Quantifying Resistance to the Sybil Attack - UMass Amherst Digital

15 Pages·2008·0.22 MB·English

Quantifying Resistance to the Sybil Attack
N.BorisMargolinandBrianNeilLevine
Dept.ofComputerScience,Univ.ofMassachusetts,Amherst,MAUSA
{margolin, brian}@cs.umass.edu
Abstract.Sybilattackshavebeenshowntobeunpreventableexceptundertheprotectionofa
vigilantcentralauthority.Weuseaneconomicanalysistoshowquantitativelythatsomeappli-
cationsandprotocolsaremorerobustagainsttheattackthanothers.Inourapproach,foreach
distributedapplicationandanattackerobjective,thereisacriticalvaluethatdeterminesthecost-
effectivenessoftheattack.ASybilattackisworthwhileonlywhenthecriticalvalueisexceeded
bytheratioofthevalueoftheattacker’sgoaltothecostofidentities.Weshowthatformany
applications, successful Sybil attacks may be expensive even when the Sybil attack cannot be
prevented.Specifically,weproposetheuseofarecurringfeeasadeterrentagainsttheSybilat-
tack.Asadetailedexample,welookatfourvariationsoftheSybilattackagainstarecurringfee
basedonionroutinganonymousroutingnetworkandquantifyitsvulnerability.
1 Introduction
Many distributed services and peer-to-peer (p2p) applications are vulnerable to Sybil
attacks [17], where a single malicious entity masquerades as many counterfeit iden-
tities and uses them to launch a coordinated assault. The attack can be used to ruin
the integrity of reputation systems [5,12], create false routes in mobile ad hoc net-
works [23], identify users of anonymous routing protocols [16], cheat p2p computing
systems(e.g.,SETI@home)[47],andfree-ridecooperativefilestoragesystems[15].A
form of the Sybil attack is commonly used to fool Google’s PageRank algorithm [6].
In most situations it is not possible to prevent Sybil attacks using resource tests, and
certificatesystemsgenerallydonotguaranteenoentityhastwokeys.TheSybilattack
hasbeenwidelystudiedbutremainsunsolvedingeneral.Severalpapershaveevaluated
formallytheconditionsunderwhichapplicationsaresusceptibletotheattack[12,17],
howeverthisisacoarse-grainedapproach.Itisnottruethatallapplicationsareequally
vulnerable.
Inthispaper,wequantifythethreatoftheSybilattackusinganeconomicmodel.
Forthefirsttime,weshowthattheattackposesadifferentlevelofthreattodifferentap-
plications.WederiveaconcretemeasureofattackresistancecalledtheSybilvaluation.
Thevaluation isthecritical ratioof thevalueof theattacker’sgoal tothe per-identity
costoftheprotocol—atthecriticalratioorabovetheattackercanexpecttoprofitfrom
attacking the protocol. This measure allows us to quantitatively compare the threat as
ThisworkwassupportedinpartbyNationalScienceFoundationawardNSF-0133055.
thenumberofpeersinthesystemchanges.Moreover,ouranalysisdistinguishesappli-
cationsnotbywhattypeofservicetheyprovide,butratherbythespecificSybilattack
variationstheapplicationsallow.
Many have suggested addressing the Sybil attack by charging one-time resource
costs per participating identity. As part of our analysis, we show that protocols that
charge a recurring fee per participating identity are more effective as a disincentive
against successful Sybil attacks. Our previous work on the Informant protocols is an
example [26] of how recurring fees can also be used to detect Sybil attacks, and our
work here is complementary. We show that recurring fee protocols are more secure
becausetheyrequirethatthesuccessfulattacker’shasresourcesthatscalelinearlywith
thenumberofotherparticipants(insteadofaconstantamount).Thislinearrequirement
issynergisticwithp2papplicationsthatseektoincreasethenumberofpeersforother
performance benefits. Moreover, in recurring fee protocols, two uncoordinated Sybil
attackerswillincreasetheresourcesrequiredofeachotherwithoutincreasingcoststo
honestparticipants.
Asaconcreteexample ofprotocolanalysisusingtheSybilvaluation,we evaluate
aRecurringFeeOnionRoutingprotocol,whichwerefertoasRFORtodistinguishit
fromOnionRoutingorthedeployedTorprotocol[16],whichoperateswithoutexplicit
or implicit recurring fees. In Tor, as it is deployed now, an attacker will always find
benefitfromsettingupjusttwoidentitiesnomatterthepopulationsize,andtheattacker
canamortizeallcostsovertimetoanegligibleamount.EvaluationsofRFORusingthe
tracesofparticipationoftheactualTorsystemshowasharpcontrast.Forexample,as
ofSeptember2007,thetracesshown = 1373volunteerpeersactingasproxyservers.
WiththerecurringrouterentryfeechargedbyaRFORprotocol,arationalentitywould
have to value the knowledge of a single connection of a specific user at 4n times the
router entry fee in order to launch a Sybil attack. For a fee set at $0.01, this value is
$54.92 given the population in the traces, which may be enough to discourage only
casualattackers;ifRFORwasdeployedtoprotectusersthataremoreconcernedabout
theiranonymity,thefeecouldbesethigher.Usingtheserealtracesinourevaluation,we
areabletoshowthataRFORsystemwouldgrowlessvulnerabletosomeSybilattacks
withincreasespopularity,butwouldstillbesusceptibletoSybil-basedDoSattacksby
resource-poorattackers.
Forapplicationsthatcannottolerateanyentitywithmultipleidentities,centralized
manualidentitycertificationistheonlysolution,but,asDouceurpointsout,fewappli-
cationscanbearthecost.Formanyapplications,managingrecurringpaymentoffeesis
amorereasonablesolution.Severaldistributed,Internet-basedmicro-paymentschemes
canmanagefees[7,8,41,42].Forapplicationswhoseusersmaybeunwillingtomake
monetarypayments,feescanalsobeimposedlessrobustly,thoughperhapsmoreread-
ily,throughtheuseofnon-monetarymechanismssuchasCAPTCHAs[43]andSMS
messages.Ourapproachisflexibleinthatpeersinthesystemneedtoshowonlythata
paymentwasmade;thepaymentdoesnothavetobetootherpeersinthesystem.Fur-
thermore,inourapproachidentitiesareneveraskedtoprovetheyareseparateentities.
Outline.InSection2,westateourmodelandassumptionsregardingidentity,protocols,
andSybils.InSection3,wepresentacost-benefitanalysisformaliciousattackersbased
onentryfees.InSection4wediscussdifferenttypesofentryfees.InSection5,wegive
2
anoverviewofapproachestotheSybilattackintheliterature.Toourknowledge,this
isthefirstbroadoverviewofresearchonthissubject.Weofferconcludingremarksin
Section6.
2 GoalsandModel
OurmodelisanextensionofDouceur’s[17]inwhicheachpeerparticipatinginanet-
workprotocolisauniqueidentitythatiscontrolledbyarationalactor[34]knownasan
entity.ASybilattackoccurswhenoneentitysecretlycontrolsmultipleidentities.Iden-
titiessendmessagestoeachotherthroughacommunicationscloudthatprecludesdef-
initeidentificationusingdirectobservation.Weassumethatmessagescanbesecurely
linkedtoidentities,thoughnottoentities.Thiscanbeaccomplished,asinDouceur,by
havingidentitieschoosepublic/privatekeypairsandsigningtheirmessagesorbyother
methods [37]. The use of public keys does not imply a PKI because the keys are not
linkedsecurelytoanyreal-worldentity.
Wemodeltheapplicationsrunningthenetworkprotocolashavinganentryphase
andaservicephase.Duringtheentryphase,eachidentityischargedanentryfee,andwe
assumetheidentitycanlaterdemonstratetoothersthatthefeehasbeenpaid.Recurring
feeapplicationsforcepeerstorepeattheentryphase(andfee)afteroneormoreservice
phases.
Below,weintroduceamodelthatincludesentityutilityandstrategy,thevalueofthe
Sybil attack in general, and then we define three specific types of Sybil attacks. First,
wediscussthelimitationsofourapproach.
Limitations. Ourmodelappliestoapplicationsthatinvolveweaklyauthenticatedpar-
ticipants sharing resources. We show that such applications that charge recurring fees
aremoresecurethanthosethatpayaone-timefixedcost.Weevaluateanonymouscom-
municationsystems(andotherapplications)belowasanexample—yet,Torcharges
nofeesatallcurrently.Itisnotourintenttocomparehavingnofees(andthereforeno
defenseagainsttheSybilattack)againsthavingfees.Moreover,ouranalysisdoesnot
indicatewhetherapplicationswouldbemoreorlesspopulariftheycharged(recurring)
fees. On the one hand, some users might not find the increased cost worth the appli-
cation’s services; on the other hand, some users might find the application has added
benefit since it is more secure. The answer to this financial question depends on the
specificapplicationandbusinessmodel.
We do not investigate how to ensure fees are paid, though many others have done
so[7,8,41,42]).Wedonotethatdoingsoisaneasiertaskthanrequiringatrustedauthor-
itythatcancertifythateachidentityisanindependententity;thelatterisdifficulteven
with access to real-world documents [1]. Finally, we note that fees do not need to be
monetary,andtypicallywillnotbe.Instead,itmayinvolvetheuseofCAPTCHAS[43],
SMSmessages,orothertechniques,asdiscussedinSection4.Giventheprevalenceof
botnets,feesthatcanbepaidbyobtainingacomputerandIPaddressarenotsatisfac-
tory.
3
2.1 EntityUtility
Because our entities are rational actors, they have a specific utility for each possible
protocoloutcome,andtheyapplystrategiesthatgivethemthehighestpossibleexpected
utility.Rationalactorsperformacost-benefitanalysistodeterminewhatactiontotake
—includingwhethertolaunchaSybilattackagainstaspecificprotocol.
Our model follows basic game theory [34]. Let E represent a set of entities par-
ticipating in a protocol, controlling a set of identities I. Let S be the set of possible
e
actions, called strategies, that an entity e ∈ E can carry out. An entity must decide
onasinglestrategybasedonhisknowledgeandgoals.Anexamplestrategywouldbe
launching a Sybil attack with a certain number of identities. Since there are multiple
entitiesparticipating,thereisasetofoutcomesforn=|E|entities
O =S ×S ×···×S (1)
e1 e2 en
The combination of the strategies of participating entities completely defines an out-
come.Anoutcomeo ∈ O isaselectionofonestrategyfromeachofthesensets;that
is o is tuple (s ,...,s ) representing the strategy taken by all entities. For simplic-
e1 en
ity,wedonotdiscussnon-deterministic(i.e.,irrational)attackers,buttheyrequireonly
minorchangestoourmodel.
Eachentity’spreferencesareexpressedusingautilityfunctionthatmapsoutcomes
toautilityscore.Theutilityofanoutcomeotoanentityeisthesumofabenefitutility
τ (o) and acost utility π (o) (normally negative)determined bypayments madeby e
e e
inoutcomeo:
u (o)≡τ (o)+π (o). (2)
e e e
Whenentryfeesareused,thecost,π (o),istheproductoftheentryfeeandthenumber
e
ofidentitiescontrolledbytheentity.
2.2 TheGeneralSybilObjective
ForanattackerentitymconsideringthewisdomofaSybilattack,σ ∈S represents
q m
thestrategyofenteringqidentities—anddoingwhateverelseisnecessaryinorderto
reachsomeobjective.
Let A be the set of the objectives that an attacker can attempt to achieve using
Sybil attacks. We define an objective success count operator ψ(o), which gives the
number of successes by m in the outcome o. For example, one set of objectives is to
controltheentirepaththroughananonymitysystem,revealingtheinitiatorofapacket.
WhenparticipatingasmultipleSybilidentities,anattackermaycontrolmultiplepaths,
revealingmultipleinitiators,whichincreasesthevalueofψaccordingly.
Weassumethattheattackingentitym∈Evaluesattackslinearly,withthesuccess
ofasingleattackvaluedatv,sothat
τ (o)=vψ(o). (3)
m
Ingeneral,anattacker’sexpectedbenefitfromaSybilattackusingqidentitiesis
X
E[τ |s =σ ]= vψ(o)Pr[o|σ ]. (4)
m m q q
o∈O
4
We restrict our analysis to protocols in which honest entities do not gain any benefit
fromSybilattacks.Thatis,weassumehonestusersvaluemosttheprotocol’sobjectives
(e.g.,anonymity)andthatmalicioususersvalueoutsideobjectivesmore(e.g.,breaking
anonymity).
2.3 SpecificSybilObjectives
The Sybil attack can be launched as one of several specific objectives that depend on
theapplicationbeingattacked.Wedistinguishtheseattacksbythewaytheapplication
uses peers to offer service. In all cases, the application starts the service phase by se-
lectingasubsetof k peers(identities);typically,a subsetk isselectedforeach ofthe
nparticipatingidentities.Forexample,Crowdsformsapathofkpeersforanonymous
routing for each peer that is a source of traffic. From here, we can distinguish several
differentSybilattackobjectives.
First, for any specific application, there is a minimum number of identities re-
quiredforasuccessfulattack.Forexample,tosuccessfullylaunchthepredecessorat-
tackanattackerneedsonlyc=1identitiesfortheCrowdsprotocolbutc=2identities
tofortheOnionRoutingprotocol[45].
Second, we distinguish One-time feeobjectives, which areapplicable to applica-
tionswheretheattackercanlaunchSybilattacksrepeatedlywithoutadditionalcost—
aswhenentryfeesarechargedonlyonetimeeverperidentity.Sinceanyattackwitha
non-zeroprobabilityofsuccessisexpectedtosucceedeventually,agivenstrategyhas
either no chance of success, or is guaranteed success. In this case, the only strategies
that the attacker needs to consider are σ (entering no identities) and σ (entering the
0 c
minimumnumberofidentitiesrequiredforsuccess).One-timefeeattacksaredenoted
T .OnionRoutingandthedeployedTorsystemareexamplesofone-timefeeprotocols.
c
Third, for applications that charge a recurring entry fee for one or more service
phases,severalattackscanbedistinguished.Forexample,whilemostanonymousrout-
ing protocols create subgroups (paths) of k peers, choosing with replacement from a
set I of peers, Pastiche [15] is a p2p application that stores backup data from each
source node with k other peers, choosing without replacement (though Pastiche does
not charge fees in reality). In both cases, the objective of the attacker is to control c
of the k identities chosen each service phase for each of n sources. However, we dis-
tinguish the former case as a binomial objective, since k identities are chosen with
replacementfromI.Andwerefertothelattercaseasahypergeometricobjective,since
kidentitiesarechosenwithoutreplacementfromI.Wefurtherdetailthesecasesbelow.
• Binomial objectives. For each identity in the application, a subgroup is chosen
with replacement, and the attacker may try to target all subgroups, a specific vic-
tim’ssubgroup,ortrytosucceedagainstany(thatis,noonespecifically)victim’s
subgroup,aswedetailbelow.
• When attacking a specific subgroup, denoted Bspec., the attacker’s utility is
c,k
proportionaltotheprobabilityofsuccessagainsttheoneidentity.
• Whenseekingsuccessagainstanyonesubgroup,denotedBany,theattacker’s
c,k
utilityisproportionaltotheprobabilityofsuccessagainstatleastoneidentity.
5
• Whenattackingallnsubgroups,denotedBall ,theattacker’sutilityispropor-
c,k
tionaltothetotalnumberofgroupcontrolsuccesses.
• Hypergeometric objectives. A subgroup of k identities are chosen without re-
placement.SuchobjectivesaredenotedH .SETI@home[38]andPastiche[15]
c,k
are subject to the hypergeometric objectives, since identities in peer groups are
chosenwithoutreplacement,forredundancy.ThenotationH representstheob-
c,k
jective of controlling a specific peer group. There are a large number of natural
subcasesoftheHypergeometricobjective(comparedtojustthreefortheBinomial
objective),andtoavoidcomplexityweomitthem.
Commonly,p2papplicationsselectidentitiesforsubgroupsuniformlyatrandom,and
we assume so here for all objectives; our previous work [45] suggests that uniform
randomselectionisthemostattack-resistantapproachforanonymouscommunications
systems,andweconjecturethatitisthemostattack-resistantapproachformanyother
p2psystemsaswell.
3 TheSybilValuation
Inthissection,weuseourmodeltodeterminewhenthebenefitsofaspecificSybilat-
tackexceedsthecosts,apointwecalltheSybilvaluation.Whenanattacker’svaluation
oftheirobjective,intermsoftheentryfeecost,exceedstheSybilvaluation,itisintheir
interesttolaunchtheattack.
WedenotetheSybilvaluationforanobjectiveabyγ ,defined
a
q
γ ≡min (5)
a q E[ψa|σq]
whereE[ψ |σ ]givestheexpectednumberofsuccessesforanattackerwiththeobjec-
a q
tivealaunchingaSybilattackwithqidentities.
Using this measure, a protocol designer or user can determine how intrinsically
resistant a protocol is to a Sybil attack, so she can independently evaluate the design
of the protocol and the setting of entry fee. Once the design is fixed, she can use the
measure to determine how to set the entry fee to discourage attackers with different
valuationsforsuccessinreachinganobjective.
First,weshowthatanattackermonlybenefitsfromanattackwhentheirobjective
valuationisatleastγ timestheirper-identitycost.Theattacker’sexpectedutilityfor
a
aSybilattackwithqidentitiesmustbenon-negativefortheattacktoberational.Soan
attackisrationalifandonlyif
E[τ |σ ]−qf ≥0 (6)
m q
vE[ψ |σ ]≥qf (7)
a q
qf
v ≥ . (8)
E[ψ |σ ]
a q
6
Objective Example Specific Optimalnum Sybil γ∗ as
a
Type Applications objective identities Valuation(γ∗) n→∞
a
One-time [13,17,24] T c c c
c
Fee
Binomial Bspec. 1 (1−( n )k)−1 k−1n
RFORdenialof 1,k n+1
service,RFOR Bspec. (k−1)n “ k ”k−1kn ekn
endpointsattack, k,k k−1
andPredecessor B1an,ky 1 (1−(n+n1)kn)−1 e−k
attack[44] Bany (k−1)n+k kn
k,k
Ball 1 1/n(1−( n )k) k−1
1,k n+1
“ ”k−1
Ball (k−1)n k k k
k,k k−1
Hyper- SETI@Home[38], H SameasBspec.
1,k 1,k
geometric Pastiche[15]
H (k−1)n+k kn
k,k
Table1.Optimalnumberofidentities,Sybilvaluation,andasymptoticbehaviorasngrowslarge
fordifferentobjectives.Forderivations,seetheAppendix.TheSybilvaluationsoftheBinomial
andHypergeometricobjectiveshavenoclosed-formrepresentationforgeneralcandk[11],and
theyareomittedforreadability.
Since the attacker is rational, she will choose the optimal number of identities q to
includeintheprotocol.Therefore,
qf
v ≥min (9)
q E[ψa|σq]
v ≥γ f. (10)
a
Forclarity,webeganthissubsectionbydefiningtheSybilvaluation;notethatInequal-
ities6through9areatemplateforderivingtheratio.
Inequality10saysnothingabouttheresourcesavailabletoaparticularattacker.An
attackermayvalueanobjectivehighly,butnotlaunchaSybilattackifshedoesnothave
enoughsufficientresourcestoachieveit.However,inthispaper,wetakethedefender’s
pointofviewandconservativelyassumethatanattackercontrolsanunlimitedamount
ofresources.
Insomecases,theoptimalnumberofidentitiesqwillbeverysmall,sotheattacker
willonlyhaveaverysmallchanceofsuccesseachround.Byenteringalargernumber
ofidentities,theattackerwoulddecreasetheexpectednumberofroundsuntilsuccess,
buttheexpectedtotalcostwouldbehigher.
3.1 γ forSpecificObjectives
a
We now quantify γ , the susceptibility of applications to Sybil attacks. Table 1 has
a
resultsforeachobjectivediscussedinSection2.3:theone-timefee,binomial,andhy-
7
pergeometricobjectives.Whilethederivationofγ isnotdifficult,theanalysisofeach
a
protocoltypeismoreinvolved,lengthy,andinsomecasesithasnoclosedform.
Asanexample,considertheobjectiveBspec.,whereaspecificidentity’ssubgroupis
1,k
targetedandtheattackerneedstobeselectedasonly1ofkpeersinthesubgroup.The
probabilityofsuccessgivenqidentitiesis1−( n )k.Thereforeforthisobjective,
q+n
q
γ =min . (11)
a q 1−( n )k
q+n
The minimizing q must be either 1 (the lowest possible value for q) or some root of
thederivativeoftheminimizedexpression.Itispossibletoshowthatthederivativeof
theminimizedexpressionisalwayspositiveforpositiveintegervaluesq.Theminimum
mustthereforebeat1,thelowestpossiblevalueforq,andthereforeforthisobjective
1
γ = . (12)
a 1−( n )k
n+1
Asngrowslargeinthiscase,thenγ approachesn/k,meaningthatincreasingpopular-
a
ityincreasescostslinearlyfortheattacker.Becauseofspacelimitations,detailsofthe
otherγ calculationsappearinourtechnicalreport[27].Wediscusstheimplicationsof
a
theresultsthataresummarizedinTable1below.
•Theone-timefeeobjective,T iseasilyachievedinmostcases;regardlessofthe
c
numberofparticipants,ittakesonlyctimestheentryfeetoachievetheobjective.For
example,theanalysisappliestoanonion-routingsystemrequiringaone-timeentryfee
where the objective is the predecessor attack [44], which requires a minimum of two
identitiesforsuccess.Thenanattackeronlyneedstovaluetheattackattwicetheentry
feeandentertwoidentitiesintotheprotocol,whichisaveryinexpensiveSybilattack.
One-timefeesarenotwell-suitedtodiscouragingSybilattacks.
• The binomial objective varies in difficulty depending on the objective; the in-
tendedvictimcanbesomespecificuser,anyuser,orallusers.
Againstspecificusers,thedifficultyofachievingthebinomialobjectiveislinearin
the n: a protocol is increasingly secure as more identities participate. This is true re-
gardlessofcandk,thoughcdeterminesifγ islinearink,linearin1/k,orsomewhere
a
inbetween1.
Inbinomialobjectiveswheretheattackerwishestosucceedagainstanysingleuser,
cdeterminesthedifficultyoftheattack.Forc=1,wefindthatγ convergesto ek as
a ek−1
n increases.Therefore, inthis case,adding morehonest identitieshaslimited benefit.
Conversely,whenc = k (andk > 1),wefindγ asymptoticallyapproaches(k−1)n
a
asnincreases.
In binomial objectives including all users, γ is asymptotically constant with in-
a
creasingn.Forc=1itapproaches1/k,whileforc=kitdoesnotdependonnatall,
butisasymptoticallyequaltoek.
• Hypergeometric objectives are those where an attacker attempts to control c
of k peer group identities, chosen without replacement. They are similar to binomial
1Thereisnoclosed-formexpressionofγ foranybinomialobjectivewhencisnotexactly1
a
ork;seeCasellaandBerger[11].
8
1400 $90
1200 0.01 $80 Full Path Objective
=$ $70
1000 n, f
o $60
# Tor routers 680000 Attacker Valuati $$$345000 End Points Objective
400 m
u $20
m
200 Mini $10 Discriminate DOS objective
Indiscriminate DOS objective
$0
0
11/05 01/06 03/06 05/06 07/06 09/06 11/06 01/07 03/07 05/07 07/07 09/07 11/07 11/05 01/06 03/06 05/06 07/06 09/06 11/06 01/07 03/07 05/07 07/07 09/07 11/07
Fig.1.(a)Torrouterpopulationovertime.(b)MinimumvaluationoffourattacksagainstRFOR
whenf =$0.01(Populationdipsaresmoothedout.)
objectives,butaremoredifficultfortheattacker,sinceheridentitiescannotbereused;
thedifferenceismostpronouncedwhennandkaresmall.
3.2 Application:RecurringFeeOnionRouting(RFOR)
Inthissection,weapplyourSybilvaluationmeasuretorevealpropertiesofarecurring
fee onion routing protocol. RFOR operates exactly according to the Onion Routing
protocoldefinitionwithtwoexceptions;(i)routerspayafeeforeverypathreformation;
(ii)pathsareconstructedbychoosingproxieswithreplacement.
OurgoalistocontrastRFOR’srelativestrengthagainsttheSybilattackwithstan-
dard Onion Routing, which provides free services to users through volunteer routers.
There is no defense against the Sybil attack in Onion Routing in design or in various
deployments;i.e.,Sybilattackscanlaunchtheattacksuccessfullyforanegligiblecost.
Tor is an example of Onion Routing that is deployed with other defenses such as
guardnodes.WenotethatToroperatorsdopayacosttooperateaTornode,butthiscost
isnotonethatwouldgrowifthoseoperatorsincreasedthenumberofSybilidentities
theyoperateonthenetworkfromthesamecomputer.Forexample,Murdochdiscovered
throughclockskewanalysisthat30particularroutersontheTornetworkwereactually
justtworealmachines[30].
OurgoalisnottoaskifOnionRoutingdeploymentssuchasTorshouldchargeusers
afee,butratherwhatisthecostthatSybilattackersshouldexpecttopayinarecurring
fee version of Onion Routing? We are unaware of previous work that quantifies the
threatposedbySybilattacks(ratherthancollaboratingentities)toOnionRouting.
Asasimpleexample,weassumethatRFORroutersarechargedafeeoff =$0.01
everypathreformation.Weassumethatthepathlength(i.e.,circuitlength)remainsat
thedefaultsettingofthree.Below,weanalyzefourobjectivesofRFORSybilattackers:
two types of denial-of-service (DoS) attacks, capturing the endpoints of a path, and
capturing the full path. We show that these objectives vary considerably in difficulty;
9
some have asymptotically linear Sybil valuations with reasonable coefficients, while
othershaveasymptoticallyconstant,andsometimesverylow,Sybilvaluations.
In our evaluations, we use Tor’s directory server’s public advertisements of avail-
ableproxies,whichhavebeenarchivedbyPeterPalfrader,whogenerouslysharedthe
data with us. The 73,309 trace files cover December 2005 until September 2007. See
Wrightetal.[45]forcharacteristicsofTormeasurements,includingup-anddown-time
distributions.NotethateachpeerroutersupportsservicestohundredsofclientsofTor.
TojointheTornetworkasaroutingpeer,apersonneedsonlyacomputerandoneIPad-
dressforeachroutertheywishtocontrol.Wearespecificallyconcernedwithattacking
thepeerroutersthatservicetheclients.
Figure1(a)showsthenumberofTorroutersovertimefromthetracesandFigure
1(b),discussedbelow,showstherequiredvaluationsoftheobjectivesovertimewhen
thereisa$0.01perpathreformationfeeforroutersinRFOR.Inourexamples,wemake
useofpeakpopulationvalueinthelogsofn = 1,373routersonSeptember23,2007.
However,itisinstructivetoexaminethesevaluesinFigure1(b)inJanuary2006,when
n=275,approximately.
• Discriminating DoS objective. If an attacker can control a single router out of the
threeinauser’sRFORpath,shecandenyservice.InthediscriminatingDoSobjective,
theattackerwantstolimitDoStocaseswhenthereisareasonableprobabilitythatthe
targeted user is on the target path. Specifically, the attacker only launches the DoS if
sheobservesthetargetnodeasthepreviousnodeinthepath.Inthiscasethereisa1/3
chancethatthepathwasinitiatedbythetargetuser.(Iftheattackerneedscertainty,then
theend-pointsobjective,discussedbelow,applies.)
ThisobjectivecorrespondstoBspec..γ fortheobjectiveisn+1 = 1374.Sothe
1,1 a
attackerwouldneedtovaluetheattackat$13.74inorderdecidetolaunchit.
•IndiscriminateDoSobjective.Inthiscase,theattackerlaunchesaDoSattackereven
ifthetargetisnotobservedasapredecessor,possiblycausingcollateraldamage.This
is the Bspec. objective when she receives utility from victimizing only a specific user,
1,3
anditistheBanyandBall objectivesotherwise.
1,3 1,3
FortheBspec.objective,whentheattackerhasaspecifictargeteduser,γ is 1 .
1,3 a 1−( n )3
n+1
At1373routersγ = 458,requiringavaluationof$4.58fortheattackata$0.01per-
a
identityfee.
The cost is even less for the other objectives. The objective when the attacker is
contentwithdenyingservicetoanyoneuser,Bany,hasaγ = 1.05at370identities,
1,3 a
requiring a valuation of $0.0105 at a $0.01 per-identity fee. The objective when the
attacker receives utility that is proportional to the total number of users it can deny
serviceto,Ball ,hasaγ =0.334,requiringavaluationofjust$0.0033foraprofitable
1,3 a
attackwhentheper-identityfeeis$0.01.
•Endpointsobjective.Forthisobjective,theattackerusesitssybilidentitiestocap-
turethetwoendpointsofapath.Thetwoproxiesthenlaunchatimingattack[31]to
determineiftheyareonthesamepath,therebylearningtheinitiatorandresponder.The
endpointsobjectiveisaB objective.
2,2
When the fee is charged per path reformation, the results are as follows. For the
binomialobjective,whentheattackprofitsonlyfromaspecificuserγ = 4n,or5492
a
at n = 1373, which gives an attacker Sybil valuation of $54.92. When the attacker
10