Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Measuring Anonymity Revisited Gergely Tóth Zoltán Hornák Ferenc Vajda Budapest University of Technology and Economics Department of Measurement and Information Systems Nordsec 2004

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Outline Our research group Anonymity in general Anonymous communication Measuring anonymity –past and present approaches –our suggestion Summary and future plans

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 SEARCH-LAB at BUTE DMIS BUTEBudapest University of Technology and Economics (BUTE) DMISDepartment of Measurement and Information Systems (DMIS) SEARCH-LABSecurity Evaluation Analysis and Research Laboratory (SEARCH-LAB) Security in mobile networksCore focus: Security in mobile networks DRM, Biometrics & AnonymityCurrent research areas: DRM, Biometrics & Anonymity

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Summary of the Presentation & Paper Anonymous communicationAnonymous communication is needed for several real-world scenarios Different implementations provide different levels of anonymity metricA theoretical, objective metric is needed to be able to compare them After analyzing past approaches, we present our suggestion

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Introduction

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Anonymity in General hiding the identityAnonymity means hiding the identity –actions are performed by subjects –aim is to hide the identity of these subjects from any possible adversary anonymity scenariosPossible anonymity scenarios –hide the identity of the voter during e-voting –hide the identity of the buyer during e-payment –hide the identity of the sender of s

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Anonymous Communication Several layers in the anonymity architecture with different functions anonymous communicationFocus of the presentation & paper: anonymous communication –systems that deliver messages so that they cannot be traced back to their sources –several such systems have been designed –aim is now to define metrics to be able to compare them

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Need for Measuring Anonymity Different systemsDifferent systems –algorithms –network topologies –adversary models Anonymity provided has to be measured –objective, theoretically –objective, theoretically based metrics easy to understand –should be easy to understand by laymen define their required anonymity level –users should be able to define their required anonymity level

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Anonymous Communication

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Model of Anonymous Communication Anonymous message transmissionAnonymous message transmission system –senders send encrypted messages to recipients through a channel –the channel alters, delays and reorders messages before delivery adversary –an adversary tries to back-trace delivered messages to their senders

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Anonymity Terminology anonymity set“Anonymity is the state of being not identifiable within a set of subjects, the anonymity set” Sender anonymitySender anonymity means that –a particular message is not linkable to any sender and –to a particular sender no message is linkable.

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Different Realizations During the evolution of science several schemes have been proposed and implemented –batch systems: MIXes –continuous-time systems –peer-to-peer systems –systems with provable anonymity, such as DC networks Let’s see some examples

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 MIXes I – Batched Operation MIXes are network relays to make back- tracing messages to their senders hard buffer randomly reorderFor this they buffer incoming messages and randomly reorder them upon delivery MIX

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 MIXes II – the MIX Network networksThey are furthermore organized in networks onion-like messagesThere, special, onion-like messages are created and propagated M to Y to MIX 3 to MIX 2 MIX 1 MIX 2 MIX 3 from sender to recipient to MIX 2 to MIX 3 to Y M to Y M

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Continuous Time Systems MIXes did batching, in most cases they do not guarantee real-time delivery process messages individuallyOn the other hand continuous-time systems process messages individually probability variable with a given density –message delay (  ) in the channel is a probability variable with a given density f(  ) –delay is not dependent on the actual message distribution

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 PROB-channel & SG-MIX Two recent continuous-time systems: –SG-MIX –SG-MIX (Stop-and-go MIX): exponential density function for non real-time scenarios –PROB-channel –PROB-channel: uniform distribution with definite maximum for real-time use-cases

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Challenge The challenge: newer and newer systems –with the evolution of science, newer and newer systems are constructed organized into networks of various topologies –different known systems are organized into networks of various topologies Which architecture is better? metric –a theoretical metric is needed to objectively compare different systems easy to understand –measuring should be easy to understand

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 More Complex Systems and Networks MIX

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Measuring Anonymity

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Attempt #1 – Anonymity Set Size Size of the anonymity set –the first attempt to quantity the level of anonymity –the bigger the anonymity set, the greater the level of anonymity –easy to calculate –easy to understand you are anonymous as if one had to pick randomly from 500 equal possibilities

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Problem with Anonymity Set Size In some simple cases anonymity set size works well (e.g. for simple MIXes) However a closer look reveals different probabilities –in the anonymity set subjects have different probabilities, i.e. one is more likely to be the actual sender than the other according to the knowledge of the adversary –simply the size of the anonymity set is not definite enough

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Attempt #2 – Entropy The probabilities of the different subjects have to be considered information theory entropyFor this purpose in the information theory a fundamental construction had been defined: entropy The improved approach: use the entropy of the probability distribution for quantifying anonymity

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Entropy – Definitions probabilitiesDetermine the probabilities for a sender being the originator for a message anonymity setThe anonymity set: Simple entropySimple entropy measure: Normalized entropyNormalized entropy measure:

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Problems with Entropy totally breakEntropy-based metrics aim to quantify the amount of information that is needed to totally break anonymity non-desirable systemsProblem: non-desirable systems with arbitrarily high entropy exist –both for simple entropy and –for normalized entropy.

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Example 20 senders, uniform distribution, P=5% 101 senders, non-uniform distribution –for one sender P=50% –for all the other 100 senders P=0.5% entropy is the sameFor both cases entropy is the same S= bits don’t achieve the same level of anonymityHowever, it is clear, that the two systems don’t achieve the same level of anonymity

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Problems with Entropy – continued In the paper for both simple and normalized entropy degenerate cases were shown local aspect –such measures neglect the local aspect of anonymity does not necessarily want to totally compromise all messagesthe adversary does not necessarily want to totally compromise all messages locally guess forsome messages with a better probability than anticipatedaim could be to locally guess for some messages with a better probability than anticipated Also easy understandability suffers

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Our Suggestion – Maximal Probability maximal probabilityUse the maximal probability as a measure source-hiding with parameter If the above holds, a system is called source-hiding with parameter  –this approach is easy-to-understand  =10% means that regardless what the adversary does, he won’t be able to compromise any of your messages with a probability greater than 10%

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Maximal Probability – continued Source-hiding property –it can be converted back to the entropy-based metrics for both simple and normalized entropy equations were given local aspect of anonymity –considers the local aspect of anonymity for no messages can the threshold be exceeded source-hiding property can be set as a requirement –for some systems source-hiding property can be set as a requirement

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Summary & Future

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Summary The field of anonymous communication is rapidly evolving In order to be able to objectively compare different systems, a theoretical metric is needed Our suggestion is to use the maximal probability from the probability distribution of the adversary to measure the achieved level of anonymity

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Research Plans For some scenarios the level of anonymity can be calculated anonymity has to be analyzed further –there are constructions where the anonymity has to be analyzed further combination of different systems –it has to be evaluated, how the combination of different systems behaves QoSSystems are needed, where the level of anonymity can be set as a requirement (QoS)

Gergely Tóth, 5 November Nordsec 2004, Helsinki, Finland, 4-5 November 2004 Thank you for your attention Gergely Tóth Budapest University of Technology and Economics Department of Measurement and Information Systems