Tempest: Temporal Dynamics in Anonymity Systems

Abstract

Many recent proposals for anonymous communication omit from their security analyses a consideration of the effects of time on important system components. In practice, many components of anonymity systems, such as the client location and network structure, exhibit changes and patterns over time. In this paper, we focus on the effect of such temporal dynamics on the security of anonymity networks. We present Tempest, a suite of novel attacks based on (1) client mobility, (2) usage patterns, and (3) changes in the underlying network routing. Using experimental analysis on real-world datasets, we demonstrate that these temporal attacks degrade user privacy across a wide range of anonymity networks, including deployed systems such as Tor; pathselection protocols for Tor such as DeNASA, TAPS, and Counter-RAPTOR; and network-layer anonymity protocols for Internet routing such as Dovetail and HORNET. The degradation is in some cases surprisingly severe. For example, a single host failure or network route change could quickly and with high certainty identify the client’s ISP to a malicious host or ISP. The adversary behind each attack is relatively weak – generally passive and in control of one network location or a small number of hosts. Our findings suggest that designers of anonymity systems should rigorously consider the impact of temporal dynamics when analyzing anonymity.

DPSelect: A Differential Privacy Based Guard Relay Selection Algorithm for Tor

“…Even though a single AS could serve thousands of Tor clients, identification of a Tor client's AS can be dangerous. As noted by Wails et al [36], knowledge of a client's AS is problematic for three unique reasons: (1) The client AS can be tar-geted to divulge a user's real identity; (2) the diversity of a client's attributes (e.g. physical location) is much lower in a single AS and could be combined with auxiliary information to perform deanonymization; (3) the client AS can be used to link connections and profile Tor clients.…”

“…However, this results in a decrease in guard relay randomness, which in turn leaks probabilistic information about client origin ASes. A major drawback of their approach is thus a significant decrease in the Shannon entropy of client source ASes over time, allowing client ASes to be statistically fingerprinted [26,36]. These fingerprinting attacks allow adversaries to link a client to her source AS.…”

A Survey of Privacy Protection and Network Security in User On-Demand Anonymous Communication

“…In practice, many components of anonymous systems, such as network structures and communication components, change over time [79]. In particular, the communication performance of routing nodes in a network, such as bandwidth, communication delay, etc., will change over time.…”

dPHI: An improved high-speed network-layer anonymity protocol

“…That is, if the adversary is located at the exit node (and hence knows the destination), the security properties of dPHI and PHI hold even if d is malicious. Recently, Wails et al [31] presented attacks against various anonymity protocols in case the source or destination moves within the network and the attacker located within the path between s and d is able to link sessions. While this is an interesting type of attack, it is not part of the threat model of dPHI.…”