<div>Anonymous communication networks (ACNs) are critical to communication privacy over the internet as they enable</div><div>individuals to maintain their privacy from untrusted intermediaries and endpoints.</div><div>Typically, ACNs involve messages traveling through some intermediaries before arriving at their destinations, and therefore they introduce network latency and bandwidth overheads. </div><div><br></div><div>The goal of this work is to investigate the fundamental constraints of anonymous communication (AC) protocols.</div><div>We analyze the relationship between bandwidth overhead, latency overhead, and sender anonymity or recipient anonymity against a global passive (network-level) adversary. </div><div>We confirm the widely believed trilemma </div><div>that an AC protocol can only achieve two out of the following three properties: </div><div>strong anonymity (i.e., anonymity up to a negligible chance),</div><div>low bandwidth overhead, and low latency overhead. </div><div><br></div><div>We further study anonymity against a stronger global passive adversary that can additionally passively compromise some of the AC protocol nodes.</div><div>For a given number of compromised nodes, </div><div>we derive as a necessary constraint a relationship between bandwidth and latency overhead whose violation make it impossible for an AC protocol to achieve strong anonymity. </div><div>We analyze prominent AC protocols from the literature and depict to which extent those satisfy our necessary constraints. </div><div>Our fundamental necessary constraints offer a guideline not only for improving existing AC systems but also for designing novel AC protocols with non-traditional bandwidth and latency overhead choices.</div><div><br></div><div>Using the guidelines indicated by our fundamental necessary constraints we provide two efficient protocol constructions.</div><div>First, we design a mixnet-based AC protocol Streams that provides provable mixing guarantees with the expense of latency overhead. Streams realizes a trusted third party stop-and-go mix as long as each message stays in the system for $\omega(\log \eta)$ rounds.</div><div>Second, we offer a DC-net based design OrgAn that can provide strong sender anonymity with constant latency at the expense of bandwidth overhead. OrgAn solves the problem of regular requirements of key and slot agreement present in typical DC-net based protocols, by utilizing a client/relay/server architecture.</div>

Internet users generally feel their actions are anonymous, but this is often not the case. Users can be tracked and their actions logged for future analysis, which is not the desire of most users. Software and services exist which offer anonymity on the Internet when used correctly. Anonymity on the Internet is useful for many people including whistleblowers, dissidents, law enforcement, and the security conscious, but it can be abused. A user can act maliciously under the guise of anonymity without the fear of retribution. Thus, a level of administrative control over users is desirable, even in an anonymous system. Administrative control over users in an open, anonymous system is extremely difficult, but what about a closed, pseudonymous system? Closed Pseudonymous Groups is a pseudonymous framework for a closed group of users that balances the needs of the user with those of a service administrator. Using a resource that uniquely identifies a user, the user may create a pseudonym with which they can interact with the service over the Internet. Misbehaving pseudonyms can be blocked from using the service, and the offending user is unable to create a new authorized pseudonym.

Deindividuation is a psychological phenomenon that occurs when a given environment reduces the "individuality" or identifiability of a person. These environments may cause a psychological reduction in self-consciousness, potentially leading to violations of sociocultural norms (Festinger, Pepitone, & Newcomb, 1952; Singer, Brush, & Lublin, 1965). The present research sought to empirically test deindividuation theory among automobile drivers utilizing the anonymizing factor of observation. Participants (N = 31) used a driving simulator and were either in the observed condition or an unobserved condition. Analysis of driving data did not reveal significant results, however self-report data had some interesting trends. Though limited in scope, this research begins to shed light on deindividuation of drivers and may provide a foundation for future research.

This dissertation addresses the challenge of enabling accurate analysis of network data while ensuring the protection of network participants' privacy. This is an important problem: massive amounts of data are being collected (facebook activity, email correspondence, cell phone records), there is huge interest in analyzing the data, but the data is not being shared due to concerns about privacy. Despite much research in privacy-preserving data analysis, existing technologies fail to provide a solution because they were designed for tables, not networks, and cannot be easily adapted to handle the complexities of network data. We develop several technologies that advance us toward our goal. First, we develop a framework for assessing the risk of publishing a network that has been "anonymized." Using this framework, we show that only a small amount of background knowledge about local network structure is needed to re-identify an "anonymous" individual. This motivates our second contribution: an algorithm that transforms the structure of the network to provably lower re-identification risk. In comparison with other algorithms, we show that our approach more accurately preserves important features of the network topology. Finally, we consider an alternative paradigm, in which the analyst can analyze private data through a carefully controlled query interface. We show that the degree sequence of a network can be accurately estimated under strong guarantees of privacy.

No description available.

No description available.

No description available.

The immutability, validity and confidentiality of an audit log is crucial when operating over sensitive data to comply to standard data regulations (e.g., HIPAA). Despite its critical needs, state-of-the-art privacy-preserving audit log schemes (e.g., Ghostor (NSDI '20), Calypso (VLDB '19)) do not fully obtain a high level of privacy, integrity, and immutability simultaneously, in which certain information (e.g., user identities) is still leaked in the log. In this work, we propose Harpocrates, a new privacy-preserving and immutable audit log scheme. Harpocrates permits data store, share, and access operations to be recorded in the audit log without leaking sensitive information (e.g., data identifier, user identity), while permitting the validity of data operations to be publicly verifiable. Harpocrates makes use of blockchain techniques to achieve immutability and avoid a single point of failure, while cryptographic zero-knowledge proofs are harnessed for confidentiality and public verifiability. We analyze the security of our proposed technique and prove that it achieves non-malleability and indistinguishability. We fully implemented Harpocrates and evaluated its performance on a real blockchain system (i.e., Hyperledger Fabric) deployed on a commodity platform (i.e., Amazon EC2). Experimental results demonstrated that Harpocrates is highly scalable and achieves practical performance. / Master of Science / Audit logs are an essential part of data storage systems as they allow to check if the system is working as intended. They are usually maintained on a server, a server with ill intentions can easily modify records of the log and make it appear that the system is working correctly. To store these records in an un-modifiable manner, prior works have leveraged special audit log storing mechanisms for e.g., blockchain due to its immutable nature. However, these works do not focus on the privacy of the records which is a crucial aspect for conforming to certain data regulations like HIPAA. In our work, we propose Harpocrates, an immutable and privacy-preserving audit log platform that supports recording operations (share/access) on sensitive data. Harpocrates leverages blockchain to achieve immutability of the audit log. Harpocrates use specific cryptographic primitives to achieve public verifiability and confidentiality of the audit log. Real world deployment of Harpocrates shows that it is practical and achieves strong security guarantees.

Seamless interconnection of smart mobile devices and cloud services is a key goal in modern mobile computing. Mobile Cloud Computing is the holistic integration of contextually-rich mobile devices with computationally-powerful cloud services to create high value products for end users, such as Apple's Siri and Google's Google Now product. This coupling has enabled new paradigms and fields of research, such as crowdsourced data collection, and has helped spur substantial changes in research fields such as vehicular ad hoc networking. However, the growth of Mobile Cloud Computing has resulted in a number of new challenges, such as testing large-scale Mobile Cloud Computing systems, and increased the importance of established challenges, such as ensuring that a user's privacy is not compromised when interacting with a location-aware service. Moreover, the concurrent development of the Infrastructure as a Service paradigm has created inefficiency in how Mobile Cloud Computing systems are executed on cloud platforms. To address these gaps in the existing research, this dissertation presents a number of software and algorithmic solutions to 1) preserve user locational privacy, 2) improve the speed and effectiveness of deploying and executing Mobile Cloud Computing systems on modern cloud infrastructure, and 3) enable large-scale research on Mobile Cloud Computing systems without requiring substantial domain expertise. / Ph. D.

Internet and mobile communications have had a profound effect on today's society. New services are constantly being deployed, in which personal data are being processed in return for personally tailored services. While mobile networks lay the groundwork for new innovative services, at the same time they pose numerous privacy challenges. There is the risk that honest citizens participating in mobile communications will have their privacy invaded for "the greater good". We argue that it is highly important that individuals are empowered to retain control over their personal spheres. Thus, the goal of this thesis is to design and evaluate anonymous overlay networks} adapted for mobile networks that allow users to control which information leaves their personal spheres in a mobile communication. Technically, by using an anonymous overlay network, users can communicate with their communication partners without disclosing their network identities. In this thesis, we propose three different anonymous overlay networks tailored for mobile networks. First, two approaches are proposed for anonymous browsing on the mobile Internet, namely mCrowds and a Tor-based approach. By applying theoretical analysis and\,/\,or practical experiments, we show that these approaches offer an appropriate trade-off between the offered degree of anonymity and performance loss. Second, an anonymous overlay network for use in mobile ad hoc networks - Chameleon - is suggested. Besides the actual design of these anonymous overlay networks, this thesis provides novel contributions in other essential areas of privacy protection and anonymous communication. First, also non-technical aspects of privacy protection are thoroughly discussed, including legal, social, and user interface aspects. Second, we survey existing metrics for quantifying anonymity and also propose new ideas regarding anonymity metrics. Third, we review and classify existing mechanisms for anonymous communication in mobile ad hoc networks. Lastly, we also propose a cryptographic technique for building up the user base of an anonymous overlay network in a secure and privacy-friendly manner.