1. Performance Modeling of Anonymity Protocols Carey Williamson Niklas Carlsson Andreas Hirt Michael J. Jacobson, Jr. Department of Computer Science University of Calgary Financial support for this research support was provided by: Natural Sciences and Engineering Research Council (NSERC), Informatics Circle of Research Excellence (iCORE), Alberta Ingenuity Fund (AIF), and Canada Foundation for Innovation (CFI)

2. 2 Introduction Anonymous communication conceals who communicates what, to whom, and when Allows individuals to communicate without fear of embarrassment, ridicule, or retribution Cornerstone for freedom of speech

3. 3 Some Real World Applications Good: Freedom of speech in totalitarian regime Crime stoppers On-line counseling Whistle blowing Group evaluations Military communications … Bad: Organized crime Terrorist groups...

4. 4 Outline Review of Anonymity Schemes Our Work: Buses, Taxis, Motorcyles Performance Modeling Numerical Results Conclusion

5. 5 xmkz ykrz iwqm qkdx Re-routing with Layered Encryption Layered Encryption: Add layers of encryption to make message contents change each hop hello

6. 6 xmkz ykrz iwqm Layered Encryption: Add layers of encryption to make message contents change each hop hello Re-routing with Layered Encryption

7. 7 Layered Encryption: Add layers of encryption to make message contents change each hop hello xmkz ykrz Re-routing with Layered Encryption

8. 8 Layered Encryption: Add layers of encryption to make message contents change each hop hello xmkz Sender? hello Problem: Timing analysis Re-routing with Layered Encryption

9. 9 Senders use nested (layered) encryption along re-routing path Mixes (re-routing nodes) mix input-output correlations: Collect input batch Peel encryption layer away Output in random order Message 1 Message 2 Message 3 Message 4 Message 5 Message 4 Message 3 Message 1 Message 5 Message 2 Mixes

10. 10 Current Solutions No Cover Traffic Partial Cover Traffic Full Cover Traffic SchemesCrowds, TORJAP, MorphMixMixmaster, Mixminion, Tarzan AnonymityWeakModerateStrong ProblemsVulnerable to known attacks Not suitable for interactive applications, don’t scale well

11. 11 Classic Buses Protocol [Beimel and Dolev 2003] Metaphor: city bus, with regularly scheduled route, which obscures the movements of its messengers Assume dark windows, and enclosed garages at each stop hello

12. 12 Anonymity in Buses Sender Anonymity: Suspected sender can claim they are forwarding a message on behalf of any other participant on the bus path Receiver Anonymity: Suspected receiver can claim they forwarded a message to any other participant on the bus path

13. 13 Key Ideas in Our Buses Indirection path: re-routing path on top of bus overlay Layered Encryption: encryption on reverse indirection path Owned Seats: Each participant replaces owned seats every bus tour (online) Receiving seats: bus copied and decrypted offline to find messages

14. 14 Buses Protocol SR hello

15. 15 SR hello xmkz Buses Protocol

16. 16 SR hello ymkq Buses Protocol

17. 17 SR hello Buses Protocol

18. 18 SR hello Buses Protocol

19. 19 ymkq SR hello xmkz Buses Protocol

20. 20 helloxmkz SR hello Buses Protocol

21. 21 Improvements with Taxis Processing Delay decreased by O(n) Owned seats are delayed once per bus tour instead of n times (see MASCOTS 2008 paper ) Networking Delay decreased by O(n) Forwarding of unowned taxis can be pipelined by giving unowned taxis network priority over owned taxis (see MASCOTS 2008 paper)

22. 22 Improvements with Motorcycles Routing Path length decreased to O(log n) Chord-based routing using finger table Forwarding delay actually increases More “message transfers” occur at nodes Still a net win overall!

23. 23 Performance metric: one-way message delay D SR Five main components Sender S must create/encrypt and send message Load-dependent sender-side delay Queueing of (average) duration Ws Load-independent path delay Path length H SR with ( D proc +D net ) delay on each node Load-dependent transfer delay Queueing at H T transfer nodes, each with duration W T Target receiver R must decrypt and receive message Model Overview

24. 24 Load-independent Delays Anonymity Protocol Processing D proc Network D net Buses KND seat KNs/r+p Taxis KD seat Ks/r+p Motorcycles KD seat Ks/r+p N nodes; K seats per node; Dseat processing per seat; s/r transmission time per seat; p per-hop propagation delay

25. 25 Hop counts MetricBuses/TaxisMotorcycles H SR (end-to-end) N/2, if L=0 (1+L)(N+1)/2, otherwise H T (transfers) LH SR – 1

26. 26 Load-dependent Delays Protocol Sender W S Transfers W T Cycle Time T C Buses Taxis Motor

27. 27 Light Load Case Light load: No queueing Q C  0 Example: Buses protocol D proc ~ N ; D net ~ N ; T C ~ N 2 ; hence, D SR ~ N 2 Scaling behavior Buses: D SR ~ N 2 Taxis: D SR ~ N Motorcycles: D SR ~ log 2 N

28. 28 Queueing Analysis (1 of 3) Single-seat (K=1) case Analysis on per-node basis New messages at rate / N Message transfers at rate H T / N Assume Poisson arrivals at aggregate rate (1+ H T ) / N Either: - service period of duration T C - vacation period of duration T C (1+ H T ) / N Node i

29. 29 Can be shown that generating function In our system Queueing Analysis (2 of 3)

30. 30 Queueing Analysis (3 of 3) Expected queue length Other metrics “relatively straightforward” to obtain, given the generating function Variance State probabilities q 0, q 1, …, q m

31. 31 Experimental Validation (Buses)

32. 32 Experimental Validation (Taxis)

33. 33 Simulation Validation (Buses)

34. 34 Simulation Validation (Taxis)

35. 35 Simulation Validation (Motorcycles)

36. 36 N=4N=16 Impact of message generation rate Different saturation points (   1) E.g., capacity planning

37. 37 Buses Taxis Motorcycles Impact of node utilization  Queueing delays dominate when  > 0.8 Note higher saturation point … can sustain higher Hence, differences even greater than shown …

38. 38 Buses Taxis Motorcycles Scaling results for light load with K seats per node Low load results As expected, scales as (roughly) Buses N 2 Taxis N Motorcycles log 2 N

39. 39 Buses Taxis Motorcycles Scaling results for different load levels Relative performance differences maintained at higher loads In summary: Motorcycles provide a robust and scalable approach for anonymous network communication.

40. 40 Conclusions The average message latency of Practical Buses scales quadratically with number of participants Analysis, simulation, and experimental results The average message latency of Taxis scales linearly with the number of participants Analysis, simulation, and experimental results The average message latency of Motorcycles scales logarithmically with the number of participants Analysis and simulation results