Tarzan: a peer-to-peer anonymizing network layer

ABSTRACT

Tarzan is a peer-to-peer anonymous IP network overlay. Because it provides IP service, Tarzan is general-purpose and transparent to applications. Organized as a decentralized peer-to-peer overlay, Tarzan is fault-tolerant, highly scalable, and easy to manage.Tarzan achieves its anonymity with layered encryption and multi-hop routing, much like a Chaumian mix. A message initiator chooses a path of peers pseudo-randomly through a restricted topology in a way that adversaries cannot easily influence. Cover traffic prevents a global observer from using traffic analysis to identify an initiator. Protocols toward unbiased peer-selection offer new directions for distributing trust among untrusted entities.Tarzan provides anonymity to either clients or servers, without requiring that both participate. In both cases, Tarzan uses a network address translator (NAT) to bridge between Tarzan hosts and oblivious Internet hosts.Measurements show that Tarzan imposes minimal overhead over a corresponding non-anonymous overlay route.

REFERENCES

• 1: The Anonymizer. http://anonymizer.com.
• 2: Oliver Berthold , Hannes Federrath , Stefan Köpsell, Web MIXes: a system for anonymous and unobservable Internet access, International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability, p.115-129, January 2001, Berkeley, California, United States
• 3: David L. Chaum, Untraceable electronic mail, return addresses, and digital pseudonyms, Communications of the ACM, v.24 n.2, p.84-90, Feb. 1981 [doi>10.1145/358549.358563]
• 4: D. Chaum, The dining cryptographers problem: unconditional sender and recipient untraceability, Journal of Cryptology, v.1 n.1, p.65-75, 1988
• 5: Ian Clarke , Oskar Sandberg , Brandon Wiley , Theodore W. Hong, Freenet: a distributed anonymous information storage and retrieval system, International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability, p.46-66, January 2001, Berkeley, California, United States
• 6: Frank Dabek , M. Frans Kaashoek , David Karger , Robert Morris , Ion Stoica, Wide-area cooperative storage with CFS, Proceedings of the eighteenth ACM symposium on Operating systems principles, October 21-24, 2001, Banff, Alberta, Canada
• 7: Dai, W. Pipenet. http://www.eskimo.com/ weidai/pipenet.txt.
• 8: Roger Dingledine , Michael J. Freedman , David Molnar, The free haven project: distributed anonymous storage service, International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability, p.67-95, January 2001, Berkeley, California, United States
• 9: John R. Douceur, The Sybil Attack, Revised Papers from the First International Workshop on Peer-to-Peer Systems, p.251-260, March 07-08, 2002
• 10: Electronic Frontiers Georgia (EFGA). Anonymous remailer information. http://anon.efga.org/Remailers/.
• 11: Federal Bureau of Investigations. Carnivore diagnostic tool. http://www.fbi.gov/hq/lab/carnivore/carnivore.htm.
• 12: Federrath, H., Ed. Designing Privacy Enhancing Technologies: International Workshop on Design Issues in Anonymity and Unobservability (2001), vol. 2009 of Lecture Notes in Computer Science, Springer-Verlag.
• 13: Goldberg, I., and Shostack, A. Freedom network 1.0 architecture, November 1999.
• 14: Goldberg, I., and Wagner, D. TAZ servers and the Rewebber network: Enabling anonymous publishing on the World Wide Web. First Monday 3, 4 (1998).
• 15: Guan, Y., Li, C., Xuan, D., Bettati, R., and Zhao, W. Preventing traffic analysis for real-time communication networks. In Proceedings of Milcom '99 (November 1999).
• 16: Mor Harchol-Balter , Tom Leighton , Daniel Lewin, Resource discovery in distributed networks, Proceedings of the eighteenth annual ACM symposium on Principles of distributed computing, p.229-237, May 04-06, 1999, Atlanta, Georgia, United States [doi>10.1145/301308.301362]
• 17: Eddie Kohler , Jinyang Li , Vern Paxson , Scott Shenker, Observed structure of addresses in IP traffic, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, November 06-08, 2002, Marseille, France [doi>10.1145/637201.637242]
• 18: David Martin , Andrew Schulman, Deanonymizing Users of the SafeWeb Anonymizing Service, Proceedings of the 11th USENIX Security Symposium, p.123-137, August 05-09, 2002
• 19: David Mazières , Michael Kaminsky , M. Frans Kaashoek , Emmett Witchel, Separating key management from file system security, Proceedings of the seventeenth ACM symposium on Operating systems principles, p.124-139, December 12-15, 1999, Charleston, South Carolina, United States
• 20: Andreas Pfitzmann , Marit Köhntopp, Anonymity, unobservability, and pseudeonymity — a proposal for terminology, International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability, p.1-9, January 2001, Berkeley, California, United States
• 21: Michael K. Reiter , Aviel D. Rubin, Crowds: anonymity for Web transactions, ACM Transactions on Information and System Security (TISSEC), v.1 n.1, p.66-92, Nov. 1998 [doi>10.1145/290163.290168]
• 22: RIAA v. Verizon. Motion to enforce July 24, 2002 subpoena. U.S. Distinct Court, District of Columbia, August 20, 2002. Case No. 1:02MS00323.
• 23: Rosen, E., Viswanathan, A., and Callon, R. Multiprotocol Label Switching Architecture, January 2001. RFC 3031.
• 24: Bruce Schneier, Description of a New Variable-Length Key, 64-bit Block Cipher (Blowfish), Fast Software Encryption, Cambridge Security Workshop, p.191-204, December 09-11, 1993
• 25: Ion Stoica , Robert Morris , David Karger , M. Frans Kaashoek , Hari Balakrishnan, Chord: A scalable peer-to-peer lookup service for internet applications, Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications, p.149-160, August 2001, San Diego, California, United States
• 26: Paul F. Syverson , David M. Goldschlag , Michael G. Reed, Anonymous Connections and Onion Routing, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.44, May 04-07, 1997
• 27: Paul Syverson , Gene Tsudik , Michael Reed , Carl Landwehr, Towards an analysis of onion routing security, International workshop on Designing privacy enhancing technologies: design issues in anonymity and unobservability, p.96-114, January 2001, Berkeley, California, United States
• 28: Marc Waldman , David Mazières, Tangler: a censorship-resistant publishing system based on document entanglements, Proceedings of the 8th ACM conference on Computer and Communications Security, November 05-08, 2001, Philadelphia, PA, USA [doi>10.1145/501983.502002]
• 29: Waldman, M., Rubin, A. D., and Cranor, L. F. Publius: A robust, tamper-evident, censorship-resistant, web publishing system. In Proceedings of the 9th USENIX Security Symposium (Denver, Colorado, August 2000), pp. 59--72.
• 30: Walton, G. China's Golden Shield: Corporations and the development of surveillance technology in the People's Republic of China, 2001. http://go.openflows.org/.
• 31: Wright, M., Adler, M., Levine, B. N., and Shields, C. An analysis of the degradation of anonymous protocols. In Network and Distributed System Security Symposium (San Diego, California, February 2002).

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.1 Network Architecture and Design
          Subjects: Distributed networks

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

General Terms:
Design, Human Factors, Management, Security

Keywords:
IP tunnels, anonymity, cover traffic, distributed trust, mix-nets, overlay networks, peer-to-peer