A Practical Complexity-Theoretic Analysis of Mix Systems Vinh Pham 1 - PowerPoint PPT Presentation

A Practical Complexity-Theoretic Analysis of Mix Systems Vinh Pham 1 , Joss Wright 2 , Dogan Kesdogan 1 Siegen University, Germany 1 , University of Oxford, United Kingdom 2 1/13

Motivation Anonymity definition [Pfitzmann & K¨ ohntop 2010]: Anonymity of a subject means that the subject is not sufficiently identifiable within a set of subjects, the anonymity set. Anon. Set Attributes Attributes s 3 a 5 s 3 a 5 Subject s 2 a 2 s 2 a 2 s 1 a 4 s 1 a 4 How strong is the concept of anonymity sets if: a subject is associated to a fixed set of attributes H A and a subject and its attributes a ∈ H A are repeatedly observed? 2/13

Simple Mix and Attacker Model Recipient set R S ′ R ′ Sender set S r 1 s 6 r 5 s 3 s 1 r 9 Mix s 5 r 2 s 8 s 4 r 3 Global passive attacker (1) Information leakage per round is ( S ′ , R ′ ) : Sender set: S (can be equal R ) Recipient set: R = { r 1 , . . . , r N } , where | R | = N Sender anonymity set: S ′ ⊂ S , where | S ′ | = b is batch size Receiver set: R ′ ⊂ R , where | R ′ | ≤ b 3/13

Attacker Model (2) Alice repeatedly contacts a fixed set of recipients: Alice’s peer set: H A = { a 1 , . . . , a m } , a i ∈ R and m = |H A | Alice’s peer: If r ∈ H A , also reffered by variable a Peer: Any receiver r ∈ R of a receiver set R ′ 4/13

Attacker Model (2) Alice repeatedly contacts a fixed set of recipients: Alice’s peer set: H A = { a 1 , . . . , a m } , a i ∈ R and m = |H A | Alice’s peer: If r ∈ H A , also reffered by variable a Peer: Any receiver r ∈ R of a receiver set R ′ Sender anon. set Observation: O = { a, r 2 , . . . , r b } , a set R ′ Observation a Alice containing Alice’s contacted peer a . r 2 s 2 . . . . (One contact per round to simplify maths.) . . r b s b Observation Set: OS = {O 1 , . . . , O t } 4/13

Attacker Model (2) Alice repeatedly contacts a fixed set of recipients: Alice’s peer set: H A = { a 1 , . . . , a m } , a i ∈ R and m = |H A | Alice’s peer: If r ∈ H A , also reffered by variable a Peer: Any receiver r ∈ R of a receiver set R ′ Sender anon. set Observation: O = { a, r 2 , . . . , r b } , a set R ′ Observation a Alice containing Alice’s contacted peer a . r 2 s 2 . . . . (One contact per round to simplify maths.) . . r b s b Observation Set: OS = {O 1 , . . . , O t } Intersection attack Goal: Unambiguous identification of Alice’s peer set H A Known: Condition (1) and (2) Unknown: Recipient set size N , batch size b , Number of Alice’s peers m , communication distribution of senders 4/13

Minimal Hitting Set Attack (HS-Attack) Example: Alice repeatedly contacts two recipients, b = 2 , m = 2 R = { 1 , . . . , 6 } 3 4 3 6 H A = { 1 , 2 } 1 2 2 1 Observations: O 1 O 2 O 3 O 4 Smallest minimal hitting set O 1 { 3 } , { 1 } O 2 { 3 , 4 } , { 3 , 2 } , { 1 , 4 } , { 1 , 2 } O 3 { 3 , 4 } , { 3 , 2 } , { 1 , 2 } O 4 { 1 , 2 } Maximal number of sets: b m 5/13

Minimal Hitting Set Attack (HS-Attack) Example: Alice repeatedly contacts two recipients, b = 2 , m = 2 R = { 1 , . . . , 6 } 3 4 3 6 H A = { 1 , 2 } 1 2 2 1 Observations: O 1 O 2 O 3 O 4 Smallest minimal hitting set O 1 { 3 } , { 1 } O 2 { 3 , 4 } , { 3 , 2 } , { 1 , 4 } , { 1 , 2 } O 3 { 3 , 4 } , { 3 , 2 } , { 1 , 2 } t h g O 4 { 1 , 2 } i t Maximal number of sets: b m 5/13

Minimal Hitting Set Attack (HS-Attack) Example: Alice repeatedly contacts two recipients, b = 2 , m = 2 R = { 1 , . . . , 6 } 3 4 3 6 H A = { 1 , 2 } 1 2 2 1 Observations: O 1 O 2 O 3 O 4 By collecting observations: Smallest minimal hitting set O 1 { 3 } , { 1 } Prob. of sets H � = H A O 2 { 3 , 4 } , { 3 , 2 } , { 1 , 4 } , { 1 , 2 } decreases exponentially O 3 { 3 , 4 } , { 3 , 2 } , { 1 , 2 } O 4 { 1 , 2 } Maximal number of sets: b m 5/13

Minimal Hitting Set Attack (HS-Attack) Example: Alice repeatedly contacts two recipients, b = 2 , m = 2 R = { 1 , . . . , 6 } 3 4 3 6 H A = { 1 , 2 } 1 2 2 1 Observations: O 1 O 2 O 3 O 4 By collecting observations: Smallest minimal hitting set O 1 { 3 } , { 1 } Prob. of sets H � = H A O 2 { 3 , 4 } , { 3 , 2 } , { 1 , 4 } , { 1 , 2 } decreases exponentially O 3 { 3 , 4 } , { 3 , 2 } , { 1 , 2 } ⇒ H A will become unique O 4 { 1 , 2 } smallest minimal hitting set Maximal number of sets: b m 5/13

Minimal Hitting Set Attack (HS-Attack) Example: Alice repeatedly contacts two recipients, b = 2 , m = 2 R = { 1 , . . . , 6 } 3 4 3 6 H A = { 1 , 2 } 1 2 2 1 Observations: O 1 O 2 O 3 O 4 By collecting observations: Smallest minimal hitting set O 1 { 3 } , { 1 } Prob. of sets H � = H A O 2 { 3 , 4 } , { 3 , 2 } , { 1 , 4 } , { 1 , 2 } decreases exponentially O 3 { 3 , 4 } , { 3 , 2 } , { 1 , 2 } N ⇒ H A will become unique P - h a O 4 { 1 , 2 } r d smallest minimal hitting set Maximal number of sets: b m 5/13

Difference to Statistical (Disclosure) Attacks Succeeds even if other recipients are more frequently observed than Alice’s peers Succeeds in the case of unpredictable distribution of recipients Example: Alice repeatedly contacts two recipients, b = 3 , m = 2 H A = { 1 , 2 } 1 2 1 2 1 1 3 4 3 5 3 5 Observations: 6 7 5 6 4 4 O 1 O 2 O 3 O 4 O 5 O 6 Peers 1 2 3 4 5 6 7 Freq. 4 2 3 3 3 2 1 6/13

Difference to Statistical (Disclosure) Attacks Succeeds even if other recipients are more frequently observed than Alice’s peers Succeeds in the case of unpredictable distribution of recipients Example: Alice repeatedly contacts two recipients, b = 3 , m = 2 H A = { 1 , 2 } 1 2 1 2 1 1 3 4 3 5 3 5 Observations: 6 7 5 6 4 4 O 1 O 2 O 3 O 4 O 5 O 6 Peers 1 2 3 4 5 6 7 Freq. 4 2 3 3 3 2 1 Smallest minimal hitting set O 1 { 1 } , { 3 } , { 6 } O 2 { 1 , 2 } , { 1 , 4 } , { 1 , 7 } , { 2 , 3 } , { 3 , 4 } , { 3 , 7 } , { 2 , 6 } , { 4 , 6 } , { 6 , 7 } O 3 { 1 , 2 } , { 1 , 4 } , { 1 , 7 } , { 2 , 3 } , { 3 , 4 } , { 3 , 7 } O 4 { 1 , 2 } , { 2 , 3 } O 5 { 1 , 2 } , { 2 , 3 } O 6 { 1 , 2 } 6/13

Contribution Current assumption about HS-attack: Intractable for large values N, b, m , due to solving NP-hard problems (smallest minimal hitting set) Surprises when applying HS-attack: Many non-trivial cases, solvable in polynomial mean time Mean complexity determined by some relation between N, b, m Contribution Mathematical bound of mean time complexity w.r.t. N, b, m Bound applies to non-uniform user communication Identifies Mix settings that are polynomial time breakable 7/13

Estimating Number of Observations Hit by a Set C � �� � Hypothesis: H = { r 1 , . . . , r x , r x 1 +1 , . . . , r m − i } � �� � � �� � x chosen peers ( m − x ) non-chosen peers chosen: C ⊆ H , where all observations hitting C are known non-chosen: Only frequency of each single peer is known � Potential: Po ( H , C ) = |OS [ C ] | + |OS [ r ] \ OS [ C ] | � �� � � �� � r ∈H\C # obs. hitting C # obs. containing r Example: Potential of H = { r 1 , r 2 , r 3 } w.r.t. chosen peers OS = {O 1 , . . . , O 8 } 2 1 1 OS [ r 1 ] = {O 1 , O 2 , O 3 } OS [ r 1 ] OS [ r 2 ] OS [ r 2 ] = {O 2 , O 3 , O 4 , O 5 } 3 OS [ r 3 ] = {O 3 , O 4 , O 6 } 2 2 C = {} : Po ( { r 1 , r 2 , r 3 } ) = (3 + 4 + 3) OS [ r 3 ] 1 8/13

Estimating Number of Observations Hit by a Set C � �� � Hypothesis: H = { r 1 , . . . , r x , r x 1 +1 , . . . , r m − i } � �� � � �� � x chosen peers ( m − x ) non-chosen peers chosen: C ⊆ H , where all observations hitting C are known non-chosen: Only frequency of each single peer is known � Potential: Po ( H , C ) = |OS [ C ] | + |OS [ r ] \ OS [ C ] | � �� � � �� � r ∈H\C # obs. hitting C # obs. containing r Example: Potential of H = { r 1 , r 2 , r 3 } w.r.t. chosen peers OS = {O 1 , . . . , O 8 } 1 1 OS [ r 1 ] = {O 1 , O 2 , O 3 } OS [ r 2 ] \ OS [ r 1 ] OS [ r 2 ] = {O 2 , O 3 , O 4 , O 5 } OS [ r 1 ] OS [ r 3 ] = {O 3 , O 4 , O 6 } 2 C = {} : Po ( { r 1 , r 2 , r 3 } ) = (3 + 4 + 3) OS [ r 3 ] \ OS [ r 1 ] C = { r 1 } : Po ( { r 1 , r 2 , r 3 } ) = 3 + (2 + 2) 1 8/13

ExactHS Algorithm Computes/disproves all hypotheses H recursively within O ( b m ) Starts with C = {} Adds one suspected peer to C in each recursion level until: H ′ Po ( H ′ , C ) < |OS| , then all H ⊇ C disproved, or max C hits all observations in OS and is thus a hitting set Example: b = 2 , m = 3 , H A = { 1 , 2 , 3 } Observations: Search tree: 4 6 5 4 7 8 (2 + 2 + 2) 1 1 2 3 3 2 O 1 O 2 O 3 O 4 O 5 O 6 max H Po ( H , {} ) Peer choices: 9/13

ExactHS Algorithm Computes/disproves all hypotheses H recursively within O ( b m ) Starts with C = {} Adds one suspected peer to C in each recursion level until: H ′ Po ( H ′ , C ) < |OS| , then all H ⊇ C disproved, or max C hits all observations in OS and is thus a hitting set Example: b = 2 , m = 3 , H A = { 1 , 2 , 3 } Observations: Search tree: 4 6 5 4 7 8 (2 + 2 + 2) 1 1 2 3 3 2 4 , 1 O 1 O 2 O 3 O 4 O 5 O 6 Peer choices: 1 C = { 4 } 9/13

ExactHS Algorithm Computes/disproves all hypotheses H recursively within O ( b m ) Starts with C = {} Adds one suspected peer to C in each recursion level until: H ′ Po ( H ′ , C ) < |OS| , then all H ⊇ C disproved, or max C hits all observations in OS and is thus a hitting set Example: b = 2 , m = 3 , H A = { 1 , 2 , 3 } Observations: Search tree: 4 6 5 4 7 8 (2 + 2 + 2) 1 1 2 3 3 2 4 , 1 O 1 O 2 O 3 O 4 O 5 O 6 2 + (2 + 1) Peer choices: 1 C = { 4 } − max H Po ( H , { 4 } ) 9/13