Improving Security and Performance in Low Latency Anonymous Networks

Improving Security and Performance in Low Latency Anonymous Networks by Kevin Scott Bauer B.S., University of Denver, 2005 A thesis submitted to the Faculty of the Graduate School of the University of Colorado in partial fulfillment of the requirements for the degree of Doctor of Philosophy Department of Computer Science 2011 This thesis entitled: Improving Security and Performance in Low Latency Anonymous Networks written by Kevin Scott Bauer has been approved for the Department of Computer Science Prof. Dirk Grunwald Prof. Douglas Sicker Prof. Shivakant Mishra Prof. Nikita Borisov Prof. Stefan Savage Date The final copy of this thesis has been examined by the signatories, and we find that both the content and the form meet acceptable presentation standards of scholarly work in the above mentioned discipline. Bauer, Kevin Scott (Ph.D., Computer Science) Improving Security and Performance in Low Latency Anonymous Networks Thesis directed by Co-Chairs Prof. Dirk Grunwald and Prof. Douglas Sicker Conventional wisdom dictates that the level of anonymity offered by low latency anonymity networks increases as the user base grows. However, the most significant obstacle to increased adoption of such systems is that their security and performance properties are perceived to be weak. In an effort to help foster adoption, this dissertation aims to better understand and improve security, anonymity, and performance in low latency anonymous communication systems. To better understand the security and performance properties of a popular low latency anonymity network, we characterize Tor, focusing on its application protocol distribution, geopolitical client and router distributions, and performance. For instance, we observe that peer-to-peer file sharing protocols use an unfair portion of the network’s scarce bandwidth. To reduce the congestion produced by bulk downloaders in networks such as Tor, we design, implement, and analyze an anonymizing network tailored specifically for the BitTorrent peer-to-peer file sharing protocol. We next analyze Tor’s security and anonymity properties and empirically show that Tor is vulner- able to practical end-to-end traffic correlation attacks launched by relatively weak adversaries that inflate their bandwidth claims to attract traffic and thereby compromise key positions on clients’ paths. We also explore the security and performance trade-offs that revolve around path length design decisions and we show that shorter paths offer performance benefits and provide increased resilience to certain attacks. Finally, we discover a source of performance degradation in Tor that results from poor congestion and flow control. To improve Tor’s performance and grow its user base, we offer a fresh approach to congestion and flow control inspired by techniques from IP and ATM networks. Dedication To my parents. Acknowledgements This thesis is the culmination of over five years of work and I wish to thank the many people who have made invaluable contributions both to this thesis and to my professional development as a researcher. First, I thank my academic advisers, Dirk Grunwald and Doug Sicker, without whose encouragement and support this work would not have been possible. Second, I thank my thesis committee, Nikita Borisov, Shiv Mishra, and Stefan Savage, for their invaluable comments and suggestions. I would also like to thank the many research collaborators and co-authors for their contributions to this thesis and to my professional development. I am particularly thankful to J. Trent Adams, Mark Allman, Mashael AlSabah, Eric Anderson, Aaron Beach, Markus Breitenbach, Nikita Borisov, Anders Drachen, Ian Goldberg, Harold Gonzales, Ben Greenstein, Greg Grudic, Dirk Grunwald, Asa Hardcastle, Joshua Juen, Yoshi Kohno, Hyunyoung Lee, Janne Lindqvist, Qin (Christine) Lv, Damon McCoy, Sears Merritt, Vern Paxson, Caleb Phillips, Stefan Savage, Micah Sherr, Doug Sicker, Robin Sommer, Parisa Tabriz, Rob Veitch, Geoff Voelker, and Gary Yee. In addition, I am grateful to Nikita Borisov, Roger Dingledine, Paul Syverson, and countless anonymous reviewers for offering helpful and constructive comments and suggestions that improved the quality of various parts of this thesis. I also especially thank Roger Dingledine for his two visits to UCSD in August and December 2010, during which time he offered invaluable expert guidance through Tor’s various layers of congestion control and flow control. I would like to especially acknowledge J. Trent Adams at The Internet Society and Tom Lookabaugh formerly at PolyCipher for their generous financial support that, in part, made this vi research possible. In addition, I thank Stefan Savage, Geoff Voelker, and Damon McCoy for sponsoring my brief stint as research staff at UCSD from August–December 2010, during which time part of this thesis was completed. Lastly, I thank Vern Paxson for sponsoring my research visit to the International Computer Science Institute’s Center for Internet Research (ICSI/ICIR) in Berkeley, CA during summer 2010, where I became fully immersed in the challenges of large-scale Internet measurement and network-based intrusion detection. If I’ve learned anything in graduate school, I learned that research is a social activity. This thesis contains text, figures, tables, data, and ideas drawn from the following jointly authored papers: [49, 54–56, 60–63, 158, 159]. Finally, and most importantly, I thank my family for encouraging me to follow my dreams and for providing the emotional and financial support that enabled me to complete my education. Of course I would be remiss if I neglected to thank my furry friends Snoopy, Bridget, and Murphy (one canine, two felines) for not excessively peeing and pooping on the carpet or otherwise trashing our apartment while I worked many long nights to finish this thesis. Lastly, I thank Catherine, my friend and partner in life, for her love and support that makes everything I do worthwhile. vii Contents Chapter 1 Introduction 1 1.1 Need for Privacy Enhancing Technologies . ........... 2 1.2 Better Performance Leads to Better Anonymity . ............ 3 1.3 ProblemStatement................................ ..... 4 1.4 Fundamental Contributions . ........ 4 1.5 DissertationOutline ............................. ....... 6 2 Background and Related Work 7 2.1 PreliminariesandDefinitions . ......... 8 2.2 AnonymityTechniques. ...... 12 2.2.1 HighLatencyAnonymity . 13 2.2.2 LowLatencyAnonymity. 17 2.3 AnonymitySystems ................................ 22 2.3.1 Crowds ....................................... 23 2.3.2 Tarzan........................................ 24 2.3.3 Tor.......................................... 25 2.3.4 IPpriv........................................ 32 2.3.5 UDP-OR ...................................... 33 2.3.6 Freedom....................................... 34 viii 2.3.7 HerbivoreFS ................................... 34 2.3.8 AnonymousRemailers . 35 2.3.9 P 5 .......................................... 36 2.3.10 Nonesuch ..................................... 37 2.3.11 AP3 ......................................... 37 2.3.12 Cashmere ..................................... 37 2.3.13 Salsa........................................ 38 2.3.14 JavaAnonymousProxy(JAP) . 38 2.3.15 Freenet ...................................... 38 2.3.16 Privacy-preserving File Sharing Protocols . ............ 39 2.4 AnonymityMetrics................................ ..... 39 2.4.1 DegreesofAnonymity . 40 2.4.2 An Information-theoretic Approach . ........ 41 2.4.3 MetricsforLow-latencySystems . ...... 42 2.5 AnonymityAttacks................................ ..... 44 2.5.1 Traffic Analysis with Packet Sizes and Timing . ........ 44 2.5.2 Packet Counting and Timing Analysis Attacks . ......... 44 2.5.3 PredecessorAttack. 46 2.5.4 Disclosure, Intersection, and Statistical DisclosureAttacks. 46 2.5.5 OnionRoutingAttacks . 47 2.6 Summary ......................................... 49 3 Characterizing a Popular Low Latency Anonymous Network 50 3.1 DataCollectionMethodology . ........ 51 3.2 ProtocolDistribution. ........ 53 3.2.1 Interactive vs. Non-interactive Web Traffic . ......... 54 3.2.2 Is Non-interactive Traffic Hurting Performance? . ........... 54 ix 3.2.3 InsecureProtocols ............................. 55 3.3 MaliciousRouterBehavior. ........ 56 3.3.1 DetectionMethodology . 56 3.3.2 Results ....................................... 57 3.3.3 Discussion.................................... 58 3.4 MisbehavingClients .............................. ...... 59 3.5 Geopolitical Client and Router Distributions . .............. 59 3.5.1 Observations .................................. 60 3.5.2 ModelingRouterUtilization. ....... 64 3.6 Circuit-level Performance Measurements . ............ 64 3.6.1 DiurnalPatternsinTrafficLoad . ..... 65 3.6.2 End-to-endLatency ............................... 67 3.6.3 End-to-endThroughput . 69 3.6.4 CircuitDuration ............................... 70 3.6.5 CircuitCapacity ............................... 72 3.6.6 Discussion.................................... 76 3.7 Ethics and Community Standards . ....... 76 3.8 BroaderImpact................................... 78 3.9 Summary ......................................... 79 4 Practical Attacks against Low Latency Anonymous Networks 80 4.1 Background...................................... 83 4.1.1 Tor’s Router Selection Algorithms . ........ 83 4.1.2 Tor’sThreatModel .............................. 85 4.2 CompromisingAnonymity . ...... 85 4.2.1 PhaseOne:SettingUp ............................ 86 4.2.2 PhaseTwo: LinkingCircuits

Load more