Anonymous Communication Network Research Articles

Design of a mix network with elliptic curve cryptography and XOR shuffling for secure communication with 5‐node

AbstractThis research paper proposes a novel 5‐node mix network, an anonymous communication network to boost privacy within the network. Within the proposed framework the crypto‐operations like encryption, decryption, and shuffling are held with the help of the Elliptic Curve Cryptography (ECC) and XOR algorithm. This unique combination helps to exchange the message within the communication network with enhanced security and privacy. To analyze the processing time and load factor at each intermediate node of mix network, an exhaustive experimental analysis is carried out for key sizes of 256, 384, and 512 bits respectively. These crypto‐operations like encryption, decryption, and XOR shuffling need varying time slots to perform at each intermediate node thereby having a varying load factor associated with them. The objective of this research is to analyze the processing time and load factor at each node within the 5‐node mix network thereby helping to analyze the strengths and weaknesses of each intermediate node. Through our analysis, these percentages are computed, shedding light on the allocation of computational load and resource utilization among the nodes.

Port-Based Anonymous Communication Network: An Efficient and Secure Anonymous Communication Network.

With the rise of the internet, there has been an increasing focus on user anonymity. Anonymous communication networks (ACNs) aim to protect the identity privacy of users in the network. As a typical ACN, Tor achieves user anonymity by relaying user data through a series of relay nodes. However, this results in higher latency due to the transmission of network traffic between multiple nodes. This paper proposes a port-based anonymous communication network (PBACN) to address this issue. First, we propose a path construction algorithm. This algorithm describes constructing paths by partitioning the communication path information, which can reduce the probability of being discovered by adversaries. Secondly, we design a port-based source routing addressing method. During data transmission from the source to the destination, each node can directly forward the data by resolving the address into the port of each node. This method eliminates the need for table lookups, reducing the complexity of routing. Lastly, we propose an entropy-based metric to measure the anonymity of different ACNs. In terms of experimental evaluation, we quantitatively analyze the anonymity and end-to-end delay of various ACNs. The experimental results show that our proposed method reduces end-to-end delay by approximately 25% compared to Tor. When the adversary fraction is 20%, PBACN can improve the anonymity degree by approximately 4%.

A Covert-Aware Anonymous Communication Network for Social Communication

To effectively protect the communication content and communication behavior of social networks, anonymous communication technologies are widely used. However, the anonymous communication networks represented by Tor and I2P lack the covertness of the control plane design, which leads to important user behavioral characteristics in the process of accessing anonymous communication networks. Therefore, network monitors can analyze users' communication behavior by tracking these characteristics. In this paper, the concept of covert measurement is proposed. On this basis, a software-defined anonymous communication network architecture is presented, which also considers the covertness of the anonymous communication network control plane and the data plane. According to the theoretical analysis and experimental results, the anonymous communication network architecture proposed in this paper has better anonymity and usability than traditional anonymous communication networks, such as Tor.

A Method for Identifying Tor Users Visiting Websites Based on Frequency Domain Fingerprinting of Network Traffic

Although the anonymous communication network Tor can protect the security of users’ data and privacy during their visits to the Internet, it also facilitates illegal users to access illegal websites. Website fingerprinting attacks can identify the websites that users are visiting to discern whether they are performing illegal operations. Existing methods tend to manually extract the traffic features of users visiting websites and construct machine learning or deep learning models to classify the features. While these methods can be effective in classifying unknown website traffic, the effect of classification in the use of defensive measures or onion service scenarios is not yet ideal. This paper proposes a method to identify Tor users visiting websites based on frequency domain fingerprinting of network traffic (FDF). We extract the direction and length features of circuit sequences in access traffic and combine and transform them into the frequency domain. The classification of access traffic is accomplished by using a deep learning classification model combining CNN, FC, and Self-Attention. In this paper, the proposed FDF method is experimentally validated in common scenarios of Tor networks. The results show that FDF outperforms the existing methods for classification in different Tor scenarios. It can achieve 98.8% and 94.3% classification accuracy in undefended and WTF-PAD defense scenarios, respectively. In the onion service scenario, the accuracy is improved by 4.7% over the current state-of-the-art Tik-Tok method.

Tor Hidden Services: A Systematic Literature Review

Anonymous communications networks were created to protect the privacy of communications, preventing censorship and traffic analysis. The most famous anonymous communication network is Tor. This anonymous communication network provides some interesting features. Among them, we can mention that Tor can hide a user’s IP address when accessing to a service such as the Web, and it also supports Tor hidden services (THS) (now named onion services) as a mechanism to conceal the server’s IP address, used mainly to provide anonymity to websites. THS is an important research field in Tor. However, there is a lack of reviews that sum up the main findings and research challenges. In this article, we present a systematic literature review that aims to offer a comprehensive overview of the research made on THS by presenting the state-of-the-art and the different research challenges to be addressed. This review has been developed from a selection of 57 articles and presents main findings and advances regarding Tor hidden services, limitations found, and future issues to be investigated.

Obfuscated Tor Traffic Identification Based on Sliding Window

Tor is an anonymous communication network used to hide the identities of both parties in communication. Apart from those who want to browse the web anonymously using Tor for a benign purpose, criminals can use Tor for criminal activities. It is recognized that Tor is easily intercepted by the censorship mechanism, so it uses a series of obfuscation mechanisms to avoid censorship, such as Meek, Format-Transforming Encryption (FTE), and Obfs4. In order to detect Tor traffic, we collect three kinds of obfuscated Tor traffic and then use a sliding window to extract 12 features from the stream according to the five-tuple, including the packet length, packet arrival time interval, and the proportion of the number of bytes sent and received. And finally, we use XGBoost, Random Forest, and other machine learning algorithms to identify obfuscated Tor traffic and its types. Our work provides a feasible method for countering obfuscated Tor network, which can identify the three kinds of obfuscated Tor traffic and achieve about 99% precision rate and recall rate.

Cryptocurrency and Privacy - An Introduction to the Interface

The largest and best-known Cryptocurrency in the global economy is Bitcoin but it is only one of approximately 2,000 cyptocurrencies in circulation today. A Bitcoin was worth 8,790.51 U.S. dollars as of March 4, 2020 and all the Bitcoins in the world were worth roughly $160.4 billion. In Bitcoin you don’t need to explicitly register or reveal your real world identity, but the pattern of your behavior might itself be identifying. This is the fundamental privacy question in a Cryptocurrency like Bitcoin leading to emergence of Privacy coins such a Monero and Zcash that utilize complex cryptography to achieve the greater Privacy levels with more anonymity features. However, in the zest for increased Privacy with focus on anonymity in Cryptocurrency transaction, the law and order issues are compromised wherein it would be near to impossible for the law enforcement agencies to track criminals dealing in money laundering, terrorist financing, tax evasion and other frauds by using Crypto currencies. In this background, it is necessary to understand “Cryptocurrency and Privacy” as an interface to better comprehends the subject of Cyptocurrency which is very dynamic in technology with multiple global implications on the economic and legal front. The present work aims to study Cryptocurrency in the context of Privacy. The foundational concepts and definitions of the two competing subjects: ‘Cryptocurrency and Privacy’ is taken up for better understanding the background of the interface. Tor, an anonymous communication network is referred in brief to state that the dilemma in the Privacy context is not unique to use of Crypto currencies technology in so far its negative effects are concerned . The conclusion suggest for finding an appropriate balance between an individual’s privacy and State’s security in Cryptocurrency technology.

A probabilistic model for anonymity analysis of anonymous communication networks

An anonymous communication network (ACN) is supposed to provide its users with anonymity attributes. As a practical matter, we need to have a means to predict the level of the anonymity provided by ACN. In this paper, we propose a probabilistic model for the security analysis of ACNs, thereby quantifying their loss of anonymity. To be precise, we have tried to obtain the probability distribution of potential senders of a message sent from an unknown source to a specific destination. With the probability distribution in hand, it is possible to define and derive some anonymity metrics. The evaluated metrics help us to gain an understanding of how much such a network may be vulnerable to attacks aiming at revealing the identity of senders of messages. Consequently, new rerouting policies and strategies can be utilized to increase the anonymity level of the network. The quantitative analysis is performed from a general perspective and the applicability of the model is not limited to a specific network. The evaluation process of the metrics using the proposed model is clarified by an illustrative example.

A Framework for Analyzing Anonymous Network Topology

Nowadays, Internet privacy becomes more and more important and sensitive, and has been one of the latest buzz words to hit the Internet world. In response to protect the privacy of Internet users, a variety of privacy enhancing technologies (PETs) have emerged. As one of privacy enhancing technologies, anonymous communication has been extensively studied from various aspects by researchers. Node churn is frequent in anonymous network, which make it difficult to maintain a stable network topology, therefore it is necessary to get more insight into the overall anonymous network topology. In this work, in order to better grasp the present situation of research, we investigate existing organizations and universities which study anonymous communication from the perspective of network topology, and related projects. Then we survey related papers to anonymous communication published in recent years, which focus on the analysis of node selection (especially in the Tor). In addition, we present a framework of anonymous communication network topology, and a visual illustration of this analysis that shows the progression of the research of network topology and node discovery in anonymous communication. Finally, some related problems and follow-up study are presented to be studied deeply in future.

A Novel Traffic Dividing and Scheduling Mechanism for Enhancing Security and Performance in the Tor Network

Objective: The main intent of this research is to improve the quality-of-service in the Tor anonymous communication network by splitting the traffic and scheduling it according to the traffic load. Methods: In this manuscript, a Novel Traffic, Dividing and Scheduling (NTDS) mechanism is introduced for improving performance in the Tor anonymous communication network. The performance of the tor network is described by using various network metrics such as bandwidth, latency, jitter, loss etc. In this mechanism, the traffic load is disseminated across circuits depends on each circuit bandwidth capacity, congestion level, measured latency, throughput. Results: The Novel Traffic, Dividing and Scheduling (NTDS) mechanism show higher performance when compared to the existing router selection method. Throughput, congestion level, latency and available bandwidth are measured for the circuit and based on this the traffic is split and scheduled. If the number of nodes is 50, the packet delivery ratio is 70% in NTDS, the throughput in NTDS is 72% and end-to-end delay is 0.69. According to the comparison results, the proposed approach works better than the other existing systems with high quality-of-service. Conclusion: The findings demonstrate that the Novel Traffic, Dividing and Scheduling (NTDS) mechanism is presented and suggested that this method has high quality-of-service. Keywords: Anonymous Communication Network, Bandwidth Estimation, Quality-of-service, Path Selection, Tor Network

Protocol-level attacks against Tor

Tor is a real-world, circuit-based low-latency anonymous communication network, supporting TCP applications over the Internet. In this paper, we present an extensive study of protocol-level attacks against Tor. Different from existing attacks, the attacks investigated in this paper can confirm anonymous communication relationships quickly and accurately by manipulating one single cell and pose a serious threat against Tor. In these attacks, a malicious entry onion router may duplicate, modify, insert, or delete cells of a TCP stream from a sender, which can cause cell recognition errors at the exit onion router. If an accomplice of the attacker at the entry onion router also controls the exit onion router and recognizes such cell recognition errors, the communication relationship between the sender and receiver will be confirmed. These attacks can also be used for launching the denial-of-service (DoS) attack to disrupt the operation of Tor. We systematically analyze the impact of these attacks and our data indicate that these attacks may drastically degrade the anonymity service that Tor provides, if the attacker is able to control a small number of Tor routers. We have implemented these attacks on Tor and our experiments validate their feasibility and effectiveness. We also present guidelines for defending against protocol-level attacks.

A New Cell-Counting-Based Attack Against Tor

Various low-latency anonymous communication systems such as Tor and Anonymizer have been designed to provide anonymity service for users. In order to hide the communication of users, most of the anonymity systems pack the application data into equal-sized cells (e.g., 512 B for Tor, a known real-world, circuit-based, low-latency anonymous communication network). Via extensive experiments on Tor, we found that the size of IP packets in the Tor network can be very dynamic because a cell is an application concept and the IP layer may repack cells. Based on this finding, we investigate a new cell-counting-based attack against Tor, which allows the attacker to confirm anonymous communication relationship among users very quickly. In this attack, by marginally varying the number of cells in the target traffic at the malicious exit onion router, the attacker can embed a secret signal into the variation of cell counter of the target traffic. The embedded signal will be carried along with the target traffic and arrive at the malicious entry onion router. Then, an accomplice of the attacker at the malicious entry onion router will detect the embedded signal based on the received cells and confirm the communication relationship among users. We have implemented this attack against Tor, and our experimental data validate its feasibility and effectiveness. There are several unique features of this attack. First, this attack is highly efficient and can confirm very short communication sessions with only tens of cells. Second, this attack is effective, and its detection rate approaches 100% with a very low false positive rate. Third, it is possible to implement the attack in a way that appears to be very difficult for honest participants to detect (e.g., using our hopping-based signal embedding).

Blind detection of spread spectrum flow watermarks

ABSTRACTRecently, the direct sequence spread spectrum (DSSS)‐based technique has been proposed to trace anonymous network flows. In this technique, homogeneous pseudo‐noise (PN) codes are used to modulate multiple bit signals that are embedded into the target flow as watermarks. This technique could be maliciously used to degrade an anonymous communication network. In this paper, we propose an effective single flow‐based scheme to detect the existence of these watermarks. Our investigation shows that, even if we have no knowledge of the applied PN code, we are still able to detect malicious DSSS watermarks via mean‐square autocorrelation (MSAC) of a single modulated flow's traffic rate time series. MSAC shows periodic peaks because of self‐similarity in the modulated traffic caused by homogeneous PN codes that are used in modulating multiple bit signals. Our scheme has low complexity and does not require any PN code synchronization. We evaluate this detection scheme's effectiveness via simulations. Our results demonstrate a high detection rate with a low false positive rate. Real‐world experiments on Tor also validate the feasibility of the detection scheme. Our scheme is more flexible and accurate than the existing multiflow‐based approach in DSSS watermark detection. We also present a theory for reconstructing the DSSS code once the DSSS code length is known and simulations validate the feasibility. Copyright © 2012 John Wiley & Sons, Ltd.

Improving Security and Performance in the Tor Network through Tunable Path Selection

The Tor anonymous communication network uses self-reported bandwidth values to select routers for building tunnels. Since tunnels are allocated in proportion to this bandwidth, this allows a malicious router operator to attract tunnels for compromise. Although Tor limits the self-reported bandwidth, it uses a high maximum value, effectively choosing performance over high anonymity for all users. We propose a router selection algorithm that allows users to control the trade-off between performance and anonymity. We also propose an opportunistic bandwidth measurement algorithm to replace self-reported values that is more sensitive to load and more responsive to changing network conditions. Our mechanism effectively blends the traffic from users of different preferences, making partitioning attacks difficult. We implemented the opportunistic measurement and tunable performance extensions and examined their performance both through simulation and in the real Tor network. Our results show that users can get dramatic increases in either performance or anonymity with little to no sacrifice in the other metric, or a more modest improvement in both. Our mechanisms are also invulnerable to the previously published low-resource attacks on Tor.

Improving Security and Performance in the Tor Network through Tunable Path Selection

The Tor anonymous communication network uses self-reported bandwidth values to select routers for building tunnels. Since tunnels are allocated in proportion to this bandwidth, this allows a malici...

WindTalker: A P2P-Based Low-Latency Anonymous Communication Network

Compared with traditional static anonymous communication networks, the P2P architecture can provide higher anonymity in communication. However, the P2P architecture also leads to more challenges, such as route, stability, trust and so on. In this paper, we present WindTalker, a P2P-based low-latency anonymous communication network. It is a pure decentralized mix network and can provide low-latency services which help users hide their real identity in communication. In order to ensure stability and reliability, WindTalker imports “seed nodes” to help a peer join in the P2P network and the peer nodes can use gossip-based protocol to exchange active information. Moreover, WindTalker uses layer encryption to ensure the information of relayed messages cannot be leaked. In addition, malicious nodes in the network are the major threat to anonymity of P2P anonymous communication, so WindTalker imports a trust mechanism which can help the P2P network exclude malicious nodes and optimize the strategy of peer discovery, tunnel construction, and relaying etc. in anonymous communications. We deploy peer nodes of WindTalker in our campus network to test reliability and analyze anonymity in theory. The network measurement and simulation analysis shows that WindTalker can provide low-latency and reliable anonymous communication services.