Low-latency Anonymous Network Research Articles

QuicTor: Enhancing Tor for Real-Time Communication Using QUIC Transport Protocol

In the past decades, the internet has emerged as the fastest way to access information. However, this revolutionary information age comes with its own set of challenges. The privacy of Internet users is at increasing risk with the advances in surveillance techniques. Users’ online behavior, activities, and even personal information are being tracked by ISPs and major tech companies. In response to the increasing need for preserving and protecting the privacy of online users, anonymity networks were developed. Tor anonymity network is a low-latency anonymity network that has gained quite a good reputation over the past years and is being adopted by thousands of users. With the great attention Tor’s network is getting, the original design of Tor was proven to have performance limiting issues. With the motivation for addressing the performance limitation in Tor, we present QuicTor, a datagram-based design to solve Tor’s transport-layer limiting issue. We evaluated the performance of QuicTor in comparison to vanilla Tor as well as other performance-enhancing proposals. QuicTor achieved significant performance improvements for interactive applications as well as streaming applications. Running Tor over a datagram-based protocol entails a careful security analysis. In this article, we assess the behavior of QuicTor under side-channel attacks aiming to de-anonymize Tor’s clients. We show that the performance improvements brought by QuicTor do not reduce the anonymity of clients under the investigated types of attacks.

MorphIT: Morphing Packet Reports for Internet Transparency

Abstract Can we improve Internet transparency without worsening user anonymity? For a long time, researchers have been proposing transparency systems, where traffic reports produced at strategic network points help assess network behavior and verify service-level agreements or neutrality compliance. However, such reports necessarily reveal when certain traffic appeared at a certain network point, and this information could, in principle, be used to compromise low-latency anonymity networks like Tor. In this paper, we examine whether more Internet transparency necessarily means less anonymity. We start from the information that a basic transparency solution would publish about a network and study how that would impact the anonymity of the network’s users. Then we study how to change, in real time, the time granularity of traffic reports in order to preserve both user anonymity and report utility. We evaluate with real and synthetic data and show that our algorithm can offer a good anonymity/utility balance, even in adversarial scenarios where aggregates consist of very few flows.

A novel passive website fingerprinting attack on tor using fast fourier transform

One of the main applications of low latency anonymity networks, such as Tor, is to protect data and users’ privacy from interception over the Internet. This paper presents a novel passive website fingerprinting attack to defeat Tor's anonymity mechanism with a significant improvement in comparison with similar methods. Unlike the state-of-the-art approaches, the proposed method does not need to change the sequence of IP packets exchanged between users and the first relay in the network. We introduce a new method based on the Fast Fourier Transform to calculate the similarity distance of instances from traffic patterns. In this way, the time complexity of feature extraction is reduced by a factor of 400 during the classification process. Considering a closed-world scenario, our method easily spots on target websites with a minimum success rate of 95%. As yet another notable payoff, the accuracy keeps up more robustly while the polarity of target website grows gradually.

Correlation-Based Traffic Analysis Attacks on Anonymity Networks

In this paper, we address attacks that exploit the timing behavior of TCP and other protocols and applications in low-latency anonymity networks. Mixes have been used in many anonymous communication systems and are supposed to provide countermeasures to defeat traffic analysis attacks. In this paper, we focus on a particular class of traffic analysis attacks, flow-correlation attacks, by which an adversary attempts to analyze the network traffic and correlate the traffic of a flow over an input link with that over an output link. Two classes of correlation methods are considered, namely time-domain methods and frequency-domain methods. Based on our threat model and known strategies in existing mix networks, we perform extensive experiments to analyze the performance of mixes. We find that all but a few batching strategies fail against flow-correlation attacks, allowing the adversary to either identify ingress and egress points of a flow or to reconstruct the path used by the flow. Counterintuitively, some batching strategies are actually detrimental against attacks. The empirical results provided in this paper give an indication to designers of Mix networks about appropriate configurations and mechanisms to be used to counter flow-correlation attacks.