Towards Measuring Anonymity Claudia Díaz COSIC Group, K.U.Leuven (Belgium) http://www.esat.kuleuven.ac.be/cosic claudia.diaz@esat.kuleuven.ac.be April 2002

Contents Introduction Entropy Model Degree of anonymity Examples: Remailer Crowds Onion Routing Extension and alternative solution Conclusions and future work

Introduction Context: systems that provide anonymous connections (Crowds, Onion Routing, Mix networks, …) Goal: use information theory to measure the amount of information gained by an attacker by observing the system

Entropy (1) Definition of Entropy: Measure of the uncertainty of a random variable. Measure of the amount of information required on the average to describe the random variable Notation: H(X)

Entropy (2) Given a discrete random variable, X, that can take N possible values with probability greater than zero, (p1 … pN), the entropy of X is defined as:

Entropy (3) The more equally distributed, the more information (greater H(X)); the closer to a deterministic distribution, the less information (smaller H(X)) The entropy of X is a functional of the distribution of X, it does not depend on the values taken by X (X: set of possible senders; pi: probability that X = xi)

Model Anonymity: “state of being not identifiable within a set of subjects” Entities: senders, receivers, mixes (nodes, jondos) Attack model: Internal/External Passive/Active Local/Global

Assumptions (1) The attacker tries to find the sender of a particular message The attacker knows the number of users of the system (N) The attacker performs traffic analysis. An active attacker may introduce or delete messages from the system

Assumptions (2) After the attack, probabilities are assigned to the senders; the attacker obtains information of the form “with probability p, user A is the sender of the message” All users send in average the same number of messages A user sends messages which follow a Poisson distribution over the time

Assumptions (3) Passive attack: The maximum entropy is HM = log2N Active attack: The attacker can reduce the set of potential senders by deleting messages, the maximum entropy is calculated with the number remaining users

Degree of Anonymity (1) We define: H(X): entropy of the system after the attack HM: maximum achievable entropy for N users, HM = log2(N) Note that:

Degree of Anonymity (2) The degree of anonymity is defined as: Remarks: Independent from the number of senders

Example: Remailer

Remailer: Attack 1 Global, active, external attacker He blocks the messages of 8 users (anonymity set reduced to 2) Maximum entropy: HM = log2(2) = 1 After the attack (traffic analysis of remaining messages), the probability of user 1 of having sent message M is p. The probability of user 2 is (1-p)

Degree of anonymity

Remailer: Attack 2 Passive, global, external attacker Size of the anonymity set: 10 Maximum entropy: HM = log2(10) After the attack: pi = p/3, for i = 1, 2, 3 pi = (1-p)/7, for i = 4 … 10

Degree of anonymity

Example: Crowds

Crowds: Attack Attacker: internal, passive and local (collaborating jondos) Message goes through at least 1 corrupted jondo N: Number of members of the crowd C: Number of collaborating jondos Maximum entropy: HM = log2(N-C)

Degree of anonymity

Example: Onion Routing

Onion Routing: Attack Passive, global, external attacker Maximum entropy is HM=log2(N) After the traffic analysis, the attacker is able to discard some users. He has narrowed down the anonymity set to S users: pi = 1/S i = 1 … S pi = 0 i > S

Degree of anonymity

Extension of the model We may get different distributions with a certain probability (e.g., Crowds: the message may go through a corrupted jondo with probability p1 or not with probability p2 = 1 - p1) If a system offers a degree di with pi, we suggest: d =  pi · di

Alternative A system may have a requirement on the anonymity level of the type: “users should have at least a degree of anonymity equivalent to a system with M users and perfect indistinguishability” If the system does not meet the requirement launch an alarm (or use dummy traffic) Solution: we may compare the entropy with the reference value (HR=log2(M)), instead of comparing against the maximum entropy

Conclusions We propose a model to evaluate the degree of anonymity provided by a system With this scheme we have means to compare the effectiveness of different attack models Usefulness of Information Theory in this field of research.

Further Research on this Topic Find a minimum acceptable value for d Develop a model that takes into account contextual information (as a priori information) Evolution of the degree of anonymity with the time Measure the probability of finding a match sender-recipient (not focused on a particular message) Analyze the effect of dummy traffic