Global Adversary Research Articles

A Framework for Provably Secure Onion Routing against a Global Adversary

Onion routing and mix networks are a central technology to enable anonymous communication on the Internet. As such, a large number of protocols and model variants have been explored in the field, which offer differing levels of privacy, exhibit vulnerabilities, or even supersede each other. These factors make discovering the appropriate formalization for new developments difficult, and some model variants have not been formalized at all. We address this issue by creating one parametrized framework that encompasses the onion routing and mix network models and functionalities with a global adversary in the related work. In doing so, we create a categorization of the variants of onion routing models in use in the related work and map common OR and mix network protocols to their variants. For each identified variant: Our framework offers i) an ideal functionality in the Universal Composability framework, and ii) game-based properties that imply realization of the ideal functionality when a protocol satisfies them. In effect, our framework both unifies and extends previous formalization efforts in the field.

A hierarchical distributed trusted location service achieving location k-anonymity against the global observer

As widely known in the literature, location-based services can seriously threaten users’ privacy. Privacy-aware location-based services can be obtained by protecting the user’s identity, so that queries cannot be linked with users. A way to do this is to place a trusted third party, called Location Trusted Service, between the user and the service provider, with the role of mediating the queries coming from the users and proxying them to the provider. Before proxying the query, the Location Trusted Service builds a cloaking area that includes a sufficient number of users such that it can represent an anonymity set. This way, the identity of the user is protected against an untrusted service provider. Unfortunately, in wide-area scenarios, a centralized location-trusted service might represent a serious threat to security and privacy because the service represents a single point of failure that manages very critical and massive information. Moreover, privacy protection also against a global adversary capable to monitor the whole traffic, would result in an excessive amount of cover traffic in the network (being cover traffic necessary in this threat model).To overcome the above limitations we propose a hierarchical Location Trusted Service, whose implementation benefits from the edge–cloud paradigm. In our proposal, the territory is organized in hierarchical zones possibly managed by different autonomous organizations. Organizations that manage higher zones are involved when lower-level organizations are not able to satisfy the requests of the users. As only the lowest-level services manage exact location data, while the higher ones operate only on aggregate values, the risk associated with the single point of failure of the centralized solution is drastically reduced. Moreover, leveraging the edge–cloud implementation of the system, network traffic is better confined to the edge of the network, making the protection against the global observer feasible.A nice feature of our method is that it is parametric with respect to any existing cloaking area construction technique. However, as our method, for non-local queries, operates on aggregate data, a certain degree of approximation is introduced. To validate our proposal, we conducted an experimental campaign on a real-life map by applying our method on top of well-known cloaking area construction technique called Casper. The results turned out to be positive. For a wide range of sizes of the anonymity set, the approximation (expressed by the metric called effectiveness) is less than 10%. On the other hand, concerning the network performance, we have observed an improvement in latency and throughput ranging from 20% to 170% (depending on the size of the anonymity set). In the highest density distribution, we achieve a 66% saving in overall (non-local) traffic compared to the centralized approach.

OrgAn: Organizational Anonymity with Low Latency

There is a growing demand for network-level anonymity for delegates at global organizations such as the UN and Red Cross. Numerous anonymous communication (AC) systems have been proposed over the last few decades to provide anonymity over the internet; however, they introduce high latency overhead, provide weaker anonymity guarantees, or are difficult to deploy at the organizational networks. Recently, the PriFi system introduced a client/relay/server model that suitably utilizes the organizational network topology and proposes a low-latency, strong-anonymity AC protocol. Using an efficient lattice-based (almost) keyhomomorphic pseudorandom function and Netwon’s power sums, we present a novel AC protocol OrgAn in this client/relay/server model that provides strong anonymity against a global adversary controlling the majority of the network. OrgAn’s cryptographic design allows it to overcome several major problems with any realistic PriFi instantiation: (a) unlike PriFi, OrgAn avoids frequent, interactive, slot-agreement protocol among the servers; (b) a PriFi relay has to receive frequent communication from the servers, which can not only become a latency bottleneck but also reveal the access pattern to the servers and increases the chance of server collusion/coercion, while OrgAn servers are absent from any real-time process. We demonstrate how to make this public-key cryptographic solution scale equally well as the symmetric-cryptographic PriFi with practical pre-computation and storage requirements. Through a prototype implementation, we show that OrgAn provides similar throughput and end-to-end latency guarantees as PriFi, while still discounting the setup challenges in PriFi.

CoverDrop: Blowing the Whistle Through A News App

Abstract Whistleblowing is hazardous in a world of pervasive surveillance, yet many leading newspapers expect sources to contact them with methods that are either insecure or barely usable. In an attempt to do better, we conducted two workshops with British news organisations and surveyed whistleblowing options and guidelines at major media outlets. We concluded that the soft spot is a system for initial contact and trust establishment between sources and reporters. CoverDrop is a two-way, secure system to do this. We support secure messaging within a news app, so that all its other users provide cover traffic, which we channel through a threshold mix instantiated in a Trusted Execution Environment within the news organisation. CoverDrop is designed to resist a powerful global adversary with the ability to issue warrants against infrastructure providers, yet it can easily be integrated into existing infrastructure. We present the results from our workshops, describe CoverDrop’s design and demonstrate its security and performance.

Changes in U.S. Security and Defense Strategy toward China: Assessment and Policy Implications

This study analyzes American defense and security strategy towards China and assesses its policy impact on security on the Korean Peninsula and the Asia-Pacific region more generally. The rapid rise of the People’s Republic of China as a geopolitical power and its aggressive foreign policy has considerably heightened fears among U.S. policymakers that China poses a threat. The intensifying strategic rivalry and distrust between Washington and Beijing since the inauguration of President Donald J. Trump in 2017 is leading to worsened relations between the two countries. This trend is likely to continue in the foreseeable future, and it is also expected that the American grand strategy will view China as the new global adversary, drawing down the “War on Terror” in the process. China is indeed fast emerging as the target of sustained deterrence, and this shift in American strategic thinking will likely continue even after the 2020 U.S. Presidential elections. Intensifying Sino-American geopolitical competition is resulting in a new Cold War posture, reflecting in turn a lack of strategic dialogue. As a result, the risk of Sino-American military conflict in geopolitical hotspots around the world (including the Korean Peninsula) is rapidly increasing, and countries in the region are worried about being entangled in a Great Power conflict between the two countries. In the meantime, the United States is soliciting countries in the region to join an “anti-Beijing” grouping of sorts, seeking to integrate pre-existing alliances (e.g., the ROK-U.S. Alliance) into this new grouping. Beijing, for its part, is attempting to weaken those traditional alliances with Washington, through measures such as economic coercion. Seoul is bearing the brunt of such sustained pressure from Beijing and is being pressured by both countries to “pick” one side over the other. Practically speaking, rather than pick sides, Seoul ought to chart a middle course, proceeding with “strategic confidence” that draws on a clear delineation of national interest and backing of the South Korean public. In particular, it would behoove Seoul to provide opportunities for deliberation on Korean Peninsula security issues, enhancing the prospects for meaningful strategic dialogue between Washington and Beijing. Concurrently, Seoul would also benefit from vigilant monitoring of the changing balance of power between United States and China, utilizing insights drawn from keen monitoring to further enhance its defense capabilities. In so doing, it is expected that Seoul will enhance its strategic value and military deterrence capabilities. Concurrently, by way of proactive military-to-military diplomatic engagement with neighboring countries, cooperative deterrence capabilities also would have to be significantly enhanced.

Source Anonymity against Global Adversary in WSNs Using Dummy Packet Injections: A Survey

Source anonymity in wireless sensor networks (WSNs) becomes a real concern in several applications such as tracking and monitoring. A global adversary that has sophisticated resources, high computation and full view of the network is an obvious threat to such applications. The network and applications need to be protected and secured to provide the expected outcome. Source anonymity is one of the fundamental WSNs security issues. It is all about preventing the adversary from reaching the origin by analyzing the traffic of the network. There are many methods to provide source anonymity, which is also known as Source Location Privacy (SLP). One of these methods is based on dummy packets. The basic notion is to inject the network with dummy packets to confuse the adversary about the location of the transmitting source node. This paper provides a survey of protocols for anonymity that use dummy packet injections. We discuss each technique from the point of their advantages and disadvantages. Further, We provide a comparison for the most promising techniques provided in the literature which use dummy packet injections. A comparison for the adversary assumptions and capabilities will be provided as well.

Age-based anonymity: a randomized routing approach to communication unobservability

Providing anonymous communication on networks of interconnected computers is an active area of research which aims to enhance the privacy of the users of such networks. Communication unobservability, stronger property compared to anonymity, attempts to guarantee that legitimate messages are not discernible from dummy traffic. A network with an active global adversary is one which it is assumed that all nodes in the network are potentially being monitored at all times, and also that at any time any node could be an adversary. This paper introduces a set of anonymous system design requirements for providing enhanced communication unobservability. A new anonymous networking system was designed based on these requirements to provide both sender and receiver anonymity. The proposed system has a structured peer-to-peer network architecture and a randomized routing algorithm to obfuscate the detection of communication paths and the message routing patterns. An age-based method is proposed to prevent even the first node after the sender from identifying the original sender. A simulation program was designed and implemented to test the proposed system. The effect of different parameters on the proposed algorithm is demonstrated using a simulation program.

Secure Roadside Unit Hotspot Against Eavesdropping Based Traffic Analysis in Edge Computing Based Internet of Vehicles

Edge computing-based Internet of Vehicles (EC-IoV) has emerged when computing environment is extended to vehicular network edge for supporting compute-intensive applications. To implement EC-IoV, roadside units (RSUs) are enhanced and upgraded toward edge computing infrastructures with hardware improvements. RSU is a crucial component to communicate with and serve vehicles in EC-IoV. However, RSUs easily suffer from potential network attacks. The attacks lower the quality of user experience, disrupt RSU workload scheduling and even result in user information leakage. Due to the open deployment environment, network traffic among all RSUs may be eavesdropped by a global adversary. When a hotspot phenomenon causes heavy traffic to an RSU, the adversary could take advantage of traffic statistics to locate the RSU. After that, the adversary may concentrate to attack the RSU and try to interrupt on-going services. As a consequence, RSU hotspot attack with traffic eavesdropping is launched. In this paper, we focus on such a new adversary model in EC-IoV and discuss the attack and its defence. To prevent from the attack, we propose a proactive scheme by generating dummy traffic delivery. The local vehicles are collaborative and encouraged to send dummy packets to specified RSUs. This dummy traffic will mislead the traffic statistics and protect hospot RSUs. Stackelberg game approach is used to build an incentive mechanism in the scheme. Numerical results demonstrate that our scheme is effective and efficient to secure EC-IoV against RSU hotspot attack.

CLPS: context-based location privacy scheme for VANETs

Location privacy preservation is considered as a challenge for deploying vehicular ad hoc networks (VANETs). In fact, the continuous periodical broadcast of spatiotemporal information in beacons allows a global passive adversary (GPA) to link pseudonyms and reconstruct vehicle traces. Consequently, it is imperative that a vehicle selects the right context to change pseudonym to confuse the adversary and ensure pseudonyms unlinkability. In this paper, we propose a context-based location privacy scheme (CLPS) that makes the following contributions: i) a pseudonym changing strategy that allows a vehicle to change pseudonyms based on its context; ii) a linkability threat, called cheating attack that negatively affects the proposed pseudonym changing strategy. A cheating detection mechanism is developed to allow a vehicle to detect misbehaving vehicles that launch the cheating attack, and assess the success of the pseudonym change. Finally, we evaluate CLPS against GPA by simulations using privacy extension, PREXT, in Veins, and we compare it against different existing privacy schemes.

Safety-Aware Location Privacy in VANET: Evaluation and Comparison

VANET safety applications broadcast cooperative awareness messages (CAM) periodically to provide vehicles with continuous updates about the surrounding traffic. The periodicity and the spatiotemporal information contained in these messages allow a global adversary to track vehicle movements. Many privacy schemes have been proposed for VANET, but only few schemes consider their impact on safety applications. Also, each scheme is evaluated using inconsistent metrics and unrealistic vehicle traces, which makes comparing the actual performance of different schemes in the wild more difficult. In this paper, we aim to fill this gap and compare different privacy schemes not only in terms of the privacy gained, but also their impact on safety applications. A distortion-based privacy metric is initially proposed and compared with other popular privacy metrics showing its effectiveness in measuring privacy. A practical safety metric which is based on Monte Carlo analysis is then proposed to measure the QoS of two safety applications: forward collision warning and lane change warning. Using realistic vehicle traces, six state-of-the-art VANET privacy schemes are evaluated and compared in terms of the proposed privacy and safety metrics. Among the evaluated schemes, it was found that the coordinated silent period scheme achieves the best privacy and QoS levels, but fully synchronized silence among all vehicles is a practical challenge. The CAPS and CADS schemes provide a practical compromise between privacy and safety since they employ only the necessary silence periods to prevent tracking and avoid changing pseudonyms in trivial situations.

Hiding the Rumor Source

Anonymous social media platforms, like Secret, Yik Yak, and Whisper, have emerged as important tools for sharing ideas without the fear of judgment. Such anonymous platforms are also important in nations under authoritarian rule, where freedom of expression and the personal safety of message that authors may depend on anonymity. Whether for fear of judgment or retribution, it is sometimes crucial to hide the identities of users who post sensitive messages. In this paper, we consider a global adversary who wishes to identify the author of a message; it observes either a snapshot of the spread of a message at a certain time or sampled timestamp metadata, or both. Recent advances in rumor source detection show that existing messaging protocols are vulnerable against such an adversary. We introduce a novel messaging protocol, which we call adaptive diffusion, and show that under the snapshot adversarial model, adaptive diffusion spreads content fast and achieves perfect obfuscation of the source when the underlying contact network is an infinite regular tree. That is, all users with the message are nearly equally likely to have been the origin of the message. When the contact network is an irregular tree, we characterize the probability of maximum likelihood detection by proving a concentration result over Galton-Watson trees. Experiments on a sampled Facebook network demonstrate that adaptive diffusion effectively hides the location of the source even when the graph is finite, is irregular, and has cycles.

MimiBS: Mimicking Base-Station to Provide Location Privacy Protection in Wireless Sensor Networks

In a wireless sensor network (WSN), sink node/base station (BS) gathers data from surrounding nodes and sends them to a remote server via a gateway. BS holds important data. Therefore, it is necessary to hide its location from an inside/outside attacker. Providing BS location anonymity against a local and global adversary, we propose a novel technique called MimiBS “Mimicking Base-Station”. The key idea is the integration of aggregator nodes (ANs) with sensor nodes (SNs), while fine tuning TTL (time to live) value for fake packets, and setting some threshold value for real packet counter rpctr. MimiBS creates multiple traffic-hotspots (zones), which shifts the focus from BS to the newly created ANs hotspots. Multiple traffic-hotspots confuse the adversary while determining the real BS location information. We defend the BS location information anonymity against traffic analysis attack, and traffic tracing attack. MimiBS gives an illusion of having multiple BSs, and thus, if the attacker knows any about AN, he/she will be deceived between the real BS and ANs. MimiBS outperforms BLAST (base-station location anonymity and security technique), RW (random walk), and SP (shortest path), while conducting routing without fake packets, with fake packets, without energy consideration, and with energy consideration respectively.

Source Anonymity in WSNs against Global Adversary Utilizing Low Transmission Rates with Delay Constraints.

Wireless sensor networks (WSN) are deployed for many applications such as tracking and monitoring of endangered species, military applications, etc. which require anonymity of the origin, known as Source Location Privacy (SLP). The aim in SLP is to prevent unauthorized observers from tracing the source of a real event by analyzing the traffic in the network. Previous approaches to SLP such as Fortified Anonymous Communication Protocol (FACP) employ transmission of real or fake packets in every time slot, which is inefficient. To overcome this shortcoming, we developed three different techniques presented in this paper. Dummy Uniform Distribution (DUD), Dummy Adaptive Distribution (DAD) and Controlled Dummy Adaptive Distribution (CAD) were developed to overcome the anonymity problem against a global adversary (which has the capability of analyzing and monitoring the entire network). Most of the current techniques try to prevent the adversary from perceiving the location and time of the real event whereas our proposed techniques confuse the adversary about the existence of the real event by introducing low rate fake messages, which subsequently lead to location and time privacy. Simulation results demonstrate that the proposed techniques provide reasonable delivery ratio, delay, and overhead of a real event's packets while keeping a high level of anonymity. Three different analysis models are conducted to verify the performance of our techniques. A visualization of the simulation data is performed to confirm anonymity. Further, neural network models are developed to ensure that the introduced techniques preserve SLP. Finally, a steganography model based on probability is implemented to prove the anonymity of the techniques.

FMSLPP: fake-message based sink location privacy preservation for WSNs against global eavesdroppers

Traditional encryption and authentication methods are not effective in preserving sink’s location privacy from a global adversary that could be monitoring the network’s traffic and time-of-arrival of traffic flows. In this paper, we present a novel method named fake-message based sink location privacy preservation (FMSLPP) to protect sink’s location privacy against global eavesdroppers. In this method, we let sensors generate fake messages with a probability before the sink sends a message, in order to confuse an adversary about the sink’s location. We also make each node have approximately the same traffic volume to protect the sink’s location privacy. Simulation results from two approaches of sensor deployment (random deployment or controlled deployment) indicate that FMSLPP makes it very difficult for the global adversary to identify the location of the sink; at the same time, transmission of fake messages does not impact significantly the network’s performance in terms of network life.

Anti-traffic analysis attack for location privacy in WSNs

Traditional encryption and authentication methods are not effective in preserving a sink's location privacy from a global adversary that is monitoring the network traffic. In this paper, we first propose a novel anti-traffic analysis (ATA) method to preserve the sink's location privacy. In order to confuse a local or global adversary, each node generates dummy messages, the number of which is dependent on the number of the node's children. Hence, ATA is able to prevent the adversary from acquiring valuable information on the sink's location through the traffic analysis attack. However, a larger number of dummy messages lead to consumption of extra energy. Then, we design our improved ATA (IATA) in such a way that we select some sensors to act as fake sinks, to ensure that sensors around fake sinks generate dummy messages and discard received dummy messages. Since the problem of the optimal fake sinks' placement is nondeterministic polynomial time (NP)-hard, we employ local search heuristics based on network traffic and security entropy. Performance analysis of the ATA scheme can protect the sink's location privacy, and IATA scheme can reduce energy consumption.

Providing Location Privacy against a Global Adversary in Wireless Sensor Networks

Wireless sensor networks are widely used in our daily life. It consists of various sensors which collect different information containing the identity, status, and location of an object or any other business, social or privately relevant information. But we pay attention to some issues related to sensor’s location privacy. In this paper, we focus on protecting the sensor’s location by introducing suitable modifications to sensor routing to make it difficult for an eavesdropper to find the original location. And we propose a Multi-source and Multi-routing scheme, which is a flexible routing strategy to protect the sensor’s location. Our strategy can efficiently reduce the chance of packets being detected. And the adversary can find it difficult to find the exact location of the source node or the base station.

A Privacy Preserving Scheme in Wireless Sensor Networks

The privacy of sensitive events observed by a sensor network needs to be protected. An adversary can track the trajectory of a moving object or determine the location of the occurrence of a critical event to breach its privacy. In this paper, we propose ring signature for obfuscating the spatial information. First, the extended region of location of an event of interest as estimated from a sensor communication is presented. Then, the increase in this region of spatial uncertainty due to the effect to the effect of ring signature is determined. We observe that ring signature can effectively enhance the region of location uncertainty of a sensed event. This can help in sustaining the privacy of the event of interest against a local or a global adversary. Finally, we evaluate the efficacy of our privacy enhancing strategy by finding its effect on delay and throughput of the sensor network.

Efficient spatial privacy preserving scheme for sensor network

Abstract The privacy of sensitive events observed by a wireless sensor networks (WSN) needs to be protected. Adversaries with the knowledge of sensor deployment and network protocols can infer the location of a sensed event by monitoring the communication from the sensors even when the messages are encrypted. Encryption provides confidentiality; however, the context of the event can used to breach the privacy of sensed objects. An adversary can track the trajectory of a moving object or determine the location of the occurrence of a critical event to breach its privacy. In this paper, we propose ring signature to obfuscate the spatial information. Firstly, the extended region of location of an event of interest as estimated from a sensor communication is presented. Then, the increase in this region of spatial uncertainty due to the effect of ring signature is determined. We observe that ring signature can effectively enhance the region of location uncertainty of a sensed event. As the event of interest can be situated anywhere in the enhanced region of uncertainty, its privacy against local or global adversary is ensured. Both analytical and simulation results show that induced delay and throughput are insignificant with negligible impact on the performance of a WSN.

Pool-based anonymous communication framework for high-performance computing

We propose and analyze in details the revised model of XPROB, an infinite family of pool-based anonymous communication systems that can be used in various applications including high performance computing environments. XPROB overcomes the limitations of APROB Channel that only resists a global delaying adversary (GDA). Each instance of XPROB uses a pool mix as its core component to provide resistance against a global active adversary (GAA), a stronger yet more practical opponent than a GDA. For XPROB, a GAA can drop messages from users but cannot break the anonymity of the senders of messages. Analysis and experimental evaluations show that each instance of XPROB provides greater anonymity than APROB Channel for the same traffic load and user behaviors (rate and number of messages sent). In XPROB, any message can be delivered with high probability within a few rounds after its arrival into the system; thus, an opponent cannot be certain when a message will be delivered. Furthermore, users can choose their own preference balance between anonymity and delay. Through the evaluation, we prove that XPROB can provide anonymity for users in high-performance computing environments.

Sage: a strong privacy-preserving scheme against global eavesdropping for ehealth systems

The eHealth system is envisioned as a promising approach to improving health care through information technology, where security and privacy are crucial for its success and largescale deployment. In this paper, we propose a strong privacy-preserving Scheme against Global Eavesdropping, named SAGE, for eHealth systems. The proposed SAGE can achieve not only the content oriented privacy but also the contextual privacy against a strong global adversary. Extensive analysis demonstrates the effectiveness and practicability of the proposed scheme.