Anonymous System Research Articles

Eventual election of multiple leaders for solving consensus in anonymous systems

In classical distributed systems, each process has a unique identity. Today, new distributed systems have emerged where a unique identity is not always possible to be assigned to each process. For example, in many sensor networks a unique identity is not possible to be included in each device due to its small storage capacity, reduced computational power, or the huge number of devices to be identified. In these cases, we have to work with anonymous distributed systems where processes cannot be identified. Consensus cannot be solved in classical and anonymous asynchronous distributed systems where processes can crash. To bypass this impossibility result, failure detectors are added to these systems. It is known that $$\varOmega $$Ω is the weakest failure detector class for solving consensus in classical asynchronous systems when a majority of processes never crashes. Although $${ A }\varOmega $$AΩ was introduced as an anonymous version of $$\varOmega ,$$Ω, to find the weakest failure detector in anonymous systems to solve consensus when a majority of processes never crashes is nowadays an open question. Furthermore, $${ A }\varOmega $$AΩ has the important drawback that it is not implementable. Very recently, $${ A }\varOmega '$$AΩ? has been introduced as a counterpart of $$\varOmega $$Ω for anonymous systems. In this paper, we show that the $${ A }\varOmega '$$AΩ? failure detector class is strictly weaker than $${ A }\varOmega $$AΩ (i.e., $${ A }\varOmega '$$AΩ? provides less information about process crashes than $${ A }\varOmega $$AΩ). We also present in this paper the first implementation of $${ A }\varOmega '$$AΩ? (hence, we also show that $${ A }\varOmega '$$AΩ? is implementable), and, finally, we include the first implementation of consensus in anonymous asynchronous systems augmented with $${ A }\varOmega '$$AΩ? and where a majority of processes does not crash.

Failure detectors in homonymous distributed systems (with an application to consensus)

This paper is on homonymous distributed systems where processes are prone to crash failures and have no initial knowledge of the system membership (“homonymous” means that several processes may have the same identifier). New classes of failure detectors suited to these systems are first defined. Among them, the classes HΩ and HΣ are introduced that are the homonymous counterparts of the classes Ω and Σ, respectively. (Recall that the pair 〈Ω,Σ〉 defines the weakest failure detector to solve consensus.) Then, the paper shows how HΩ and HΣ can be implemented in homonymous systems without membership knowledge (under different synchrony requirements). Finally, two algorithms are presented that use these failure detectors to solve consensus in homonymous asynchronous systems where there is no initial knowledge of the membership. One algorithm solves consensus with 〈HΩ,HΣ〉, while the other uses only HΩ, but needs a majority of correct processes.Observe that the systems with unique identifiers and anonymous systems are extreme cases of homonymous systems from which follows that all these results also apply to these systems. Interestingly, the new failure detector class HΩ can be implemented with partial synchrony (i.e., all messages sent after some bounded time GST will be received after at most an unknown bounded latency δ), while the analogous class AΩ defined for anonymous systems cannot be implemented (even in synchronous systems). Hence, the paper provides the first consensus algorithm for anonymous systems with this model of partial synchrony and a majority of correct processes.

Study on the relationship between prefix caching and path stretch ratio

In a very recent paper, we analyze the cause of path stretch in scalable routing system, quantitatively studies the relationship between path stretches, scalable routing evolution and inter-AS collaboration, where AS represents anonymous system. Some scholars notice that prefix caching in routers may influence the path stretch ratio and gave their different understanding on path stretch. Thus, this note studies the relationship between prefix caching and path stretch ratio, and presents quantitive results.

Non-Interactive Anonymous Credential Based on Structure-Preserving Signature

ABSTRACTStructure-preserving signature, as a special kind of digital signature, provides a way to construct modular cryptographic protocols with reasonable efficiency while retaining conceptual simplicity. This feature makes it suitable to be applied in the construction of non-interactive anonymous credential systems, which allows the user to convince a verifier of the possession of a certificate issued by the trusted authority anonymously and efficiently without interaction. In this paper, we design a secure and efficient structure-preserving signature scheme (SPSIG), and combine the scheme with Groth–Sahai non-interactive zero-knowledge (GSNIZK) proof system to construct a non-interactive anonymous credential scheme. The SPSIG is based on q-ADH-SDH assumption and can resist existential forgery in the chosen message attack. The message, signature, and verification keys are group elements, which are fully compatible with the GSNIZK system. The SXDH assumption is employed to instantiate the certificate-proving process, which is considered to be the most efficient instantiation at the moment. We analyze the efficiency and formally prove the security in the standard model. The result shows that our scheme satisfies correctness, zero knowledge, and unforgeability, and achieves identity authentication in the way of anonymity. Besides, our scheme has stronger anonymity, traceability, and non-interaction, and has lower communication cost compared with the conventional schemes.

Randomized trial of a novel game-based appointment system for a university hospital venereology unit: study protocol.

BackgroundChlamydia is the most common reportable sexually transmitted disease (STD) in Norway, and its incidence in the two northernmost counties has been disclosed to be nearly the double of the Norwegian average. The latest publicly available rates showed that 85.6% of the new cases were diagnosed in people under 29 years old.The information and communication technologies are among the most powerful influences in the lives of young people. The Internet can potentially represent a way to educate on sexual health and encourage young people, and especially youth, to be tested for STDs. If hospital websites include an easy and anonymous system for scheduling appointments with the clinic, it is possible that this could lead to an increase in the number of people tested for STDs.MethodsThe purpose of the study is to assess the impact of a game-based appointment system on the frequency of consultations at a venereology unit and on the use of an educational web app. An A/B testing methodology is used. Users from the city of Tromsø, in North Norway, will be randomized to one of the two versions of the game-style web app on sexual health at www.sjekkdeg.no. Group A will have access to educational content only, while group B will have, in addition, access to a game-based appointment system with automatic prioritization. After one year of the trial, it will be analyzed if the game-based appointment system increases the number of consultations at the venereology unit and if health professionals deem the system useful.DiscussionThis study will explore if facilitating the access to health services for youth through the use of a game-based appointment system integrated in a game-style web app on sexual health education can have an impact on appointment rates.Trial registrationThe trial is registered at clinicaltrials.org under the identifier ClinicalTrials.gov NCT:02128620

De-anonymizing and countermeasures in anonymous communication networks

To fulfill global requirements for network security and privacy, anonymous communication systems have been extensively investigated and deployed over the world to provide anonymous communication services for users. Nonetheless, diverse de-anonymizing techniques have been proposed to compromise anonymity and impose a severe threat to anonymous communication systems. In this article, we classify the existing de-anonymizing techniques and provide an overview of these techniques. In addition, corresponding countermeasures are studied to mitigate the risks posed by these de-anonymizing techniques.

Workload modelling for mix-based anonymity services

Evaluating and improving the performance of mix-based anonymity systems in a real-world setting is critical to foster their adoption. However, current research in this field mostly employs unrealistic models for evaluation purposes. Moreover, previously documented results are often difficult to reproduce. We propose two complementary models tailored to the evaluation of mix-based anonymity services. The models enable realistic experiments and are easy to use as they allow to automatically extract workloads from trace files recorded in real networks and replay them in simulations. We also describe our ready-to-use open source evaluation suite that implements the models. Given the suite, researchers can easily create and re-use well-defined workload sets for evaluation purposes. The workloads can be replayed both in discrete-event simulations and distributed experiments. With this initiative we want to foster open research in our discipline.

Extracting association patterns in network communications.

In network communications, mixes provide protection against observers hiding the appearance of messages, patterns, length and links between senders and receivers. Statistical disclosure attacks aim to reveal the identity of senders and receivers in a communication network setting when it is protected by standard techniques based on mixes. This work aims to develop a global statistical disclosure attack to detect relationships between users. The only information used by the attacker is the number of messages sent and received by each user for each round, the batch of messages grouped by the anonymity system. A new modeling framework based on contingency tables is used. The assumptions are more flexible than those used in the literature, allowing to apply the method to multiple situations automatically, such as email data or social networks data. A classification scheme based on combinatoric solutions of the space of rounds retrieved is developed. Solutions about relationships between users are provided for all pairs of users simultaneously, since the dependence of the data retrieved needs to be addressed in a global sense.

Towards Attacks and Defenses of Anonymous Communication Systems

Anonymous communication system has been hot topic in the field of information security, and attack techniques against anonymous systems are endless. This paper first classifies and summarizes the study of attacks against anonymous communication system in recent years, then analyzes the trend of the research on different attack technologies; secondly, it provides a comparative analysis of defense capability the mainstream anonymous communication system to the various attacks; Finally, combining the advantages and disadvantages of different systems, the authors propose an improved node selection and router forwarding algorithms for anonymous communication systems, and design an architecture of anonymous communications software based on the algorithm.

Markov Chain Monte Carlo Models, Gibbs Sampling, & Metropolis Algorithm for High-Dimensionality Complex Stochastic Problems

Markov chain Monte Carlo (MCMC) methods have an important role in solving high dimensionality stochastic problems characterized by computational complexity. Given their critical importance, there is need for network and security risk management research to relate the MCMC quantitative methodological concerns with network and security risk applications. This article contributes to that research stream. The core quantitative methodological focus of the article is on Monte Carlo Models and MCMC Algorithms, Gibbs Sampling and Metropolis-Hastings Algorithm. Network and security risk management application focus is on how MCMC methods help solve previously unsolvable problems in computational statistical modeling of cryptography, cryptanalytics, and penetration testing; intrusion detection & prevention and anomaly detection; and, privacy in anonymity systems and social networks. Future quantitative methods applied research and development in MCMC and computational statistical computing to address systemic risk and model risk management is recommended.

Anonymous hierarchical identity-based encryption without key delegation in decryption

Hierarchical identity-based encryption (HIBE) introduces the concept of hierarchical identity in identity-based encryption (IBE) which eases the burden of key generation centre. Anonymous identity-based encryption is another extension of IBE in which the ciphertext leaks no information about the target identity. In this paper, we propose a new anonymous hierarchical identity-based encryption system. Unlike previous anonymous HIBE system, our system needs no key delegation in decryption, i.e., the user can decrypt the ciphertext directly if his identity vector is the prefix of the target identity vector. So it is not necessary for the user to know the target identity vector, which enhances the practicality of anonymous HIBE systems. Our system is constructed in composite order groups and proven adaptive security and anonymity from four static assumptions by using the dual system encryption technique.

A system-wide anonymity metric with message multiplicities

An important goal of an anonymity system is to hide the level of communication between two users, i.e., the number of messages one user sent to another. We construct an anonymity metric that measures the extent to which the system-wide communication pattern of all users of an anonymity system is hidden, among other possible patterns, in the aftermath of an attack. Our model allows users to send or receive multiple messages via the anonymity system, and our metric handles attacks that are capable of determining infeasibility of some of the system's input-output message combinations. We also analyse two earlier attempts in the literature at arriving at such a metric, and show that one of those attempts is limited to only a small class of such attacks, while the other fails to take any attack into account. In comparison, our metric is comprehensive, as it is applicable to all attacks mentioned above.

AATCT: Anonymously Authenticated Transmission on the Cloud with Traceability

In Cloud computing, anonymous authentication is an important service that must be available to users in the Cloud. Users have the right to remain anonymous as long as they behave honestly. However, in case a malicious behavior is detected, the system – under court order – must be able to trace the user to his clear identity. Most of the proposed authentication schemes for the Cloud are either password-based authentication schemes that are vulnerable to offline dictionary attacks, or biometric-based authentication schemes that take a long time of execution specially in case of high security requirements. In this paper, we propose an efficient and secure scheme to non-interactively authenticate the users on the Cloud to the remote servers while preserving their anonymity. In case of accusations, the registration authority is able to trace any user to his clear identity. We avoid using low entropy passwords or biometric mechanisms, instead, we employ pseudonym systems in our design. The computation complexity and storage requirements are efficient and suitable to be implemented on smart cards/devices. Our proposed scheme withstands challenging adversarial attacks such as, stolen databases attacks, databases insertion attacks, impersonation attacks, replay attacks and malicious users/servers collaboration attacks.

A collaborative-based approach for avoiding traffic analysis and assuring data integrity in anonymous systems

The paper introduces a new collaborative technique for assuring data integrity while avoiding traffic analysis and other types of similar attacks (e.g., man-in-the-middle, data source fingerprinting, etc.). The new technique utilizes a quorum based approach to allow the client to validate the authenticity of the received data at his/her end by comparing different copies of the data. Similar to a reputation system, the new approach relies on the feedback of end-user communication experiences as well as a centralized entity to determine the trustfulness of nodes in the system. The new approach also is a hybrid of centralized and decentralized system that will help in keeping the system ‘alive’ to prevent different types of attacks that are carried out on centralized and decentralized peer-to-peer systems. The technique also accomplishes data transfer from source to destination using a distributed system, encryption, and a relatively new way for communication amongst system components.

Protecting User’s Privacy from Browser-Based Attacks

Recently there has been a new kind of attacks, browser-based attacks, against anonymous communication systems, such as Tor. This kind of attacks exploits JavaScript in the browser or the HTML meta refresh to generate some predefined signals to correlate users and their visited websites. A novel and efficient defense against such attacks is proposed in this paper. Our main observation is that the attacker must generate enough signals from the client site (the browser) to correlate the user and the website while we can detect the attack at the client site. More specifically, when a user is browsing a specific website and a browser-based attack is in progress, the number of outgoing flows and the total byte counts generated by the browser should be much larger compared with the normal browsing behavior. So we can set up fingerprints (number of outgoing flows and total byte counts) for normal browsing of web pages for a period of time and utilize these fingerprints to detect browser-based attacks. We have also found that some JavaScript codes must be executed many times if the attacker uses JavaScript to communicate. We have modified the Mozilla Firefox JavaScript engine to audit execution times of JavaScript code to defend these attacks, including browser-based attacks.

Bayesian Inference of Information Theoretic Metrics of Anonymity

Information theoretic metrics is popular theory to measure anonymity. However the difficulty in getting the probability distribution of subjects hampers its practical usage. In this paper we propose a Bayesian inference method to tackle this problem. Our method makes it possible to compare the anonymity of different anonymous systems. We use this method to analyze Threshold Mix and point out different system parameters which do and do not have influence on anonymity.

Garbled Routing (GR): A generic framework towards unification of anonymous communication systems

Anonymous Communication Systems conceal the identity of the communicating parties to preserve their privacy. Various approaches exist, yet none is taking advantage of the diversity of the available solutions to offer a higher anonymity. We introduce a generic framework, a high level host architecture, that allows the mixture of various communication protocols. Our proposal relies on plugin components to offer generic message processing, and on dynamic routing schemes to offer a generic circuit establishment. The results include a potentially higher anonymity for all the networks deployed within the framework, and a pathway towards sharing user-bases and code-bases, mixing the low- and high-latency communication, and benefiting from security-by-obscurity. Blending various protocols also achieves some level of network unobservability. This paper presents the design of the generic framework, the path to its adoption, the model of two real-world systems, the analysis of various security aspects, and the experimental results.

The Generalized Loneliness Detector and Weak System Models for k-Set Agreement

This paper presents two weak partially synchronous system models Manti(n-k) and Msink(n-k), which are just strong enough for solving k-set agreement: We introduce the generalized (n-k)-loneliness failure detector L(k), which we first prove to be sufficient for solving k-set agreement, and show that L(k) but not L(k-1) can be implemented in both models. Manti(n-k) and Msink(n-k) are hence the first message passing models that lie between models where Ω (and therefore consensus) can be implemented and the purely asynchronous model. We also address k-set agreement in anonymous systems, that is, in systems where (unique) process identifiers are not available. Since our novel k -set agreement algorithm using L(k) also works in anonymous systems, it turns out that the loneliness failure detector L=L(n-1) introduced by Delporte et al. is also the weakest failure detector for set agreement in anonymous systems. Finally, we analyze the relationship between L(k) and other failure detectors suitable for solving k-set agreement.

Neighborhood Failures in Random Topology Covert Communication Networks

A covert communications network is a connected, overlay, peer-to-peer network being used to support communications within a group in which the survival of the group depends on (a) confidentiality and anonymity for communications, (b) concealment of participation in the network to both other members of the group and external eavesdroppers, and (c) resilience against disconnec- tion. These requirements are much more stringent than for typical privacy and anonymity systems. In order to protect the network from subversion of individual nodes, neighbors of failed nodes have to be isolated from the network as well. Thus, all failures have to treated as neighborhood failures. Network membership is protected through topology management in order to limit each participant's knowledge of the network addresses (IP address, email address, etc.) of other participants. In this paper, we propose a measure for determining the suitability of random topologies for use in a covert communication network, and we use this measure to analyze the suitability of Erdös-Rényi Random Graphs for use in a covert communication network.

The SMS Chaum Mix

Mobile devices such as smartphones are prime candidates for the application of mixing techniques to provide anonymity for small groups of individuals numbering 30 to 40 members. In this work, a Chaum mix inspired, smartphone based network that uses the Short Message Service (SMS) is proposed. This system leverages both techniques used by current anonymity networks as well as knowledge gained from current and past research to make messages private and untraceable. Previously published attacks to anonymous systems are addressed as well as mitigation techniques.