Limits of Anonymity in Open Environments

Abstract

A user is only anonymous within a set of other users. Hence, the core functionality of an anonymity providing technique is to establish an anonymity set. In open environments, such as the Internet, the established anonymity sets in the whole are observable and change with every anonymous communication. We use this fact of changing anonymity sets and present a model where we can determine the protection limit of an anonymity technique, i.e. the number of observations required for an attacker to “break” uniquely a given anonymity technique. In this paper, we use the popular MIX method to demonstrate our attack. The MIX method forms the basis of most of the today’s deployments of anonymity services (e.g. Freedom, Onion Routing, Webmix). We note that our approach is general and can be applied equally well to other anonymity providing techniques.

In more recent times, a new technique providing perfect protection was discovered independently by two different groups[6],[7]. This technique, known as Private Information Retrieval (PIR), has similarities to the DC-Networks.

MIX technique uses public key encryption, thus the technique provides perfect anonymity, i. encryption is not considered as a limiting factor [2],[8].