Balancing Performance in Tor: Anonymity Challenges Explored
Explore the delicate balance between performance and anonymity in Tor, as discussed in a seminar by Rob Jansen. Learn about induced throttling attacks, traffic correlation, and more related to anonymity and security in online communication networks.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
How Low Can You Go: Balancing Performance with Anonymity in Tor DC-Area Anonymity,Privacy, and Security Seminar May 10th, 2013 Rob Jansen U.S. Naval Research Laboratory rob.g.jansen@nrl.navy.mil PETS 2013, joint w/ John Geddes and Nick Hopper, U of Minnesota
This Talk in a Nutshell New class of induced throttling attacks Drastically improves traffic correlation via stealthy throughput style attacks Analyze attacks against Traffic admission control algorithms Congestion control algorithms
Traffic Correlation: Throughput Mittal et.al. CCS 11
Traffic Correlation: Throughput Mittal et.al. CCS 11
Traffic Correlation: Throughput Mittal et.al. CCS 11
Traffic Correlation: Throughput Induced throttling: improve correlation accuracy
Traffic Correlation: Latency Hopper et.al. CCS 07
Traffic Correlation: Latency Inject redirect or javascript Start timer Hopper et.al. CCS 07
Traffic Correlation: Latency GET Request redirected page Hopper et.al. CCS 07
Traffic Correlation: Latency GET Stop timer Estimate latency Hopper et.al. CCS 07
Outline Tor intro, traffic correlation Why Tor is slow Traffic admission control Induced throttling attack Effects of throughput vs induced throttling Congestion control Induced throttling attack Effects of throughput vs induced throttling
~500,000 clients Tor s Current Status ~3000 relays
~500,000 clients Tor s Current Status ~3000 1200 relays
Flows 3% Bytes 40% 2008' 58% 92% BitTorrent HTTP Other 11% 2010'' 52% 36% 69% ' McCoy et al. PETS 2008, '' Chaabane et al. NSS 2010
Tor is Slow[er] Web (320 KiB) Bulk (5 MiB)
Tor != Internet Specialized Tor performance enhancements Reducing load: traffic admission control Reducing load, improving utilization: congestion control
Outline Tor intro, traffic correlation Why Tor is slow Traffic admission control Induced throttling attack Effects of throughput vs induced throttling Congestion control Induced throttling attack Effects of throughput vs induced throttling
Traffic Admission Control Which connections? At what rate?
Traffic Admission Control Sybil attack! Which connections? At what rate?
Traffic Admission Control Sybil attack (connect only)
Traffic Admission Control Throughput drops to throttle rate
Traffic Admission Control Disconnect sybils
Traffic Admission Control Throughput increases
Induced Throttling Prototype bitsplit flag threshold Jansen et.al. USENIX Sec 12
Induced Throttling Results j P[V =Ci]= P[V =Ci|Rj]P[G= Rj] Throughput Attack Induced Throttling Attack
Outline Tor intro, traffic correlation Why Tor is slow Traffic admission control Induced throttling attack Effects of throughput vs induced throttling Congestion control Induced throttling attack Effects of throughput vs induced throttling
Congestion Control 50 cells (max 500)
Congestion Control SENDME 50 cells (max 500)
Congestion Control 500 cells
Congestion Control 500 cells Throughput drops to 0
Congestion Control SENDME 500 cells
Congestion Control SENDME 500 cells Throughput increases
Induced Throttling Results Raw throughput Smoothed throughput
Induced Throttling Results j P[V =Ci]= P[V =Ci|Rj]P[G= Rj] Throughput Attack Induced Throttling Attack
Questions? rob.g.jansen@nrl.navy.mil
