Citation: Doswell, Stephen (2016) Measurement and management of the impact of mobility on low-latency anonymity networks. Doctoral thesis, Northumbria University. This version was downloaded from Northumbria Research Link: http://nrl.northumbria.ac.uk/30242/ Northumbria University has developed Northumbria Research Link (NRL) to enable users to access the University’s research output. Copyright © and moral rights for items on NRL are retained by the individual author(s) and/or other copyright owners. Single copies of full items can be reproduced, displayed or performed, and given to third parties in any format or medium for personal research or study, educational, or not-for-profit purposes without prior permission or charge, provided the authors, title and full bibliographic details are given, as well as a hyperlink and/or URL to the original metadata page. The content must not be changed in any way. Full items must not be sold commercially in any format or medium without formal permission of the copyright holder. The full policy is available online: http://nrl.northumbria.ac.uk/policies.html MEASUREMENT AND MANAGEMENT OF THE IMPACT OF MOBILITY ON LOW-LATENCY ANONYMITY NETWORKS S.DOSWELL Ph.D 2016 Measurement and management of the impact of mobility on low-latency anonymity networks Stephen Doswell A thesis submitted in partial fulfilment of the requirements of the University of Northumbria at Newcastle for the degree of Doctor of Philosophy Research undertaken in the Department of Computer Science and Digital Technologies, Faculty of Engineering and Environment October 2016 Declaration I declare that the work contained in this thesis has not been submitted for any other award and that it is all my own work. I also confirm that this work fully acknowledges opinions, ideas and contributions from the work of others. Any ethical clearance for the research presented in this thesis has been approved. Approval has been sought and granted by the University Ethics Committee on 23rd March 2012. I declare that the word count of this thesis is no more than 40,718 words. Stephen Doswell October 2016 Acknowledgements I would like to express my sincere appreciation and thanks to my supervision team: Dr. Nauman Aslam, Dr. David Kendall, and Dr. Graham Sexton for their guidance, knowledge, and not least patience. A special thanks to my friends and family and finally the medical professionals who helped me recover from serious illness to be able to return to my studies and submit this thesis. Anyone who sacrifices their privacy for security will end up with neither. Benjamin Franklin (1706 - 1790) Abstract Privacy, including the right to privacy of correspondence, is a human right. Privacy-enhancing technologies, such as the Tor anonymity network, help maintain this right. The increasing use of Tor from mobile devices raises new challenges for the continued effectiveness of this low-latency anonymity network. Mobile Tor users may access the Internet from a range of wireless networks and service providers. Whenever a wireless network hands-off a mobile device’s connection from one access point to another, its external Internet Protocol (IP) address changes, and the connection to the Tor network is dropped. Every dropped connection requires the Tor circuit to be rebuilt. The time required to rebuild the circuit negatively impacts client performance. This research is the first to highlight this negative impact and to investigate the likely extent of the impact for typical usage scenarios and mobility models. The increased network churn caused by circuit rebuilding also negatively impacts anonymity. A novel metric (q-factor) is proposed here to measure the trade-off between anonymity and performance over the duration of a communication session. Two new solutions to the problems of managing mobility in a low-latency anonymity network are proposed in this thesis. The first solution relies on adaptive client throttling, based ona Kaplan-Meier estimator of the likelihood of a mobile network hand-off. The second solution relies on the use of a static bridge relay (mBridge) that acts as a persistent ‘home’ for a mobile Tor connection, so avoiding the need to recreate the Tor circuit whenever the mobile device is handed-off. The effectiveness of these solutions has been measured using the new q-factor metric. Both solutions provide better performance for mobile Tor clients than the standard Tor client implementation, although some performance reduction by comparison with static Tor clients remains. The bridge relay solution (mBridge) has been shown to offer better performance than client throttling, but is more vulnerable to certain types of attack. A strength of both solutions is that changes are restricted to client devices, the existing algorithms and protocols of the interior Tor network are unaffected. List of publications Published: Stephen Doswell, Nauman Aslam, David Kendall and Graham Sexton (2015) A longi- tudinal approach to measuring the impact of mobility on low-latency anonymity networks. In: Proceedings of the 2015 International Wireless Communications and Mobile Computing Conference (IWCMC 2015 Security Symposium). IEEE, 24th-28th August 2015, Dubrovnik, Croatia. Stephen Doswell, Nauman Aslam, David Kendall and Graham Sexton (2013) Please Slow Down! The Impact on Tor Performance from Mobility. In: 3rd Annual ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM), 8th November 2013, Berlin, Germany. Stephen Doswell, Nauman Aslam, David Kendall and Graham Sexton (2013) The novel use of bridge relays to provide persistent Tor connections for mobile devices. In: 2013 IEEE 24th International Symposium on Personal, Indoor and Mobile Radio Communications: Mobile and Wireless Networks (PIMRC’13 - Mobile and Wireless Networks), 8th-11th September, 2013, London. Stephen Doswell (2013) Internet anonymity with mobility - key challenges for the future. In: Northumbria Research Conference (NRC’13), 15th-16th May 2013, Newcastle. Glossary This list contains domain-specific terms that are not ambiguous but, rather, may be unknown to the reader. It provides a general meaning of these terms. Additive-increase / multiplicative-decrease (AIMD): refers to the algorithm best known for its use in Transmission Control Protocol (TCP) congestion management. Anderson’s rule: refers to a principle formulated by Ross J. Anderson that if a system designed for ease of access it becomes insecure; if made too secure it becomes impossible to use. Average bitrate (ABR): is the measurement of the average amount of data transferred per unit of time, usually per second. Bonini’s paradox: explains the difficulty in constructing models or simulations that fully capture the workings of complex systems. Botnet: a number of Internet-connected computers communicating often used to send spam email or participate in distributed denial-of-service attacks. Braess’s paradox: is a proposed explanation for why improvements to a network can sometimes impede traffic through it, generating worse overall performance. Economy: the ratio between good and bad data transferred. Dissent: is a research project to create a practical anonymous group communication system offering strong, provable security guarantees with reasonable efficiency. Garlic routing: a variant of onion routing that encrypts multiple messages together and uses xii Glossary separate outbound and inbound paths, to make it more difficult for attackers to perform traffic analysis. Global (adversary): both a theoretical and non-theoretical adversary who has infinite, or finite but large amount of capability, to perform an attack. Hand-off: refers to the process of transferring communications from one network to another. Indinymity: a ‘distinguishability’ based metric, based on distinguishing features for adver- saries to make probabilistic ‘guesses’. Invisible Internet Project (I2P): an overlay network and ‘darknet’ that allows applica- tions to send messages to each other pseudonymously and securely. Kaplan-Meier estimator: also known as the product limit estimator, is used to estimate the survival function from lifetime data. In medical research, it is often used to measure the fraction of patients living for a certain amount of time after treatment. Man-in-the-Middle (MitM): in cryptography and computer security, a man-in-the-middle attack is where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. Mix network: first described by David Chaum, mix networks are routing protocols that create hard-to-trace communications by using a chain of proxy servers known as mixes. Onion routing: is a technique for anonymous communications over a computer network, where messages are encapsulated within layers of encryption, analogous to layers of an onion. Onion, the: is a conceptual representation of the multilayered encapsulation of the onion routing datagram. Orbot: is software that provides anonymity on the Internet from a Google Android smart- phone. It acts as an instance of the Tor network on such mobile devices and allows traffic routing from a device’s web browser, e-mail client, etc., through the Tor network, providing anonymity for the user. xiii Privacy-enhancing technologies (PET): a technology that enhances the privacy of an indi- vidual! Possinymity: a ‘possibilistic’ based measurement of an anonymity set size motivated by plausible deniability arguments. Quality of experience (QoE): a qualitative