Onion Routing for Enhanced Privacy Protection
More Anonymous Onion Routing
Through Trust
Aaron Johnson and Paul Syverson
22nd IEEE Computer Security Foundations Symposium
July 2009
1
How Onion Routing Works
User
u
running client
Internet destination
d
Routers running servers
u
d
1
2
3
4
5
2
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
1
2
3
4
5
3
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
1
2
3
4
5
4
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
1
2
3
4
5
5
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
1
2
3
4
5
6
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
{{{m}3
}
4
}
1
1
2
3
4
5
7
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
{{m}3
}
4
1
2
3
4
5
8
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
{m}3
1
2
3
4
5
9
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
m
1
2
3
4
5
10
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
m’
1
2
3
4
5
11
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
{m’}3
1
2
3
4
5
12
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
{{m’}3
}
4
1
2
3
4
5
13
How Onion Routing Works
u
d
1.
u
creates
l
-hop
circuit
through routers
2.
u
opens a stream in the circuit to
d
3.
Data is exchanged
{{{m’}3
}
4
}
1
1
2
3
4
5
14
Onion Routing
•
Practical design with low latency and overhead
•
•
Open source implementation
(
http://www.torproject.org/
)
•
Over 1500 volunteer routers
•
Estimated 200,000 users
15
Adversary
u
2
4
5
d
v
e
f
16
1
3
Adversary
u
1
2
3
4
5
d
v
e
f
17
•
Active & Local
Adversary
u
1
2
3
4
5
d
v
e
f
18
•
Active & Local
•
Correlation attack
Adversary
u
1
2
3
4
5
d
v
e
f
19
•
Active & Local
•
Correlation attack
Using Trust
•
Adversarial routers
20
u
1
2
3
4
5
d
Using Trust
21
u
1
2
3
4
5
d
•
Adversarial routers
•
User doesn’t know where the adversary is.
Using Trust
22
u
1
2
3
4
5
d
•
Adversarial routers
•
User doesn’t know where the adversary is.
•
User may have some idea of which routers are
likely to be adversarial.
Model
•
Router
r
i
has
trust
t
i
.
An attempt to
compromise a router succeeds with
probability
c
i
= 1-
t
i
.
•
User will choose circuits using a known
distribution.
•
Adversary attempts to compromise at most
k
routers,
K
R
.
•
After attempts, users actually choose circuits.
23
Model
•
For anonymity, minimize correlation attack
•
Probability of compromise:
c
(
p
,
K
) =
r
,
s
K
p
rs
c
r
c
s
•
Problem:
–
Input:
Trust values
t
1
,…,
t
n
–
Output:
Distribution
p*
on router pairs such that
p*
argmin
p
max
K
R
:
|
K
|=
k
c
(
p
,
K
)
24
Algorithm
•
Turn into a linear program
•
Variables:
p
rs
r
,
s
R
t
(slack variable)
•
Constraints:
–
Probability distribution:
0
p
rs
1
r
,
s
R
p
rs
= 1
–
Minimax:
t
– c
(
p
,
K
)
0
K
R
:
|
K
|=
k
•
Objective function :
t
25
Algorithm
•
Turn into a linear program
•
Variables:
p
rs
r
,
s
R
t
(slack variable)
•
Constraints:
–
Probability distribution:
0
p
rs
1
r
,
s
R
p
rs
= 1
–
Minimax:
t
– c
(
p
,
K
)
0
K
R
:
|
K
|=
k
•
Objective function :
t
26
Problem:
Exponential-size linear program
Independent-Choice Approximation
1.
Let
c
(
p
) =
max
K
R
:|
K
|=
k
r
K
p
r
c
r
.
2.
Choose routers independently using
27
p
*
argmin
p
c
(
p
)
Independent-Choice Approximation
1.
Let
c
(
p
) =
max
K
R
:|
K
|=
k
r
K
p
r
c
r
.
2.
Choose routers independently using
28
p
*
argmin
p
c
(
p
)
Let
= argmin
i
c
i
.
Let
p
1
(
r
) = 1.
Let
p
2
(
r
i
)
=
/
c
i
, where
= (
i
1/
c
i
)
-1
.
Theorem
:
c
(
p
*
) =
c
(
p
1
) if
c
k
c
(
p
2
) otherwise
29
p
i
*
c
i
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
Independent-Choice Approximation
30
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
1.
Adversary chooses k routers with largest
p
i
c
i
.
p
i
*
c
i
Independent-Choice Approximation
31
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
1.
Adversary chooses k routers with largest
p
i
c
i
.
2.
c
i
j
c
i
j
+1
or swapping would be an improvement.
p
i
*
c
i
Independent-Choice Approximation
32
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
1.
Adversary chooses k routers with largest
p
i
c
i
.
2.
c
i
j
c
i
j
+1
or swapping would be an improvement.
3.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
k.
p
i
*
c
i
Independent-Choice Approximation
33
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
1.
Adversary chooses k routers with largest
p
i
c
i
.
2.
c
i
j
c
i
j
+1
or swapping would be an improvement.
3.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
k.
4.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
2.
p
i
*
c
i
Independent-Choice Approximation
34
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
1.
Adversary chooses k routers with largest
p
i
c
i
.
2.
c
i
j
c
i
j
+1
or swapping would be an improvement.
3.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
k.
4.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
2.
5.
Adjusting
p
1
changes
c
(
p
) linearly. Therefore one
extreme is a minimum.
p
i
*
c
i
Independent-Choice Approximation
35
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
1.
Adversary chooses k routers with largest
p
i
c
i
.
2.
c
i
j
c
i
j
+1
or swapping would be an improvement.
3.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
k.
4.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
2.
5.
Adjusting
p
1
changes
c
(
p
) linearly. Therefore one
extreme is a minimum.
p
1
p
i
*
c
i
Independent-Choice Approximation
36
r
i
1
r
i
2
r
i
3
r
i
4
r
i
5
Proof
:
1.
Adversary chooses k routers with largest
p
i
c
i
.
2.
c
i
j
c
i
j
+1
or swapping would be an improvement.
3.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
k.
4.
Can assume that
p
i
c
i
=
p
j
c
j;
i
,
j
>=
2.
5.
Adjusting
p
1
changes
c
(
p
) linearly. Therefore one
extreme is a minimum.
p
2
Independent-Choice Approximation
p
i
*
c
i
Theorem
:
The approximation ratio of
independent selection is
(
n).
37
Independent-Choice Approximation
Theorem
:
The approximation ratio of
independent selection is
(
n).
38
Proof sketch
:
Let
I
n
= (
c
1
, . . . ,
c
n
,
k
) be such that
1.
c
1
=
O
(1/
n
)
2.
c
2
>
c
,
c
(0, 1)
3.
k
=
o
(
n
)
4.
k
=
(1)
1
2
3
4
5
Independent-Choice Approximation
Theorem
:
The approximation ratio of
independent selection is
(
n).
39
Proof sketch
:
Let
I
n
= (
c
1
, . . . ,
c
n
,
k
) be such that
1.
c
1
=
O
(1/
n
)
2.
c
2
>
c
,
c
(0, 1)
3.
k
=
o
(
n
)
4.
k
=
(1)
Let
p
*
(
r
1
,
r
i
)
1/(
c
r
1
c
r
i
).
Then
c
(
I
n
,
p
1
)/
c
(
I
n
,
p
*
) =
(
n
/
k
)
and
c
(
I
n
,
p
2
)/
c
(
I
n
,
p
*
) =
(
k
).
1
2
3
4
5
Independent-Choice Approximation
Theorem
:
The approximation ratio of
independent selection is
(
n).
40
Proof sketch
:
Let
I
n
= (
c
1
, . . . ,
c
n
,
k
) be such that
1.
c
1
=
O
(1/
n
)
2.
c
2
>
c
,
c
(0, 1)
3.
k
=
o
(
n
)
4.
k
=
(1)
Let
p
*
(
r
1
,
r
i
)
1/(
c
r
1
c
r
i
).
Then
c
(
I
n
,
p
1
)/
c
(
I
n
,
p
*
) =
(
n
/
k
)
and
c
(
I
n
,
p
2
)/
c
(
I
n
,
p
*
) =
(
k
).
1
2
3
4
5
p
1
Independent-Choice Approximation
Theorem
:
The approximation ratio of
independent selection is
(
n).
41
Proof sketch
:
Let
I
n
= (
c
1
, . . . ,
c
n
,
k
) be such that
1.
c
1
=
O
(1/
n
)
2.
c
2
>
c
,
c
(0, 1)
3.
k
=
o
(
n
)
4.
k
=
(1)
Let
p
*
(
r
1
,
r
i
)
1/(
c
r
1
c
r
i
).
Then
c
(
I
n
,
p
1
)/
c
(
I
n
,
p
*
) =
(
n
/
k
)
and
c
(
I
n
,
p
2
)/
c
(
I
n
,
p
*
) =
(
k
).
1
2
3
4
5
p
2
Independent-Choice Approximation
Theorem
:
The approximation ratio of
independent selection is
(
n).
42
Proof sketch
:
Let
I
n
= (
c
1
, . . . ,
c
n
,
k
) be such that
1.
c
1
=
O
(1/
n
)
2.
c
2
>
c
,
c
(0, 1)
3.
k
=
o
(
n
)
4.
k
=
(1)
Let
p
*
(
r
1
,
r
i
)
1/(
c
r
1
c
r
i
).
Then
c
(
I
n
,
p
1
)/
c
(
I
n
,
p
*
) =
(
n
/
k
)
and
c
(
I
n
,
p
2
)/
c
(
I
n
,
p
*
) =
(
k
).
1
2
3
4
5
p
*
Independent-Choice Approximation
43
U
V
Trust Model
•
Two trust levels:
t
1
t
2
•
U = {r
i
|
t
i
=
t
1
}, V = {r
i
|
t
i
=
t
2
}
44
U
V
Trust Model
•
Two trust levels:
t
1
t
2
•
U = {r
i
|
t
i
=
t
1
}, V = {r
i
|
t
i
=
t
2
}
Theorem
:
Three distributions can be optimal:
Trust Model
•
Two trust levels:
t
1
t
2
•
U = {r
i
|
t
i
=
t
1
}, V = {r
i
|
t
i
=
t
2
}
45
Theorem
:
Three distributions can be optimal:
1.
p
(
r
,
s
)
c
r
c
s
for
r
,
s
R
U
V
Trust Model
•
Two trust levels:
t
1
t
2
•
U = {r
i
|
t
i
=
t
1
}, V = {r
i
|
t
i
=
t
2
}
46
Theorem
:
Three distributions can be optimal:
1.
p
(
r
,
s
)
c
r
c
s
for
r
,
s
R
2.
p
(
r
,
s
)
c
1
2
if
r
,
s
U
0 otherwise
U
V
Trust Model
•
Two trust levels:
t
1
t
2
•
U = {r
i
|
t
i
=
t
1
}, V = {r
i
|
t
i
=
t
2
}
47
Theorem
:
Three distributions can be optimal:
1.
p
(
r
,
s
)
c
r
c
s
for
r
,
s
R
2.
p
(
r
,
s
)
3.
p
(
r
,
s
)
c
1
2
if
r
,
s
U
0 otherwise
c
1
2
(
n
(
n
-1)-
v
0
(
v
0
-1))
if
r
,
s
U
c
2
2
(
m
(
m
-1)-
v
1
(
v
1
-1))
if
r
,
s
V
0
otherwise
U
V
where
v
0
= max(
k
-
m
,0) and
v
1
= (max(
k
-
n
,0))
Generalization and Other Applications
•
Pick a subset of size
j
•
Minimize the chance that all are compromised
•
Examples
:
1.
Heterogenous sensor networks
2.
Distributed computation (
e.g.
SETI@home)
3.
Data integrity in routing
48
Future Work
•
Generalization to other problems
•
Heterogeneous trust
–
Users choose paths differently
–
User profiling
–
Adversary may not know trust values
•
Roving adversary
49
Explore the concept of onion routing for anonymous internet communication explained through images. Learn how users create circuits and exchange data through multiple routers to enhance privacy and security. Discover the intricate process step by step in a visual format.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
More Anonymous Onion Routing Through Trust Aaron Johnson and Paul Syverson 22nd IEEE Computer Security Foundations Symposium July 2009 1
How Onion Routing Works 1 2 u d 3 5 User u running client Internet destination d 4 Routers running servers 2
How Onion Routing Works 1 2 u d 3 5 4 1. u creates l-hop circuit through routers 3
How Onion Routing Works 1 2 u d 3 5 4 1. u creates l-hop circuit through routers 4
How Onion Routing Works 1 2 u d 3 5 4 1. u creates l-hop circuit through routers 5
How Onion Routing Works 1 2 u d 3 5 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 6
How Onion Routing Works {{{m}3}4}1 1 2 u d 3 5 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 7
How Onion Routing Works 1 2 u d 3 5 {{m}3}4 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 8
How Onion Routing Works 1 2 u d 3 5 {m}3 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 9
How Onion Routing Works 1 2 m u d 3 5 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 10
How Onion Routing Works 1 2 u d m 3 5 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 11
How Onion Routing Works 1 2 u d 3 5 {m }3 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 12
How Onion Routing Works 1 2 {{m }3}4 u d 3 5 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 13
How Onion Routing Works 1 2 {{{m }3}4}1 u d 3 5 4 1. u creates l-hop circuit through routers 2. u opens a stream in the circuit to d 3. Data is exchanged 14
Onion Routing Practical design with low latency and overhead Open source implementation (http://www.torproject.org/) Over 1500 volunteer routers Estimated 200,000 users 15
Adversary u 1 2 d v e 3 5 4 f 16
Adversary u 1 2 d v e 3 5 4 f Active & Local 17
Adversary u 1 2 d v e 3 5 4 f Active & Local Correlation attack 18
Adversary u 1 2 d v e 3 5 4 f Active & Local Correlation attack 19
Using Trust 1 2 u d 3 5 4 Adversarial routers 20
Using Trust 1 2 u d 3 5 4 Adversarial routers User doesn t know where the adversary is. 21
Using Trust 1 2 u d 3 5 4 Adversarial routers User doesn t know where the adversary is. User may have some idea of which routers are likely to be adversarial. 22
Model Router ri has trust ti. An attempt to compromise a router succeeds with probability ci = 1-ti. User will choose circuits using a known distribution. Adversary attempts to compromise at most k routers, K R. After attempts, users actually choose circuits. 23
Model For anonymity, minimize correlation attack Probability of compromise: c(p,K) = r,s Kprs cr cs Problem: Input: Trust values t1, ,tn Output: Distribution p* on router pairs such that p* argminp maxK R:|K|=kc(p,K) 24
Algorithm Turn into a linear program Variables: prs r,s R t (slack variable) Constraints: Probability distribution: 0 prs 1 r,s R prs = 1 Minimax: t c(p,K) 0 K R:|K|=k Objective function : t 25
Algorithm Turn into a linear program Variables: prs r,s R t (slack variable) Constraints: Probability distribution: 0 prs 1 r,s R prs = 1 Minimax: t c(p,K) 0 K R:|K|=k Objective function : t Problem: Exponential-size linear program 26
Independent-Choice Approximation 1. Let c(p) = maxK R:|K|=k r Kpr cr. 2. Choose routers independently using p* argminpc(p) 27
Independent-Choice Approximation 1. Let c(p) = maxK R:|K|=k r Kpr cr. 2. Choose routers independently using p* argminpc(p) Let = argminici. Let p1(r ) = 1. Let p2(ri) = /ci, where = ( i 1/ci)-1. Theorem: c(p*) = c(p2) otherwise c(p1) if c k 28
Independent-Choice Approximation Proof: pi*ci ri1 ri2 ri3 ri4 ri5 29
Independent-Choice Approximation Proof: pi*ci ri1 ri2 ri3 ri4 ri5 1. Adversary chooses k routers with largest pici. 30
Independent-Choice Approximation Proof: pi*ci ri1 ri2 ri3 ri4 ri5 1. Adversary chooses k routers with largest pici. 2. cij cij+1or swapping would be an improvement. 31
Independent-Choice Approximation Proof: pi*ci ri1 ri2 ri3 ri4 ri5 1. Adversary chooses k routers with largest pici. 2. cij cij+1or swapping would be an improvement. 3. Can assume that pici = pjcj;i,j>= k. 32
Independent-Choice Approximation Proof: pi*ci ri1 ri2 ri3 ri4 ri5 1. Adversary chooses k routers with largest pici. 2. cij cij+1or swapping would be an improvement. 3. Can assume that pici = pjcj;i,j>= k. 4. Can assume that pici = pjcj;i,j>= 2. 33
Independent-Choice Approximation Proof: pi*ci ri1 ri2 ri3 ri4 ri5 1. Adversary chooses k routers with largest pici. 2. cij cij+1or swapping would be an improvement. 3. Can assume that pici = pjcj;i,j>= k. 4. Can assume that pici = pjcj;i,j>= 2. 5. Adjusting p1 changes c(p) linearly. Therefore one extreme is a minimum. 34
Independent-Choice Approximation Proof: p1 pi*ci ri1 ri2 ri3 ri4 ri5 1. Adversary chooses k routers with largest pici. 2. cij cij+1or swapping would be an improvement. 3. Can assume that pici = pjcj;i,j>= k. 4. Can assume that pici = pjcj;i,j>= 2. 5. Adjusting p1 changes c(p) linearly. Therefore one extreme is a minimum. 35
Independent-Choice Approximation Proof: p2 pi*ci ri1 ri2 ri3 ri4 ri5 1. Adversary chooses k routers with largest pici. 2. cij cij+1or swapping would be an improvement. 3. Can assume that pici = pjcj;i,j>= k. 4. Can assume that pici = pjcj;i,j>= 2. 5. Adjusting p1 changes c(p) linearly. Therefore one extreme is a minimum. 36
Independent-Choice Approximation Theorem: The approximation ratio of independent selection is ( n). 37
Independent-Choice Approximation Theorem: The approximation ratio of independent selection is ( n). Proof sketch: Let In = (c1, . . . , cn, k) be such that 1. c1 = O(1/n) 2. c2 > c, c (0, 1) 3. k = o(n) 4. k = (1) 1 2 3 5 4 38
Independent-Choice Approximation Theorem: The approximation ratio of independent selection is ( n). Proof sketch: Let In = (c1, . . . , cn, k) be such that 1. c1 = O(1/n) 2. c2 > c, c (0, 1) 3. k = o(n) 4. k = (1) Let p*(r1,ri) 1/(cr1cri). Then c(In, p1)/c(In, p*) = (n/k) and c(In, p2)/c(In, p*) = (k). 1 2 3 5 4 39
Independent-Choice Approximation Theorem: The approximation ratio of independent selection is ( n). Proof sketch: Let In = (c1, . . . , cn, k) be such that 1. c1 = O(1/n) 2. c2 > c, c (0, 1) 3. k = o(n) 4. k = (1) Let p*(r1,ri) 1/(cr1cri). Then c(In, p1)/c(In, p*) = (n/k) and c(In, p2)/c(In, p*) = (k). p1 1 2 3 5 4 40
Independent-Choice Approximation Theorem: The approximation ratio of independent selection is ( n). Proof sketch: Let In = (c1, . . . , cn, k) be such that 1. c1 = O(1/n) 2. c2 > c, c (0, 1) 3. k = o(n) 4. k = (1) Let p*(r1,ri) 1/(cr1cri). Then c(In, p1)/c(In, p*) = (n/k) and c(In, p2)/c(In, p*) = (k). p2 1 2 3 5 4 41
Independent-Choice Approximation Theorem: The approximation ratio of independent selection is ( n). Proof sketch: Let In = (c1, . . . , cn, k) be such that 1. c1 = O(1/n) 2. c2 > c, c (0, 1) 3. k = o(n) 4. k = (1) Let p*(r1,ri) 1/(cr1cri). Then c(In, p1)/c(In, p*) = (n/k) and c(In, p2)/c(In, p*) = (k). p* 1 2 3 5 4 42
Trust Model Two trust levels: t1 t2 U = {ri | ti=t1}, V = {ri | ti=t2} U V 43
Trust Model Two trust levels: t1 t2 U = {ri | ti=t1}, V = {ri | ti=t2} Theorem: Three distributions can be optimal: U V 44
Trust Model Two trust levels: t1 t2 U = {ri | ti=t1}, V = {ri | ti=t2} Theorem: Three distributions can be optimal: 1. p(r,s) crcs for r,s R U V 45
Trust Model Two trust levels: t1 t2 U = {ri | ti=t1}, V = {ri | ti=t2} Theorem: Three distributions can be optimal: 1. p(r,s) crcs for r,s R c12if r,s U 0 otherwise U 2. p(r,s) V 46
Trust Model Two trust levels: t1 t2 U = {ri | ti=t1}, V = {ri | ti=t2} Theorem: Three distributions can be optimal: 1. p(r,s) crcs for r,s R c12if r,s U 0 otherwise U 2. p(r,s) 3. p(r,s) c12(n(n-1)-v0(v0-1)) if r,s U c22(m(m-1)-v1(v1-1)) if r,s V 0otherwise where v0 = max(k-m,0) and v1 = (max(k-n,0)) V 47
Generalization and Other Applications Pick a subset of size j Minimize the chance that all are compromised Examples: 1. Heterogenous sensor networks 2. Distributed computation (e.g. SETI@home) 3. Data integrity in routing 48
Future Work Generalization to other problems Heterogeneous trust Users choose paths differently User profiling Adversary may not know trust values Roving adversary 49
