Analyzing and Protecting Communication Metadata

Most communication systems (e.g., e-mails, instant messengers, VPNs) use encryption to prevent third parties from learning sensitive information.However, encrypted communications protect the contents but often leak metadata: the amount of data sent and the time it was sent, the way the data should be decrypted, the identity of the sender and the recipient.These metadata are a pervasive threat to privacy: They enable a variety of attacks that range from recovering plaintext contents from encrypted communications to inferring communicating parties.Our goal in this thesis is two-fold: First, to raise awareness about this problem by demonstrating attacks that threaten user privacy; and second, to propose novel solutions that reduce the metadata leakage and maintain acceptable usability and costs.To achieve the first goal, we present the first work that performs an in-depth analysis of the communications of wearable devices under the lens of traffic analysis.We demonstrate that the metadata of Bluetooth communications of wearable devices (smartwatches, fitness trackers, and blood-pressure monitors) leak sensitive information to a passive observer, despite the use of encryption.By design, these devices handle fine-grained and long-term, personal, medical and lifestyle-related data from their users.Our work highlights the need to rethink how sensitive data is exchanged in this setting.More generally, we confirm that metadata can pose a threat to user privacy, even in settings where traffic-analysis attacks are perhaps not an immediate threat.For the second goal, we begin by presenting a theoretical contribution that concerns ciphertext formats:Padmé, a padding function designed to reduce the metadata leakage of files and messages through their length.Padmé efficiently hides the size of objects even when they have very different sizes.Padmé is a part of PURBs, a ciphertext format that does not leak metadata, except for a small amount about the size.Then, we design systems that enable communicating while reducing metadata leakage: Anonymous Communication Networks (ACNs).ACNs protect against some metadata leakage (e.g., who is communicating and when).Traffic-analysis resistant ACNs have not seen widespread adoption yet, possibly due to their technical shortcomings.We focus on two aspects that remain unsolved: small-scale traffic-agnostic communication that achieves low latency, and large-scale asynchronous messaging that handles millions of users.We present PriFi, an ACN that provides provable traffic-analysis resistance and low-latency in the context of a local-area network.The protocol hides the source and recipient of a message by ensuring that the communication patterns of all participants are equal, even in the presence of active attacks.PriFi ensures low-latency and traffic-agnostic communication for a small set of users.We then present Rubato, an ACN for anonymous messaging that handles millions of users.Other large-scale ACNs have an important limitation: A sender and a recipient need to be online at the same time to resist intersection attacks.As participants are uncoordinated, they need to be online and to send cover traffic at all times, which is infeasible for many users.Rubato is a circuit-based mixnet that enables its users to be asynchronous; they can participate in the network according to their own schedule.Unlike previous ACNs, this enables users to participate using their mobile devices.

When Whereabouts is No Longer Thereabouts

Julien Freudiger

Modern mobile devices are fast, programmable and feature localization and wireless capabilities. These technological advances notably facilitate mobile access to Internet, development of mobile applications and sharing of personal information, such as location information. Cell phone users can for example share their whereabouts with friends on online social networks. Following this trend, the field of ubiquitous computing foresees communication networks composed of increasingly inter-connected wireless devices offering new ways to collect and share information in the future. It also becomes harder to control the spread of personal information. Privacy is a critical challenge of ubiquitous computing as sharing personal information exposes users' private lives. Traditional techniques to protect privacy in wired networks may be inadequate in mobile networks because users are mobile, have short-lived encounters and their communications can be easily eavesdropped upon. These characteristics introduce new privacy threats related to location information: a malicious entity can track users' whereabouts and learn aspects of users' private lives that may not be apparent at first. In this dissertation, we focus on three important aspects of location privacy: location privacy threats, location-privacy preserving mechanisms, and privacy-preservation in pervasive social networks. Considering the recent surge of mobile applications, we begin by investigating location privacy threats of location-based services. We push further the understanding of the privacy risk by identifying the type and quantity of location information that statistically reveals users' identities and points of interest to third parties. Our results indicate that users are at risk even if they access location-based services episodically. This highlights the need to design privacy into location-based services. In the second part of this thesis, we delve into the subject of privacy-preserving mechanisms for mobile ad hoc networks. First, we evaluate a privacy architecture that relies on the concept of mix zones to engineer anonymity sets. Second, we identify the need for protocols to coordinate the establishment of mix zones and design centralized and distributed approaches. Because individuals may have different privacy requirements, we craft a game-theoretic model of location privacy to analyze distributed protocols. This model predicts strategic behavior of rational devices that protects their privacy at a minimum cost. This prediction leads to the design of efficient privacy-preserving protocols. Finally, we develop a dynamic model of interactions between mobile devices in order to analytically evaluate the level of privacy provided by mix zones. Our results indicate the feasibility and limitations of privacy protection based on mix zones. In the third part, we extend the communication model of mobile ad hoc networks to explore social aspects: users form groups called "communities" based on interests, proximity, or social relations and rely on these communities to communicate and discover their context. We analyze using challenge-response methodology the privacy implications of this new communication primitive. Our results indicate that, although repeated interactions between members of the same community leak community memberships, it is possible to design efficient schemes to preserve privacy in this setting. This work is part of the recent trend of designing privacy protocols to protect individuals. In this context, the author hopes that the results obtained, with both their limitations and their promises, will inspire future work on the preservation of privacy.

EPFL2011

A simple & [and] accessible front-end satellite receiver for communications and e-learning in emerging countries

Olivier Videme Bossou

For the universities of the emergent countries, and those of Cameroon in particular, the fight to reach a durable development requires to know the needed scientific and technical information for their development, how to get it and to spread it out among partners in the country. Obviously, the complete answer to these preoccupations lies well beyond the framework of this project, but a projection, partial but highly significant, can nevertheless be obtained if one concentrates one's efforts on a specific technological field : in the present study, we shall treat of antennas for telecommunications systems. This subject is highly suitable as example and potential incubator for future achievements. The ultimate goal is to design and carry out the fabrication of a system of satellite communications adapted to the financial resources and to the development needs of the universities of the South. First of all, we will review the state of the art in satellite communication systems, both for already operating ones and also for new systems, still under development. Then we will determine which system of satellite telecommunications has a receiver and communication fees with affordable costs : our choice will be made on Worldspace satellite system, which was actually designed for developing countries. We will also review the status of planar antenna and low noise amplifier technology, and then explicit the basic challenge involved in our thesis project. One of the aims of this project is to use local wood as dielectric in SSFIP type antennas. Before using a material as dielectric in an antenna design, it must be characterized. Before carrying the characterization of local wood species, we will begin by reviewing some commonly used dielectric measurement techniques. Then we will carry out a series of measurements to characterize the species of wood growing in the Cameroonian forest. At the end of the series of measurements and according to the dielectric losses observed, we will select the species of wood best suited to make a good substrate for a microstrip antenna. Next, we will design, manufacture and test low cost antennas. These antennas must satisfy not only technical criteria compatible with those of the telecommunications system chosen but, even most importantly, it must meet socioeconomic criteria : the antennas must be manufactured with low cost and locally available materials, making use of simple technological processes. Once we have found the wood species that exhibits the lowest dielectric losses, we will simulate, and then manufacture the SSFIP type antenna with wood as substrate and aluminium as conducting element. Then we will measure its characteristics and check whether they are compatible with those of a Worldspace receiver. The signal received from the satellite by the antenna is very weak. It will be important to strengthen the received signal with a low noise amplifier (LNA) before connecting the antenna to the receiver. Thus the antenna and the LNA constitute an active antenna and form what we call here the radiofrequency (RF) front-end. We will design, manufacture and measure the LNA characteristics. A simple manufacturing process must be used to realize these antennas, because later on they must be manufactured locally in Cameroon : this is a determining challenge to ensure the economic independence, which is essential in our thesis project. Afterwards we will join the LNA to the planar antenna and connect the active antenna obtained in this manner to a commercial Worldspace receiver. Finally, we will perform receiving tests of the Worldspace radio station with the system designed. In parallel, our project includes a second goal, which presents an equivalent significance. We will use existing Matlab codes to develop an online course to teach antenna theory. In addition, at the end of the project and when the Cameroonian local manufacture would have started, we will put all algorithms used for the antenna design on the web site in a multi-media applet, together with a complete documentation of all the manufacturing technologies used. The courses that already exist in Lausanne and Yaounde, relating to the description of other types of antennas will be added, thus leading to a complete teachware that would ensure the durability and the dissemination of the results obtained, and would provide an invaluable tool for teaching and training.

EPFL2007

Protecting privacy through metadata analysis

Sandra Deepthy Siby

Although encryption hides the content of communications from third parties, metadata, i.e., the information attached to the content (such as the size or timing of communication) can be a rich source of details and context. In this dissertation, we demonstrate the power of metadata analysis. We illustrate ways in which we can use metadata analysis to protect privacy, by addressing two problems in the areas of network and web privacy.In the first problem, we study recently standardized protocols such as encrypted DNS and QUIC. We show how metadata analysis can be used by adversaries to perform website-fingerprinting attacks against these protocols and to infer websites visited by a user, thereby compromising their privacy. We use the insights from our analysis to identify the requirements for developing effective countermeasures and to improve the resistance of these protocols to website fingerprinting. We find that hiding metadata is challenging.In the second problem, we address the issue of online advertising and tracking services (ATS) that are constantly evolving to evade privacy protections established by browser vendors. We demonstrate how the very fact of metadata being hard to hide can be useful to defenders. Defenders can use metadata analysis to build ATS-detection systems that are more robust against adversarial evasion by capturing behavioral metadata of ATS. We use our findings to detect and counter the emergence of tracking via first-party cookies.