SwarmScreen
Privacy through plausible deniability in P2P systems.
The Short Story
The goal was to make it harder for an attacker to work out your downloading habits. Part of why BitTorrent works so well is that it lets you download from large numbers of connections — and those same connections are opportunities for eavesdropping. Our study of the BitTorrent network showed that user connection patterns reveal strong communities, which enable a guilt-by-association attack: an entire community can be classified by monitoring one of its members. With P2P networks increasingly under surveillance from private and government organizations, this needed a practical answer.
SwarmScreen hid real traffic in a sea of connections to randomly selected torrents, shaping those extra connections to look like the genuine ones. It slowed downloads, necessarily — so it offered a tuning knob, SPF, the SwarmScreen Protection Factor. Like sunscreen, a higher setting gives more protection; a lower one gives back bandwidth.
The Attack
Peer-to-peer systems draw their scalability and performance from large numbers of connections between cooperating hosts. Existing privacy work concealed connection data through encryption and trusted networks, but left the existence of each connection visible.
BitTorrent is a useful case because peers connect purely on shared, concurrent interest in the same content — not friendship, language or geography. Using connection patterns gathered from real users, we studied whether communities form: collections of peers far more likely to connect to each other than to random peers. They do, and strongly. Users inside a typical community were 5 to 25 times more likely to connect to each other than to users outside it.
That structure is what makes the attack work. From a single observation point, an attacker could reveal 50% of the network using only knowledge of a peer’s neighbours and their neighbours — two hops. An attacker monitoring just 1% of the network could correctly assign users to their communities of interest more than 86% of the time.
The Defence
We proposed a privacy-preserving layer that obfuscates user-generated network behaviour, and showed that plausible deniability is achievable by adding a relatively small proportion — between 25% and 50% — of extra random connections, provided they are statistically indistinguishable from natural ones. SwarmScreen generated exactly those, by participating in randomly selected torrents without looking anomalous.
Encryption does not solve this problem, because the attack reads connection patterns rather than payloads. Tor disguises endpoints but is not built for P2P, and downloads through it slowed by roughly a factor of ten; SwarmScreen let users choose their own slowdown instead.
Why the Name
SwarmScreen uses multiple swarms to screen real traffic. It also sounds like sunscreen, which made SPF the natural name for the privacy/performance dial.
Availability
SwarmScreen installed into the Vuze/Azureus client, first released in March 2009, with community translations into French, Italian, Portuguese, Slovak, Russian, Polish, Chinese and Catalan. It is no longer available.
The project shipped with a legal disclaimer worth preserving in spirit: the privacy claims rested on the results in the technical report and were not legal advice, and the software downloaded nothing unless the user configured it to.
Papers
- Strange Bedfellows: Communities in BitTorrent — IPTPS 2010
- SwarmScreen: Privacy Through Plausible Deniability in P2P Systems — Northwestern EECS technical report, 2009
Coverage
The Register covered the work in April 2009, under “P2P eavesdrop ‘guilt by association attack’ developed”.
People
This was joint work with the Amaral Lab at Northwestern.
Faculty
- Fabián E. Bustamante (Northwestern University)
- Luís A. Nunes Amaral (Northwestern University)
Students
Collaborators
- Jordi Duch, Dean Malmgren, Roger Guimerà (Northwestern University)
Related Links
- Privacy in Peer-to-Peer Systems — the project SwarmScreen was built for