Predecessor Attack Research Articles

Proposal, design and evaluation of a mechanism to limit the length of anonymous overlay network paths

An alternative to guarantee anonymity in overlay networks may be achieved by building a multi-hop path between the initiator and the destination. Random walks (also known by means of the Crowds algorithm) have been widely used for this purpose in IP networks. Therefore, we explore the use of a Crowds-based mechanism to provide anonymity in overlay networks. However, the original algorithm does not limit the length of the paths, and in an overlay network the associated costs may grow excessively. Thus, controlling the length of the Crowds-based paths is a crucial issue in this scenario. A straightforward implementation makes use of a time-to-live (TTL) field. However, this implementation will immediately reveal whether the predecessor node is the initiator or not. This paper presents a novel mechanism to control the path length without using the TTL field. We propose an analytical model to evaluate the degree of anonymity when the path length is limited using our scheme. We conclude that limiting the multi-hop path length does not have any relevant impact over the degree of anonymity. We also prove that the new mechanism does not increase the vulnerability of Crowds over the traffic analysis and predecessor attacks.

Passive-Logging Attacks Against Anonymous Communications Systems

Using analysis, simulation, and experimentation, we examine the threat against anonymous communications posed by passive-logging attacks. In previous work, we analyzed the success of such attacks under various assumptions. Here, we evaluate the effects of these assumptions more closely. First, we analyze the Onion Routing-based model used in prior work in which a fixed set of nodes remains in the system indefinitely. We show that for this model, by removing the assumption of uniformly random selection of nodes for placement in the path, initiators can greatly improve their anonymity. Second, we show by simulation that attack times are significantly lower in practice than bounds given by analytical results from prior work. Third, we analyze the effects of a dynamic membership model, in which nodes are allowed to join and leave the system; we show that all known defenses fail more quickly when the assumption of a static node set is relaxed. Fourth, intersection attacks against peer-to-peer systems are shown to be an additional danger, either on their own or in conjunction with the predecessor attack. Finally, we address the question of whether the regular communication patterns required by the attacks exist in real traffic. We collected and analyzed the Web requests of users to determine the extent to which basic patterns can be found. We show that, for our study, frequent and repeated communication to the same Web site is common.

The predecessor attack

There have been a number of protocols proposed for anonymous network communication. In this paper, we investigate attacks by corrupt group members that degrade the anonymity of each protocol over time. We prove that when a particular initiator continues communication with a particular responder across path reformations, existing protocols are subject to the attack. We use this result to place an upper bound on how long existing protocols, including Crowds, Onion Routing, Hordes, Web Mixes, and DC-Net, can maintain anonymity in the face of the attacks described. This provides a basis for comparing these protocols against each other. Our results show that fully connected DC-Net is the most resilient to these attacks, but it suffers from scalability issues that keep anonymity group sizes small. We also show through simulation that the underlying topography of the DC-Net affects the resilience of the protocol: as the number of neighbors a node has increases the strength of the protocol increases, at the cost of higher communication overhead.