Abstract Anonymous communication networks (ACNs) are intended to protect the metadata privacy during the communication. As typical ACNs, onion mix-nets adopt source routing where the source defines a static path and wraps the message with the public keys of on-path nodes so that the message could be delivered to the destination. However, onion mix-nets lack resilience when the static on-path mixes fail, which could result in message loss, communication failure and even de-anonymization attacks. Therefore, it is desirable to achieve routing resilience in onion mix-nets for persistent routing capability even against node failure. The state-of-the-art solutions mainly adopt mix groups and thus need to share secrets among all the group members, which may cause single point of failure and render massive loss of anonymity. To address the above problem, in this work we design a hybrid routing approach, which essentially embeds the onion mix-net with hop-by-hop routing to achieve desirable routing resilience. Furthermore, we extend our scheme with a threshold setting, and propose T-hybrid routing to mitigate the anonymity loss when group mixes are compromised. Besides, we propose the active defense mechanism to defend replay attacks in the scenario of mix groups. As for experimental evaluations, we conduct a quantitative analysis of the resilience and anonymity for various schemes, and demonstrate that T-hybrid routing can achieve a good balance between resilience and anonymity. In addition, we manage to realize the full T-hybrid routing prototype and test its performance in the cloud hosting environment. The experimental results show that compared with typical onion mix-nets, our T-hybrid routing mechanism only increases about 20%-25% regarding the end-to-end delay, and thus is still practical while with better resilience.

中文翻译：

---

在匿名通信网络中平衡匿名性和弹性

摘要 匿名通信网络（ACN）旨在保护通信过程中的元数据隐私。作为典型的 ACN，洋葱混合网采用源路由，其中​​源定义静态路径，并用路径上节点的公钥包装消息，以便将消息传递到目的地。然而，当静态路径混合失败时，洋葱混合网络缺乏弹性，这可能导致消息丢失、通信失败甚至去匿名化攻击。因此，即使在节点故障的情况下，为了持久路由能力，在洋葱混合网络中实现路由弹性也是可取的。最先进的解决方案主要采用混合组，因此需要在所有组成员之间共享秘密，这可能会导致单点故障并导致匿名性的大量损失。为了解决上述问题，在这项工作中，我们设计了一种混合路由方法，该方法本质上将洋葱混合网络与逐跳路由嵌入在一起，以实现理想的路由弹性。此外，我们使用阈值设置扩展了我们的方案，并提出了 T 混合路由以减轻组混合受到损害时的匿名性损失。此外，我们提出了主动防御机制来防御混合组场景中的重放攻击。至于实验评估，我们对各种方案的弹性和匿名性进行了定量分析，并证明了 T-hybrid 路由可以在弹性和匿名性之间取得良好的平衡。此外，我们设法实现了完整的 T 混合路由原型并在云托管环境中测试其性能。实验结果表明，与典型的洋葱混合网相比，