On the Effectiveness of Continuous-Time Mixes under Flow Correlation Attacks

ABSTRACT To achieve anonymity in open environments such as the Internet, special proxies, denoted as mixes, were proposed to relay messages for senders and receivers. A mix may delay, batch and reorder packets to disrupt the packet-level timing correlation of packets into and out of the mix. Often multiple mixes are grouped into a mix network, which preserves anonymity in presence of compromised mixes. In a flow-based mix network, so-called flow correlation attacks have been proposed earlier to explore flow-level correlation and have been shown empirically to seriously degrade mix-based anonymous communication systems. In this paper, we theoretically analyze the effectiveness of a mix network under flow correlation attacks. Our formulae clearly show how a mix network will ultimately fail when an adversary has access to sufficiently long flow samples, independently of the type of flows (TCP or UDP). We illustrate the analysis methodology by modeling a continuous-time mix, which randomly delays each incoming packet. Our queuingmodel-based analysis captures the essence of flow correlation attacks and can provide useful guidelines for designers who develop and deploy anonymity systems.