Source-linked AI summary
ANDaNA: Anonymous Named Data Networking Application
Steven DiBenedetto, Paolo Gasti, Gene Tsudik, Ersin Uzun
TL;DR
NDN’s content-oriented naming improves networking flexibility but creates privacy concerns because names and related mechanisms can reveal users’ interests. The paper designs and analyzes ANDaNA, an NDN add-on inspired by Tor, and reports comparable anonymity with lower overhead, while noting limits against global passive observation.
Problem
NDN lacks source and destination addresses but its semantically rich names and architecture introduce privacy concerns that require an anonymity solution.
Method
The paper designs ANDaNA, an onion-routing-inspired anonymization add-on that runs above NDN and analyzes it under a realistic adversarial model.
Results
ANDaNA provides anonymity with fewer anonymizing router hops than Tor and introduces less overhead, especially for anticipated traffic patterns.
Takeaways & Limitations
The work offers an initial privacy approach for NDN while keeping the design aligned with NDN principles and low-latency interactive communication.
Takeaways & Limitations
Because ANDaNA does not intentionally delay messages or add dummy packets beyond limited padding, a global passive adversary can violate its anonymity properties.
Abstract
from arXiv · showhide
Content-centric networking -- also known as information-centric networking (ICN) -- shifts emphasis from hosts and interfaces (as in today's Internet) to data. Named data becomes addressable and routable, while locations that currently store that data become irrelevant to applications. Named Data Networking (NDN) is a large collaborative research effort that exemplifies the content-centric approach to networking. NDN has some innate privacy-friendly features, such as lack of source and destination addresses on packets. However, as discussed in this paper, NDN architecture prompts some privacy concerns mainly stemming from the semantic richness of names. We examine privacy-relevant characteristics of NDN and present an initial attempt to achieve communication privacy. Specifically, we design an NDN add-on tool, called ANDaNA, that borrows a number of features from Tor. As we demonstrate via experiments, it provides comparable anonymity with lower relative overhead.
1 Introduction
The paper motivates privacy for content-centric networking by identifying privacy challenges in NDN and introduces ANDaNA, an onion-routing-inspired add-on evaluated for security and performance.
- Motivation: Anonymity matters because it can help users evade censorship, overcome communication restrictions, and protect activities from observers.
- Motivation: NDN’s semantically rich names create privacy risks despite packets lacking source and destination addresses.The paper identifies name, content, cache, and signature privacy challenges.
- Evaluation: ANDaNA is analyzed under a realistic adversarial model, with anonymity and unlinkability shown to hold using fewer anonymizing router hops than Tor.
- Evaluation: ANDaNA’s testbed evaluation reports less overhead than Tor, especially for anticipated traffic patterns.
- Approach: ANDaNA adapts onion routing to NDN while running above NDN’s thin waist and targeting small- to medium-size interactive traffic.The design is optimized for web browsing and instant messaging with moderate, low-latency traffic.
2 NDN Overview
NDN names and routes content rather than locations, enabling caching and content-centric delivery, but its naming, retrieval, and caching mechanisms expose privacy-relevant information.
- NDN architecture: NDN addresses content by name rather than location, making content the primary networking abstraction.Names consist of one or more variable-length components that are opaque to the network.
- NDN architecture: Consumers retrieve content through interest packets, while routers forward, record, collapse, and satisfy interests using pending-interest state.
- NDN architecture: Caching lets network entities satisfy interests from distributed copies, while mandatory signatures provide content authenticity and integrity.
- Privacy analysis: NDN’s lack of source and destination addresses improves privacy near producers, but does not protect a monitored consumer’s local activity.
- Privacy analysis: Semantically meaningful names can reveal requested content, and encrypted names provide only limited privacy.
3 Related Work
Related anonymization systems trade performance against anonymity, ranging from centralized proxies and low-latency overlays to delay-tolerant mix networks and distributed peer-to-peer designs.
- Proxy approaches: Centralized anonymizing proxies are relatively efficient but vulnerable to local passive monitoring, centralized trust, and single-point failure risks.
- Mix networks: Mix networks repeatedly route encrypted messages through proxies to weaken the relationship between originator and message.
- Anonymity tradeoffs: Low-latency systems minimize delay, so batching, reordering, and decoy traffic used by delay-tolerant mixes are generally unsuitable.
- Distributed systems: Crowds probabilistically forwards unencrypted HTTP messages, whereas Morphmix and Tarzan use distributed peer-to-peer structures with layered encryption or verifiable neighbors.
- Low-latency systems: Tor uses layered encryption and three-hop circuits for low-latency anonymity, but does not add decoy traffic or randomize traffic patterns.
- ICN and censorship systems: ICN cover-content techniques require producer cooperation and substantial cover storage, while Telex requires network-infrastructure support for deployment.
4 ANDaNA
ANDaNA is an onion-routing overlay on NDN that protects consumers by sending interests through ephemeral circuits and encapsulating returned content. Its design targets low-latency traffic while limiting several correlation and traffic-analysis attacks.
- Design: ANDaNA uses concentric encryption layers and symmetric-key content encapsulation so routers can forward protected interests and content without exposing original names or signatures.The exit router encrypts the content, original name, and signature, then sends it onward as the payload of a newly signed content packet.
- Security model: Consumers must use at least one non-compromised ANDaNA node, while the system assumes an adversary may compromise or deploy routers and anonymizers and manipulate traffic.The model accounts for iterative compromise, but newly compromised state reflects packets received only after the compromise time.
- Design: ANDaNA routes NDN traffic through ephemeral circuits formed by two distinct anonymizing routers from different administrative domains and name prefixes.The circuit uses an entry and exit router and carries only one or a few encrypted interests before disappearing after delivery or timeout.
- Security properties: Ephemeral circuits and NDN caches limit traffic-analysis attacks because circuits carry too little uniform traffic for delay correlation, predecessor, or throughput-fingerprinting attacks.The paper notes that successful throughput attacks on Tor require at least a few minutes of traffic, whereas ephemeral circuits transport only one or a very small number of interests and corresponding data.
- Limitations: ANDaNA remains susceptible to denial-of-service attacks as an open public overlay, although the paper reports that only a very small number of packets per user are dropped.Anyone can join the overlay, creating opportunities for malicious anonymizers and routers to inject, delay, alter, or drop traffic.
5 Security Analysis
The security analysis formalizes anonymity and unlinkability for ANDaNA under an adversarial model that includes compromised network entities and observed packets. It derives conditions for these properties and relates them to the use of two-router ephemeral circuits and NDN’s lack of source addresses.
- Results: ANDaNA achieves anonymity comparable to Tor with two rather than three anonymizing routers, benefiting from the absence of source addresses in NDN interests.The analysis defines consumer and producer anonymity and shows that these properties imply consumer–producer unlinkability under the stated model.
- Adversarial model: The adversary may compromise producers, consumers, routers, and interfaces, but the model assumes it cannot observe all producers and consumers simultaneously or correlate a non-compromised router’s input and output.The analysis explicitly incorporates network topology and packets exchanged over the underlying NDN infrastructure.
- Limitations: Because ANDaNA is designed for low-latency traffic without intentional delays or dummy packets, a global passive adversary can violate anonymity by observing both communication ends.The paper treats such an adversary as unrealistic for a geographically distributed network spanning multiple administrative domains.
- Cryptographic analysis: Without timing or other side channels, semantic security gives the adversary only negligible advantage over 1/2 when distinguishing encryptions of two same-length interests.This supports the assumption that encrypted interests cannot be distinguished based only on observed input and output values.
- Anonymity conditions: Consumer and producer anonymity hold when ephemeral circuits contain two anonymizing routers, with at least one router not compromised.The formal results connect these anonymity properties to unlinkability between consumers and producers.
6 Implementation and Performance
ANDaNA is implemented as an application-level NDN service and evaluated on reproducible testbed topologies against NDN and Tor baselines. Its relative overhead is lower than Tor for content up to 10MB, while absolute testbed download times favor Tor + TCP/IP.
- Implementation: The prototype uses client and server application programs, encrypted interests, NDN namespaces, and ephemeral circuits routed through access routers.Clients encrypt full interest packets, while servers run on NDN routers and manage relay and session-creation namespaces.
- Experimental setup: Experiments used exclusive-access Open Network Laboratory resources with single-core Linux machines, 512MB RAM, gigabit switches, and static line topologies.The evaluation compares relative overheads because NDN and TCP/IP differ in optimization, signature processing, and user-space versus kernel-space implementation.
- NDN comparison: ANDaNA roughly doubles download times over plain NDN under favorable assumptions of topologically aligned access routers and abundant link bandwidth.The 10MB comparison is summarized in Figure 1, using measurements from a four-switch line topology with 1, 10, and 100MB files.
- Performance comparison: 1.45× to 1.7× overhead makes the symmetric-encryption variant ANDaNA-S more efficient than the asymmetric variant for 1–10MB files.The comparison includes circuit setup and transfer time relative to each system’s baseline.
- Performance comparison: Tor’s download time is 2.3–7× higher than TCP/IP for small and medium transfers, whereas large transfers increase total time by about 1.4× with Tor versus 2.4× and 2.1× for ANDaNA variants.The paper attributes the large-file crossover to Tor’s greater efficiency for large transfers and reports ANDaNA’s advantage for traffic patterns typical of smaller content.
- Performance comparison: ANDaNA’s relative overhead is smaller than Tor’s for content up to 10MB, although Tor is faster in absolute download time on the testbed.Tor’s raw download times outperform ANDaNA + NDN in these experiments, while ANDaNA’s shorter circuits are expected to help in geographically distributed, bandwidth-limited deployments.
7 Conclusions and Future Work
The paper presents ANDaNA as an initial attempt to provide anonymity in NDN, combining privacy analysis, anonymization design, and security and performance assessment. It identifies several future-work directions, including broader experimentation, directory services, cryptographic trade-offs, DoS mitigation, red-teaming, and support for other content-centric architectures.
- The work contributes privacy-issue analysis for NDN, the ANDaNA anonymization tool, and its security and performance assessment.
- Future Work: Future experiments should evaluate ANDaNA in larger testbeds and under varied traffic loads and congestion scenarios to improve profiling and reduce overhead.
- Future Work: The paper calls for a comprehensive directory service to distribute up-to-date anonymizing-router information at scale.
- Future Work: Further work should study privacy and performance trade-offs between asymmetric and symmetric ANDaNA approaches.
- Future Work: Additional directions include computational puzzles for circuit-establishment DoS mitigation, red-teaming experiments, and comparisons across content-centric architectures.
A Security Proofs
The security appendix sketches reductions showing that indistinguishability conditions support consumer and producer anonymity under the stated adversarial model. The proofs use simulator constructions that would otherwise break the assumed CPA-secure encryption scheme.
- Consumer Anonymity: The reduction argues that an adversary distinguishing swapped consumer configurations could be transformed into a simulator violating the encryption security claim.
- Consumer Anonymity: The appendix proves consumer anonymity by showing that each condition in Theorem 5.1 implies indistinguishability of configurations involving different consumers.
- Adversarial Model: The proofs assume adversarial compromise of most entities while retaining selected users and routers outside the compromised set.
- Producer Anonymity: The producer-anonymity proof similarly relies on indistinguishability when content-producing roles are exchanged between configurations.
B Performance Evaluation: Additional Results
The additional performance results present round-trip times for transferring 1, 10, and 100 MB over NDN and ANDaNA.
- The figures compare round-trip time across 1, 10, and 100 MB transfers for NDN with limited anonymity and for ANDaNA.