Towards Measuring Anonymity

Abstract

This paper introduces an information theoretic model that allows to quantify the degree of anonymity provided by schemes for anonymous connections. It considers attackers that obtain probabilistic information about users. The degree is based on the probabilities an attacker, after observing the system, assigns to the different users of the system as being the originators of a message. As a proof of concept, the model is applied to some existing systems. The model is shown to be very useful for evaluating the level of privacy a system provides under various attack scenarios, for measuring the amount of information an attacker gets with a particular attack and for comparing different systems amongst each other.

Data Retention and Anonymity Services

“…5 Critics of this way of measuring anonymity mention (rightly so) that the probability distribution of all elements in S(t) is not necessarily uniform [8,9]. However, we know that the best case from the perspective of law enforcement would be, if S(t) contains one element only.…”

“…If the law enforcement agency possesses a priori knowledge that one and the same target person is responsible for the events of interest observed at t 1 , t 2 , and t 3 , then this person (or rather her identifier) belongs to the intersection of S(t 1 ) ∩ S(t 2 ) ∩ S(t 3 ). 8 Note that events may basically occur on various layers, the application layer or the network layer, for instance. On the application layer, a law enforcement agency may observe that the same e-mail account was accessed several times.…”

Limits of Anonymity in Open Environments

“…Stop-and-Go Mixes) an alternative approach is suggested with the goal of providing probabilistic security against the (n − 1)-Attack with a security parameter µ. It was shown that a linear change of this parameter µ should have an exponential effect on the protection level of the method and on the achieved anonymity size n. However, recent research work [22,23] limits the exponential effect on the size of the anonymity set by neglecting small probabilities, e.g. by neglecting all participants with a-posteriori probability less than p ≤ 0.0001 (see Definition 1).…”

Metrics for Security and Performance in Low-Latency Anonymity Systems

“…One simple metric for anonymity system security is the size of the anonymity set, but this does not capture the non-uniformity. For this reason, Danezis and Serjantov [8] proposed entropy of the anonymity set as the effective size, and Diaz et al [9] proposed normalised entropy as the system's degree of anonymity.…”