Peer-to-Peer Information Systems Week 7: Anonymity Part 2 Old Dominion University Department of Computer Science CS 495/595 Fall 2003 Michael L. Nelson <mln@cs.odu.edu> 10/09/03

Crowds Provides anonymous http transactions CACM: http://doi.acm.org/10.1145/293411.293778 ACM TISSEC: http://doi.acm.org/10.1145/290163.290168 Lighter-weight approach than Onion Routing: http://www.onion-router.net  http://doi.acm.org/10.1145/293411.293443

“John Doe” each computer installs a proxy service on their machine proxy runs as “jondo” on initial use, the jondo process randomly chooses another jondo running on another machine pf > 0.50 a system tunable parameter, biased in favor of forwarding eventually, one of the jondo’s will choose to retrieve the object

jondo Maintenance Once a path is set in the original request: the reply is returned along the same path the same path is used for all future requests Each jondon keeps track of jondon-1 and jondon+1 from figure 1, there appears to be 2 different path states stored, even though both will appear the same in traffic analysis: local request recvd request

Paths in a Crowd Figure 1 from CACM, 42(2), Feb 1999

jondo Selection & Communication When a new jondo starts, it contacts a “blender” blender knows the location of all jondos and generates and distributes the keys jondo-jondo communication Communication between jondon and jondon+1 is encrypted with the keys from the blender new paths are recomputed when a new jondo joins this prevents being able to isolate the new path

Anonymity Spectrum Figure 2 & Table 1 from CACM, 42(2), Feb 1999

Limitations Contents are not protected in jondo communication e.g. - not suitable for passing credit card numbers! authors’ recommendation: turn off the proxy for these situations The retrieving jondo’s IP addr is not protected that jondo does have plausible deniability Mobile code still a risk for sender anonymity Retrieval time increases

Potentially More Serious Limitations Encryption distribution limitations Vendors blocking anonymous purchases stolen CC #’s Banning crowds software

Possible Improvements? Remove blender, use multicast to announce new jondos and their public keys? is multicast “good enough”? Periodically re-route requests? e.g., every hour totally re-compute the crowd paths? add new jondos then? Randomly generate noise traffic? on “false” paths even?