Date post: | 21-Jan-2016 |
Category: |
Documents |
Upload: | georgiana-ford |
View: | 222 times |
Download: | 0 times |
Traffic Matrix Approach
R. Newman
Topics
Defining anonymity Need for anonymity Defining privacy Threats to anonymity and privacy Mechanisms to provide anonymity Metrics for Anonymity Applications of anonymity technology
Represents traffic patterns Not specific to a particular message Measure traffic over time window Shows traffic from each sender to each recipient
TM(i,j) = traffic sent from i to j Can be messages, bits, bytes, or rates
Traffic Matrix
1 2 3 4
1 0 3 5 0
2 1 0 0 9
3 2 0 0 5
4 0 11 5 0
Receiver
Sen
der
Traffic Matrix
1 2 3 4
1 0 3 5 0
2 1 0 0 9
3 2 0 0 5
4 0 11 5 0
Receiver
Sen
der
S1
All nodes are both senders and receivers, i.e., peers
S2
S3 S4
31
50
025
5
011
90
Topology is a complete digraph ofN nodes,i.e., an N-clique
Traffic may be zero,light, moderate, or heavy
Traffic Matrix
1 2 3 4
1 0 3 5 0
2 1 0 0 9
3 2 0 0 5
4 0 11 5 0
Receiver
Sen
der
S1
All nodes are both senders and receivers, i.e., peers
S2
S3 S4
31
50
025
5
011
90
Links have capacity limits
Traffic that exceeds link capacity must be split over multiple routes
5
These may be symmetric or not (those shown are symmetric)
105
10
5 5
Traffic Matrix
1 2 3 4
1 0 3 5 0
2 1 0 0 9
3 2 0 0 5
4 0 11 5 0
Receiver
Sen
der
S1
All nodes are both senders and receivers, i.e., peers
S2
S3 S4
31
50
025
5
011
90
Links have capacity limits
Traffic that exceeds link capacity must be split over multiple routes
5
These may be symmetric or not (those shown are symmetric)
105
10
101
Takes the approach that attacker wants to know traffic patterns Not specific to a particular message Measure traffic over time window Global passive adversary Sees source & destination for all msgs
”Observed TM” = what attacker observes If no countermeasures, then observed TM is the actual
TM Assumes nodes are peers Assumes nodes are not compromised
Traffic Matrix
All messages are padded to same length Prevent linking messages
Only (visible) source and destination are not encrypted Prevent linking messages Prevent source/destination linkage
TAP Countermeasures
Node may send dummy messages Adds to observed traffic
Node may re-route messages Changes observed traffic pattern
Node may delay messages Helps obscure message linkage Can smooth out flows
TAP Countermeasures
TM has all diagonal entries zero No self-traffic
T[i,j] = # messages from i to j TM T dominates T’ iff for all i and j
T[i,j] >= T’[i,j] Neutral TM – all traffic is uniform
All non-diagonal values are equal For all i <> j and i’ <> j’, T[i,j] = T[i’,j’]
Unit Neutral TM: all non-diagonal values = 1 Magnitude of Neutral TM is non-zero values in TM
Traffic Matrix
All traffic between all pairs is equal Observer cannot distinguish pairs that are
engaged in much interaction from those that are engaged in none
What information does Neutral TM give? Only an upper bound on the actual possible traffic But traffic between a pair can exceed observed
traffic between the pair, due to rerouting May be overkill
Neutral Traffic Matrix
Actual TM, Tact
End-to-end TM not including any countermeasures No dummy messages No re-routing through intermediaries
Observed TM, Tobs End-to-end traffic as observed from addresses Includes dummy traffic Includes changes due to re-routed traffic
Traffic Matrix
Routes, flow assignments Actual TM requires Tact[i,j] message be sent from i to
j in time period Each message must either be sent directly from
node i to node j Or it must follow a longer path from i to j Flow assignment dictates how many message from
i to j take each particular route
Traffic Matrix
Sk
Si Sj
10
5
Tact[i,j] = 10
5
5
Tobs[i,j] = 5
Link load = number of messages using link Must not exceed link capacity How might you reroute traffic?
Traffic Matrix
S1 S2
S3 S4
31
50
025
5
011
90
5
75
7
5
5
Reroute traffic exceeding capacity Adds load to links on route Must ensure rerouting does not exceed capacity
Traffic Matrix
S1 S2
S3 S4
31
50
025
5
0
70
5
75
7
74
5
5
2
3+4=7 >5
Reroute traffic exceeding capacity Does this work now?
Yes – link loads all below capacities
Traffic Matrix
S1 S2
S3 S4
31
50
025
5
0
70
5
75
7
72
5
5
2
3+2=5
2
5+2=7
Reroute traffic exceeding capacity Total Traffic Load
Sum of link loads What are link loads?
Traffic Matrix
S1 S2
S3 S4
31
50
025
5
0
70
5
75
7
72
5
5
2
2
Source Dest’n Load
1 2 3+2=5
1 3 5
1 4 0+2=2
2 1 1+3=3
2 3 0
2 4 9-2=7
3 1 2
3 2 0+2=2
3 4 5
4 1 0+2=2
4 2 11-4=7
4 3 5+2=7
Total Load 42
Feasible TM For a given actual TM, any TM for which there
exists a set of routes and flow assignments for all senders and destinations such that no link load exceeds the corresponding link capacity
i.e., actual traffic can be re-routed according to the flow assignments without violating constraints
Traffic Matrix
Unit Padding Transform Transforms TM T to T’ by increasing the traffic by
unity on a single link For some i,j, T’[i,j] = T[i,j]+1 and for all other i’,j’ T’[i’,j’] = T[i’,j’]
TAP Countermeasures
T11 T12 T13
T21 T22 T23
T31 T32 T33
0 1 0
0 0 0
0 0 0
T11 T12+1 T13
T21 T22 T23
T31 T32 T33+ =
+ =Tact Tpad Tobs
Unit Rerouting Transform Transforms TM T to T’ by decreasing the traffic from
i to j and increasing it from i to k and from k to j by unity (reroute one i-j message via k)
For some i,j, T’[i,j] = T[i,j]-1 and For some k, T’[i,k] = T[i,j]+1 and T’[k,j] = T[k,j]+1 for all other i’,j’ T’[i’,j’] = T[i’,j’]
TAP Countermeasures
T11 T12 T13
T21 T22 T23
T31 T32 T33
0 -1 +1
0 0 0
0 +1 0
T11 T12-1 T13+1
T21 T22 T23
T31 T32+1 T33+ =
+ =Tact TRR Tobs
Delay not explicitly considered Would reduce load in one window Increase it on same link in next window But we only consider one window here...
TAP Countermeasures
T11 T12 T13
T21 T22 T23
T31 T32 T33
0 -1 0
0 0 0
0 0 0
T11 T12-1 T13
T21 T22 T23
T31 T32 T33+ =
T11 T12 T13
T21 T22 T23
T31 T32 T33
0 +1 0
0 0 0
0 0 0
T11 T12+1 T13
T21 T22 T23
T31 T32 T33+ =
Window t:
Window t+1:
Padding Pad matrix is sum of scaled unit pad matrices One unit pad per i,j pair (where i <> j) N(N-1) scaling multipliers
Rerouting Reroute matrix is sum of scaled unit reroutes One unit reroute matrix per triple (i,j,k) N(N-1)(N-2) non-zero scaling multipliers
Achieving Neutrality
Start with Tact Approach (shown for one row)
First, reroute to minimize maximum T’[i,j] T’[i,j] = Tact + TRR Then pad to bring all non-diagonals to max Tobs = Tact + TRR + Tpad
Achieving Neutrality
Tact+ TpadTRR+ T’ Tobs
Costs increase in load Increase in (mean) delay
Load Cost: Cost = Load(Tobs) –Load(Tact)
Delay Cost: All msgs delivered each period Delay measured as increase in avg # hops Avg # hops = (1-f) + 2f = 1+f Where f = fraction that is rerouted All rerouted msgs take path of 2 hops
Cost of Neutrality
Padding only: Delay cost = ?
None (f = 1) Load Cost = ?
= Load(Tobs) –Load(Tact) = [Load(Tact)+Padding] –Load(Tact) = Padding i.e, cost = exactly number of dummy messages Which is just the sum of the padding multipliers
Cost of Neutrality
Cost of Neutrality
0 1 8
2 0 1
5 3 0
0 7 0
6 0 7
3 5 0
0 8 8
8 0 8
8 8 0
+ =
Padding only: Load Cost = ?
Must pad to highest value in Tact Load(Tobs) = (N2-N)max{Tact[i,j]} Padding = (N2-N)max{Tact[i,j]} –Load(Tact)
Tact Tpad Tobs
Load(Tact)= 20 Load(Tobs)= 6x8=48Load(Tpad)= 48-20=28
Cost of Neutrality Padding only: Load Cost = (N2-N)max{Tact[i,j]} –Load(Tact)
In practice, the distribution of values in Tact is long-tailed, with many 0’s and small numbers
This leads to very high costs for padding only Problem gets worse with larger N!
Larger proportion of non-communicating pairs
Rerouting only: Let T’ be TM after rerouting T’ may not be neutral (pad later)
Delay cost = ? f = ? (average, or per pair) f = (#rerouted msgs)/(#actual msgs) = [Load(T’) – Load(Tact)] / Load(Tact) = Load(TRR) / Load(Tact) Where TRR is reroute matrix T’ = Tact + TRR Load(TRR) = sum of RR scaling multipliers
Cost of Neutrality
Rerouting only: Load Cost = ?
= Load(T’) – Load(Tact) = [Load(T’)+Load(TRR)] –Load(Tact) = Load(TRR) i.e, cost = exactly number of rerouted messages Which is the sum of the reroute multipliers
Approach: Reroute first to minimize variance Then pad to bring up to neutrality
Cost of Neutrality
Approach: Reroute first to minimize variance Then pad to bring up to neutrality
In practice This approach leads to about a doubling of load
How to find TRR that minimizes cost? Want to minimize the maximum value in T’ Turn into a system of linear inequalities
Cost of Neutrality
”Flatten” operator Takes a matrix and turns it into a vector Row-major order
(or column-major by transpose)
f(M) =
<M[1,1], M[1,2], ... , M[1,N], M[2,1], ... , M[N,N]>
Linearization of Problem
f
Let rabc = number of msgs rerouted from a to c through intermediate node b (reroute quantity) R = all N3 reroute quantities as N3 x 1 column vector
Let URMabc = unit reroute matrix for a to c via b URMabc[a,b] = 1, URMabc[b,c] = 1, URMabc[a,c] = -1 All other entries are 0 N3 URMs (some of which are all 0’s)
Let DM be N2 x N3 matrix of flattened URMs Each column is a flattened URM
So change TRR due to rerouting is f(TRR) = DM x R
Linearization of Problem
For rerouting given by reroute quantity vector R And padding given by padding matrix TP
We have:
f(Tobs) = f(Tact) + f(TRR) + f(TP)
= f(Tact) + DM x R + f(TP)
We want to minimize the costs of TP and TRR We have lower bound on possible neutral TMs
Set target neutral TM, T, to smallest possible Use linear programming to find R that satisfies inequality (if one exists)
DM x R <= f(T) – f(Tact)
Linearization of Problem
We have lower bound on possible neutral TMs Set target neutral TM, T, to smallest possible T = m times unit neutral TM m >= max(Tact)/N
Use linear programming to find R that satisfies inequality (if one exists) DM x R <= f(T) – f(Tact)
Iterate (increment m) until R can be satisfied Then set f(TP) = f(T) – [f(Tact) + DM x R]
Minimizes max(T[i,j]), hence minimizes costs
Linearization of Problem
Can treat the information ”leaked” by TMs as covert channel Mix-type packets (only src, dest show, all packets are
uniform in size, rest encrypted) How can CC ”sender” convey information? Sender is a single node Sends to ”Eve” – a local eavesdropper Relative traffic volume, absolute volume, order of transmission are
still visible How to minimize (or eliminate) CC? Neutral TM eliminates relative volume as signal
Network Covert Channels
How to minimize (or eliminate) CC? Neutral TM eliminates relative volume as signal Every node always sends indistinguishable packet to
every other node every ”round” Each node always sends to destinations in same order Only signal is change in round time intervals
But how to determine reroute quantities? Not practical for all nodes to exchange traffic levels Want a local decision
Network Covert Channels
Message Sending Policy Maintain Tx queues for each destination High priority = from other node Medium priority = from this node Low priority = dummy packet (generated) Send packet every period
Message arrival policies If dummy from other node, discard If rerouted from other node, put into High queue If local origin, reroute if dest Med queue occupied
Traffic volume changes Ne
Network Covert Channels
Traffic volume changes Negotiate shorter period length if queues stay full Negotiate longer period length if queues mostly empty All nodes must arrive at consensus Single node must dramatically change traffic to force change in period This can be audited
Mode-based security Don’t allow arbitrary period changes Only allow particular modes – reduces CC capacity Only allow change at end of cycle – lower CC capacity
Network Covert Channels
Mode-based security Don’t allow arbitrary period changes Only allow particular modes M modes define allowed period durations Only allow change at end of cycle Cycle is duration spanning one or more periods Capacity is now lg(M)/Tcycle Maximum capacity is known Attempts to exercise CC can be audited
Network Covert Channels
Given an observed TM, there are limits on possible actual TMs The sum of the traffic coming into a node j in Tact
cannot exceed the sum of the traffic coming in to node j in Tobs.
The sum of the traffic coming out of a node i in Tact cannot exceed the sum of the traffic coming out of node i in Tobs.
Although the graphs considered are cliques, the total traffic from node i to node j may exceed the capacity of the (direct) link from i to j due to some traffic being routed through other nodes
Generalizations
Compatible TM A TM T is compatible with Tobs iff there exists a set of
routes and flow assignments for T that produces T’, and Tobs >> T’ (domination)
Let Comp(Tobs) be the set of all TMs compatible with Tobs. Note that both Tobs and Tact must be in Comp(Tobs)
In the absence of other information... Attacker has no reason to pick one compatible TM
over another compatible TM – all equiprobable
Generalizations
Attacker’s question Is Tact in some set S of TMs or not?
In the absences of side information Likelihood is fraction of TMs compatible with Tobs
that are in S Probabilistic approach
Prob(Tact in S | Tobs) =
|Comp(Tobs) int S| /|Comp(Tobs)|
Generalizations
Neutral TM Approach Aims to give nothing to GPA except upper bounds All traffic is equal Can decide reroute and pad quantities from actual traffic and
desired TM Can minimize costs associated with achieving neutrality May be overkill
Probabilistic TM approach Maximize uncertainty of actual TM Large number of compatible TMs with various properties
Summary
Anonymity Metrics Anonymity Set
Per message receiver and/or sender Possibilistic
Plausible Deniability Crowds approach Probability of ”guessing right”
Consistent TM Set size Subsets corresponding to property of interest can lead to probability approach
also Covert Channel approach
Capacity of channel = info leak rate
Summary