We present a new class of statistical de- anonymization attacks against high-dimensional micro-data, such as individual preferences, recommendations, transaction records and so on Our techniques are robust to perturbation in the data and tolerate some mistakes in the adversary's background knowledge We apply our de-anonymization methodology to the Netflix Prize dataset, which contains anonymous movie ratings of 500,000 subscribers of Netflix, the world's largest online movie rental service We demonstrate that an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber's record in the dataset Using the Internet Movie Database as the source of background knowledge, we successfully identified the Netflix records of known users, uncovering their apparent political preferences and other potentially sensitive information

/pdf/robust-de-anonymization-of-large-sparse-datasets-4c1lqr3b3t.pdf

Robust De-anonymization of Large Sparse Datasets

In this paper we look closely at the popular metric of anonymity, the anonymity set, and point out a number of problems associated with it. We then propose an alternative information theoretic measure of anonymity which takes into account the probabilities of users sending and receiving the messages and show how to calculate it for a message in a standard mix-based anonymity system. We also use our metric to compare a pool mix to a traditional threshold mix, which was impossible using anonymity sets. We also show how the maximum route length restriction which exists in some fielded anonymity systems can lead to the attacker performing more powerful traffic analysis. Finally, we discuss open problems and future work on anonymity measurements.

Towards an information theoretic metric for anonymity

A key element of any mobile code based distributed system are the security mechanisms available to protect (a) the host against potentially hostile actions of a code fragment under execution and (b) the mobile code against tampering attempts by the executing host. Many techniques for the first problem (a) have been developed. The second problem (b) seems to be much harder: It is the general belief that computation privacy for mobile code cannot be provided without tamper resistant hardware. Furthermore it is doubted that an agent can keep a secret (e.g., a secret key to generate digital signatures). There is an error in reasoning in the arguments supporting these beliefs which we are going to point out.

In this paper we describe software-only approaches for providing computation privacy for mobile code in the important case that the mobile code fragment computes an algebraic circuit (a polynomial). We further describe an approach how a mobile agent can digitally sign his output securely.

Protecting Mobile Agents Against Malicious Hosts

The Customer Activated Multi-Value (CAM) card provides a customer with a primary use as a transaction card which can be further activated to have a secondary use as a credit card. The CAM card can be activated as a transaction card or as a transaction card with a credit card feature. Activation of the CAM card as a transaction card allows the customer to purchase goods and services from one specific vendor and to establish a relationship with that vendor for the goods or services rendered (for example, telephone calling card or gasoline product purchasing card) while enjoying reward benefits based on those to purchases. Activation of the credit feature of the card allows the customer to interact with any merchant that accepts traditional credit cards such as VISA®, MASTERCARD®, AMERICAN EXPRESS®, or DISCOVER®. The combination of features allows a customer to purchase various goods and services from several different merchants. If the customer chooses to activate the CAM card as both a transaction card and a credit card, the customer is given the benefit of using the card in both manners described above.

Customer activated multi-value (CAM) card

Bitcoin is quickly emerging as a popular digital payment system. However, in spite of its reliance on pseudonyms, Bitcoin raises a number of privacy concerns due to the fact that all of the transactions that take place are publicly announced in the system.

/pdf/evaluating-user-privacy-in-bitcoin-40ca6e6y81.pdf

Evaluating User Privacy in Bitcoin

This paper introduces an information theoretic model that allows to quantify the degree of anonymity provided by schemes for anonymous connections. It considers attackers that obtain probabilistic information about users. The degree is based on the probabilities an attacker, after observing the system, assigns to the different users of the system as being the originators of a message. As a proof of concept, the model is applied to some existing systems. The model is shown to be very useful for evaluating the level of privacy a system provides under various attack scenarios, for measuring the amount of information an attacker gets with a particular attack and for comparing different systems amongst each other.

Towards measuring anonymity

On the Security of Today's Online Electronic Banking Systems

This article investigates if and how mobile agents can execute secure electronic transactions on untrusted hosts. An overview of the security issues of mobile agents is first given. The problem of untrusted (i.e., potentially malicious) hosts is one of these issues, and appears to be the most difficult to solve. The current approaches to counter this problem are evaluated, and their relevance for secure electronic transactions is discussed. In particular, a state-of-the-art survey of mobile agent-based secure electronic transactions is presented.

/pdf/how-can-mobile-agents-do-secure-electronic-transactions-on-20kebut6n9.pdf

(How) can mobile agents do secure electronic transactions on untrusted hosts? A survey of the security issues and the current solutions

The APES p roject is p ar t of the Flemish STWW progra m (ht tp: / / www.iwt.be /) , which is a collection of p rojects t ha t t ry to b ridge the gap be tween the research world on the one side an d society on the other side. The p roject s ta r t ed in October 2000 and will carry on u n til October 2004. The goal of t he project is to de velop basic building blocks t ha t p rovide ano nymity in a wide varie ty of ap plications. The idea is to develop technologies which ad d anony mity to co m m u nication infras t ruc ture s, bu t also to m ore sop his ticated interactions s uch as p ayment, elections, cont ract signing, peer to peer systems, e tc. The research consor tiu m consis ts of t h ree par tners fro m the K.U.Leuven, each bringing their own expertise in this p roject: Coordinator research group COSIC, Depar t ment of Electrical Engineering ESAT; Research grou p Dist riNet, Dep ar t ment of Comp u ter Science; Research grou p ICRI, Faculty of Law. The consor tiu m is backed u p by a u ser grou p consis ting of the following me mbers: Data4S, Ubizen, Utim aco Safeware, HyperTrus t, t he Belgian Privacy Com mission and ISPA Belgiu m.

Joris Claessens

Papers

Towards measuring anonymity

On the Security of Today's Online Electronic Banking Systems

(How) can mobile agents do secure electronic transactions on untrusted hosts? A survey of the security issues and the current solutions

APES: Anonymity and Privacy in Electronic Services

Web services and web service security standards