1. The Case for Network-Layer, Peer-to-Peer Anonymization Michael J. Freedman Emil Sit, Josh Cates, Robert Morris MIT Lab for Computer Science IPTPS’02March 7, 2002 http://pdos.lcs.mit.edu/tarzan/

2. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 2 Participant can communicate anonymously with non-participant User can talk to CNN.com User ? ? Nobody knows who user is The Grail of Anonymization

3. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 3 Our Vision for Anonymization Millions of nodes participate Bounce traffic off one another Mechanism to organize nodes: peer-to-peer All applications can use: IP layer

4. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 4 Alternative 1: Proxy Approach Intermediate node to proxy traffic Completely trust the proxy Anonymizer.com User Proxy

5. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 5 Realistic Threat Model Corrupt proxy –Adversary runs proxy –Adversary targets proxy and compromises Limited, localized network sniffing Global passive observer? Adaptive active adversary? Use cover network: a different paper

6. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 6 Failures of Proxy Approach User Proxy Traffic analysis is easy Proxy reveals identity

7. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 7 Failures of Proxy Approach User Proxy X X CNN blocks connections from proxy Traffic analysis is easy Adversary blocks access to proxy (DoS) Proxy reveals identity

8. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 8 Alternative 2: Centralized Mixnet User Relay MIX encoding creates encrypted tunnel of relays –Individual malicious relays cannot reveal identity Packet forwarding through tunnel Onion Routing, Freedom Small-scale, static network, not general-purpose

9. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 9 Failures of Centralized Mixnet Relay CNN blocks core routers X

10. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 10 Relay Failures of Centralized Mixnet CNN blocks core routers Adversary targets core routers Relay

11. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 11 Relay Failures of Centralized Mixnet Relay CNN blocks core routers Adversary targets core routers Allows network-edge analysis Relay

12. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 12 Tarzan: Me Relay, You Relay Millions of nodes participate Build tunnel over random set of nodes Crowds: small-scale, not self-organizing, not a mixnet

13. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 13 Benefits of Peer-to-Peer Design No network edge to analyze: First hop does not know he’s first ? ? ? ? ? CNN cannot block everybody Adversary cannot target everybody

14. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 14 Managing Peers Requires a mechanism that 1.Discovers peers 2.Scalable 3.Robust against adversaries

15. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 15 Adversary can join more than once Due to lack of central authentication Adversaries Can Join System Try to prevent adversary from impersonating large address space

16. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 16 Stopping Evil Peers Contact peers directly to –Validate IP address –Learn public key Adversary can only answer small address space

17. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 17 Tarzan: Joining the System 1. Contacts known peer in big (Chord) network 2. Learns of a few peers for routing queries User

18. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 18 3. Contacts random peers to learn {IP addr, PK} Performs Chord lookup(random) Tarzan: Discovering Peers User

19. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 19 Tarzan: Building Tunnel User 4. Iteratively selects peers and builds tunnel Public-key encrypts tunnel info during setup Maps flowid  session key, next hop IP addr Tunnel Private Address Public Alias Address Real IP Address PNAT

20. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 20 IP Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP Diverts packets to tunnel source router IP X

21. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 21 IP Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP IP NATs to private address space 192.168.x.x Layer encrypts packet

22. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 22 Encapsulates in UDP and forwards packet Strips off encryption, forwards to next hop Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User IP APP

23. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 23 IP NATs again to public alias address Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP

24. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 24 Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User APP Reads IP headers and sends accordingly IP

25. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 25 Response repeats process in reverse IP Tarzan: Tunneling Data Traffic 5. Reroutes packets over this tunnel User IP APP IP

26. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 26 Tarzan: Tunneling Data Traffic Transparently supports anonymous servers Can build double-blinded channels Server IP APP IP Oblivious User

27. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 27 Tarzan is Fast (Enough) Prototype implementation in C++ Setup time per hop: ~20 ms + transmission time Packet forwarding per hop: < 1 ms + transmission time Network latency dominates performance

28. March 7, 2002 The Case for Network-Layer, Peer-to-Peer AnonymizationPage 28 Summary Gain anonymity: –Millions of relays –No centralization Transparent IP-layer anonymization –Towards a critical mass of users Peer-to-Peer design