Mitigating Inference Attacks in Peer-assisted CDNs

Anonymity in Peer-assisted CDNs: Inference Attacks and Mitigation Yaoqi Jia, Guangdong Bai, Prateek Saxena, and Zhenkai Liang National University of Singapore 0

Web Content Delivery Popular websites receive millions of hits per day A fast way to deliver web content Options to deliver content: Own servers Amazon EC2, Azure Content delivery networks (CDN) Akamai, CloudFlare 1

Peer-assisted CDNs Insight: Involve web clients to serve content Akamai NetSession, Swarmify, Maygh NetSession offloads 70-80% traffic [NSDI12,IMC 13] Swarmify reduces over 60% network latency Server Server Privacy issue: Infer neighbors contents Client Client 2 Client Client

Contributions Inference attacks on real-world services i.e., Swarmify, BemTV and P2PSP Anonymous Peer-assisted CDN (APAC) Involves browsers as peers Preserve high level of anonymity Desired performance Compatible with browsers 3

Inference Attacks in Peer-assisted CDNs 4

Inference Attacks Goal Infer what content a victim user has requested or delivered (browsing history) Implication Revealing a user s browsing history significantly leaks the user s privacy A user s digital identity can be revealed [S&P 10] A user s geolocation/political orientation [W2SP 14] 5

Inference Attacks in Peer-assisted CDNs Passive attacks:adversary pre-stores all content potentially interesting to the victim Active attacks:adversary traverses all content potentially served by the victim Server Server Passive Active Request Request Fetch Deliver Adversary Adversary Victim Victim 6

Real-world Case Studies Swarmify,BemTV & P2PSP A deployed site with 10 images and 2 videos A victim peer requests and stores resources An adversary in the same LAN frequently requests and serves resources No defense against inference attacks Adversary can observe all resources from/to the victim Even open for content pollution attacks How to mitigate inference attacks? 7

Anonymous Peer-assisted CDN 8

Threat Model Initiator:peer initiates the request Responder: peer responds the request Honest-but-curious adversary Follow protocols Out of scope Sybil attacks Denial-of-service attacks (DoS) 9

Anonymous Peer-assisted CDN (APAC) Goal Anonymity:conceal a user s identity to unlink her id with her online trace Performance:acceptable network latency Compatibility:no (or minor) changes on websites and clients Intuition Onion-routing (OR) techniques 10

Onion Routing,but with Careful Parameter Selection OR: Messages are encapsulated in layers of encryption (onions) Limitations: Only initiator anonymity Non-negligible circuit setup latency Nodes randomly chosen Encryption Decryption Circuit 11

Overview of APAC Peer server constructs the circuit for each request instead of peers (anonymity) Region-based circuit construction (performance) Choose intermediate nodes in three regions: near-initiator, near-responder and globally random Communications via WebRTC (compatibility) 12

Initiation in APAC Peers fetch resources from the content server Content Server Fetch Store Peer vA Peer vB 13

Content Delivery via Peers Peers fetch resources from other peers Peer Server Request Report Request via OR circuit Reply Peer vB (Responder) Peer vA (Initiator) Peer vB (Intermediate) 14

Region-based Circuit Construction Peer Server Peer vB (Intermediate) Peer vB (Responder) Peer vA (Initiator) 15

Anonymity Analysis for APAC 16

Degree of Anonymity Def 1: The degree of initiator anonymity provided by a system is defined by: D(I |O)=1-HM-H(I |O) HM =H(I |O) HM Result: The degree of initiator anonymity can be represented as: 1 Lmax Lmax-l+1 l=1 log2((1- f)N) log2N Lmax f2 D(I |O)= 1- 17

Parameter Selection Level of anonymity The maximum number of intermediate nodes Lmax Distribution factors: the fraction of intermediate nodes near the initiator/responder init/ res The total number of peers N and the number of peers having requested resources NR When Lmax 2, APAC can preserve the standard degree of anonymity (i.e., 0.8) achieved by previous work 18

Performance Evaluation 19

Measurement Setup Scenario: CDN operators place edges servers in major cities, but users are not located in those cities Deployed site provides images 1KB 2 MB Content server / peer server in City A (New York) 100 Peers in City B (Singapore) 20

Network Latency Reduction (NLR) % 80 70 60 50 LAN WLAN WAN-City 40 30 20 10 0 Swarmify 2-node For a 4-node circuit where APAC provides a latency reduction (49.7%) lower than the performance obtained for Swarmify (69.4%) and non-anonymous setting (76.1%). 3-node 4-node 5-node 6-node 21

Effect of Distribution Factors NRL(%) 30 25 20 15 10 5 0 #Nodes in each region 3-0-0 2-1-0 2-0-1 1-2-0 1-1-1 1-0-2 0-3-0 0-2-1 0-1-2 0-0-3 Locating intermediate nodes near initiator/responder reduces network latency 22

Sweet Spot NLR (%) 70 60 50 40 Sweet Spot 30 20 10 Degree of Anonymity 0 0.5 0.6 0.7 0.8 0.9 With up-to 2 intermediate nodes, APAC preserves adequate degree of anonymity (i.e., 0.8) and desired performance (e.g., 97.3% bandwidth savings) 23

Conclusion Inference attacks on peer-assisted CDNs Anonymous Peer-assisted CDN (APAC) High degree of anonymity Desired network latency reduction and bandwidth savings Compatible with current browsers 24

Thanks You Q & A E-mail: jiayaoqi@comp.nus.edu.sg 25