Ricardo Anguiano discusses Ross Anderson's paper "Eternity Service Goals"

Outline

A Modest Implementation (Adam Back)

Ian Goldberg and David Wagner (1997). "TAZ Servers and the Rewebber Network: Enabling Anonymous Publishing on the World Wide Web" University of California, Berkeley, CS 268 Final Project - May 16, 1997.
 

1. The Eternity Service
1. Abstract
1. Proposes the construction of a storage medium resistant to Denial of Service (DoS).
2. Built using redundancy and scattering techniques to replicate data across a large set of machines
3. Add anonymity mechanisms to drive up cost of DoS attacks.
2. Historical Background
1. Medieval times, knowledge was guarded and controlled.
2. Church controlled bible, encoded in Latin.
3. Guilds guarded their secrets, restricted competition
4. Gutenberg allows quick dissemination of information with the advent of the printing press.
5. Control of information leads to less competitive and a less successful society.
6. Electron publishing threatens greater control over publishing.
3. Today
1. Information is now easier to control.
2. Church of scientology, former members published secret material, court ordered material removed from US server. Mirror server in Amsterdam à an anonymous remailer in Finland
3. So publishing means putting electronic copies on some servers worldwide, which can be removed.
4. Documents can be de-published.
5. Can we assure the availability of the data against bugs, spy agencies, military, judges and courts?
4. Preventing Denial of Service
1. DoS is the neglected stepchild of computer security, yet is the most important outside of military, diplomatic communities (figures from budgets)
2. Lots of motivation for prevention of destruction of records
1. Birth/death records
2. Pollution registries
3. Medical Case Notes
4. Financial accounting
5. Audit Trails
6. Certificate Revocation Lists
3. Digital document longevity beyond the life of the media.
4. All these examples motivate a highly persistent file store.
5. Previous Work
1. Disaster recovery companies
2. Companies not Prepared
3. Availability linked to anonymity?
1. Anonymous signaling prevent selective denial of service
4. If physical location of www site can't be ascertained, no seizure order can be saved.
5. How to realize anonymous publication.
6. Eternity Service Goals
1. Example: Want to store 1 MB file for 50 years. Publisher uploads "digital counter" file, no proof of identity required. Once published, available by anonymous file transfer.
2. Copies stored on servers around the world. All are independent.
3. Diversity provides resilience against attacks and errors.
4. Once posted, cannot be deleted
5. Resistant to destruction of most participating file servers, and malicious conspiracy of attacks by most servers
6. Servers dispersed in many jurisdictions.
7. Threat model
1. World wide government base unlikely.
2. Local base likely, would not affect service in other areas
3. Net flood, provide many access points
4. Basic idea explores redundancy versus anonymity.
8. Simple Design
1. 100 servers. Each server remembers a random set of 10 of them to audit, enforce contract
2. Broadcast message, servers send copy via anonymous remailer.
9. Perjury Trap
1. Can't delete without security officer
2. Login banner requires that the officer declare under oath that he is a free agent. Only authorized under condition of free will.
3. Courts in most countries will not compel people to commit perjury.
10. Proof Hardware
1. Hardware alone is not enough. Hardware + protocol maybe.
2. Security Server
1. File uploaded, security server will share with other security servers, in other jurisdictions, which in turn send copies to other security servers in other jurisdictions.
3. Anonymized communication to prevent traffic analysis (mix nets, ring, padding)
11. Indexing
1. Index is a file on a system.
2. Aim is for seamless integration within intranet.
12. Payment
1. "Digital Cash" generates an "electronic annuity" which follows data around.
2. Economics for file server owners
1. Disk costs decrease fast
2. Annuity pay is the same over time
3. Requires a double blind system for confidentiality 
1. Bank backs annuity
13. Problems - Not yet handled by digital cash research
1. Audit? Accounting? Prevent money laundering
2. Threat: Delay payment until file is flushed
3. Opponent bugs servers, enough so they have all the copies.
4. ISP gets big, penetrates anonymity of communications.
5. Certify owners?
1. Central body bad idea
2. Distributed certification of owners can't investigate owners
3. Policy up to the publisher
6. Cheating File Server Owner
1. Collect annuity, without keeping file, download from Eternity Server to show copy. Annuity payment server sends challenge.
7. Time
1. Opponent may manipulate NTP à now 2500 AD delete files
2. No secure clock
14. Policy rules
1. Assets may not be deleted unless date confirmed, all payments received ¾

1. Questions/Comments