The Case for Network-Layer, Peer-to-Peer Anonymization Michael J. Freedman Emil Sit, Josh Cates, Robert Morris MIT Lab for Computer Science IPTPS’02March 7,

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 2 Participant can communicate anonymously with non-participant User can talk to CNN.com User ? ? Nobody knows who user is The Grail of Anonymization

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 3 Our Vision for Anonymization Millions of nodes participate Bounce traffic off one another Mechanism to organize nodes: peer-to-peer All applications can use: IP layer

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 4 Alternative 1: Proxy Approach Intermediate node to proxy traffic Completely trust the proxy Anonymizer.com User Proxy

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 5 Realistic Threat Model Corrupt proxy –Adversary runs proxy –Adversary targets proxy and compromises Limited, localized network sniffing Global passive observer? Adaptive active adversary? Use cover network: a different paper

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 6 Failures of Proxy Approach User Proxy Traffic analysis is easy Proxy reveals identity

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 7 Failures of Proxy Approach User Proxy X X CNN blocks connections from proxy Traffic analysis is easy Adversary blocks access to proxy (DoS) Proxy reveals identity

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 8 Alternative 2: Centralized Mixnet User Relay MIX encoding creates encrypted tunnel of relays –Individual malicious relays cannot reveal identity Packet forwarding through tunnel Onion Routing, Freedom Small-scale, static network, not general-purpose

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 9 Failures of Centralized Mixnet Relay CNN blocks core routers X

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 10 Relay Failures of Centralized Mixnet CNN blocks core routers Adversary targets core routers Relay

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 11 Relay Failures of Centralized Mixnet Relay CNN blocks core routers Adversary targets core routers Allows network-edge analysis Relay

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 12 Tarzan: Me Relay, You Relay Millions of nodes participate Build tunnel over random set of nodes Crowds: small-scale, not self-organizing, not a mixnet

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 13 Benefits of Peer-to-Peer Design No network edge to analyze: First hop does not know he’s first ? ? ? ? ? CNN cannot block everybody Adversary cannot target everybody

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 14 Managing Peers Requires a mechanism that 1.Discovers peers 2.Scalable 3.Robust against adversaries

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 15 Adversary can join more than once Due to lack of central authentication Adversaries Can Join System Try to prevent adversary from impersonating large address space

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 16 Stopping Evil Peers Contact peers directly to –Validate IP address –Learn public key Adversary can only answer small address space

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 17 Tarzan: Joining the System 1. Contacts known peer in big (Chord) network 2. Learns of a few peers for routing queries User

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage Contacts random peers to learn {IP addr, PK} Performs Chord lookup(random) Tarzan: Discovering Peers User

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 19 Tarzan: Building Tunnel User 4. Iteratively selects peers and builds tunnel Public-key encrypts tunnel info during setup Maps flowid  session key, next hop IP addr Tunnel Private Address Public Alias Address Real IP Address PNAT

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 20 IP Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP Diverts packets to tunnel source router IP X

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 21 IP Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP IP NATs to private address space x.x Layer encrypts packet

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 22 Encapsulates in UDP and forwards packet Strips off encryption, forwards to next hop Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User IP APP

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 23 IP NATs again to public alias address Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 24 Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP Reads IP headers and sends accordingly IP

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 25 Response repeats process in reverse IP Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User IP APP IP

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 26 Tarzan: Tunneling Data Traffic Transparently supports anonymous servers Can build double-blinded channels Server IP APP IP Oblivious User

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 27 Tarzan is Fast (Enough) Prototype implementation in C++ Setup time per hop: ~20 ms + transmission time Packet forwarding per hop: < 1 ms + transmission time Network latency dominates performance

March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 28 Summary Gain anonymity: –Millions of relays –No centralization Transparent IP-layer anonymization –Towards a critical mass of users Peer-to-Peer design