arXiv subjects

Florian Tschorsch

Publications and source records attributed to Florian Tschorsch.

At least 19 recordsLinked to original sources

arXiv2026

Security Analysis of Bitcoin's V2 Transport Protocol: Exploiting Design Implications for Sustained Eclipse and Downgrade Attacks

Bitcoin recently introduced a new protocol for the encryption of peer-to-peer (P2P) communication. The protocol, known as V2 P2P transport, represents a big step towards securing the overlay network against various previously-known attack vectors. Based on an analysis of V2 P2P transport, this work examines the current viability of said attacks and concludes that while they are now remediated, alternative attacks and paths to similar objectives exist. The identified shortcomings are conceptual (and not implementation bugs) and even applicable to other P2P networks. We show how a network-level attacker can identify application messages using the length of TCP payloads, can eclipse a target node by taking advantage of how encrypted communication channels work and can downgrade all of a node's connections to the unencrypted protocol by using the mechanisms designed for compatibility. We validate our contributions using a combination of network measurements, emulations and simulations. Finally, we propose a series of short-term and long-term countermeasures towards securing Bitcoin's P2P network. To the best of our knowledge, we are the first to study Bitcoin's security under V2 P2P transport.

cs.CR↗

arXiv2026

DeZent: Decentralized z-Anonymity with Privacy-Preserving Coordination

Analyzing large volumes of sensor network data, such as electricity consumption measurements from smart meters, is essential for modern applications but raises significant privacy concerns. Privacy-enhancing technologies like z-anonymity offer efficient anonymization for continuous data streams by suppressing rare values that could lead to re-identification, making it particularly suited for resource-constrained environments. Originally designed for centralized architectures, z-anonymity assumes a trusted central entity. In this paper, we introduce deZent, a decentralized implementation of z-anonymity that minimizes trust in the central entity by realizing local z-anonymity with lightweight coordination. We develop deZent using a stochastic counting structure and secure sum to coordinate private anonymization across the network. Our results show that deZent achieves comparable performance to centralized z-anonymity in terms of publication ratio, while reducing the communication overhead towards the central entity. Thus, deZent presents a promising approach for enhancing privacy in sensor networks while preserving system efficiency.

cs.DC↗

arXiv2025

ContinuumConductor : Decentralized Process Mining on the Edge-Cloud Continuum

Process mining traditionally assumes centralized event data collection and analysis. However, modern Industrial Internet of Things systems increasingly operate over distributed, resource-constrained edge-cloud infrastructures. This paper proposes a structured approach for decentralizing process mining by enabling event data to be mined directly within the IoT systems edge-cloud continuum. We introduce ContinuumConductor a layered decision framework that guides when to perform process mining tasks such as preprocessing, correlation, and discovery centrally or decentrally. Thus, enabling privacy, responsive and resource-efficient process mining. For each step in the process mining pipeline, we analyze the trade-offs of decentralization versus centralization across these layers and propose decision criteria. We demonstrate ContinuumConductor at a real-world use-case of process optimazition in inland ports. Our contributions lay the foundation for computing-aware process mining in cyber-physical and IIoT systems.

cs.DC↗

arXiv2025

Information Inference Diagrams: Complementing Privacy and Security Analyses Beyond Data Flows

This work introduces Information Inference Diagrams (I2Ds), a modeling framework aiming to complement existing approaches for privacy and security analysis of distributed systems. It is intended to support established threat modeling processes. Our approach is designed to be compatible with Data Flow Diagrams~(DFDs), which form the basis of many established techniques and tools. Unlike DFDs, I2Ds represent information propagation, going beyond mere data flows to enable more formal reasoning in threat modeling while remaining practical. They define inference and sharing (flow) relations on information items to model how information moves through a system. To this end, we provide formal definitions for information items, entities, and flows. By introducing classes as a type system, our formal rules are both generic and allow conformance to existing vocabularies. We demonstrate the applicability of I2Ds through examples, that showcase their versatility in system analysis.

cs.CR↗

arXiv2025

PermRust: A Token-based Permission System for Rust

Permission systems which restrict access to system resources are a well-established technology in operating systems, especially for smartphones. However, as such systems are implemented in the operating system they can at most manage access on the process-level. Since moderns software often (re)uses code from third-parties libraries, a permission system for libraries can be desirable to enhance security. In this short-paper, we adapt concepts from capability systems building a novel theoretical foundation for permission system at the level of the programming language. This leads to PermRust, a token-based permission system for the Rust programming language as a zero cost abstraction on top of its type-system. With it access to system resources can be managed per library.

cs.PL↗

arXiv2025

PrivTru: A Privacy-by-Design Data Trustee Minimizing Information Leakage

Data trustees serve as intermediaries that facilitate secure data sharing between independent parties. This paper offers a technical perspective on Data trustees, guided by privacy-by-design principles. We introduce PrivTru, an instantiation of a data trustee that provably achieves optimal privacy properties. Therefore, PrivTru calculates the minimal amount of information the data trustee needs to request from data sources to respond to a given query. Our analysis shows that PrivTru minimizes information leakage to the data trustee, regardless of the trustee's prior knowledge, while preserving the utility of the data.

cs.CR↗

arXiv2025

Process Mining on Distributed Data Sources

Major domains such as logistics, healthcare, and smart cities increasingly rely on sensor technologies and distributed infrastructures to monitor complex processes in real time. These developments are transforming the data landscape from discrete, structured records stored in centralized systems to continuous, fine-grained, and heterogeneous event streams collected across distributed environments. As a result, traditional process mining techniques, which assume centralized event logs from enterprise systems, are no longer sufficient. In this paper, we discuss the conceptual and methodological foundations for this emerging field. We identify three key shifts: from offline to online analysis, from centralized to distributed computing, and from event logs to sensor data. These shifts challenge traditional assumptions about process data and call for new approaches that integrate infrastructure, data, and user perspectives. To this end, we define a research agenda that addresses six interconnected fields, each spanning multiple system dimensions. We advocate a principled methodology grounded in algorithm engineering, combining formal modeling with empirical evaluation. This approach enables the development of scalable, privacy-aware, and user-centric process mining techniques suitable for distributed environments. Our synthesis provides a roadmap for advancing process mining beyond its classical setting, toward a more responsive and decentralized paradigm of process intelligence.

cs.ET↗

arXiv2025

Progressive Pruning: Analyzing the Impact of Intersection Attacks

Stream-based communication dominates today's Internet, posing unique challenges for anonymous communication networks (ACNs). Traditionally designed for independent messages, ACNs struggle to account for the inherent vulnerabilities of streams, such as susceptibility to intersection attacks. In this work, we address this gap and introduce progressive pruning, a novel methodology for quantifying the susceptibility to intersection attacks. Progressive pruning quantifies and monitors anonymity sets over time, providing an assessment of an adversary's success in correlating senders and receivers. We leverage this methodology to analyze synthetic scenarios and large-scale simulations of the Tor network using our newly developed TorFS simulator. Our findings reveal that anonymity is significantly influenced by stream length, user population, and stream distribution across the network. These insights highlight critical design challenges for future ACNs seeking to safeguard stream-based communication against traffic analysis attacks.

cs.CR↗

arXiv2024

Plausibly Deniable Content Discovery for Bitswap Using Random Walks

Bitswap is the data exchange protocol for the content-addressed peer-to-peer overlay network IPFS. During content discovery, Bitswap reveals the interest of a peer in content to all neighbors, enabling the tracking of user interests. In our paper, we propose a modification of the Bitswap protocol, which enables source obfuscation using proxies for content discovery. The proxies are selected via a random-walk. Enabling content discovery through proxies introduces plausible deniability. We evaluate the protocol modification with a simulation. The protocol modification demonstrates enhanced privacy, while maintaining acceptable performance levels.

cs.NI↗

arXiv2024

An applied Perspective: Estimating the Differential Identifiability Risk of an Exemplary SOEP Data Set

Using real-world study data usually requires contractual agreements where research results may only be published in anonymized form. Requiring formal privacy guarantees, such as differential privacy, could be helpful for data-driven projects to comply with data protection. However, deploying differential privacy in consumer use cases raises the need to explain its underlying mechanisms and the resulting privacy guarantees. In this paper, we thoroughly review and extend an existing privacy metric. We show how to compute this risk metric efficiently for a set of basic statistical queries. Our empirical analysis based on an extensive, real-world scientific data set expands the knowledge on how to compute risks under realistic conditions, while presenting more challenges than solutions.

cs.CR↗

arXiv2024

From Theory to Comprehension: A Comparative Study of Differential Privacy and $k$-Anonymity

The notion of $\varepsilon$-differential privacy is a widely used concept of providing quantifiable privacy to individuals. However, it is unclear how to explain the level of privacy protection provided by a differential privacy mechanism with a set $\varepsilon$. In this study, we focus on users' comprehension of the privacy protection provided by a differential privacy mechanism. To do so, we study three variants of explaining the privacy protection provided by differential privacy: (1) the original mathematical definition; (2) $\varepsilon$ translated into a specific privacy risk; and (3) an explanation using the randomized response technique. We compare users' comprehension of privacy protection employing these explanatory models with their comprehension of privacy protection of $k$-anonymity as baseline comprehensibility. Our findings suggest that participants' comprehension of differential privacy protection is enhanced by the privacy risk model and the randomized response-based model. Moreover, our results confirm our intuition that privacy protection provided by $k$-anonymity is more comprehensible.

cs.CR↗

arXiv2023

Fair Reward Distribution in Federated Byzantine Agreement Systems

Federated Byzantine Agreement Systems (FBASs) offer a solution to consensus in permissionless systems by adapting the well-studied Byzantine agreement model to permissionless consensus. Unlike its counterparts in the context of permissionless consensus, the FBAS system model does not offer validating nodes protocol-level incentives although they are entrusted with safeguarding and ensuring the functionality of the system. Multiple studies have reported on the small number of active validators in these systems leading to some concerns about their resilience. To this end, this paper studies how rewards can be distributed in FBASs and presents a fair reward distribution function for FBASs. The challenge is that, on the one hand, consensus in an FBAS is found jointly between all nodes and, on the other hand, nodes do not all contribute equally to this process. We draw on game-theoretic methods to quantify these contributions bearing the overall health of the FBAS in mind and present a fair reward distribution function which we evaluate based on a set of identified properties.

cs.NI↗

arXiv2023

Improving Bitswap Privacy with Forwarding and Source Obfuscation

IPFS is a content-addressed decentralized peer-to-peer data network, using the Bitswap protocol for exchanging data. The data exchange leaks the information to all neighbors, compromising a user's privacy. This paper investigates the suitability of forwarding with source obfuscation techniques for improving the privacy of the Bitswap protocol. The usage of forwarding can add plausible deniability and the source obfuscation provides additional protection against passive observers. First results showed that through trickle-spreading the source prediction could decrease to 40 %, at the cost of an increased content fetching time. However, assuming short distances between content provider and consumer the content fetching time can be faster even with the additional source obfuscation.

cs.CR↗

arXiv2023

"Am I Private and If So, how Many?" -- Using Risk Communication Formats for Making Differential Privacy Understandable

Mobility data is essential for cities and communities to identify areas for necessary improvement. Data collected by mobility providers already contains all the information necessary, but privacy of the individuals needs to be preserved. Differential privacy (DP) defines a mathematical property which guarantees that certain limits of privacy are preserved while sharing such data, but its functionality and privacy protection are difficult to explain to laypeople. In this paper, we adapt risk communication formats in conjunction with a model for the privacy risks of DP. The result are privacy notifications which explain the risk to an individual's privacy when using DP, rather than DP's functionality. We evaluate these novel privacy communication formats in a crowdsourced study. We find that they perform similarly to the best performing DP communications used currently in terms of objective understanding, but did not make our participants as confident in their understanding. We also discovered an influence, similar to the Dunning-Kruger effect, of the statistical numeracy on the effectiveness of some of our privacy communication formats and the DP communication format used currently. These results generate hypotheses in multiple directions, for example, toward the use of risk visualization to improve the understandability of our formats or toward adaptive user interfaces which tailor the risk communication to the characteristics of the reader.

cs.HC↗

arXiv2023

Modeling Tor Network Growth by Extrapolating Consensus Data

Since the Tor network is evolving into an infrastructure for anonymous communication, analyzing the consequences of network growth is becoming more relevant than ever. In particular, adding large amounts of resources may have unintentional consequences for the system performance as well as security. To this end, we contribute a methodology for the analysis of scaled Tor networks that enables researchers to leverage real-world network data. Based on historical network snapshots (consensuses), we derive and implement a model for methodically scaling Tor consensuses. This allows researchers to apply established research methods to scaled networks. We validate our model based on historical data, showing its applicability. Furthermore, we demonstrate the merits of our data-driven approach by conducting a simulation study to identify performance impacts of scaling Tor.

cs.NI↗

arXiv2022

Optimization-Based Predictive Congestion Control for the Tor Network: Opportunities and Challenges

Based on the principle of onion routing, the Tor network achieves anonymity for its users by relaying user data over a series of intermediate relays. This approach makes congestion control in the network a challenging task. As of today, this results in higher latencies due to considerable backlog as well as unfair data rate allocation. In this paper, we present a concept study of PredicTor, a novel approach to congestion control that tackles clogged overlay networks. Unlike traditional approaches, it is built upon the idea of distributed model predictive control, a recent advancement from the area of control theory. PredicTor is tailored to minimizing latency in the network and achieving max-min fairness. We contribute a thorough evaluation of its behavior in both toy scenarios to assess the optimizer and complex networks to assess its potential. For this, we conduct large-scale simulation studies and compare PredicTor to existing congestion control mechanisms in Tor. We show that PredicTor is highly effective in reducing latency and realizing fair rate allocations. In addition, we strive to bring the ideas of modern control theory to the networking community, enabling the development of improved, future congestion control. We therefore demonstrate benefits and issues alike with this novel research direction.

cs.NI↗

arXiv2022

Towards Standardized Mobility Reports with User-Level Privacy

The importance of human mobility analyses is growing in both research and practice, especially as applications for urban planning and mobility rely on them. Aggregate statistics and visualizations play an essential role as building blocks of data explorations and summary reports, the latter being increasingly released to third parties such as municipal administrations or in the context of citizen participation. However, such explorations already pose a threat to privacy as they reveal potentially sensitive location information, and thus should not be shared without further privacy measures. There is a substantial gap between state-of-the-art research on privacy methods and their utilization in practice. We thus conceptualize a standardized mobility report with differential privacy guarantees and implement it as open-source software to enable a privacy-preserving exploration of key aspects of mobility data in an easily accessible way. Moreover, we evaluate the benefits of limiting user contributions using three data sets relevant to research and practice. Our results show that even a strong limit on user contribution alters the original geospatial distribution only within a comparatively small range, while significantly reducing the error introduced by adding noise to achieve privacy guarantees.

cs.CR↗

arXiv2022

"Am I Private and If So, how Many?" - Communicating Privacy Guarantees of Differential Privacy with Risk Communication Formats

Decisions about sharing personal information are not trivial, since there are many legitimate and important purposes for such data collection, but often the collected data can reveal sensitive information about individuals. Privacy-preserving technologies, such as differential privacy (DP), can be employed to protect the privacy of individuals and, furthermore, provide mathematically sound guarantees on the maximum privacy risk. However, they can only support informed privacy decisions, if individuals understand the provided privacy guarantees. This article proposes a novel approach for communicating privacy guarantees to support individuals in their privacy decisions when sharing data. For this, we adopt risk communication formats from the medical domain in conjunction with a model for privacy guarantees of DP to create quantitative privacy risk notifications. We conducted a crowd-sourced study with 343 participants to evaluate how well our notifications conveyed the privacy risk information and how confident participants were about their own understanding of the privacy risk. Our findings suggest that these new notifications can communicate the objective information similarly well to currently used qualitative notifications, but left individuals less confident in their understanding. We also discovered that several of our notifications and the currently used qualitative notification disadvantage individuals with low numeracy: these individuals appear overconfident compared to their actual understanding of the associated privacy risks and are, therefore, less likely to seek the needed additional information before an informed decision. The promising results allow for multiple directions in future research, for example, adding visual aids or tailoring privacy risk communication to characteristics of the individuals.

cs.HC↗