Oliver Berthold

Web MIXes: a system for anonymous and unobservable Internet access

We present the architecture, design issues and functions of a MIX-based system for anonymous and unobservable real-time Internet access. This system prevents traffic analysis as well as flooding attacks. The core technologies include an adaptive, anonymous, time/volume-sliced channel mechanism and a ticket-based authentication mechanism. The system also provides an interface to inform anonymous users about their level of anonymity and unobservability.

Project “anonymity and unobservability in the Internet”

It is a hard problem to achieve anonymity for real-time services in the Internet (e.g. Web access). All existing concepts fail when we assume a very strong attacker model (i.e. an attacker is able to observe all communication links). We also show that these attacks are real- world attacks. This paper outlines alternative models which mostly render these attacks useless. Our present work tries to increase the efficiency of these measures.

Identity management based on P3P

Identity management is a powerful mechanism to enhance user-privacy. In this paper we will examine the idea of an identity management system built atop of an anonymous-communication network. First, we will develop some basic approaches to realize identity management, and we will introduce the Platform for Privacy Preferences Project (P3P) as a standard for exchanging personal data in the World Wide Web. After discussing the feasibility of using P3P as a basis, we will outline some possibilities for designing an identity management system using P3P. For this purpose, other building blocks, especially considering the representation of different kinds of pseudonyms as the core of an identity management system, are described. Finally, we will sketch possible future developments of identity managers.

RFID: Verbraucherängste und verbraucherschutz

RFID introduction is a hotly debated public policy issue. The technology enables physical environments to become more interactive and supportive by tagging each item with a chip that wirelessly communicates with a service-enriched backend infrastructure. Based on a number of user studies at Humboldt-Universität and at the Auto-ID Center, this article presents the major fears associated with RFID introduction. We show to what extent these fears are justified and derive a number of system requirements for giving users more control over an RFID-enabled IT infrastructure. After presenting several recent technical proposals for privacy protection, we focus on the question of controlled access to RFID tags. We conclude with a proposal for an easy-to-use private password model.

Maintaining Privacy in RFID Enabled Environments

The presence of RFID technology in every-day life is expected to become a reality in the near future. Yet, as RFID tags enter consumer households and threaten to identify their owners’ belongings, whereabouts and habits concerns arise about the maintenance of privacy. People are afraid of being’ scanned’ or tracked with the help of a technology that is invisible to them and not under their control. To address this consumer concern standardization bodies such as the Auto-ID Center have proposed to integrate a kill functionality into RFID tags. The present article argues that killing tags at the store exit is, however, not a viable long-term strategy to ensure default privacy. Too many business models and services are already in the pipeline to use RFID functionality after a purchase has taken place. Economic interest and consumer benefits risk undermining widespread tag killing. As a response to this dilemma we propose a simple disable/enable mechanism. Our suggestion is to disable all tags by default as part of the shopping check-out process and provide consumers with a password that enables them to re-enable their objects’ tags if needed.

Efficiency Improvements of the Private Message Service

Based on the private message service described in [4] we show efficiency improvements of that private message service in the computational setting. Regarding an attacker which may control all but one of the queried servers we describe a private message service with a total communication complexity of blinded read between client and private message service of n bit upstream and k bit downstream, where n denotes the number of cells in the database and k the size of one cell. Apart from a registration mechanism, the communication complexity between client and service is independent of the number of queried servers. Our improvement of the private message service is not only extremely efficient in terms of communication, but also in terms of computation. Further we describe how to use the message service in case of messages which are addressed using visible implicit addresses. After that we prove that at least parts of messages which are addressed using invisible implicit addresses must be broadcasted.We generalize the message service to operations in ZN (N ? 2) and prove the security of blinded read.

Praktischer Schutz vor Flooding-Angriffen bei Chaumschen Mixen

Dieses Papier beschreibt Verfahren, mit denen sich Angriffe der Klasse der Flooding- bzw. „n-1“-Angriffe auf Anonymisierungsdienste erkennen lassen und deren Erfolg verhindert werden kann.

Effizienter unbeobachtbarer Datenbankzugriff

Es wird ein effizentes Verfahren zum unbeobachtbaren, privaten Datenbankzugriff (PDA) vorgestellt. Die Server-Komponente des Systems besteht aus einem oder mehreren Sicheren Coprozessoren (SC’s), d.h. physisch geschutzten Rechner-Modulen, die einen potentiell beobachtbaren Datenspeicher nutzen. Einem die SC’s nicht kontrollierenden, ansonsten aber omniprasenten Angreifer bleibt verborgen, welche Information bei einer Nutzeranfrage abgefragt werden. Im Unterschied zu ublichen „PDA“-Ansatzen, die meist auf Vertrauensverteilung und Kryptographie basieren, kann mit dem vorgestellten PDA-Schema eine hohere Effizienz und praktische Einsatzfahigkeit erzielt werden. Zudem ermoglicht die Verwendung von SC’s breitere Einsatzgebiete i.d.R ohne spezielle Software im Nutzerrechner, z.B. anonyme Web(service)-, Datenbank-, File-, Community- und Payment-Dienste.