Anonymity systems like Tor provide privacy and security for Internet users, particularly groups such as journalists, whistleblowers, activists, intelligence agencies, and police. As research grows in the area of future Internet designs, such as with NSF's GENI testbed, it isimportant to build anonymity systems that work for these designs as well the current Internet. In this project, we explored three major directions related toanonymity systems and next-generation Internet anonymity: 1. topology, 2. traffic analysis, and 3. P2P designs.

1. In the area of topology, our Dovetail design raised the bar on security for future Internet anonymity systems that protect privacy while maintaining much lower costs than today's systems like Tor. Compared with the prior work, which did not protect users from local eavesdroppers, Dovetail offers protection against any single point of attack in the network. An overview of the Dovetail design is shown in Fig. 1. We investigated the privacy of this approach in extensive simulations on full Internet topologies, finding it provides effective resilience against an attacker anywhere in the system. Beyond this, we also studied topologies for systems providing high security against eavesdroppers, finding algorithms to select efficient connections between relays. Finally, we explored path selection in theTor system for more efficient and secure connections.

2. With traffic analysis, an attacker can undermine the privacy protections of an anonymity system by observing some of the system's activity and inferring the link between a sender and receiver. For our work on traffic analysis, we examined both short-term and long-term attacks against anonymity systems, as well as defenses against these attacks. In a series of works on stepping stone detection and covert channels, we demonstrated ways for communications to evade observation and blend in with other traffic. For long-term traffic analysis, we explored novel attacks and novel defenses like receiver-bound cover, in which the anonymity system sends extra traffic to the users' destinations. Our findings are informing the design of Lilac, a highly secure and usable anonymous chat service that we are developing and is available to try at http://thelilacproject.org. Fig. 2 shows a screenshot of the service.

3. Systems like Tor rely on centralized servers to gather and distribute critical information that users need to connect securely, but this approach is vulnerable to malicious hackers and denial-of-service attacks. Peer-to-peer (P2P) designs provide a decentralized way to access information about relays in Tor and matchmaker nodes in Dovetail. Such designs, however, are challenging to design securely when considering the range of possible attacks. We explored a technique by which many P2P systems can be improved through building reputation on inferred paths in the system. Our experiments showed that, perhaps surprisingly, sharing reputation information in this setting is counterproductive. Analysis further demonstrated the security of our techniques against a range of attacker strategies. We also explored a P2P anonymity design called Pisces that leverages social network information to significantly improve the security of path selection in a P2P anonymity system compared to the state of the art. 

Dissemination: The project findings were disseminated in numerous publications in leading conferences and journals. As the principle investigator for this project, Dr. Wright gave 17 invited talks about the work. 

Dr. Wright was the program co-chair of the Privacy EnhancingTechnologies Symposium in 2012 and 2013 as well as the co-chair of a DIMACS working group on measuring anonymity in May 2013. He served on a panel for an NSF CAREER workshop in May 2013. These efforts to serve ...

Please report errors in award information by writing to: awardsearch@nsf.gov.