Extending Tor to achieve recipient anonymity

Abstract Tor is a well-known routing protocol implementing the Onion multi-layered encryption to achieve communication anonymity. Among other possible attacks, Tor is vulnerable to passive attacks based on the compromise of multiple nodes, allowing the adversary to observe the traffic flow and then identify the relationship between sender and recipient. Relationship anonymity, in every threat model, can be reached by achieving at least one between sender and recipient anonymity. Tor implements the onion-service mechanism to offer recipient anonymity. However, it does not protect against a global adversary, that monitors the traffic exchanged in the network. The idea of this paper is to achieve such protection by relying on the collaboration of k Tor relays to hide the actual recipient within an anonymity set of relays. Our approach also includes the exchange of cover traffic among the collaborating Tor relays. We implement this approach by first proposing a modification to Tor (called L-Tor) that preserves the linear circuits as in standard Tor. Then, we propose B-Tor, extending Tor via tree-like circuits. Our analysis shows that using linear circuits (as in L-Tor) would not lead to advantageous results due to the resulting high latency. Instead, we show that B-Tor achieves protection against global adversaries while preserving low-latency applications.