1. Peer-to-Peer Information Systems Week 7: Anonymity Part 2
Old Dominion University
Department of Computer Science
CS 495/595 Fall 2003
Michael L. Nelson
10/09/03

2. Crowds Provides anonymous http transactions
CACM:
ACM TISSEC:
Lighter-weight approach than Onion Routing:  

3. “John Doe” each computer installs a proxy service on their machine
proxy runs as “jondo”
on initial use, the jondo process randomly chooses another jondo running on another machine
pf > 0.50
a system tunable parameter, biased in favor of forwarding
eventually, one of the jondo’s will choose to retrieve the object

4. jondo Maintenance Once a path is set in the original request:
the reply is returned along the same path
the same path is used for all future requests
Each jondon keeps track of jondon-1 and jondon+1
from figure 1, there appears to be 2 different path states stored, even though both will appear the same in traffic analysis:
local request
recvd request

5. Paths in a Crowd
Figure 1 from CACM, 42(2), Feb 1999

6. jondo Selection & Communication
When a new jondo starts, it contacts a “blender”
blender knows the location of all jondos and generates and distributes the keys jondo-jondo communication
Communication between jondon and jondon+1 is encrypted with the keys from the blender
new paths are recomputed when a new jondo joins
this prevents being able to isolate the new path

7. Anonymity Spectrum
Figure 2 & Table 1 from CACM, 42(2), Feb 1999

8. Limitations Contents are not protected in jondo communication
e.g. - not suitable for passing credit card numbers!
authors’ recommendation: turn off the proxy for these situations
The retrieving jondo’s IP addr is not protected
that jondo does have plausible deniability
Mobile code still a risk for sender anonymity
Retrieval time increases

9. Potentially More Serious Limitations
Encryption distribution limitations
Vendors blocking anonymous purchases
stolen CC #’s
Banning crowds software

10. Possible Improvements?
Remove blender, use multicast to announce new jondos and their public keys?
is multicast “good enough”?
Periodically re-route requests?
e.g., every hour totally re-compute the crowd paths?
add new jondos then?
Randomly generate noise traffic?
on “false” paths even?