Context

Anonymous communication network designs exist in different flavors to defend
different threat models with various adversarial strengths. Tor is an example of
extremely performant design that probabilistically resists local
adversaries to some extent, but does not offer a security guarantee against a global
passive adversary (GPA). At the other end of this spectrum, academic proposals
such as Atom or XRD offer provable security against both a GPA and
local attackers, such as insiders (i.e., a fraction of the network controlled
by the adversary). However, those designs pay a significant performance penalty,
limiting their appeal. In between these two types of systems, we also find designs
based on continuous-time mixing, such as Loopix or Nym, which are not provably secure against a GPA but
may be stronger than Tor. Yet like Tor, they also probabilistically
resist local adversaries only to some extent, i.e., the probability to get
compromised in reality is not negligible.

routesim is a tool to analyze and evaluate continuous-time mixing designs (such as Loopix/Nym) and measures their ability to
resist the insider threat, i.e. an adversary running nodes in the network
and actively trying to deanonymize their users. With routesim, it is possible to test subtle design decisions and have a precise understanding
of how they impact users' anonymity. As a user of a given anonymity network, it
is also possible to use routesim to simulate their own behavior and evaluate its
impact. This could be useful, for example, for a whistleblower to verify and
adapt their behavior to minimize chances to get deanonymized while
communicating critical information.

Routesim -- Technical goal

This is a behavioural simulator for user activity in a continuous-time Mixnet. The objective of
this tool is to evaluate the probability of a deanonymization through time,
assuming some level of adversarial activity among the mixes. This probability
of deanonymization is determined by the user behaviour (i.e., how many messages
the user sends, and their sending volume distribution through time).

This program can take in input behavioural patterns; i.e., a probabilistic
model of the user activity through a period. The simulator can then play this
pattern upon a configured virtual time limit (in days). For example, the
simulator can play a user email pattern within the Mixnet during 100 days.

We read topologies configuration from files, in which each file matchs an epoch
(i.e., an epoch is a timeframe during which the network topology remains the
same). The simulator then output path information for each message sent by each
sampled user (i.e., we apply a Monte Carlo method). As a matter of example, the
"simple" model outputs the following kind of line:

1970-01-01 00:44:31 2538 570,260,1007, false

containing the date, the sample id, the path (mix ids) and whether the route is
fully compromised or not (i.e., whether the user selected PATH_LENGTH malicious mixes).

The timings and number of path sampled depends on the user model selected. E.g.,
for the "simple" user model, one path is sampled every 10 minutes on average
(uniformly random in 5, 15 minutes).

More complex user models and logging mechanisms are also implemented.
Fundamentally, we derive two classes of interactions with the mixnet:
Synchronous one. E.g., sending files to a dropbox, or sending a HTTP request to
a Web Server). And asynchronous ones that mainly capture potential interaction
between anonymous users (e.g., some user send a message to someone's else
mailbox; and the peer can then anonymously fetch the message asynchronously).

Installing Rust

curl --proto '=https' --tlsv1.3 -sSf https://sh.rustup.rs | sh

See Other Installation
Methods if
you're on Windows.

Add Cargo to your PATH.

export PATH="$HOME/.cargo/bin:$PATH"

Compiling and installing routesim

Clone the repository.

  git clone https://github.com/frochet/routesim.git

Compile && install.

cd routesim
cargo install --path .

You should now have routesim installed in ~/.cargo/bin and access to its
interface:

routesim -h

Examples

A dummy example

In your terminal, run the following:

routesim --in-dir testfiles/single_layout --epoch 86401 -u simple --users 2 --days 1 -c 1 -t

This instructs routesim to simulate two users during 1 day with the "simple"
user model, and outputs to stdout the route taken during the virtual day.

A complex usage case: evaluating the impact of your email sending pattern

If you wish to simulate your email-pattern behavior over the Mixnet,
there are a few steps ahead of the simulation itself. Your first need to
extract your data, and post-process them using the available script
located at scripts/process-mailbox.py.

Assuming you have a thunderbird client, install the addon
ImportExportTools NG, and then export your send folder as a .mbox file.
Then, use the script to produce two files containing some processed
information:

python3 scripts/process-mailbox.py path/to/mbox/file

You should then have two .json file in your current directory, named
time_data.json and size_data.json.

Preparing Bow-Tie topologies

mkdir -p topologies/bow-tie
cd topologies/bow-tie
../../scripts/split_csv_file.sh ../../testfiles/layout_data/bow_tie/dynamic_hybrid_steady_0.03_layout.csv

Running a Simulation

routesim --timestamps-h time_data.json --sizes-h size_data.json --in-dir topologies/bow-tie --epoch 3600 -u email --users 5000 --days 30 | sed 's/;/\n/g' > output_routesim_data

Parsing & Plotting Results

You'll find scripts to process and plots the simulation results in
the directory scripts/. process_sim.py processes the output of the
routesim command and stores relevant summaries serialized in a pickle
file.

$ python3 scripts/process_sim.py -h
usage: process_sim.py [-h] --in_file IN_FILE [--outname OUTNAME] [--format FORMAT] [--nbr_messages_until_compromise] --samples SAMPLES

Process results from routesim.py. Output serialized objects for plotting script, and output the answer to 'How many messages clients send before getting deanonymed, on average'

optional arguments:
  -h, --help            show this help message and exit
  --in_file IN_FILE     The output file produced by routesim.py
  --outname OUTNAME     filename for the pickle storage
  --format FORMAT       tell the parser the expected format
  --nbr_messages_until_compromise
                        Display the number of messages until compromise, on average
  --samples SAMPLES     Number of samples in file used in the simulation (--users in routesim)

python3 scripts/process_sim.py --in_file output_routesim_data --outname data_to_plot --format async --samples 5000

Now you should have a file named data_to_plot.pickle in your active
directory. You can use plot_processed_sim.py to get a visual.

$ python3 scripts/plot_processed_sim.py -h
usage: plot_processed_sim.py [-h] [--time] [--count] [--data DATA [DATA ...]] [--label LABEL [LABEL ...]]

Plot Time-to-first route compromised cdf of the routesim results

optional arguments:
  -h, --help            show this help message and exit
  --time
  --count
  --data DATA [DATA ...]
                        datapath to the pickle file
  --label LABEL [LABEL ...]
                        Line label in the same order than the data

You can give the script multiple --data and --label for all your
simulations. They will be plotted on the same figure.

python3 scripts/plot_processed_sim.py --time --data data_to_plot.json.pickle --label simulation_example

In this case, only one line is expected.

frochet/routesim