Denial-of-Service Flooding Detection in Anonymity Networks Computer Networks & Communications Group Institute for IT-Security and Security Law University of Passau Germany Performance Measurement and Management for Two-Level Optimization of Networks and Peer-to-Peer Applications (GR/S69009/01) Network of Excellence: Design and Engineering of the Future Generation Internet (IST ) Jens Oberender Melanie Volkamer Hermann de Meer MonAM 2007 LAAS-CNRS, Toulouse, France 5. November 2007

Attacks in Anonymity Networks  Chaum’s Mixer  A sender remains anonymous, if an adversary catches no evidence on sender identity  How to protect receivers from anonymous flooding attacks? 1. Enable traffic flow detection  DoS attack detection 2. Prevent anonymity breach  protect sender identity  Message Tagging DoS Flooding Detection in Anonymity Networks2

Linkability Continuum  Two messages are linkable by an adversary, if evidence on their relation can be provided.  Pseudonyms –Adversary links all messages  malicious profiling  Unobservability +Observer cannot link any messages together  Limited Linkability  Restricted number of linkable messages  Enables traffic flow clustering DoS Flooding Detection in Anonymity Networks3 1  NoneLifelong #Messages per Profile Message Linkability Limited

Attacker Model Security Objectives 1. Limited linkability 2. Linkability resistant to malicious influence DoS Flooding Detection in Anonymity Networks4 Privacy Adversary Aim: disclose sender anonymity Observe incoming tags Collude with other DoS engines Message Flooding Attacker Aim: Denial-of-Service Exhausts victim resources DoS Mitigation Adversary Access Control Attacker Anonymity Network Access Control Adversary Receiver Access Control Adversary Receiver Assumptions  Anonymity Network unbroken  Access Control Entity trusted by sender & receivers

Message tagging  Fast, local traffic flow cluster criteria  Hash from characteristic strings (key derivation function)  Values not comparable with fresh salt  Linkability control Tag properties  Sender differentiate senders  Receiverdisables cross-server profiling  Time Framedisables lifelong linkability DoS Flooding Detection in Anonymity Networks5

Internal vs. External Tags Anonymity Attack using external tags  Collude to learn anonymous paths Proposed internal Message Tagging  Tags reside within encrypted channel DoS Flooding Detection in Anonymity Networks6

Clustering of Anonymous Traffic Flows  Anonymous Messages  Header data stripped off, application level analysis needed  Message tags enable flow clustering  Clusters of [ Sender,  ] at Engine  Detection frames cluster partial message flows  Arrival rate DoS Flooding Detection in Anonymity Networks7

Clustering of time-based Tags DoS Flooding Detection in Anonymity Networks8

Scalability Issues  Clock skew in distributed systems  misuse degrades linkability Access control entity  Counts messages per sender  Logarithm effects on tag DoS Flooding Detection in Anonymity Networks9 Traffic flow classification  Arrival rate per message tag  Activity profiling

Sender Linkability  Scales with message volume  Depends on arrival rate towards each receiver  Message tags collisions  Flow splitting increases linkability  Incentive mechanism  Strategic players’ goal: maximize privacy  Inoffensive communication encouraged DoS Flooding Detection in Anonymity Networks10

Multiple sender identities  Equivalent to DDoS  No defense against attacks from different sender identities, but…  Example BotNets  Anonymity for attacker only  Proxy functionality  Yet these don’t spy SMTP authentication  Anonymity networks  No need to operate a BotNet  Anonymous attacks using real identity  Hard-to-detect without add-ons  Benefits the privacy of the broad public! DoS Flooding Detection in Anonymity Networks11

Conclusions  Partial traffic flows  Ability to detect Anonymous DoS Flooding Attacks state-of-the-art techniques applicable  Sender Anonymity maintained  Sender Privacy  Defense of cross-server profiling  Restricted amount of message linkable  Arrival Rate  Linkability DoS Flooding Detection in Anonymity Networks12 Jens Oberender