Onions in the queue: an integral networking perspective on anonymous communication systems
Performance is a pivot point in the design of anonymity overlays. Due to their growing popularity, they are faced with increasing load, which makes design problems imminent. The special requirements and complex architecture of anonymity overlays renders the topic a challenging but likewise inspiring object of research. In this work, we discuss the design of low latency anonymous communication systems in general and the Tor network as the de facto standard in particular. We develop solutions to a number of research questions, all collectively following the aim of enhancing and securing such networks. By doing this we create a fundamental technical understanding of networking aspects in anonymity overlays and tackle the most prevalent performance issue experienced today: network congestion. To this end, we systematically explore the design space of data transport in anonymity overlays and reveal serious performance issues. This exploration provides insights in how (not) to design a transport protocol for anonymity overlays. In order to support future design decisions, we additionally present a methodology to measure networks in a privacy preserving manner. The fundamental results of this thesis include the discovery of a destructive denial of service attack and the associated design flaw of performing hop by hop reliability and end to end flow control. Moreover, we emphasize the central role of fairness. In particular, we show that gross unfairness between circuits may arise and lead to poor performance. While these kind of issues are difficult to fix, we provide respective security measures and a fully distributed scheduling algorithm that implicitly achieves global fairness. These issues clearly demonstrate the inadequacy of currently employed congestion control in anonymity overlays. In particular, we identify a feedback "gap" between incoming and outgoing connections as the primary cause of performance issues. Aware of the requirements and the problems of anonymity overlays, we develop a tailored transport protocol. It combines congestion control with a backpressure based flow control mechanism. The resulting overlay is able to react locally and thus rapidly to varying network conditions. It yields superior performance and a resilient overlay network. With our work, we contribute an integral perspective on networking aspects of anonymity overlays and tackle the root cause of performance issues.