Anonymity Mixes as (Partial) Assembly Queues: Modeling and Analysis
AAnonymity Mixes as (Partial) Assembly Queues:Modeling and Analysis
Mehmet Fatih Aktas¸ and Emina Soljanin
Department of Electrical and Computer Engineering, Rutgers UniversityEmail: { mehmet.aktas, emina.soljanin } @rutgers.edu Abstract —Anonymity platforms route the traffic over a net-work of special routers that are known as mixes and implementvarious traffic disruption techniques to hide the communicatingusers’ identities. Batch mixes in particular anonymize commu-nicating peers by allowing message exchange to take place onlyafter a sufficient number of messages (a batch) accumulate, thusintroducing delay. We introduce a queueing model for batch mixand study its delay properties. Our analysis shows that delay of abatch mix grows quickly as the batch size gets close to the numberof senders connected to the mix. We then propose a randomizedbatch mixing strategy and show that it achieves much betterdelay scaling in terms of the batch size. However, randomizationis shown to reduce the anonymity preserving capabilities of themix. We also observe that queueing models are particularly usefulto study anonymity metrics that are more practically relevantsuch as the time-to-deanonymize metric.
Index Terms —Chaum mixes, Delay analysis, Queueing Theory,Order statistics.
I. I
NTRODUCTION
In numerous circumstances, more than just the contentof a message has to be hidden from the adversary. Unlikecovertness which aims to deny that any communication istaking place [1]–[3], we consider the case where it is knownthat a group of peers communicate but it is desired to hidewho is communicating with whom [4]. It is well known thatidentities of peers communicating over a network can beidentified via rather simple network traffic analysis techniques[5]. Anonymity mixes were introduced by David Chaum in1980’s as a general framework for implementing anonymousmessage exchange [6]. They are sophisticated network routersthat pass messages such that no one (except the mix itself) canlink an ingoing message to an outgoing message. Today, someform of a mix is often a part of anonymity preserving solu-tions (e.g., PetMail, Mixminion, Panoramix) or data transferservices (e.g., Onion routing, Freenet).A mix typically collects messages and forwards them inbatches according to a fixed deterministic rule or a randomizedstrategy (see e.g., [7]–[9]). This allows hiding the origin ofthe outgoing messages, but also introduces delay in messagetransfer. The incurred delay of the mixes is the most concern-ing cost of anonymity they provide. For instance anonymousweb browsing platform ToR, which currently has more than2 million users, does not implement sophisticated mixing tokeep a low latency platform, even though it is shown to bevulnerable to deanonymization attacks based on network trafficanalysis [10]–[12]. Appropriate modeling of the mixes is crucial to studytheir delay vs. anonymity tradeoff. Stability conditions anddelay characteristics of a mix naturally depend on its systemparameters which also determine its anonymity preservingcapabilities. In this paper, we propose and study two queueingmodels for batch mixes that are designed and used againstpassive adversarial attacks. Note that, we do not consideractive attacks that involve traffic injection into the network,which have also been shown to successfully deanonymizeusers on popular anonymity platforms [12], [13].We propose a mix model that implements the well knowndeterministic batch mixing algorithm [7]. We observe the closeconnection of the model to assembly queues, which was usedto model and study the operational process of assemblingmultiple items into a product [14]. Using the proposed model,we find that batch mix provides a well defined anonymityguarantee that gets better with the batch size, on the otherhand, its incurred delay grows quickly as the batch size getsclose to the number of senders connected to the mix.Our study of the batch mix led us to consider a newrandomized mixing algorithm. We show that the randomizedmodel achieves better delay scaling in terms of the batchsize compared to its deterministic counterpart. However, itcan provably preserve anonymity only if the adversary cannot infer the state of the mix, and is in general vulnerable toanonymity attacks under low traffic.There are many measures of anonymity and privacy (see[15], [16]). We are here concerned with preserving unlinkabil-ity , which is ensuring that no sender/receiver pair is exposed.Our study shows that delay of the mix can be reduced bysacrificing some anonymity, which would eventually lead tocomplete deanonymization of all the sender-receiver pairs.However, message transfer sessions are of finite duration inpractice, and minimum amount of time required for an attackto destroy anonymity is a concern regardless of the anonymitymeasure. Previous papers that are concerned with the delay ofanonymity schemes ignore the queueing dynamics within themix (see e.g., [17], [18] and references therein). We believethat queueing models are necessary for studying the time-to-deanonymize metric, and this paper is a first step towardsunderstanding this metric.This paper is organized as follows. Sec. II-A describes thebatch mix model. Sec. II-B presents the anonymity guaranteeimplemented by a batch mix. Sec. III shows a stability criterionfor the batch mix and presents an approximate method for a r X i v : . [ c s . PF ] J u l locking queue 2, 4 Forwarding queue 1, 2, 4 Fig. 1: Illustration of a (4 , batch mix. As long as there areless than three non-empty queues, messages are blocked (Left).As soon as a message arrival forms a group of three non-emptyqueues, one message from each is dispatched (Right).analyzing its incurred delay. Sec. IV introduces a randomizedbatch mixing strategy, and discusses its anonymity and delayproperties. Sec. V gives a summary and conclusions.II. A B ATCH M IX AND ITS A NONYMITY
A. Mix Model
A batch mix has n senders connected, and buffers themessages incoming from each sender in a separate first-infirst-out queue with an infinite buffer space. As soon as any k ≥ queues become non-empty, one message from each isdispatched (see Fig. 1). The recipient sets of each sender areassumed to be disjoint and of at most size m .Each sender is assumed to generate an independent Poissonmessage traffic at rate λ . Delay added by the mix is assumedto come only from the message queueing time. We ignore anymessage reception or transmission delay. Definition 1. An ( n, k ) batch mix is a system of n first-infirst-out queues, each receiving messages from an independentPoisson process of rate λ . Messages are blocked as long as themix has less than k non-empty queues. As soon as k queuesbecome non-empty, one message from each is dispatched.B. Attack Model and Anonymity We assume that the adversary monitoring the traffic goingin and out of the mix can observe 1) who the sender of eachincoming message is and 2) who the recipient of each outgoingmessage is. Thus, if a message arrival triggers a messagedeparture, the adversary can identify the sender-receiver pair.His goal is to identify the receivers of a particular sender,which we refer to as the target sender .Forwarding messages in batches of size k prevents theadversary from immediately finding out the exact destinationof an incoming message, as it can be any of the k messagerecipients. However, the adversary can, over time, collect mul-tiple size- k receiver sets, each containing a potential recipientof the target sender. Intersecting such sets would eventuallyreveal the receivers linked to the target sender. We refer tosuch attacks as intersection attacks [19]. We say that the mix preserves anonymity, when it ensuresthat no sender/receiver pair is exposed, that is, no sender andreceiver can be linked. Theorem 1 (Anonymity under intersection attack) . Considera target sender connected to an ( n, k ) batch mix that is underintersection attacks. When k < n , all m receivers of the targetcan be identified if m ≤ (cid:98) n/k (cid:99) . All m receivers cannot beidentified surely otherwise.Proof. This theorem is a reformulation of [7, Claim 1]. Let ad-versary wait and observe m mutually disjoint sets R , . . . , R m of size k that include the possible receivers of Alice. These m sets can be disjoint only if km ≤ n . Adversary is thus sure thatthere is exactly one receiver of Alice in each observed recipientset R i . Afterwards, adversary refines each of these sets byobserving new recipient sets that intersect with only one ofthe prior sets. This means, a new recipient set R is useful if R ∩ R i (cid:54) = ∅ and R ∩ R j = ∅ for all j (cid:54) = i , then R i can be refinedto R ∩ R i . Note that if R intersects with multiple prior recipientsets, then refining all intersecting sets may remove the actualreceivers of Alice. The correct refinement process can becontinued until each of the sets R , . . . , R m contains onlyone receiver. Remaining m receivers in the refined recipientsets are clearly the communication partners of Alice.As described above, intersection attacks will surely identifyall receivers of a target only if adversary can observe m disjoint sets of size k . This is the only way for adversaryto isolate each receiver of the target in a separate set so that anewly observed set can be intersected with one of these sets correctly , that is, intersection will not surely end up removingthe true receiver from the set. When km > n , adversary cannever observe m disjoint sets of size k , hence can never surelyidentify all m receivers of the target.III. S TABILITY AND D ELAY
A batch mix consists of n FIFO queues, each bufferingmessages arriving from an i.i.d. Poisson process. A messagearrival triggers a batch departure if it finds k − other non-empty queues in the mix, and the arriving message departsimmediately with the batch. Therefore, there can be at most k − non-empty queues in the mix at any time. Since allthe queues and the associated arrival processes are identical,system state can be represented as the Markov process L ( t ) =( l ( t ) , . . . , l k − ( t )) where l i ( t ) denotes the length of the i thlongest queue in the system at time t .An ( n, n ) batch mix behaves as an assembly queue, foundto be unstable in [14]. Stability here refers to the existence ofan invariant probability measure for the system state process. Theorem 2. An ( n, k ) batch mix is stable if k < n .Proof. A Markov process is stable if and only if it is positiverecurrent. Given that transition rates of L ( t ) are neither too“slow” nor too “fast”, its positive recurrence is implied bythe positive recurrence of its embedded discrete chain S t . Wehere use the Foster-Lyapunov criterion to show the positiverecurrence of S t as interpreted from [20, Thm. 2].or system state s = ( s , . . . , s k − ) , let W ( s ) := s log ( n/n − k − . Recall that s k − = min { s i , i = 1 , . . . , k − } .Note that sup s W ( s ) = ∞ as required. One step drift forany state s ∈ { s, W ( s ) > } is E [ W ( S ) − W ( S ) | S = s ] < . and we have sup { s, W ( s ) ≤ } E [ S | S = s ] < < ∞ . Thus S t , hence L ( t ) is positive recurrent.There are three scenarios that a message can experience uponarrival to the mix: 1) If a message arrives to an empty queueand finds k − other non-empty queues in the mix, then it willimmediately depart with no queueing. 2) If a message arrivesto an empty queue and finds fewer than k − other non-emptyqueues in the mix, then it has to wait for a formation of k non-empty queues (i.e., a batch). 3) If a message arrives to anon-empty queue, it has to first wait to the HoL (head of theline) in its queue, and then wait for the next batch formation.In a tagged queue, batch formation delay experienced by amessage is completely characterized by the number of non-empty queues R (excluding the tagged queue) seen by themessage once it moves to HoL. If R < k − , message willbe blocked until any k − − R of the n − − R emptyqueues receive at least a message. Using the memorylessproperty of message inter-arrival times, batch formation delayis distributed as the ( k − − R ) th order statistic of n − − R i.i.d. exponentials, which we denote as X n − − R : k − − R .Overall, a message moving to HoL may find from up to k − other non-empty queues, hence there are k possibledifferent distributions for the batch formation delay.When k = 2 , system state is just the longest queue lengthand defines a birth-death process. Exact analysis is formidablewhen k > because of the infamous state space explosionproblem. We first present the exact analysis for k = 2 , thenpresent an approximate method for k > , which is similar toan approximation presented for assembly queues in [21]. A. Exact analysis of ( n, -mix In ( n, -mix for n > , there can be at most one non-empty queue at any time, hence the system state is capturedby the length of the longest queue L ( t ) . It defines a singledimensional birth-death Markov process as shown in Fig. 3.Exact analysis in this case is straightforward. Let p l bethe stationary probability for state l . From global balanceequations we find p = n − n − p l = n ( n − n − i +1 ; l = 1 , , . . . Ergodicity implies that fraction of the time an arbitrary queueis non-empty (i.e., average load on the queue) is ρ = (1 − X i : j := 0 if i < j or j = 0 . p ) /n = 1 / n − . Larger n gives higher frequency ofemptiness at the servers, which is natural since queues emptyout faster when the mix receives messages at a higher rate.Using the stationary state probabilities, first two momentsof the length of an arbitrary queue are given as E [ L ] = 1 n ∞ (cid:88) l =1 l p l = 12( n − E [ L ] = 1 n ∞ (cid:88) l =1 l p l = n n − We next derive some simple conclusions for the steady statedelay experienced by an arriving message. Using PASTA [22],an arbitrary message finds the system empty with probability p and will have to wait for the first arrival to one ofthe other n − queues. Since arrivals are Poisson, waitingtime distribution for the message is minimum of n − λ ) ’s, that is Exp (( n − λ ) . An arriving message mayfind its corresponding queue with l messages with probability p l /n . In this case, waiting time distribution for the messageis sum of l + 1 independent Exp (( n − λ ) ’s, which is Erlang ( l + 1 , ( n − λ ) . Finally, it may also find its corre-sponding queue empty with probability p l ( n − /n if thereis another queue with l messages. Then the message will notbe queued and will depart immediately upon arrival togetherwith the first message in the busy queue. Using the law oftotal probability, distribution of waiting time D for an arbitrarymessage is then given as Pr { D > w } = p Pr { Exp (( n − λ ) > w } + 1 n ∞ (cid:88) l =1 p l Pr { Erlang ( l + 1 , ( n − λ ) > w } . B. Approximate analysis of ( n, k > -mix We here adopt the following approximating assumption;a message upon moving to head of the line (HoL) in itsqueue finds each other queue independently non-empty withprobability p . Given that, and the fact that there can be atmost k − non-empty queues at any time, the number of non-empty queues seen by a message moving to HoL is distributedas R ∼ B |{ B ≤ k − } where B ∼ Binom( n − , p ) . Given R = r , message will have to wait before getting dispatched forthe first k − − r among all the n − − r empty queues to receiveat least one arrival, that is, the message will experience a batchformation delay of V |{ R = r } ∼ X n − − r : k − − r . Then V foran arbitrary message, which arrives to a non-empty queue inthe first place , is approximately distributed as Pr { V ≤ v } = E R [Pr { X n − − R : k − − R ≤ v } ] , (1)where E R denotes expectation with respect to R .Batch formation delay for messages that arrive to an emptyqueue is differently distributed (than V above) because theyfind each other queue non-empty with a different probabilitythan messages that arrive to a non-empty queue. Let a taggedqueue be left empty by a departing message m . If the queuewas left non-empty, the next message in line would have k A v e r a g e d e l a y Batch mix, n = 40, λ = 1 SimulationM/G/1/efs approximation 0.25 0.50 0.75 1.00 1.25 1.50 1.75 2.00 λ A v e r a g e d e l a y Batch mix, n = 40 k =10, Simulation k =10, M/G/1/efs approximation k =20, Simulation k =20, M/G/1/efs approximation 10 20 30 40 k A v e r a g e d e l a y n = 40, λ = 1 Batch mixSampling mix
Fig. 2: (Left, Middle) Average delay in a batch mix with n = 40 ; Left: fixed λ and varying k , Middle: fixed k and varying λ .(Right) Comparison between the average delay in a batch mix and in a sampling mix with p a = 1 /n . nλ ( n − ) λ λ ( n − ) λ λ ( n − ) λ · · · Fig. 3: Markov process for ( n, -mix. State here denotes thelength of the longest queue in the mix; length means thesystem is empty.immediately moved to HoL. Then according to our earlierassumption, the number of non-empty queues left behind non-empty by m is distributed as R . Including the next arrival tothe tagged queue, say message m + , the next batch formationrequires k − R of the n − R empty queues to receive at leastan arrival. Given that m + is among these first k − R arrivalsand messages are generated from i.i.d. streams, probability that m + is the j th among the k − R arrivals is / ( k − R ) . Thus,batch formation delay experienced by a message arriving toan empty queue is approximately distributed as Pr { V e ≤ v } = E R k − R (cid:88) j =1 Pr { X n − R − j : k − R − j ≤ v } k − R . (2) Proposition 1 (Approximation by decoupling the queues) . An ( n, k ) batch mix approximately behaves to each sender as an M/G/ / efs queue with regular service times distributed as (1) and exceptional first service times distributed as (2) . Approximation requires estimating p , for which a naturalestimate would be the average load ρ for a queue, which isknown for an M/G/ / efs queue to be [23] ρ = λ E [ V e ]1 − λ ( E [ V ] − E [ V e ]) . Moments of V and V e depend on p , hence on its estimate ρ . The equality above can be solved numerically to find avalue for ρ . Simulated and approximated values of delay arecompared in Fig. 2 for a (40 , k ) batch mix. Despite thestrong independence assumptions employed in deriving theapproximation, it compares well with the simulations for low values of k , which is the practically relevant case since theincurred delay must be kept below a threshold in practice.IV. S AMPLING MIX
A sampling mix also implements an ( n, k ) model; mixbuffers the messages from each of the n connected sendersin a separate FIFO queue and each sender communicateswith a disjoint set of at most m receivers. However, bufferedmessages are forwarded differently compared to batch mix; assoon as a message arrives to the mix, k queues are randomlyselected and released. Releasing a queue allows it to forwarda message if it is non-empty. Specifically with probability p a ,the queue that receives the arrival is selected together with k − queues chosen uniformly at random from the remaining n − queues, or with probability − p a , the queue that receivesthe arrival is skipped and k queues are selected uniformly atrandom from the rest of the queues. Theorem 3.
Average load of a queue in an ( n, k ) samplingmix is given as ρ = (1 − p a ) / ( k − p a ) and the average delay experienced by a message is given as (1 − p a ) /λ ( k − . Proof.
The length of a particular queue in the mix defines abirth-death process with a state space of non-negative integersand transition rates given for i ≥ as Pr { i → i + 1 } = λ (1 − p a ) , Pr { i + 1 → i } = ( n − λp o , where p o = p a ( k − / ( n −
1) + (1 − p a ) k/ ( n − . Stationarystate probabilities are easily derived, using which averagelength of a queue is found, then Little’s law is applied.As shown in Fig. 2, average delay of a sampling mix scalesmuch better with k (i.e., decays as / ( k − ) comparedto a batch mix (i.e., grows exponentially in k beyond avalue). However, a sampling mix cannot provide a well-definedanonymity guarantee while a batch mix can (see Thm. 1). Theorem 4.
All receivers of a target sender connected to asampling mix can be identified with intersection attacks by anadversary that can infer the state of the mix.roof.
Queues in the mix will empty out infinite number oftimes under stability. Suppose that the adversary can detectwhenever the mix becomes empty. Firstly, assume p (cid:54) = 0 .Given that a message from a target finds the mix empty,the arriving message will be forwarded with probability p or no message will depart. If the message is immediatelyforwarded, a receiver of the target will revealed. Number oftimes repeating this attack required to identify a receiver isgeometric with p , hence attack will be almost surely successfulin finite time.Secondly, assume p (cid:54) = 0 . Given that a message from a targetfinds more than one non-empty queue in the mix, the followingdeparture may include messages going only to the receivers ofthe non-target senders. This reveals which receiver does notbelong to the recipient set of the target. Eventually adversarywill be left with the correct set of receivers.Sampling mix will empty out more frequently and cannotoften build a state complex enough to hide the origin ofthe outgoing messages when k is larger and/or arrival rate λ is lower, hence intersection attacks with state knowledgewill resolve faster. Moreover, even simple intersection attacksthat do not require state knowledge can deanonymize a targetconnected to a sampling mix if p a is not chosen carefully. Theorem 5.
All receivers of a target sender connected to an ( n, k ) sampling mix with p a (cid:54) = 1 /n can be identified withintersection attacks that do not require state knowledge.Proof. Once a message arrives to a queue in steady state,probability of a departure from any other queue is q = p o ρ =(1 − p a ) / ( n − . Suppose m = 1 and p a > q ( p a < q ).Adversary can record the message departures per arrival froma target sender. By the law of large numbers, the greatest(smallest) number of departures will almost surely be observedon the correct receiver in the limit. Same idea applies wheneach sender communicates with multiple receivers. Finally, p a = q if and only if p a = 1 /n .In other words, in order to preserve anonymity, it is nec-essary to maximize the uncertainty within the steady stateprobabilities of message departures from the queues. R´enyientropy is commonly used for measuring uncertainty and uni-form distribution is known to maximize it, which is achievedby setting p a = 1 /n . V. C ONCLUSION
We proposed a queueing model for batch anonymity mixesand showed that batch a mix with a deterministic message dis-patching policy ensures that no sender-receiver pair is exposed(referred to as anonymity in this paper) under intersectionattacks. On the other hand, its incurred delay on messagetransfer grows quickly as the batch size gets close to thenumber of connected senders. We introduced a sampling mixmodel that implements a randomized message dispatchingpolicy. Sampling mix permits an exact delay analysis, whichallowed us to show that randomization allows cutting thetail of delay immensely, however, at the cost of giving up on the anonymity guarantee implemented by its deterministiccounterpart. We hope to next use our proposed queueing modelto understand the performance of mixes in terms of the time-to-deanonymize metric vs. the incurred message transfer delay.A
CKNOWLEDGMENTS
This research is based upon work supported by the NationalScience Foundation under Grant No. SaTC-1816404.R
EFERENCES[1] S. Kadhe, S. Jaggi, M. Bakshi, and A. Sprintson, “Reliable, deniable,and hidable communication over multipath networks,” in . IEEE, 2014, pp. 611–615.[2] B. A. Bash, D. Goeckel, D. Towsley, and S. Guha, “Hiding informationin noise: Fundamental limits of covert wireless communication,”
IEEECommunications Magazine , vol. 53, no. 12, pp. 26–31, 2015.[3] M. R. Bloch, “Covert communication over noisy channels: A resolv-ability perspective,”
IEEE Transactions on Information Theory , vol. 62,no. 5, pp. 2334–2354, 2016.[4] I. Safaka, L. Czap, K. Argyraki, and C. Fragouli, “Towards unconditionaltor-like anonymity,” in
The 2015 IEEE International Sumposium onNetwork Coding (NetCod)-Invited Paper , 2015.[5] A. Pfitzmann and M. Waidner, “Networks without user observability- design options,” in
Workshop on the Theory and Application ofCryptographic Techniques . Springer, 1985, pp. 245–253.[6] D. L. Chaum, “Untraceable electronic mail, return addresses, and digitalpseudonyms,”
Commun. of the ACM , vol. 24, no. 2, pp. 84–90, 1981.[7] D. Kesdogan, D. Agrawal, and S. Penz, “Limits of anonymity in openenvironments,” in
Information Hiding . Springer, 2002, pp. 53–69.[8] O. Berthold and H. Langos, “Dummy traffic against long term in-tersection attacks,” in
International Workshop on Privacy EnhancingTechnologies . Springer, 2002, pp. 110–128.[9] C. Dıaz and A. Serjantov, “Generalising mixes,” in
PET . Springer,2003, pp. 18–31.[10] R. Dingledine, N. Mathewson, and P. Syverson, “Challenges in deploy-ing low-latency anonymity (draft),”
Unpublished Manuscript. http://tor.eff. org/cvs/tor/doc/design-paper/challenges. pdf , 2005.[11] ——, “Deploying low-latency anonymity: Design challenges and socialfactors,”
IEEE Security & Privacy , 2007.[12] S. Chakravarty, M. V. Barbera, G. Portokalidis, M. Polychronakis,and A. D. Keromytis, “On the effectiveness of traffic analysis againstanonymity networks using flow records.” in
PAM . Springer, 2014.[13] S. Murdoch and P. Zieli´nski, “Sampled traffic analysis by internet-exchange-level adversaries,” in
Privacy Enhancing Technologies .Springer, 2007, pp. 167–183.[14] J. M. Harrison, “Assembly-like queues,”
Journal of Applied Probability ,vol. 10, no. 2, pp. 354–367, 1973.[15] A. Pfitzmann and M. Hansen, “Anonymity, unlinkability, unobservabil-ity, pseudonymity, and identity management,”
Technical report , 2005.[16] I. Issa, S. Kamath, and A. B. Wagner, “An operational measure ofinformation leakage,” in
Information Science and Systems (CISS), 2016Annual Conference on . IEEE, 2016, pp. 234–239.[17] O. Javidbakht and P. Venkitasubramaniam, “Delay anonymity tradeoff inmix networks: Optimal routing,”
IEEE/ACM Transactions on Network-ing (TON) , vol. 25, no. 2, pp. 1162–1175, 2017.[18] P. Venkitasubramaniam and L. Tong, “Anonymous networking withminimum latency in multihop networks,” in . IEEE, 2008, pp. 18–32.[19] M. K. Wright, M. Adler, B. N. Levine, and C. Shields, “An analysis ofthe degradation of anonymous protocols.” in
NDSS , 2002, pp. 39–50.[20] S. Foss and T. Konstantopoulos, “An overview of some stochasticstability methods,”
J. of the Operations Research Society of Japan , 2004.[21] E. Lipper and B. Sengupta, “Assembly-like queues with finite capacity:bounds, asymptotics and approximations,”
Queueing Systems , 1986.[22] R. W. Wolff, “Poisson arrivals see time averages,”
Operations Research ,vol. 30, no. 2, pp. 223–231, 1982.[23] P. D. Welch, “On a generalized m/g/1 queuing process in which the firstcustomer of each busy period receives exceptional service,”