Quantifying unlinkability in multi-hop wireless networks

Abstract

Consider a multi-hop wireless network in which devices act as anonymizing routers. Even if devices anonymize their link transmissions, an adversary may still be able to infer key information by observing the traffic patterns in the network. In this work, we quantify how well an adversary can infer unlinkability, that is, the probability that different pairs of devices are communicating, from anonymized link transmissions. We first propose a metric to compute unlinkability using a Kalman-filter based adversary. Using this metric, we then evaluate how different network characteristics impact unlinkability. We assume that devices do not reorder packets to mix traffic and thereby increase unlinkability. Instead, we show that traffic mixing is still possible due to the use of multi-hop routing and broadcast transmissions, with the amount of mixing dependent on the network characteristics. In simulation, we find that (i) for unicast links, as network connectivity increases unlinkability decreases, while for broadcast links, as connectivity increases unlinkability increases, (ii) link dynamics tend to increase unlinkability with unicast links but decrease unlinkability with broadcast links, (iii) well-connected topologies, particularly with broadcast links, achieve the same level of unlinkability with fewer transmissions per packet delivered, (iv) a lattice topology has consistently good unlinkability in different scenarios, and (v) heterogeneous network traffic gives higher unlinkability and better anonymization efficiency than uniform traffic, even when the average rate of traffic is the same.

Introduction

Rather than relying on fixed infrastructure like Internet routers or cell towers to relay traffic, in a multi-hop wireless network devices relay traffic for each other in a peer-to-peer fashion. Lack of infrastructure not only makes multi-hop wireless networks easier to deploy, it also increases privacy. For instance, devices can avoid communication over infrastructure that may be monitored [1], [2], and users can better control the distribution of their data by ensuring that any collected data is stored locally.

Consider then a multi-hop wireless network in which devices act as anonymizing routers. Even if devices anonymize their link transmissions an adversary may still be able to infer important information by observing the traffic patterns in the network, such as which pairs of devices are communicating. This is problematic since in many multi-hop wireless networks, different devices have different roles (e.g., sources vs. sinks in a sensor network) and some devices are more critical to network functionality (e.g., a military commander) than others. If an adversary can identify such devices it can prevent important information from reaching its destination.

Given this network scenario, our goal is to quantify what impacts how well an adversary can infer unlinkability [3], that is, the probability that different pairs of devices are communicating (see Section 2.1), given the anonymized link transmissions. We assume that the devices in the multi-hop wireless networks we consider do not mix (i.e., reorder) traffic, unlike a mix network [4]. Instead, we hypothesize that traffic mixing is still possible due to the use of multi-hop routing and broadcast transmissions (see Fig. 1 and Section 2.2). The amount of traffic mixing that is possible should depend on the flows present, the network connectivity, the link dynamics, and the routing strategy. It is these network characteristics whose influence on traffic mixing and thus unlinkability that we investigate in this work.

To quantify unlinkability, we assume a global adversary that passively eavesdrops on the anonymized packet transmissions on each link. The adversary uses these transmissions to compute a probability distribution over the possible communicating pairs of devices. We formulate the adversary as a Kalman filter to compute this distribution and derive an unlinkability metric. We then introduce the idea of anonymization efficiency to quantify the efficiency of unlinkable communication in different network scenarios.

In simulation, we confirm that traffic mixing does occur even when devices themselves do not mix traffic. We show that (i) for unicast links, as network connectivity increases unlinkability decreases, while for broadcast links, as connectivity increases unlinkability increases, (ii) link dynamics tend to increase unlinkability with unicast links but decrease unlinkability with broadcast links, (iii) well-connected topologies, particularly with broadcast links, achieve the same level of unlinkability with fewer transmissions per packet delivered, (iv) a lattice topology has consistently good unlinkability in different scenarios, and (v) heterogeneous traffic gives higher unlinkability and better anonymization efficiency than uniform traffic, even when the average rate of traffic is the same.

The rest of this paper is structured as follows. In Section 2, we explain how traffic mixing can happen in multi-hop wireless networks. In Section 3 we review related work. In Section 4, we describe our Kalman filter adversary. In Section 5, we show how we use our Kalman filter adversary to derive an unlinkability metric and propose the idea of anonymization efficiency. In Section 6, we evaluate our unlinkability metric in simulation. Finally, in Section 7, we summarize our contributions.