Anonymity - Courses.cs.washington.edu

2y ago
27 Views
2 Downloads
1.44 MB
30 Pages
Last View : 2m ago
Last Download : 2m ago
Upload by : Mariam Herr
Transcription

CSE 484 / CSE M 584: Computer Security and PrivacyAnonymityAutumn 2020Franziska (Franzi) Roesnerfranzi@cs.washington.eduThanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Yoshi Kohno, John Manferdelli, JohnMitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials .

Admin Homework #3: Due today! Lab #3: Due next Friday! Next week:– Last week of classes!– Ethics panel on Wednesday– No section on Thursday (use the time to work with yourproject groups, etc.)12/4/2020CSE 484 / CSE M 584 - Autumn 20202

The New Yorker,199312/4/2020CSE 484 / CSE M 584 - Autumn 20203

Privacy on Public Networks Internet is designed as a public network– Machines on your LAN may see your traffic, network routers see alltraffic that passes through them Routing information is public– IP packet headers identify source and destination– Even a passive observer can figure out who is talking to whom Encryption does not hide identities– Encryption hides payload, but not routing information– Even IP-level encryption (tunnel-mode IPSec/ESP) reveals IPaddresses of IPSec gateways Modern web: Accounts, web tracking, etc. 12/4/2020CSE 484 / CSE M 584 - Autumn 20204

QuestionsQ1: What is anonymity?Q2: Why might people want anonymity on theInternet?Q3: Why might people not want anonymity onthe Internet?12/4/2020CSE 484 / CSE M 584 - Autumn 20205

What is Anonymity? Anonymity is the state of being not identifiablewithin a set of subjects– You cannot be anonymous by yourself! Big difference between anonymity and confidentiality– Hide your activities among others’ similar activities Unlinkability of action and identity– For example, sender and email he/she sends are no morerelated after observing communication than before Unobservability (hard to achieve)– Observer cannot even tell whether a certain action tookplace or not12/4/2020CSE 484 / CSE M 584 - Autumn 20206

Applications of Anonymity (I) Privacy– Hide online transactions, Web browsing, etc. fromintrusive governments, marketers and archivists Untraceable electronic mail––––Corporate whistle-blowersPolitical dissidentsSocially sensitive communications (online AA meeting)Confidential business negotiations Law enforcement and intelligence– Sting operations and honeypots– Secret communications on a public network12/4/2020CSE 484 / CSE M 584 - Autumn 20207

Applications of Anonymity (II) Digital cash– Electronic currency with properties of paper money(online purchases unlinkable to buyer’s identity) Anonymous electronic voting Censorship-resistant publishing12/4/2020CSE 484 / CSE M 584 - Autumn 20208

Part 1: Anonymity in Datasets12/4/2020CSE 484 / CSE M 584 - Autumn 20209

How to release an anonymous dataset?12/4/2020CSE 484 / CSE M 584 - Autumn 202010

How to release an anonymous dataset? Possible approach: remove identifyinginformation from datasets?Massachusettsmedical voter data[Sweeney 1997]12/4/2020CSE 484 / CSE M 584 - Autumn 202011

[Sweeney 2002]k-Anonymity Each person contained in the dataset cannot bedistinguished from at least k-1 others in the data.Doesn’t work forhigh-dimensionaldatasets (whichtend to be sparse)12/4/2020CSE 484 / CSE M 584 - Autumn 202012

[Dwork et al.]Differential Privacy Setting: Trusted party has a database Goal: allow queries on the database that areuseful but preserve the privacy of individualrecords Differential privacy intuition: add noise so thatan output is produced with similar probabilitywhether any single input is included or not Privacy of the computation, not of the dataset12/4/2020CSE 484 / CSE M 584 - Autumn 202013

Part 2: Anonymity in Communication12/4/2020CSE 484 / CSE M 584 - Autumn 202014

Chaum’s Mix Early proposal for anonymous email– David Chaum. “Untraceable electronic mail, returnaddresses, and digital pseudonyms”. Communications ofthe ACM, February 1981.Before spam, people thoughtanonymous email was a good idea Modern anonymity systems use Mix as the basicbuilding block12/4/2020CSE 484 / CSE M 584 - Autumn 202015

Basic Mix 20MixAdversary knows all senders andall receivers, but cannot link a sentmessage with a received messageCSE 484 / CSE M 584 - Autumn 202016

Anonymous Return AddressesM includes {K1,A}pk(mix), K2 where K2 is a fresh public r2,M’}K2}K1{K1,A}pk(mix), {r2,M’}K2Response MIXSecrecy without authentication(good for an online confession service )12/4/2020CSE 484 / CSE M 584 - Autumn 202017

Mix Cascades and Mixnets Messages are sent through a sequence of mixes Can also form an arbitrary network of mixes (“mixnet”) Some of the mixes may be controlled by attacker,but even a single good mix ensures anonymity Pad and buffer traffic to foil correlation attacks12/4/2020CSE 484 / CSE M 584 - Autumn 202018

Disadvantages of Basic Mixnets Public-key encryption and decryption at eachmix are computationally expensive Basic mixnets have high latency– OK for email, not OK for anonymous Web browsing Challenge: low-latency anonymity network12/4/2020CSE 484 / CSE M 584 - Autumn 202019

[Reed, Syverson, Goldschlag 1997]Another Idea: Randomized Routinge.g., Onion RoutingRRR1AliceRR3R2R4RRRBob Sender chooses a random sequence of routers Some routers are honest, some controlled by attacker Sender controls the length of the path12/4/2020CSE 484 / CSE M 584 - Autumn 202021

Onion 4,k3}pk(R3),{R4{B,k4}pk(R4),{{M}pk(B)Bob}k4}k3} k2} k1 Routing info for each link encrypted with router’s public key Each router learns only the identity of the next router12/4/2020CSE 484 / CSE M 584 - Autumn 202022

Tor Second-generation onion routing network– http://tor.eff.org– Developed by Roger Dingledine, Nick Mathewsonand Paul Syverson– Specifically designed for low-latency anonymousInternet communications Running since October 2003 “Easy-to-use” client proxy– Freely available, can use it for anonymous browsing12/4/2020CSE 484 / CSE M 584 - Autumn 202023

Tor Circuit Setup (1) Client proxy establishes a symmetric sessionkey and circuit with Onion Router #112/4/2020CSE 484 / CSE M 584 - Autumn 202024

Tor Circuit Setup (2) Client proxy extends the circuit by establishinga symmetric session key with Onion Router #2– Tunnel through Onion Router #112/4/2020CSE 484 / CSE M 584 - Autumn 202025

Tor Circuit Setup (3) Client proxy extends the circuit by establishinga symmetric session key with Onion Router #3– Tunnel through Onion Routers #1 and #212/4/2020CSE 484 / CSE M 584 - Autumn 202026

Using a Tor Circuit Client applications connect and communicateover the established Tor circuit.12/4/2020CSE 484 / CSE M 584 - Autumn 202027

How do you know who to talk to? Directory servers– Maintain lists of active onion routers, theirlocations, current public keys, etc.– Control how new routers join the network “Sybil attack”: attacker creates a large number ofrouters– Directory servers’ keys ship with Tor code12/4/2020CSE 484 / CSE M 584 - Autumn 202028

Issues and Notes of Caution Passive traffic analysis– Infer from network traffic who is talking to whom– To hide your traffic, must carry other people’s traffic! Active traffic analysis– Inject packets or put a timing signature on packet flow Compromise of network nodes– Attacker may compromise some routers Powerful adversaries may compromise “too many”– It is not obvious which nodes have been compromised Attacker may be passively logging traffic– Better not to trust any individual router Assume that some fraction of routers is good, don’t know which12/4/2020CSE 484 / CSE M 584 - Autumn 202034

Issues and Notes of Caution Tor isn’t completely effective by itself– Tracking cookies, fingerprinting, etc.– Exit nodes can see everything!12/4/2020CSE 484 / CSE M 584 - Autumn 202035

Issues and Notes of Caution The simple act of using Tor could make one atarget for additional surveillance Hosting an exit node could result in illegalactivity coming from your machine12/4/2020CSE 484 / CSE M 584 - Autumn 202036

Anonymity is the state of being not identifiable within a set of subjects –You cannot be anonymous by yourself! Big difference between anonymity and confidentiality –Hide your activities among others’ simila

Related Documents:

A separate privacy principle dealing with consent? 686 20. Anonymity and Pseudonymity 689 Introduction 689 Expanding the anonymity principle 690 Application of the 'Anonymity and Pseudonymity' principle 696 Guidance on the 'Anonymity and Pseudonymity' principle 706 Summary of 'Anonymity and Pseudonymity' principle 708 21.

Oct 10, 2013 · Anonymity and encryption are not new phenomena: anonymity has long facilitated the expression of controversial ideas and enabled dissent in many countries of the world; the use of ciphers and codes to protect the privacy of communications has The protection of anonymity

anonymity unless accompanying policies are respected. The k-anonymity protection model is important because it forms the basis on which the real-world systems known as Datafly, µ-Argus and k-Similar provide guarantees of privacy protection. Keywords: data anonymity, data privacy,

actor or actress, or the local chief of police?” A.“Like everyone else, public figures should have the protection of anonymity to the extent that they desire it.” (“Understanding Anonymity,” p. 9) Q. “I saw an ad in the paper for an A.A. group. It t

P-47 Understanding Anonymity “Anonymity is the spiritual foundation of all our traditions, ever reminding us to place principles before personalities.” P-47_Understanding_Anonymity.indd 2 6/17/19 11:23 AM

Confidentiality and anonymity are related but distinct concepts. The Concise Oxford Dictionary defines confidentiality as: ‘spoken or written in confidence; charged with secrets’ while anonymity is defined as: ‘of unknown name, of unknown authorship’. In the ethics literature, confidentiality is commonly viewed as akin to the principle ofFile Size: 210KB

to define the quality of anonymity and to compare different anonymity systems. Malacaria [16] defined the leakage of confidential information in a program as the conditional mutual information between its outputs and secre

asset management periods to drive the size, shape and resource requirement for the estate. With the nature of property, change takes time to achieve and with budget constraints, innovation driving an expectation to improve and the current baseline where changes to the estate compared to its size have been minimal. As this review progresses it is clear that utilisation of the estate can be .