Hiding payments in lightning network with approximate differentially private payment channels

Abstract

Payment Channel Networks (PCN) form a class of techniques created to solve the scalability problems that permissionless blockchains such as Bitcoin face. The Lightning Network (LN) is the biggest PCN to date. As of September 2021, LN is an interconnected network with 27 thousand nodes and 71 thousand channels, representing a total payment capacity of 2500 bitcoins (114M USD). LN nodes establish trustless payment channels by locking funds in a funding transaction. The distribution of the funds can be modified with near-instant transactions without broadcasting them to the blockchain. By chaining channels together, it is possible for two nodes to transact without having a direct channel between them. This results in far fewer transactions needing to be broadcast and a theoretical number of off-chain transactions per second that can rival established, centralized payment systems. With off-chain transactions one can obtain more privacy than with on-chain transaction: individual payments through LN should be able to stay private. However, recent research suggests that this is not the case. Several works have shown that channel balances can be tracked with the Balance Discovery Attack (BDA). Monitoring the changes in channel balances over time enables an adversary to track individual payments in LN. Since payments can travel through channels outside the scope of influence of the payer or the payee, these BDA’s form an Interdependent Privacy (IDP) risk for the participants of the LN network. This work applies approximate differential privacy to hide payment amounts of a realistic size in LN. To our knowledge, this is the first time that strong privacy guarantees in the sense of approximate differential privacy are achieved in the setting of LN. We prove the feasibility with our prototype, compatible with LN today. Our solution is evaluated in terms of cost and utility and we show that the latter is not affected by our solution.