Feeds

Better onion anonymity possible: researcher

Boost to reliability as well

Internet Security Threat Report 2014

Onion routing – which in spite of its DARPA genealogy are disliked by national security types – could be made more anonymous, according to a an Iranian researcher now working on a PhD at Concordia University in Montreal.

In this Arxiv-published paper, Ehsan Saboori and co-author Shahriar Mohammadi propose separating the “request” and “response” paths on onion networks to improve user anonymity.

Saboori’s paper notes that over time, a user of a technology such as the TOR project can be identified by analysis of network traffic.

His proposal depends on trusted supernodes (someone at Concordia could have proofread the paper, since it’s mis-spelled “suppernode” throughout) to maintain peer lists of participants, and provide peer information to a requester joining the network.

The requester then randomly chooses two paths for its communications: one path to contact the responder (the host the peer is trying to contact), and a different path for responses.

The idea is that traffic analysis becomes more complex, since each requester on the network is able to periodically – and randomly – select new paths to the responder. This makes it difficult for an intruder to identify the origin path of transferred data.

While the supernodes, if compromised, could reveal participants in the network, the existence of the peers doesn’t identify what routes were chosen by a given requester at a given point in time. Anonymity would, however, depend on scale: if a supernode architecture has too few peers, they would be relatively easy to identify.

Saboori also notes that the scheme needs multiple supernodes so that they don’t become a single point of failure (allowing the onion network to be attacked by a DoS against a supernode). ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.