Privacy in Peer-to-Peer Systems

Mon, 01 Jun 2009 00:00:00 +0000

Project Overview

Discussions of privacy in peer-to-peer systems tended to focus on content: what a user downloads, and who can observe it. This project started from a different place. In BitTorrent, whom you connect to is itself revealing, because people with similar interests end up in the same swarms repeatedly, and those repeated co-occurrences are visible to anyone watching the network.

Working with Luís Amaral’s group at Northwestern, we applied community-detection methods from complex-network analysis to BitTorrent connection patterns. The result, reported in Strange Bedfellows, is that users cluster into stable communities that persist over time and can be recovered from connection structure alone — no payload inspection required. An observer who cannot see what you downloaded can still infer a great deal about what you are interested in, simply from the company you keep.

The interdisciplinary collaboration was essential here: the measurement side supplied the traces and the systems questions, and the network-science side supplied the methods for finding structure in them.

SwarmScreen

If connection patterns are the leak, then the defence has to operate on connection patterns. SwarmScreen adds a controlled fraction of connections to swarms the user has no interest in, deliberately blurring the community structure an observer would otherwise recover.

The design point is plausible deniability rather than concealment. A user’s real activity is still there, but it is no longer separable from behaviour they never chose, so an observer cannot attribute any particular interest with confidence. The cost is a tunable amount of extra traffic, which the tech report examines against the privacy gained.

Software

SwarmScreen — a Vuze extension making downloading behaviour difficult to classify from connection patterns, with a tunable privacy/performance trade-off.

Papers

Strange Bedfellows: Communities in BitTorrent — IPTPS 2010
SwarmScreen: Privacy Through Plausible Deniability in P2P Systems — Northwestern EECS technical report, 2009

Coverage

The Register covered the work in April 2009, under “P2P eavesdrop ‘guilt by association attack’ developed”.

People

This was joint work with the Amaral Lab at Northwestern.

Faculty

Fabián E. Bustamante (Northwestern University)
Luís A. Nunes Amaral (Northwestern University)

Students

David R. Choffnes

Collaborators

Jordi Duch (Northwestern University)
Dean Malmgren (Northwestern University)
Roger Guimerà (Northwestern University)

AquaLab Research Group

SwarmScreen

Mon, 09 Mar 2009 00:00:00 +0000

The Short Story

The goal was to make it harder for an attacker to work out your downloading habits. Part of why BitTorrent works so well is that it lets you download from large numbers of connections — and those same connections are opportunities for eavesdropping. Our study of the BitTorrent network showed that user connection patterns reveal strong communities, which enable a guilt-by-association attack: an entire community can be classified by monitoring one of its members. With P2P networks increasingly under surveillance from private and government organizations, this needed a practical answer.

SwarmScreen hid real traffic in a sea of connections to randomly selected torrents, shaping those extra connections to look like the genuine ones. It slowed downloads, necessarily — so it offered a tuning knob, SPF, the SwarmScreen Protection Factor. Like sunscreen, a higher setting gives more protection; a lower one gives back bandwidth.

The Attack

Peer-to-peer systems draw their scalability and performance from large numbers of connections between cooperating hosts. Existing privacy work concealed connection data through encryption and trusted networks, but left the existence of each connection visible.

BitTorrent is a useful case because peers connect purely on shared, concurrent interest in the same content — not friendship, language or geography. Using connection patterns gathered from real users, we studied whether communities form: collections of peers far more likely to connect to each other than to random peers. They do, and strongly. Users inside a typical community were 5 to 25 times more likely to connect to each other than to users outside it.

That structure is what makes the attack work. From a single observation point, an attacker could reveal 50% of the network using only knowledge of a peer’s neighbours and their neighbours — two hops. An attacker monitoring just 1% of the network could correctly assign users to their communities of interest more than 86% of the time.

The Defence

We proposed a privacy-preserving layer that obfuscates user-generated network behaviour, and showed that plausible deniability is achievable by adding a relatively small proportion — between 25% and 50% — of extra random connections, provided they are statistically indistinguishable from natural ones. SwarmScreen generated exactly those, by participating in randomly selected torrents without looking anomalous.

Encryption does not solve this problem, because the attack reads connection patterns rather than payloads. Tor disguises endpoints but is not built for P2P, and downloads through it slowed by roughly a factor of ten; SwarmScreen let users choose their own slowdown instead.

Why the Name

SwarmScreen uses multiple swarms to screen real traffic. It also sounds like sunscreen, which made SPF the natural name for the privacy/performance dial.

Availability

SwarmScreen installed into the Vuze/Azureus client, first released in March 2009, with community translations into French, Italian, Portuguese, Slovak, Russian, Polish, Chinese and Catalan. It is no longer available.

The project shipped with a legal disclaimer worth preserving in spirit: the privacy claims rested on the results in the technical report and were not legal advice, and the software downloaded nothing unless the user configured it to.

Papers

Strange Bedfellows: Communities in BitTorrent — IPTPS 2010
SwarmScreen: Privacy Through Plausible Deniability in P2P Systems — Northwestern EECS technical report, 2009

Coverage

The Register covered the work in April 2009, under “P2P eavesdrop ‘guilt by association attack’ developed”.

People

This was joint work with the Amaral Lab at Northwestern.

Faculty

Fabián E. Bustamante (Northwestern University)
Luís A. Nunes Amaral (Northwestern University)

Students

David R. Choffnes

Collaborators

Jordi Duch, Dean Malmgren, Roger Guimerà (Northwestern University)

Privacy in Peer-to-Peer Systems — the project SwarmScreen was built for

Complex Networks | Aqualab - Northwestern University

Privacy in Peer-to-Peer Systems

Project Overview

SwarmScreen

Software

Papers

Coverage

People

Related Links

SwarmScreen

The Short Story

The Attack

The Defence

Why the Name

Availability

Papers

Coverage

People

Related Links