Probabilistic and nondeterministic aspects of Anonymity 1

Transcription

1 MFPS XX1 Preliminary Version Probabilisti and nondeterministi aspets of Anonymity 1 Catusia Palamidessi 2 INRIA and LIX Éole Polytehnique, Rue de Salay, Palaiseau Cedex, FRANCE Abstrat Anonymity means that the identity of the user performing a ertain ation is maintained seret. The protools for ensuring anonymity often use random mehanisms whih an be desribed probabilistially. The user, on the other hand, may be seleted either nondeterministially or probabilistially. We investigate various notions of anonymity, at different levels of strength, for both the ases of probabilisti and nondeterministi users. Key words: Anonymity, Probabilisti Automata, onditional probability. 1 Introdution Anonymity is the property of keeping seret the identity of the user performing a ertain ation. The need for anonymity may raise in a wide range of situations, like postings on eletroni forums, voting, delation, donations, and many others. The protools for ensuring anonymity often use random mehanisms whih an be desribed probabilistially. This is the ase, for example, of the Dining Cryptographers [3], Crowds [7], and Onion Routing [12]. In ontrast, we usually don t know anything about the users, so their behavior, and in partiular, the hoie of the user who performs the ation with respet to whih we want to ensure anonymity, should better be regarded as nondeterministi. (The same would hold for adversaries, although in this paper we do not onsider them.) The whole system onstituted by the protool and the users presents therefore both probabilisti and nondeterministi aspets. 1 This work has been partially supported by the Projet Rossignol of the ACI Séurité Informatique (Ministère de la reherhe et nouvelles tehnologies). 2 atusia@lix.polytehnique.fr This is a preliminary version. The final version will be published in Eletroni Notes in Theoretial Computer Siene URL:

2 Various formal definitions and frameworks for analyzing anonymity have been developed in literature. They an be lassified into approahes based on proess-aluli [9,8], epistemi logi [11,5], and funtion views [6]. From the point of view of the onepts of probability and nondeterminism, however, all these approahes are either purely nondeterministi (also known as possibilisti) or purely probabilisti. The purely nondeterministi approah in [9,8] is based on the so-alled priniple of onfusion : a system is anonymous if the set of the possible outomes is saturated with respet to the intended anonymous users, i.e. if one suh user an ause a ertain observable trae in one possible omputation, then there must be alternative omputations in whih eah other anonymous user an give rise to the same observable trae (modulo the identity of the anonymous users). The purely probabilisti proposals an be lassified under two different points of view: those whih fous on the probability of the users, and those whih fous on the effet that the observables have on the probability of the users. The distintion is subtle but fundamental. In the fist ase, anonymity holds when (an observer knows that) all users have the same probability of having performed the ation (fr. strong probabilisti anonymity in [5]). In the seond ase, it holds when the for any user i and any observable o the onditional probability that i has performed the ation, given the observable, is the same as the (a priory) probability that the user has performed the ation (fr. the informal notion used in [3], and the onditional probabilisti anonymity in [5]). The probabilisti approah also brings naturally to differentiate the notion of anonymity with respet to different levels of strength. Reiter and Robin [7] have proposed the following hierarhy: Beyond suspiion The atual user (i.e. the user that performed the ation) is not more likely (to have performed the ation) than every other user. Probable innoene The atual user has probability less than. Possible innoene There is a non trivial probability that another used ould have performed the ation. These notions were only given informally in [7], and it is unlear to us whether the authors had in mind the first or the seond of the points of view desribed above. On one hand, if we interpret the informal definitions literally, they orrespond to the first point of view. This is the interpretation given by Halpern and O Neill in [5]: they haraterize probable innoene and possible innoene with the notion of (probabilisti) α-anonymity, and beyond suspiion with their notion of strong probabilisti anonymity. On the other hand, the result of probable innoene proved in [7] for Crowds does not seem to fit with this interpretation, while it ould fit with a suitable weakening of the anonymity notion illustrated above under the seond perspetive (i.e. what Halpern and O Neill all onditional probabilisti anonymity). 2

3 In this work we assume that the users may be nondeterministi, i.e. that nothing may be known about the relative frequeny by whih eah user perform the anonymous ation. More preisely, the users an in priniple be totally unpreditable and hange intention every time, so that their behavior annot be thought of as probabilisti 3. The internal mehanisms of the systems, on the ontrary, like oin tossing in the dining philosophers, or the random seletion of a nearby node in Crowds, are supposed to exhibit a ertain regularity and obey a probabilisti distribution. Correspondingly, we explore a notion of probabilisti anonymity that fouses on the internal mehanism of the system, i.e. their non-leakage of probabilisti information, and it is in a sense independent from the users in ase they are nondeterministi. The ounterpart of our definition in the ase the users are probabilisti (with possibly unknown probabilities), an be shown to orrespond to a generalized version of Halpern and O Neill s onditional probabilisti anonymity, where generalized here means that the anonymity holds for any probability distribution to the users. This abstrat is based on the ongoing work reported in [1], [4] and [2]. 2 Nondeterminism and probability In our approah we onsider systems that an perform both probabilisti and nondeterministi hoie. Intuitively, a probabilisti hoie represents a set of alternative transitions, eah of them assoiated to a ertain probability of being seleted. The sum of all probabilities on the alternatives of the hoie must be 1, i.e. they form a probability distribution. Nondeterministi hoie is also a set of alternatives, but we have no information on how likely one alternative is seleted. There have been many models proposed in literature that ombine both nondeterministi and probabilisti hoie. One of the most general is the formalism of probabilisti automata proposed in [10]. We give here a brief and informal desription of it. A probabilisti automaton onsists in a set of states, and labeled transitions between them. For eah node, the outgoing transitions are partitioned in groups alled steps. Eah step represents a probabilisti hoie, while the hoie between the steps is nondeterministi. Figure 1 illustrates some examples of probabilisti automata. We represent a step by putting an ar aross the member transitions. For instane, in (a), 3 In the areas of onurreny theory there has been a long-standing disussion on whether nondetermistism an be thought of as a situation in whih the probabilities are unknown and an hange very time the experiment is repeated. Nowadays the prevailing opinion, whih we share, is that nondetermistism and probability are fundamentally different onepts. Furthermore, in the formalisms used in onurreny (for instane proess algebras) the differene is lear, as these two onepts (nondeterminism and unknown hanging probability) obey different laws. 3

4 s 2 a s 3 b s 1 s 1 s 1 a 2/3 1/3 s 4 s 5 b a b a b 1/3 1/6 a a s 6 s 7 s 8 (a) (b) () Fig. 1. Examples of probabilisti automata state s 1 has two steps, the first is a probabilisti hoie between two transitions with labels a and b, eah with probability. When there is only a transition in a step, like the one from state s 3 to state s 6, the probability is of ourse 1 and we omit it. In this paper, we use only a simplified kind of automaton, in whih from eah node we have either a probabilisti hoie or a nondeterministi hoie (more preisely, either one step or a set of singleton steps), like in (b). In the partiular ase that the hoies are all probabilisti, like in (), the automaton is alled fully probabilisti. Given an automaton M, we denote by etree(m) its unfolding, i.e. the tree of all possible exeutions of M (in Figure 1 the automata oinide with their unfolding beause there is no loop). If M is fully probabilisti, then eah exeution (maximal branh) of etree(m) has a probability obtained as the produt of the probability of the edges along the branh. In the finite ase, we an define a probability measure for eah set of exeutions, alled event, by summing up the probabilities of the elements 4. Given an event x, we will denote by p(x) the probability of x. For instane, let the event be the set of all omputations in whih ours. In () its probability is p() = 1/3 + 1/6 = 1/3. When nondeterminism is present, the probability an vary, depending on how we resolve the nondeterminism. In other words we need to onsider a funtion ς that, eah time there is a hoie between different steps, selets one of them. By pruning the non-seleted steps, we obtain a fully probabilisti exeution tree etree(m, ς) on whih we an define the probability as before. For historial reasons (i.e. sine nondeterminism typially arises from the parallel operator), the funtion ς is alled sheduler. It should then be lear that the probability of an event is relative to the partiular sheduler. We will denote by p ς (x) the probability of the event x under the sheduler ς. For example, onsider (a). We have two possible 4 In the infinite ase things are more ompliated: we annot define a probability measure for all sets of exeution, and we need to onsider as event spae the σ-field generated by the ones of etree(m). However, in this paper, we onsider only the finite ase. 4

5 shedulers determined by the hoie of the step in s 1. Under one sheduler, the probability of is. Under the other, it is 2/3 + 1/3 = 2/3. In (b) we have three possible shedulers under whih the probability of is 0, and 1, respetively. 3 Anonymity systems We model the anonymity protool as a probabilisti automaton M. The onept of anonymity is relative to the set of anonymous users and to what is visible to the observer. Hene, following [9,8] we lassify the ations of M into the three sets A, B and C as follows: A is the set of the anonymous ations A = {a(i) i I} where I is the set of the identities of the anonymous users and a is an injetive funtions from I to the set of ations, whih we all abstrat ation. We also all the pair (I, a) anonymous ation generator. B is the set of the observable ations. We will use b, b,...to denote the elements of this set. C is the set of the remaining ations (whih are unobservable). Note that the ations in A normally are not visible to the observer, or at least, not for the part that depends on the identity i. However, for the purpose of defining and verifying anonymity we model the elements of A as visible outomes of the system. Definition 3.1 An anonymity system is a tuple (M, I, a, B,Z,p), where M is a probabilisti automaton, (I, a) is an anonymous ation generator, B is a set of observable ations, Z is the set of all possible shedulers for M, and for every ς Z, p ς is the probability measure on the event spae generated by etree(m, ς). For simpliity, we assume the users to be the only possible soure of nondeterminism in the system. If they are probabilisti, then the system is fully probabilisti, hene Z is a singleton and we omit it. We introdue the following notation to represent the events of interest: a(i) : all the exeutions in etree(m, ς) ontaining the ation a(i); a : all the exeutions in etree(m, ς) ontaining an ation a(i) for an arbitrary i; o : all the exeutions in etree(m, ς) ontaining as their maximal sequene of observable ations the sequene o (where o is of the form b 1 b 2... b n for some b 1, b 2,...,b n B). We denote by O (observables) the set of all suh o s. We use the symbols, and to represent the union, the intersetion, and the omplement of events, respetively. 5

6 We wish to keep the notion of observables as general as possible, but we still need to make some assumptions on them. First, we want the observables to be disjoint events. Seond, they must over all possible outomes. Third, an observable o must indiate unambiguously whether a has taken plae or not, i.e. it either implies a, or it implies a. In set-theoreti terms it means that either o is a subset of a or of the omplement of a. Formally: Assumption 1 (on the observables) (i) ς Z. o 1, o 2 O. o 1 o 2 p ς (o 1 o 2 ) = p ς (o 1 ) + p ς (o 2 ) (ii) ς Z. p ς (O) = 1 (iii) ς Z. o O. (p ς (o a) = p ς (o)) p ς (o a) = p ς (o) Analogously, we need to make some assumption on the anonymous ations. We onsider first the onditions tailored for the nondeterministi users: eah sheduler determines ompletely whether an ation of the form a(i) takes plae or not, and in the positive ase, there is only one suh i. Formally: Assumption 2 (on the anonymous ations, for nondeterministi users) ς Z. p ς (a) = 0 ( i I. (p ς (a(i)) = 1 j I. j i p ς (a(j)) = 0)) We now onsider the ase in whih the users are fully probabilisti. The assumption on the anonymous ations in this ase is muh weaker: we only require that there be at most one user that performs a, i.e. a(i) and a(j) must be disjoint for i j. Formally: Assumption 3 (on the anonymous ations, for probabilisti users) i, j I. i j p(a(i) a(j)) = p(a(i)) + p(a(j)) 4 Strong probabilisti anonymity In this setion we reall the notion of strong anonymity proposed in [1]. Let us first assume that the users are nondeterministi. Intuitively, a system is strongly anonymous if, given two shedulers ς and ϑ that both hoose a (say a(i) and a(j), respetively), it is not possible to detet from the probabilisti measure of the observables whether the sheduler has been ς or ϑ (i.e. whether the seleted user was i or j). Definition 4.1 anonymous if A system (M, I, a, B,Z,p) with nondeterministi users is ς, ϑ Z. o O. p ς (a) = p ϑ (a) = 1 p ς (o) = p ϑ (o) The probabilisti ounterpart of Definition 4.1 an be formalized using the onept of onditional probability. Reall that, given two events x and y with p(y) > 0, the onditional probability of x given y, denoted by p(x y), is equal to p(x y)/p(y). 6

7 A system (M, I, a, B, p) with probabilisti users is anony- Definition 4.2 mous if i, j I. o O. (p(a(i)) > 0 p(a(j)) > 0) p(o a(i)) = p(o a(j)) The notions of anonymity illustrated so far fous on the probability of the observables. More preisely, it requires the probability of the observables to be independent from the seleted user. In [1] it was shown that Definition 4.2 is equivalent to the notion adopted impliitly in [3], and alled onditional anonymity in [5]. As illustrated in the introdution, the idea of this notion is that a system is anonymous if the observations do not hange the probability of the a(i) s. In other words, we may know the probability of a(i) by some means external to the system, but the system should not inrease our knowledge about it. A system (M, I, a, B, p) with probabilisti users is anony- Proposition 4.3 mous if i I. o O. p(o a) > 0 p(a(i) o) = p(a(i) a) The notions of strong anonymity proposed in this setion have been verified in [1] on the example of the Dining Cryptographers with perfetly fair oins. 4.1 Independene from the probability distribution of the users One important property of Definition 4.2 is that it is independent from the probability distribution of the users. Intuitively, this is due to the fat that the ondition of anonymity implies that p(o a(i)) = p(o)/p(a), hene it is independent from p(a(i)). Theorem 4.4 If (M, I, a, B,p) is anonymous (aording to Definition 4.2) then for any p whih differs from p only on the a(i) s, (M, I, a, B,p ) is anonymous. Also the haraterization of anonymity given in Proposition 4.3 is (obviously) independent from the probability distribution of the users. It should be remarked, however, that their orrespondene with Definition 4.2, and the property of independene from the probability of the users, only holds under the hypothesis that there is at most one agent performing a. (Assumption 3.) 5 Weak probabilisti anonymity The notion of anonymity proposed in previous setion is very strong as it imply the system to leak no information. In reality, some amount of probabilisti information may be revealed by the protool. Typial auses may be either the presene of attakers whih interfere with the normal exeution the protool, or some unavoidable imperfetion of the internal mehanisms, or may even 7

8 be inherent to the way the protool is designed. In any ase, the information leaked by the system an be used by an observer to infer the likeliness that the ation has been performed by a ertain user. In [4] we have proposed the following weak variants of Definition 4.1, Definition 4.2, and of the notion expressed in Proposition 4.3. Let us onsider first the ase of nondeterministi users: Definition 5.1 Given α [0, 1], a system (M, I, a, B, Z, p) with nondeterministi users is α-anonymous if max{ p ς (o) p ϑ (o) ς, ϑ Z, o O, p ς (o a) = p ς (o), p ϑ (o a) = p ϑ (o)} = α Intuitively, p ς (o) p ϑ (o) = α means that, whenever we observe o, we suspet that user i is more likely than user j to have performed the ation by an additive fator α (where i and j represent the users seleted by ς and ϑ, respetively). Let us now onsider the ase of probabilisti users. The weak version of Definition 4.2, is the following: Definition 5.2 Given α [0, 1], a system (M, I, a, B, p) with probabilisti users is α-anonymous if max{ p(o a(i)) p(o a(j)) i, j I, o O, p(a(i)) > 0, p(a(j)) > 0 } = α An alternative notion of weak anonymity for probabilisti users an be obtained by weakening the formula in Proposition 4.3. Definition 5.3 Given α [0, 1], a system (M, I, a, B, p) with probabilisti users is α-anonymous if max{ p(a(i) o) p(a(i) a) i I, o O, p(o a) > 0} = α Intuitively, p(a(i) o) p(a(i) a) = α means that, after observing o, the probability we attribute to i as the performer of the ation, has inreased by an additive fator α. Differently from their strong version, Definitions 5.2 and Definitions 5.3 are not equivalent. The notions of weak anonymity proposed in this setion have been tested in [4] on the example of the Dining Cryptographers with biased oins. In [2] it has been proved that a slight variant of Definitions 5.2 and 5.3 orrespond, with α =, to the property proved in [7] for the system Crowds (and alled, still in [7], probable innoene). Referenes [1] Mohit Bhargava and Catusia Palamidessi. Probabilisti anonymity. Tehnial report, INRIA Futurs and LIX, Submitted for publiation. 8

9 [2] Kostantinos Chatzikokolakis and Catusia Palamidessi. Probable innoene revisited. Tehnial report, INRIA Futurs and LIX, [3] David Chaum. The dining ryptographers problem: Unonditional sender and reipient untraeability. Journal of Cryptology, 1:65 75, [4] Yuxin Deng, Catusia Palamidessi, and Jun Pang. Weak probabilisti anonymity. Tehnial report, INRIA Futurs and LIX, Submitted for publiation. [5] Joseph Y. Halpern and Kevin R. O Neill. Anonymity and information hiding in multiagent systems. In Pro. of the 16th IEEE Computer Seurity Foundations Workshop, pages 75 88, [6] Domini Hughes and Vitaly Shmatikov. Information hiding, anonymity and privay: a modular approah. Journal of Computer Seurity, 12(1):3 36, [7] Mihael K. Reiter and Aviel D. Rubin. Crowds: anonymity for Web transations. ACM Transations on Information and System Seurity, 1(1):66 92, [8] Peter Y. Ryan and Steve Shneider. Modelling and Analysis of Seurity Protools. Addison-Wesley, [9] Steve Shneider and Abraham Sidiropoulos. CSP and anonymity. In Pro. of the European Symposium on Researh in Computer Seurity (ESORICS), volume 1146 of Leture Notes in Computer Siene, pages Springer- Verlag, [10] Roberto Segala and Nany Lynh. Probabilisti simulations for probabilisti proesses. Nordi Journal of Computing, 2(2): , An extended abstrat appeared in Proeedings of CONCUR 94, LNCS 836: [11] Paul F. Syverson and Stuart G. Stubblebine. Group prinipals and the formalization of anonymity. In World Congress on Formal Methods (1), pages , [12] P.F. Syverson, D.M. Goldshlag, and M.G. Reed. Anonymous onnetions and onion routing. In IEEE Symposium on Seurity and Privay, pages 44 54, Oakland, California,