trust • Users may know how likely a router is to be under observation. Tor Routers with Possible Trust Factors Source: http://torstatus.blutmagie.de, 10/12/2011

17. Problems • What is trust? • Model • How do we use trust? • Path-selection algorithm

18. Model Observed destination User u Naïve users N 0 1 Observed source Probability of Compromise: cu(r) Trust: τu(r) = 1-cu(r) Au Adversaries

19. Trust-based Path Selection Algorithm • Destination links observed only • Use downhill algorithm. • Source links observed only • Use one-hop path of most-trusted router. • Neither source nor destination links observed • Connect directly to destination. • Both source and destination links observed • Connect directly to destination.

20. Downhill Algorithm Key idea: Blend in with the naïve users. Random Most trusted

21. Downhill Algorithm Key idea: Blend in with the naïve users. Random Most trusted

22. Downhill Algorithm Key idea: Blend in with the naïve users. Random Most trusted

23. Downhill Algorithm Router Trust CDF 0 Fraction of Routers 0 1 Trust Most trusted Random

24. Downhill Algorithm Router Trust CDF 0 Fraction of Routers 0 1 Trust Random Most trusted

25. Downhill Algorithm Router Trust CDF 0 Fraction of Routers 0 1 Trust Random Most trusted

26. Downhill Algorithm Router Trust CDF 0 Fraction of Routers 0 1 Trust Downhill Random Most trusted

27. Downhill Algorithm

28. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric.

29. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi

30. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi

31. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi

32. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi

33. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi

34. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi

35. Downhill Algorithm Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi

36. Downhill Algorithm • Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. • For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi • For each connection, • Create circuit through selected routers. • Randomly choose two routers. • Extend circuit through them to the destination.

37. Downhill Algorithm • Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. • For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi • For each connection, • Create circuit through selected routers. • Randomly choose two routers. • Extend circuit through them to the destination.

38. Downhill Algorithm • Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. • For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi • For each connection, • Create circuit through selected routers. • Randomly choose two routers. • Extend circuit through them to the destination.

39. Downhill Algorithm • Set path length l and trust levels λ1,…, λlto optimize expectation of anonymity metric. • For 1 ≤ i ≤ l, Randomly select among routers with trust ≥ λi • For each connection, • Create circuit through selected routers. • Randomly choose two routers. • Extend circuit through them to the destination.

40. Anonymity Analysis • Metric: Posterior probability of actual source of a given connection. dynamic Example: static u • Let Ti = {r : τu(r) ≥ λi}. • Let Au⊂R be the routers compromised by Au. • Let X1 = Pr[ u chose observed path] = (|T1\Au|/|T1|) (|T2\Au|/|T2|)(1/|T3|) (1/|R|)2 • Let X2 = Pr[ n∈N chose observed path] = (|R\Au|/|R|)2(1/|R|)3 • Posterior probability: X1/(X1+|N|X2)

41. Anonymity Analysis

42. Anonymity Analysis Scenario 1: User has some limited information. τ=.1 τ=.99 τ=.9 10 routers 5 routers 1000 routers

43. Anonymity Analysis Scenario 2: User and friends run routers. Adversary is strong. τ=.999 τ=.95 τ=.5 5 routers 50 routers 1000 routers

44. Linking Analysis • Metric: Connection entropy at times user communicates. Example: (u,d1) (u,d2) (u,d3) t1 t2 t3

45. Linking Analysis • Metric: Connection entropy at times user communicates. Example: (?,d1) (?,d2) (?,d3) t1 t2 t3 The adversary may not know the user.

46. Linking Analysis • Metric: Connection entropy at times user communicates. Example: (v,d1) (v,d2) (v,d3) t1 t2 t3 Connections without dynamic hops may be linked by final hop.

47. Linking Analysis • Metric: Connection entropy at times user communicates. Example: (v,d1) (w,d2) (x,d3) t1 t2 t3 With dynamic hops, posterior distribution may be more even.

48. Linking Analysis • Metric: Connection entropy at times user communicates. Example: (v,d1) (w,d2) (x,d3) t1 t2 t3 With dynamic hops, posterior distribution may be more even. Theorem: Entropy of connection distribution is increased by using dynamic hops.

49. Trust Errors Theorem (informal):Error in trust of router r changes expected anonymity proportional to 1. Size of error 2. Expected number of times r is used 3. Expected relative size of r’s trust set

50. Trust Errors Errors in Scenario 1 (many @ medium trust) Fraction x of low are medium,x/2 of med. are low, x/2 of med. are high,x of high are medium.