DPSelect: A Differential Privacy Based Guard Relay Selection Algorithm for Tor

Abstract

Recent work has shown that Tor is vulnerable to attacks that manipulate inter-domain routing to compromise user privacy. Proposed solutions such as Counter-RAPTOR [29] attempt to ameliorate this issue by favoring Tor entry relays that have high resilience to these attacks. However, because these defenses bias Tor path selection on the identity of the client, they invariably leak probabilistic information about client identities. In this work, we make the following contributions. First, we identify a novel means to quantify privacy leakage in guard selection algorithms using the metric of Max-Divergence. Max-Divergence ensures that probabilistic privacy loss is within strict bounds while also providing composability over time. Second, we utilize Max-Divergence and multiple notions of entropy to understand privacy loss in the worst-case for Counter-RAPTOR. Our worst-case analysis provides a fresh perspective to the field, as prior work such as Counter-RAPTOR only analyzed average case-privacy loss. Third, we propose modifications to Counter-RAPTOR that incorporate worst-case Max-Divergence in its design. Specifically, we utilize the exponential mechanism (a mechanism for differential privacy) to guarantee a worst-case bound on Max-Divergence/privacy loss. For the quality function used in the exponential mechanism, we show that a Monte-Carlo sampling-based method for stochastic optimization can be used to improve multi-dimensional trade-offs between security, privacy, and performance. Finally, we demonstrate that compared to Counter-RAPTOR, our approach achieves an 83% decrease in Max-Divergence after one guard selection and a 245% increase in worst-case Shannon entropy after 5 guard selections. Notably, experimental evaluations using the Shadow emulator shows that our approach provides these privacy benefits with minimal impact on system performance.

ExitSniffer: Towards Comprehensive Security Analysis of Anomalous Binding Relationship of Exit Routers

“…Tor's selection of exit nodes follows the routing selection algorithm [15]. The client randomly selects a node as the exit node from the relay node set that meets the exit node label rules by using the bandwidth weighting algorithm [16].…”

ShorTor: Improving Tor Network Latency via Multi-hop Overlay Routing

“…We note that all works here operate at the circuit layer and are proposed modifications to Tor's circuit selection protocol. There is additionally a large body of work that alters path selection in Tor for purposes of security [13,15,30,40,48,64,73,82,89]. While important, these works are orthogonal to ShorTor and often result in substantially degraded performance [61,74] without clear security advantages over Tor's current protocol [36,85,86].…”

Once is Never Enough: Foundations for Sound Statistical Inference in Tor Network Experimentation

“…The Tor experimentation tools and models described above have assisted researchers in exploring how changes to Tor's path selection [5,7,13,24,28,41,46,52,58,60,61,73,75], load balancing [22,27,31,34,40,53], traffic admission control [2,16,21,23,33,35,37,42,47,74], congestion control [4,20], and denial of service mechanisms [12,26,36,39,59] affect Tor performance and security [3]. The standard practice that has emerged from this work is to sample a single scaled-down Tor network model and use it to run experiments with standard Tor and each of a set of chosen configurations of the proposed performance-enhancing mechanism.…”

“…Researchers have contributed numerous proposals for improving Tor performance in order to support continued growth in the network, including those that attempt to improve Tor's path selection [5,7,13,24,28,41,46,52,58,60,61,73,75], load balancing [22,27,31,34,40,53], traffic admission control [2,16,21,23,33,35,37,42,47,74], and congestion control mechanisms [4,20]. The standard practice when proposing a new mechanism for Tor is to run a single experiment with each recommended configuration of the mechanism and a single experiment with standard Tor.…”